# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Jun 3 2020 08:38:37 # Log Creation Date: 19.08.2020 02:21:35.684 Process: id = "1" image_name = "hidden-tear.exe" filename = "c:\\users\\fd1hvy\\desktop\\hidden-tear.exe" page_root = "0x18e22000" os_pid = "0xef8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x560" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x1164 [0062.220] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19ff50 | out: lpSystemTimeAsFileTime=0x19ff50*(dwLowDateTime=0x9a579a21, dwHighDateTime=0x1d675cf)) [0062.224] GetCurrentProcess () returned 0xffffffff [0062.224] GetProcessWindowStation () returned 0xe4 [0062.248] GetUserObjectInformationW (in: hObj=0xe4, nIndex=1, pvInfo=0x19feb8, nLength=0xc, lpnLengthNeeded=0x0 | out: pvInfo=0x19feb8, lpnLengthNeeded=0x0) returned 1 [0062.257] CreateFileA (lpFileName="\\\\.\\SICE" (normalized: "sice"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.276] CreateFileA (lpFileName="\\\\.\\NTICE" (normalized: "ntice"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.281] CreateFileA (lpFileName="\\\\.\\NTFIRE" (normalized: "ntfire"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.308] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\hidden-tear.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d8 [0062.308] SetFilePointer (in: hFile=0x1d8, lDistanceToMove=204565, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x31f15 [0062.308] ReadFile (in: hFile=0x1d8, lpBuffer=0x580000, nNumberOfBytesToRead=0x283db, lpNumberOfBytesRead=0x46c215, lpOverlapped=0x0 | out: lpBuffer=0x580000*, lpNumberOfBytesRead=0x46c215*=0x283db, lpOverlapped=0x0) returned 1 [0062.312] CloseHandle (hObject=0x1d8) returned 1 [0062.331] GetCurrentProcess () returned 0xffffffff [0062.413] CreateFileW (lpFileName="\\\\.\\VBoxGuest" (normalized: "vboxguest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x40000080, hTemplateFile=0x0) returned 0xffffffff [0062.443] CreateFileA (lpFileName="\\\\.\\SICE" (normalized: "sice"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.450] CreateFileA (lpFileName="\\\\.\\NTICE" (normalized: "ntice"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.456] CreateFileA (lpFileName="\\\\.\\NTFIRE" (normalized: "ntfire"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0063.054] NtdllDefWindowProc_W (hWnd=0x302cc, Msg=0x24, wParam=0x0, lParam=0x19f85c) returned 0x0 [0063.054] NtdllDefWindowProc_W (hWnd=0x302cc, Msg=0x81, wParam=0x0, lParam=0x19f850) returned 0x1 [0063.063] NtdllDefWindowProc_W (hWnd=0x302cc, Msg=0x83, wParam=0x0, lParam=0x19f83c) returned 0x0 [0063.884] NtdllDefWindowProc_W (hWnd=0x302cc, Msg=0x1, wParam=0x0, lParam=0x19f850) returned 0x0 [0063.888] DestroyWindow (hWnd=0x302cc) returned 1 [0063.888] NtdllDefWindowProc_W (hWnd=0x302cc, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0063.890] NtdllDefWindowProc_W (hWnd=0x302cc, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0063.895] NtdllDefWindowProc_W (hWnd=0x302cc, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0063.900] GetCurrentProcess () returned 0xffffffff [0063.903] OutputDebugStringW (lpOutputString="") [0063.905] NtSetInformationThread (ThreadHandle=0xfffffffe, ThreadInformationClass=0x11, ThreadInformation=0x0, ThreadInformationLength=0x0) returned 0x0 [0063.905] CloseHandle (hObject=0x19fe04) returned 0 [0063.917] GetCurrentProcess () returned 0xffffffff [0063.923] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\hidden-tear.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e4 [0063.923] GetFileSize (in: hFile=0x1e4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5a2f0 [0063.923] GetFileInformationByHandle (in: hFile=0x1e4, lpFileInformation=0x609258 | out: lpFileInformation=0x609258) returned 1 [0063.923] CloseHandle (hObject=0x1e4) returned 1 [0063.950] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\hidden-tear.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e4 [0063.950] ReadFile (in: hFile=0x1e4, lpBuffer=0x5d0000, nNumberOfBytesToRead=0x1a200, lpNumberOfBytesRead=0x19ff3c, lpOverlapped=0x0 | out: lpBuffer=0x5d0000*, lpNumberOfBytesRead=0x19ff3c*=0x1a200, lpOverlapped=0x0) returned 1 [0063.952] GetFileSize (in: hFile=0x1e4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5a2f0 [0063.952] CloseHandle (hObject=0x1e4) returned 1 [0063.980] GetCurrentProcess () returned 0xffffffff [0063.980] GetSystemInfo (in: lpSystemInfo=0x19ff08 | out: lpSystemInfo=0x19ff08*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0064.017] CreateFileW (lpFileName="\\\\.\\VBoxGuest" (normalized: "vboxguest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x40000080, hTemplateFile=0x0) returned 0xffffffff [0064.024] IsDebuggerPresent () returned 0 [0064.025] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName="ç\x8c¿ã\x82\x82æ\x9c¨ã\x81\x8bã\x82\x89è\x90½ã\x81¡ã\x82\x8b") returned 0x1e4 [0064.026] GetCurrentProcessId () returned 0xef8 [0064.141] CloseHandle (hObject=0x1f8) returned 1 [0064.142] CloseHandle (hObject=0x1f4) returned 1 [0064.159] CloseHandle (hObject=0x228) returned 1 [0064.160] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\hidden-tear.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x228 [0064.160] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5a2f0 [0064.166] CloseHandle (hObject=0x22c) returned 1 [0064.166] CloseHandle (hObject=0x228) returned 1 [0064.378] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\\\v1.0.3705\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v1.0.3705\\clr.dll"), dwDesiredAccess=0x20000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0064.382] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\\\v1.0.3705\\mscorwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v1.0.3705\\mscorwks.dll"), dwDesiredAccess=0x20000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0064.384] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\\\v1.1.4322\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v1.1.4322\\clr.dll"), dwDesiredAccess=0x20000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0064.384] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\\\v1.1.4322\\mscorwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v1.1.4322\\mscorwks.dll"), dwDesiredAccess=0x20000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0064.385] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\\\v2.0.50727\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\clr.dll"), dwDesiredAccess=0x20000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0064.390] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\\\v2.0.50727\\mscorwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorwks.dll"), dwDesiredAccess=0x20000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0x238 [0064.401] CloseHandle (hObject=0x238) returned 1 [0064.402] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll"), dwDesiredAccess=0x20000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0x238 [0064.404] CloseHandle (hObject=0x238) returned 1 [0064.418] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\hidden-tear.exe.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0064.421] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\hidden-tear.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x23c [0064.421] GetFileInformationByHandle (in: hFile=0x23c, lpFileInformation=0x19f334 | out: lpFileInformation=0x19f334) returned 1 [0064.425] CloseHandle (hObject=0x23c) returned 1 [0064.425] CloseHandle (hObject=0x240) returned 1 [0064.425] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\hidden-tear.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x240 [0064.425] GetFileInformationByHandle (in: hFile=0x240, lpFileInformation=0x19f334 | out: lpFileInformation=0x19f334) returned 1 [0064.426] CloseHandle (hObject=0x240) returned 1 [0064.426] CloseHandle (hObject=0x23c) returned 1 [0064.432] CloseHandle (hObject=0x240) returned 1 [0064.432] CloseHandle (hObject=0x23c) returned 1 [0064.646] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll"), dwDesiredAccess=0x20000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0x238 [0064.646] CloseHandle (hObject=0x238) returned 1 [0064.934] CloseHandle (hObject=0x248) returned 1 [0064.934] CloseHandle (hObject=0x244) returned 1 [0064.936] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\hidden-tear.exe.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0064.938] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x244 [0064.949] ReadFile (in: hFile=0x244, lpBuffer=0x708fc8, nNumberOfBytesToRead=0xfff, lpNumberOfBytesRead=0x19f6e0, lpOverlapped=0x0 | out: lpBuffer=0x708fc8*, lpNumberOfBytesRead=0x19f6e0*=0xfff, lpOverlapped=0x0) returned 1 [0064.958] ReadFile (in: hFile=0x244, lpBuffer=0x70f358, nNumberOfBytesToRead=0x17f7, lpNumberOfBytesRead=0x19f6c8, lpOverlapped=0x0 | out: lpBuffer=0x70f358*, lpNumberOfBytesRead=0x19f6c8*=0x17f7, lpOverlapped=0x0) returned 1 [0064.960] ReadFile (in: hFile=0x244, lpBuffer=0x70f358, nNumberOfBytesToRead=0x1001, lpNumberOfBytesRead=0x19f6d8, lpOverlapped=0x0 | out: lpBuffer=0x70f358*, lpNumberOfBytesRead=0x19f6d8*=0x1001, lpOverlapped=0x0) returned 1 [0064.962] ReadFile (in: hFile=0x244, lpBuffer=0x70f358, nNumberOfBytesToRead=0x1002, lpNumberOfBytesRead=0x19f6d8, lpOverlapped=0x0 | out: lpBuffer=0x70f358*, lpNumberOfBytesRead=0x19f6d8*=0x1002, lpOverlapped=0x0) returned 1 [0064.963] ReadFile (in: hFile=0x244, lpBuffer=0x706fc0, nNumberOfBytesToRead=0x1f28, lpNumberOfBytesRead=0x19f6cc, lpOverlapped=0x0 | out: lpBuffer=0x706fc0*, lpNumberOfBytesRead=0x19f6cc*=0x1f28, lpOverlapped=0x0) returned 1 [0064.967] CloseHandle (hObject=0x244) returned 1 [0065.001] CloseHandle (hObject=0x260) returned 1 [0065.001] CloseHandle (hObject=0x264) returned 1 [0065.006] CloseHandle (hObject=0x260) returned 1 [0065.006] CloseHandle (hObject=0x268) returned 1 [0065.008] CloseHandle (hObject=0x268) returned 1 [0065.008] CloseHandle (hObject=0x260) returned 1 [0065.023] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\hidden-tear.exe.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\hidden-tear.exe.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.058] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x19fc0c, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x19fc0c*=0x2a8) returned 1 [0065.058] CloseHandle (hObject=0x0) returned 0 [0065.464] CreateFileW (lpFileName="C:\\WINDOWS\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\f12799647dc4f4abd2f0f17790337f04\\mscorlib.ni.dll.aux" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\f12799647dc4f4abd2f0f17790337f04\\mscorlib.ni.dll.aux"), dwDesiredAccess=0x80000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0065.464] GetFileSize (in: hFile=0x330, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb0 [0065.464] ReadFile (in: hFile=0x330, lpBuffer=0x19f238, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x19f1d4, lpOverlapped=0x0 | out: lpBuffer=0x19f238*, lpNumberOfBytesRead=0x19f1d4*=0xb0, lpOverlapped=0x0) returned 1 [0065.466] CloseHandle (hObject=0x330) returned 1 [0066.368] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\hidden-tear.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c [0066.368] GetFileInformationByHandle (in: hFile=0x32c, lpFileInformation=0x19f17c | out: lpFileInformation=0x19f17c) returned 1 [0066.369] CloseHandle (hObject=0x32c) returned 1 [0066.788] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0066.795] RoInitialize () returned 0x1 [0066.795] RoUninitialize () returned 0x0 [0067.002] CreateFileW (lpFileName="C:\\WINDOWS\\assembly\\pubpol120.dat" (normalized: "c:\\windows\\assembly\\pubpol120.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0067.012] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x358 [0067.012] ReadFile (in: hFile=0x358, lpBuffer=0x746ca0, nNumberOfBytesToRead=0xfff, lpNumberOfBytesRead=0x19bde8, lpOverlapped=0x0 | out: lpBuffer=0x746ca0*, lpNumberOfBytesRead=0x19bde8*=0xfff, lpOverlapped=0x0) returned 1 [0067.015] ReadFile (in: hFile=0x358, lpBuffer=0x744c98, nNumberOfBytesToRead=0x17f7, lpNumberOfBytesRead=0x19bdd0, lpOverlapped=0x0 | out: lpBuffer=0x744c98*, lpNumberOfBytesRead=0x19bdd0*=0x17f7, lpOverlapped=0x0) returned 1 [0067.017] ReadFile (in: hFile=0x358, lpBuffer=0x744c98, nNumberOfBytesToRead=0x1001, lpNumberOfBytesRead=0x19bde0, lpOverlapped=0x0 | out: lpBuffer=0x744c98*, lpNumberOfBytesRead=0x19bde0*=0x1001, lpOverlapped=0x0) returned 1 [0067.018] ReadFile (in: hFile=0x358, lpBuffer=0x744c98, nNumberOfBytesToRead=0x1002, lpNumberOfBytesRead=0x19bde0, lpOverlapped=0x0 | out: lpBuffer=0x744c98*, lpNumberOfBytesRead=0x19bde0*=0x1002, lpOverlapped=0x0) returned 1 [0067.020] ReadFile (in: hFile=0x358, lpBuffer=0x74bf70, nNumberOfBytesToRead=0x1f28, lpNumberOfBytesRead=0x19bdd4, lpOverlapped=0x0 | out: lpBuffer=0x74bf70*, lpNumberOfBytesRead=0x19bdd4*=0x1f28, lpOverlapped=0x0) returned 1 [0067.023] CloseHandle (hObject=0x358) returned 1 [0067.060] CreateFileW (lpFileName="C:\\WINDOWS\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\02d3b6022cc1ee466eb660dedcff59aa\\System.Windows.Forms.ni.dll.aux" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\02d3b6022cc1ee466eb660dedcff59aa\\system.windows.forms.ni.dll.aux"), dwDesiredAccess=0x80000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0067.061] GetFileSize (in: hFile=0x35c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6b8 [0067.062] ReadFile (in: hFile=0x35c, lpBuffer=0x745ca0, nNumberOfBytesToRead=0x6b8, lpNumberOfBytesRead=0x19b9a4, lpOverlapped=0x0 | out: lpBuffer=0x745ca0*, lpNumberOfBytesRead=0x19b9a4*=0x6b8, lpOverlapped=0x0) returned 1 [0067.064] CloseHandle (hObject=0x35c) returned 1 [0067.092] CloseHandle (hObject=0x35c) returned 1 [0067.105] CloseHandle (hObject=0x35c) returned 1 [0067.120] CloseHandle (hObject=0x35c) returned 1 [0067.124] CreateFileW (lpFileName="C:\\WINDOWS\\assembly\\NativeImages_v4.0.30319_32\\System\\fcfb8bac8ea9a0e69d72c350b22f8e3f\\System.ni.dll.aux" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\fcfb8bac8ea9a0e69d72c350b22f8e3f\\system.ni.dll.aux"), dwDesiredAccess=0x80000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x360 [0067.124] GetFileSize (in: hFile=0x360, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x26c [0067.124] ReadFile (in: hFile=0x360, lpBuffer=0x749398, nNumberOfBytesToRead=0x26c, lpNumberOfBytesRead=0x19b064, lpOverlapped=0x0 | out: lpBuffer=0x749398*, lpNumberOfBytesRead=0x19b064*=0x26c, lpOverlapped=0x0) returned 1 [0067.129] CloseHandle (hObject=0x360) returned 1 [0067.145] CloseHandle (hObject=0x360) returned 1 [0069.753] CloseHandle (hObject=0x35c) returned 1 [0069.759] CreateFileW (lpFileName="C:\\WINDOWS\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\5b307e2b9719b21749a8c73127ab5f45\\System.Drawing.ni.dll.aux" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\5b307e2b9719b21749a8c73127ab5f45\\system.drawing.ni.dll.aux"), dwDesiredAccess=0x80000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x360 [0069.760] GetFileSize (in: hFile=0x360, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x248 [0069.760] ReadFile (in: hFile=0x360, lpBuffer=0x7491d8, nNumberOfBytesToRead=0x248, lpNumberOfBytesRead=0x19b064, lpOverlapped=0x0 | out: lpBuffer=0x7491d8*, lpNumberOfBytesRead=0x19b064*=0x248, lpOverlapped=0x0) returned 1 [0069.763] CloseHandle (hObject=0x360) returned 1 [0070.222] CloseHandle (hObject=0x35c) returned 1 [0070.243] CloseHandle (hObject=0x35c) returned 1 [0070.294] CloseHandle (hObject=0x35c) returned 1 [0070.310] CloseHandle (hObject=0x35c) returned 1 [0071.579] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ec60 | out: phkResult=0x19ec60*=0x0) returned 0x2 [0071.580] RegCloseKey (hKey=0x80000002) returned 0x0 [0071.598] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x19eeb8, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0071.625] IsAppThemed () returned 0x1 [0071.628] CoTaskMemAlloc (cb=0xf0) returned 0x745d48 [0071.628] CreateActCtxA (pActCtx=0x19f408) returned 0x745f3c [0071.922] CoTaskMemFree (pv=0x745d48) [0071.991] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc19a [0071.991] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc199 [0072.015] GetUserNameW (in: lpBuffer=0x19f230, pcbBuffer=0x19f4a8 | out: lpBuffer="FD1HVy", pcbBuffer=0x19f4a8) returned 1 [0072.018] GetComputerNameW (in: lpBuffer=0x19f230, nSize=0x19f4a8 | out: lpBuffer="NQDPDE", nSize=0x19f4a8) returned 1 [0072.035] CreateFileW (lpFileName="C:\\WINDOWS\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\10c894cab0a0e771eaf82414b0906f03\\System.Configuration.ni.dll.aux" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\10c894cab0a0e771eaf82414b0906f03\\system.configuration.ni.dll.aux"), dwDesiredAccess=0x80000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0072.040] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x360 [0072.040] ReadFile (in: hFile=0xf0, lpBuffer=0x7566b8, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x19cb24, lpOverlapped=0x0 | out: lpBuffer=0x7566b8*, lpNumberOfBytesRead=0x19cb24*=0x360, lpOverlapped=0x0) returned 1 [0072.043] CloseHandle (hObject=0xf0) returned 1 [0072.054] CreateFileW (lpFileName="C:\\WINDOWS\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\7334607a1c01834b6f09c482bd20ff7e\\System.Core.ni.dll.aux" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\7334607a1c01834b6f09c482bd20ff7e\\system.core.ni.dll.aux"), dwDesiredAccess=0x80000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x368 [0072.055] GetFileSize (in: hFile=0x368, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x384 [0072.055] ReadFile (in: hFile=0x368, lpBuffer=0x757b90, nNumberOfBytesToRead=0x384, lpNumberOfBytesRead=0x19c1e4, lpOverlapped=0x0 | out: lpBuffer=0x757b90*, lpNumberOfBytesRead=0x19c1e4*=0x384, lpOverlapped=0x0) returned 1 [0072.057] CloseHandle (hObject=0x368) returned 1 [0072.090] CloseHandle (hObject=0x368) returned 1 [0072.889] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe.config", nBufferLength=0x105, lpBuffer=0x19ed08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe.config", lpFilePart=0x0) returned 0x2e [0073.003] CreateFileW (lpFileName="C:\\WINDOWS\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\505cf682ecefa94755fc069d26e7434e\\System.Xml.ni.dll.aux" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\505cf682ecefa94755fc069d26e7434e\\system.xml.ni.dll.aux"), dwDesiredAccess=0x80000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0073.004] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ec [0073.004] ReadFile (in: hFile=0xf0, lpBuffer=0x75aa90, nNumberOfBytesToRead=0x2ec, lpNumberOfBytesRead=0x19c91c, lpOverlapped=0x0 | out: lpBuffer=0x75aa90*, lpNumberOfBytesRead=0x19c91c*=0x2ec, lpOverlapped=0x0) returned 1 [0073.014] CloseHandle (hObject=0xf0) returned 1 [0073.121] CloseHandle (hObject=0xf0) returned 1 [0073.805] GetCurrentProcess () returned 0xffffffff [0073.805] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19f070 | out: TokenHandle=0x19f070*=0x364) returned 1 [0073.810] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x19eafc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0073.814] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19f068 | out: lpFileInformation=0x19f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0073.816] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x19eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0073.816] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19f070 | out: lpFileInformation=0x19f070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0073.818] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x19ea64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0073.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa8) returned 1 [0073.819] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xf0 [0073.820] GetFileType (hFile=0xf0) returned 0x1 [0073.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efa4) returned 1 [0073.820] GetFileType (hFile=0xf0) returned 0x1 [0074.106] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x19f064 | out: lpFileSizeHigh=0x19f064*=0x0) returned 0x8c8f [0074.106] ReadFile (in: hFile=0xf0, lpBuffer=0x263b5d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f020, lpOverlapped=0x0 | out: lpBuffer=0x263b5d4*, lpNumberOfBytesRead=0x19f020*=0x1000, lpOverlapped=0x0) returned 1 [0074.136] ReadFile (in: hFile=0xf0, lpBuffer=0x263b5d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19eecc, lpOverlapped=0x0 | out: lpBuffer=0x263b5d4*, lpNumberOfBytesRead=0x19eecc*=0x1000, lpOverlapped=0x0) returned 1 [0074.139] ReadFile (in: hFile=0xf0, lpBuffer=0x263b5d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ed80, lpOverlapped=0x0 | out: lpBuffer=0x263b5d4*, lpNumberOfBytesRead=0x19ed80*=0x1000, lpOverlapped=0x0) returned 1 [0074.139] ReadFile (in: hFile=0xf0, lpBuffer=0x263b5d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ed80, lpOverlapped=0x0 | out: lpBuffer=0x263b5d4*, lpNumberOfBytesRead=0x19ed80*=0x1000, lpOverlapped=0x0) returned 1 [0074.140] ReadFile (in: hFile=0xf0, lpBuffer=0x263b5d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ed80, lpOverlapped=0x0 | out: lpBuffer=0x263b5d4*, lpNumberOfBytesRead=0x19ed80*=0x1000, lpOverlapped=0x0) returned 1 [0074.140] ReadFile (in: hFile=0xf0, lpBuffer=0x263b5d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ecb8, lpOverlapped=0x0 | out: lpBuffer=0x263b5d4*, lpNumberOfBytesRead=0x19ecb8*=0x1000, lpOverlapped=0x0) returned 1 [0074.168] ReadFile (in: hFile=0xf0, lpBuffer=0x263b5d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ee3c, lpOverlapped=0x0 | out: lpBuffer=0x263b5d4*, lpNumberOfBytesRead=0x19ee3c*=0x1000, lpOverlapped=0x0) returned 1 [0074.170] ReadFile (in: hFile=0xf0, lpBuffer=0x263b5d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ed48, lpOverlapped=0x0 | out: lpBuffer=0x263b5d4*, lpNumberOfBytesRead=0x19ed48*=0x1000, lpOverlapped=0x0) returned 1 [0074.170] ReadFile (in: hFile=0xf0, lpBuffer=0x263b5d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ed48, lpOverlapped=0x0 | out: lpBuffer=0x263b5d4*, lpNumberOfBytesRead=0x19ed48*=0xc8f, lpOverlapped=0x0) returned 1 [0074.171] ReadFile (in: hFile=0xf0, lpBuffer=0x263b5d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ee0c, lpOverlapped=0x0 | out: lpBuffer=0x263b5d4*, lpNumberOfBytesRead=0x19ee0c*=0x0, lpOverlapped=0x0) returned 1 [0074.171] CloseHandle (hObject=0xf0) returned 1 [0074.173] GetCurrentProcess () returned 0xffffffff [0074.173] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19f1b8 | out: TokenHandle=0x19f1b8*=0xf0) returned 1 [0074.174] GetCurrentProcess () returned 0xffffffff [0074.174] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19f1b8 | out: TokenHandle=0x19f1b8*=0x368) returned 1 [0074.175] GetCurrentProcess () returned 0xffffffff [0074.175] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19f070 | out: TokenHandle=0x19f070*=0x36c) returned 1 [0074.175] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\hidden-tear.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19f068 | out: lpFileInformation=0x19f068*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0074.175] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe.config", nBufferLength=0x105, lpBuffer=0x19eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe.config", lpFilePart=0x0) returned 0x2e [0074.175] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\hidden-tear.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19f070 | out: lpFileInformation=0x19f070*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0074.176] GetCurrentProcess () returned 0xffffffff [0074.176] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19f1b8 | out: TokenHandle=0x19f1b8*=0x370) returned 1 [0074.176] GetCurrentProcess () returned 0xffffffff [0074.176] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19f1b8 | out: TokenHandle=0x19f1b8*=0x374) returned 1 [0074.222] GetCurrentProcess () returned 0xffffffff [0074.222] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19f018 | out: TokenHandle=0x19f018*=0x378) returned 1 [0074.227] GetCurrentProcess () returned 0xffffffff [0074.227] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19f028 | out: TokenHandle=0x19f028*=0x37c) returned 1 [0080.069] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74250000 [0080.076] AdjustWindowRectEx (in: lpRect=0x19f448, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50081 | out: lpRect=0x19f448) returned 1 [0080.079] GetCurrentProcess () returned 0xffffffff [0080.079] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x19f35c, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x19f35c*=0x380) returned 1 [0080.092] GetCurrentActCtx (in: lphActCtx=0x19f2bc | out: lphActCtx=0x19f2bc*=0x0) returned 1 [0080.092] ActivateActCtx (in: hActCtx=0x745f3c, lpCookie=0x19f2cc | out: hActCtx=0x745f3c, lpCookie=0x19f2cc) returned 1 [0080.093] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0080.239] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x6fb30000 [0081.852] GetModuleHandleW (lpModuleName="user32.dll") returned 0x750c0000 [0081.853] GetProcAddress (hModule=0x750c0000, lpProcName="DefWindowProcW") returned 0x743c0140 [0081.853] lstrlenW (lpString="obsidium.dll") returned 12 [0081.853] lstrlenW (lpString="gdi32.dll") returned 9 [0081.854] GetStockObject (i=5) returned 0x900015 [0081.858] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0081.862] CoTaskMemAlloc (cb=0x5c) returned 0x74e5c0 [0081.862] RegisterClassW (lpWndClass=0x19f170) returned 0xc19c [0081.863] CoTaskMemFree (pv=0x74e5c0) [0081.863] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0081.864] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r36_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x402cc [0081.879] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e990 | out: phkResult=0x19e990*=0x38c) returned 0x0 [0082.005] RegQueryValueExW (in: hKey=0x38c, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x19e9b0, lpData=0x0, lpcbData=0x19e9ac*=0x0 | out: lpType=0x19e9b0*=0x0, lpData=0x0, lpcbData=0x19e9ac*=0x0) returned 0x2 [0082.005] RegQueryValueExW (in: hKey=0x38c, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x19e9b0, lpData=0x0, lpcbData=0x19e9ac*=0x0 | out: lpType=0x19e9b0*=0x0, lpData=0x0, lpcbData=0x19e9ac*=0x0) returned 0x2 [0082.006] RegCloseKey (hKey=0x38c) returned 0x0 [0082.008] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc19d [0082.009] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc19e [0082.011] GetClientRect (in: hWnd=0x402cc, lpRect=0x19e9c8 | out: lpRect=0x19e9c8) returned 1 [0082.012] GetWindowRect (in: hWnd=0x402cc, lpRect=0x19e9c8 | out: lpRect=0x19e9c8) returned 1 [0082.014] GetParent (hWnd=0x402cc) returned 0x0 [0082.014] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1da90001) returned 1 [0083.115] EtwEventRegister (in: ProviderId=0x265785c, EnableCallback=0x4ba060e, CallbackContext=0x0, RegHandle=0x2657838 | out: RegHandle=0x2657838) returned 0x0 [0083.124] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74250000 [0083.125] AdjustWindowRectEx (in: lpRect=0x19f3f4, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0x19f3f4) returned 1 [0083.125] GetSystemMetrics (nIndex=59) returned 1460 [0083.125] GetSystemMetrics (nIndex=60) returned 920 [0083.125] GetSystemMetrics (nIndex=34) returned 136 [0083.125] GetSystemMetrics (nIndex=35) returned 39 [0083.125] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74250000 [0083.126] AdjustWindowRectEx (in: lpRect=0x19f2f4, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0x19f2f4) returned 1 [0083.204] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe.config", nBufferLength=0x105, lpBuffer=0x19ecc8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe.config", lpFilePart=0x0) returned 0x2e [0083.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f184) returned 1 [0083.204] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\hidden-tear.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19f200 | out: lpFileInformation=0x19f200*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0083.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f180) returned 1 [0083.224] CloseHandle (hObject=0x394) returned 1 [0084.075] GetSystemMetrics (nIndex=11) returned 32 [0084.076] GetSystemMetrics (nIndex=12) returned 32 [0084.081] CreateIconFromResourceEx (presbits=0x266aa3c, dwResSize=0x10a8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x90127 [0084.092] GetSystemDefaultLCID () returned 0x409 [0084.092] GetStockObject (i=17) returned 0xa01c1 [0084.094] GetObjectW (in: h=0xa01c1, c=92, pv=0x19f144 | out: pv=0x19f144) returned 92 [0084.503] GdiplusStartup (in: token=0x5e5ee8, input=0x19e6f8, output=0x19e748 | out: token=0x5e5ee8, output=0x19e748) returned 0x0 [0084.538] CoTaskMemAlloc (cb=0x5c) returned 0x74e9d0 [0084.547] GdipCreateFontFromLogfontW (hdc=0x60100ce, logfont=0x74e9d0, font=0x19f20c) returned 0x0 [0095.215] CoTaskMemFree (pv=0x74e9d0) [0095.216] lstrlenW (lpString="obsidium.dll") returned 12 [0095.216] lstrlenW (lpString="mscoree.dll") returned 11 [0095.217] CoTaskMemAlloc (cb=0x5c) returned 0x74e690 [0095.217] CoTaskMemFree (pv=0x74e690) [0095.217] CoTaskMemAlloc (cb=0x5c) returned 0x74e690 [0095.217] CoTaskMemFree (pv=0x74e690) [0095.218] GdipGetFontUnit (font=0x2311f08, unit=0x19f1d4) returned 0x0 [0095.218] GdipGetFontSize (font=0x2311f08, size=0x19f1d8) returned 0x0 [0095.218] GdipGetFontStyle (font=0x2311f08, style=0x19f1d0) returned 0x0 [0095.219] GdipGetFamily (font=0x2311f08, family=0x19f1cc) returned 0x0 [0095.220] GdipGetFontSize (font=0x2311f08, size=0x266bfa8) returned 0x0 [0095.221] GdipCreateFromHDC (hdc=0x60100ce, graphics=0x19f1e8) returned 0x0 [0095.230] GdipGetDpiY (graphics=0x5d3f260, dpi=0x266c084) returned 0x0 [0095.231] GdipGetFontHeight (font=0x2311f08, graphics=0x5d3f260, height=0x19f1e0) returned 0x0 [0095.231] GdipGetEmHeight (family=0x2319440, style=0, EmHeight=0x19f1e8) returned 0x0 [0095.231] GdipGetLineSpacing (family=0x2319440, style=0, LineSpacing=0x19f1e8) returned 0x0 [0095.232] GdipDeleteGraphics (graphics=0x5d3f260) returned 0x0 [0095.232] GdipCreateFont (fontFamily=0x2319440, emSize=0x41040000, style=0, unit=0x3, font=0x266c0a0) returned 0x0 [0095.232] GdipGetFontSize (font=0x231ef48, size=0x266c0a4) returned 0x0 [0095.233] GdipDeleteFont (font=0x2311f08) returned 0x0 [0095.233] GdipCreateFromHDC (hdc=0x60100ce, graphics=0x19f21c) returned 0x0 [0095.234] CoTaskMemAlloc (cb=0x5c) returned 0x74eaa0 [0095.235] GdipGetLogFontW (font=0x231ef48, graphics=0x5d3f260, logfontW=0x74eaa0) returned 0x0 [0095.240] CoTaskMemFree (pv=0x74eaa0) [0095.240] CoTaskMemAlloc (cb=0x5c) returned 0x74e690 [0095.240] CoTaskMemFree (pv=0x74e690) [0095.241] CoTaskMemAlloc (cb=0x5c) returned 0x74eaa0 [0095.241] CoTaskMemFree (pv=0x74eaa0) [0095.241] GdipDeleteGraphics (graphics=0x5d3f260) returned 0x0 [0095.242] CoTaskMemAlloc (cb=0x5c) returned 0x74eb08 [0095.242] CreateFontIndirectW (lplf=0x74eb08) returned 0x190a019b [0095.242] CoTaskMemFree (pv=0x74eb08) [0095.242] SelectObject (hdc=0x3f0105d8, h=0x190a019b) returned 0x8a01c2 [0095.243] GetTextMetricsW (in: hdc=0x3f0105d8, lptm=0x19f328 | out: lptm=0x19f328) returned 1 [0095.419] GetTextExtentPoint32W (in: hdc=0x3f0105d8, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x266c2cc | out: psizl=0x266c2cc) returned 1 [0095.482] SelectObject (hdc=0x3f0105d8, h=0x8a01c2) returned 0x190a019b [0095.491] DeleteDC (hdc=0x3f0105d8) returned 1 [0095.492] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74250000 [0095.492] AdjustWindowRectEx (in: lpRect=0x19f070, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19f070) returned 1 [0095.492] AdjustWindowRectEx (in: lpRect=0x19f2b4, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0x19f2b4) returned 1 [0095.493] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74250000 [0095.493] AdjustWindowRectEx (in: lpRect=0x19efe8, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19efe8) returned 1 [0095.493] AdjustWindowRectEx (in: lpRect=0x19f0ec, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0x19f0ec) returned 1 [0095.494] GetSystemMetrics (nIndex=34) returned 136 [0095.494] GetSystemMetrics (nIndex=35) returned 39 [0095.494] GetCurrentActCtx (in: lphActCtx=0x19f47c | out: lphActCtx=0x19f47c*=0x0) returned 1 [0095.494] ActivateActCtx (in: hActCtx=0x745f3c, lpCookie=0x19f48c | out: hActCtx=0x745f3c, lpCookie=0x19f48c) returned 1 [0095.494] GetCurrentActCtx (in: lphActCtx=0x19f29c | out: lphActCtx=0x19f29c*=0x745f3c) returned 1 [0095.495] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0095.495] AdjustWindowRectEx (in: lpRect=0x19f1dc, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19f1dc) returned 1 [0095.495] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0095.495] CreateWindowExW (dwExStyle=0x50080, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r36_ad1", lpWindowName="hidden tear", dwStyle=0x2cf0000, X=-2147483648, Y=-2147483648, nWidth=140, nHeight=92, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x302d6 [0095.502] GetClientRect (in: hWnd=0x302d6, lpRect=0x19e978 | out: lpRect=0x19e978) returned 1 [0095.502] GetWindowRect (in: hWnd=0x302d6, lpRect=0x19e978 | out: lpRect=0x19e978) returned 1 [0095.503] SetWindowTextW (hWnd=0x302d6, lpString="hidden tear") returned 1 [0095.531] GetUserObjectInformationA (in: hObj=0xe4, nIndex=1, pvInfo=0x266c7e8, nLength=0xc, lpnLengthNeeded=0x19e870 | out: pvInfo=0x266c7e8, lpnLengthNeeded=0x19e870) returned 1 [0095.547] SetConsoleCtrlHandler (HandlerRoutine=0x4ba065e, Add=1) returned 1 [0095.548] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0095.548] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0095.550] GetClassInfoW (in: hInstance=0x400000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWndClass=0x266c84c | out: lpWndClass=0x266c84c) returned 0 [0095.599] CoTaskMemAlloc (cb=0x58) returned 0x747d50 [0095.599] RegisterClassW (lpWndClass=0x19e7c0) returned 0xc1a0 [0095.600] CoTaskMemFree (pv=0x747d50) [0095.601] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x70030 [0095.603] DefWindowProcW (hWnd=0x70030, Msg=0x83, wParam=0x0, lParam=0x19e2ec) returned 0x0 [0095.603] DefWindowProcW (hWnd=0x70030, Msg=0x1, wParam=0x0, lParam=0x19e300) returned 0x0 [0095.603] DefWindowProcW (hWnd=0x70030, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0095.604] DefWindowProcW (hWnd=0x70030, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0095.635] GetStartupInfoW (in: lpStartupInfo=0x266cca4 | out: lpStartupInfo=0x266cca4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0095.637] GetParent (hWnd=0x302d6) returned 0x0 [0095.639] GetSystemMetrics (nIndex=49) returned 16 [0095.639] GetSystemMetrics (nIndex=50) returned 16 [0095.639] CreateIconFromResourceEx (presbits=0x266cd24, dwResSize=0x468, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x901f1 [0095.641] SendMessageW (hWnd=0x302d6, Msg=0x80, wParam=0x0, lParam=0x901f1) returned 0x0 [0095.642] SendMessageW (hWnd=0x302d6, Msg=0x80, wParam=0x1, lParam=0x90127) returned 0x0 [0095.643] GetSystemMenu (hWnd=0x302d6, bRevert=0) returned 0xe02ab [0095.649] GetWindowPlacement (in: hWnd=0x302d6, lpwndpl=0x19f2ac | out: lpwndpl=0x19f2ac) returned 1 [0095.650] EnableMenuItem (hMenu=0xe02ab, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0095.650] EnableMenuItem (hMenu=0xe02ab, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0095.650] EnableMenuItem (hMenu=0xe02ab, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0095.650] EnableMenuItem (hMenu=0xe02ab, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0095.650] EnableMenuItem (hMenu=0xe02ab, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0095.650] GetClientRect (in: hWnd=0x302d6, lpRect=0x19f2f0 | out: lpRect=0x19f2f0) returned 1 [0095.650] GetClientRect (in: hWnd=0x302d6, lpRect=0x19f250 | out: lpRect=0x19f250) returned 1 [0095.650] GetWindowRect (in: hWnd=0x302d6, lpRect=0x19f250 | out: lpRect=0x19f250) returned 1 [0095.650] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0095.651] GetWindowTextLengthW (hWnd=0x302d6) returned 11 [0095.651] GetSystemMetrics (nIndex=42) returned 0 [0095.651] GetWindowTextW (in: hWnd=0x302d6, lpString=0x19f1c8, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0095.652] GetWindowTextLengthW (hWnd=0x302d6) returned 11 [0095.652] GetSystemMetrics (nIndex=42) returned 0 [0095.652] GetWindowTextW (in: hWnd=0x302d6, lpString=0x19f1c8, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0095.658] SetWindowPos (hWnd=0x302d6, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0095.660] GetWindowPlacement (in: hWnd=0x302d6, lpwndpl=0x19ef90 | out: lpwndpl=0x19ef90) returned 1 [0095.660] GetClientRect (in: hWnd=0x302d6, lpRect=0x19ef40 | out: lpRect=0x19ef40) returned 1 [0095.660] GetWindowRect (in: hWnd=0x302d6, lpRect=0x19ef40 | out: lpRect=0x19ef40) returned 1 [0095.674] GetSystemMenu (hWnd=0x302d6, bRevert=0) returned 0xe02ab [0095.674] GetWindowPlacement (in: hWnd=0x302d6, lpwndpl=0x19f29c | out: lpwndpl=0x19f29c) returned 1 [0095.674] EnableMenuItem (hMenu=0xe02ab, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0095.674] EnableMenuItem (hMenu=0xe02ab, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0095.674] EnableMenuItem (hMenu=0xe02ab, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0095.674] EnableMenuItem (hMenu=0xe02ab, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0095.674] EnableMenuItem (hMenu=0xe02ab, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0095.675] ShowWindow (hWnd=0x302d6, nCmdShow=5) returned 0 [0095.675] GetWindowTextLengthW (hWnd=0x302d6) returned 11 [0095.675] GetSystemMetrics (nIndex=42) returned 0 [0095.675] GetWindowTextW (in: hWnd=0x302d6, lpString=0x19ee8c, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0095.727] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0095.727] GetWindowTextLengthW (hWnd=0x302d6) returned 11 [0095.727] GetSystemMetrics (nIndex=42) returned 0 [0095.727] GetWindowTextW (in: hWnd=0x302d6, lpString=0x19ed6c, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0095.727] GetWindowTextLengthW (hWnd=0x302d6) returned 11 [0095.727] GetSystemMetrics (nIndex=42) returned 0 [0095.727] GetWindowTextW (in: hWnd=0x302d6, lpString=0x19ed6c, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0095.751] SetWindowPos (hWnd=0x302d6, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0095.754] GetWindowPlacement (in: hWnd=0x302d6, lpwndpl=0x19eb54 | out: lpwndpl=0x19eb54) returned 1 [0095.754] GetClientRect (in: hWnd=0x302d6, lpRect=0x19eb00 | out: lpRect=0x19eb00) returned 1 [0095.754] GetWindowTextLengthW (hWnd=0x302d6) returned 11 [0095.754] GetSystemMetrics (nIndex=42) returned 0 [0095.754] GetWindowTextW (in: hWnd=0x302d6, lpString=0x19e9c0, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0095.754] GetClientRect (in: hWnd=0x302d6, lpRect=0x19ea08 | out: lpRect=0x19ea08) returned 1 [0096.093] GetSysColor (nIndex=10) returned 0xb4b4b4 [0096.093] GetSysColor (nIndex=2) returned 0xd1b499 [0096.093] GetSysColor (nIndex=9) returned 0x0 [0096.093] GetSysColor (nIndex=12) returned 0xababab [0096.093] GetSysColor (nIndex=15) returned 0xf0f0f0 [0096.093] GetSysColor (nIndex=20) returned 0xffffff [0096.093] GetSysColor (nIndex=16) returned 0xa0a0a0 [0096.093] GetSysColor (nIndex=15) returned 0xf0f0f0 [0096.093] GetSysColor (nIndex=16) returned 0xa0a0a0 [0096.093] GetSysColor (nIndex=21) returned 0x696969 [0096.093] GetSysColor (nIndex=22) returned 0xe3e3e3 [0096.093] GetSysColor (nIndex=20) returned 0xffffff [0096.093] GetSysColor (nIndex=18) returned 0x0 [0096.093] GetSysColor (nIndex=1) returned 0x0 [0096.094] GetSysColor (nIndex=27) returned 0xead1b9 [0096.094] GetSysColor (nIndex=28) returned 0xf2e4d7 [0096.094] GetSysColor (nIndex=17) returned 0x6d6d6d [0096.094] GetSysColor (nIndex=13) returned 0xd77800 [0096.094] GetSysColor (nIndex=14) returned 0xffffff [0096.094] GetSysColor (nIndex=26) returned 0xcc6600 [0096.094] GetSysColor (nIndex=11) returned 0xfcf7f4 [0096.094] GetSysColor (nIndex=3) returned 0xdbcdbf [0096.094] GetSysColor (nIndex=19) returned 0x0 [0096.094] GetSysColor (nIndex=24) returned 0xe1ffff [0096.094] GetSysColor (nIndex=23) returned 0x0 [0096.094] GetSysColor (nIndex=4) returned 0xf0f0f0 [0096.094] GetSysColor (nIndex=30) returned 0xf0f0f0 [0096.094] GetSysColor (nIndex=29) returned 0xd77800 [0096.094] GetSysColor (nIndex=7) returned 0x0 [0096.094] GetSysColor (nIndex=0) returned 0xc8c8c8 [0096.094] GetSysColor (nIndex=5) returned 0xffffff [0096.094] GetSysColor (nIndex=6) returned 0x646464 [0096.094] GetSysColor (nIndex=8) returned 0x0 [0096.096] GetSystemMetrics (nIndex=80) returned 1 [0096.151] EnumDisplayMonitors (hdc=0x0, lprcClip=0x0, lpfnEnum=0x4ba06ae, dwData=0x0) returned 1 [0096.154] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19e668 | out: lpmi=0x19e668) returned 1 [0096.155] DeleteDC (hdc=0x2f0107de) returned 1 [0096.156] GetCurrentObject (hdc=0x60100ce, type=0x1) returned 0xb00017 [0096.156] GetCurrentObject (hdc=0x60100ce, type=0x2) returned 0x900010 [0096.156] GetCurrentObject (hdc=0x60100ce, type=0x7) returned 0x690507be [0096.156] GetCurrentObject (hdc=0x60100ce, type=0x6) returned 0x8a01c2 [0096.156] SaveDC (hdc=0x60100ce) returned 1 [0096.157] GetNearestColor (hdc=0x60100ce, color=0xf0f0f0) returned 0xf0f0f0 [0096.158] CreateSolidBrush (color=0xf0f0f0) returned 0x471007eb [0096.158] FillRect (hDC=0x60100ce, lprc=0x19e8a8, hbr=0x471007eb) returned 1 [0096.159] DeleteObject (ho=0x471007eb) returned 1 [0096.159] RestoreDC (hdc=0x60100ce, nSavedDC=-1) returned 1 [0096.169] GetWindowPlacement (in: hWnd=0x302d6, lpwndpl=0x19eb38 | out: lpwndpl=0x19eb38) returned 1 [0096.169] GetClientRect (in: hWnd=0x302d6, lpRect=0x19eae8 | out: lpRect=0x19eae8) returned 1 [0096.169] GetWindowRect (in: hWnd=0x302d6, lpRect=0x19eae8 | out: lpRect=0x19eae8) returned 1 [0096.170] GetSystemMenu (hWnd=0x302d6, bRevert=0) returned 0xe02ab [0096.171] GetWindowPlacement (in: hWnd=0x302d6, lpwndpl=0x19ee40 | out: lpwndpl=0x19ee40) returned 1 [0096.171] EnableMenuItem (hMenu=0xe02ab, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0096.171] EnableMenuItem (hMenu=0xe02ab, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0096.171] EnableMenuItem (hMenu=0xe02ab, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0096.171] EnableMenuItem (hMenu=0xe02ab, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0096.171] EnableMenuItem (hMenu=0xe02ab, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0096.176] SetLayeredWindowAttributes (hwnd=0x302d6, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0096.181] GetCurrentThreadId () returned 0x1164 [0097.089] GetParent (hWnd=0x302d6) returned 0x0 [0097.114] GetWindowTextLengthW (hWnd=0x302d6) returned 11 [0097.114] GetSystemMetrics (nIndex=42) returned 0 [0097.114] GetWindowTextW (in: hWnd=0x302d6, lpString=0x19e924, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0097.117] GetCurrentActCtx (in: lphActCtx=0x19eda0 | out: lphActCtx=0x19eda0*=0x745f3c) returned 1 [0097.118] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0097.118] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0097.118] CreateWindowExW (dwExStyle=0x90080, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r36_ad1", lpWindowName="hidden tear", dwStyle=0x2cf0000, X=182, Y=182, nWidth=140, nHeight=92, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x7002e [0097.127] GetClientRect (in: hWnd=0x7002e, lpRect=0x19e478 | out: lpRect=0x19e478) returned 1 [0097.127] GetWindowRect (in: hWnd=0x7002e, lpRect=0x19e478 | out: lpRect=0x19e478) returned 1 [0097.127] SetWindowTextW (hWnd=0x7002e, lpString="hidden tear") returned 1 [0097.127] SetLayeredWindowAttributes (hwnd=0x7002e, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0097.129] GetStartupInfoW (in: lpStartupInfo=0x266e494 | out: lpStartupInfo=0x266e494*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0097.130] GetParent (hWnd=0x7002e) returned 0x0 [0097.131] GetStockObject (i=5) returned 0x900015 [0097.131] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0097.132] CoTaskMemAlloc (cb=0x5c) returned 0x74e9d0 [0097.132] RegisterClassW (lpWndClass=0x19ec7c) returned 0xc1a1 [0097.132] CoTaskMemFree (pv=0x74e9d0) [0097.132] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0097.132] CreateWindowExW (dwExStyle=0x80, lpClassName="WindowsForms10.Window.0.app.0.141b42a_r36_ad1", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x30202 [0097.142] SendMessageW (hWnd=0x7002e, Msg=0x80, wParam=0x0, lParam=0x901f1) returned 0x0 [0097.142] SendMessageW (hWnd=0x7002e, Msg=0x80, wParam=0x1, lParam=0x90127) returned 0x0 [0097.281] GetSystemMenu (hWnd=0x7002e, bRevert=0) returned 0x2b00e1 [0097.282] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x19edb0 | out: lpwndpl=0x19edb0) returned 1 [0097.282] EnableMenuItem (hMenu=0x2b00e1, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0097.282] EnableMenuItem (hMenu=0x2b00e1, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0097.282] EnableMenuItem (hMenu=0x2b00e1, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0097.282] EnableMenuItem (hMenu=0x2b00e1, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0097.282] EnableMenuItem (hMenu=0x2b00e1, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0097.282] GetClientRect (in: hWnd=0x7002e, lpRect=0x19edf4 | out: lpRect=0x19edf4) returned 1 [0097.282] GetClientRect (in: hWnd=0x7002e, lpRect=0x19ed54 | out: lpRect=0x19ed54) returned 1 [0097.282] GetWindowRect (in: hWnd=0x7002e, lpRect=0x19ed54 | out: lpRect=0x19ed54) returned 1 [0097.282] SetWindowPos (hWnd=0x7002e, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1 [0097.290] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x19ea04 | out: lpwndpl=0x19ea04) returned 1 [0097.290] GetClientRect (in: hWnd=0x7002e, lpRect=0x19e9b0 | out: lpRect=0x19e9b0) returned 1 [0097.290] GetWindowTextLengthW (hWnd=0x7002e) returned 11 [0097.290] GetSystemMetrics (nIndex=42) returned 0 [0097.291] GetWindowTextW (in: hWnd=0x7002e, lpString=0x19e870, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0097.291] GetClientRect (in: hWnd=0x7002e, lpRect=0x19e8b8 | out: lpRect=0x19e8b8) returned 1 [0097.291] GetCurrentObject (hdc=0x10105d6, type=0x1) returned 0xb00017 [0097.291] GetCurrentObject (hdc=0x10105d6, type=0x2) returned 0x900010 [0097.291] GetCurrentObject (hdc=0x10105d6, type=0x7) returned 0x6a0507be [0097.291] GetCurrentObject (hdc=0x10105d6, type=0x6) returned 0x8a01c2 [0097.291] SaveDC (hdc=0x10105d6) returned 1 [0097.291] GetNearestColor (hdc=0x10105d6, color=0xf0f0f0) returned 0xf0f0f0 [0097.291] CreateSolidBrush (color=0xf0f0f0) returned 0x481007eb [0097.291] FillRect (hDC=0x10105d6, lprc=0x19e758, hbr=0x481007eb) returned 1 [0097.291] DeleteObject (ho=0x481007eb) returned 1 [0097.292] RestoreDC (hdc=0x10105d6, nSavedDC=-1) returned 1 [0097.292] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x19e9e8 | out: lpwndpl=0x19e9e8) returned 1 [0097.292] GetClientRect (in: hWnd=0x7002e, lpRect=0x19e998 | out: lpRect=0x19e998) returned 1 [0097.292] GetWindowRect (in: hWnd=0x7002e, lpRect=0x19e998 | out: lpRect=0x19e998) returned 1 [0097.301] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x19e544 | out: lpwndpl=0x19e544) returned 1 [0097.301] GetClientRect (in: hWnd=0x7002e, lpRect=0x19e4f0 | out: lpRect=0x19e4f0) returned 1 [0097.301] GetWindowTextLengthW (hWnd=0x7002e) returned 11 [0097.301] GetSystemMetrics (nIndex=42) returned 0 [0097.301] GetWindowTextW (in: hWnd=0x7002e, lpString=0x19e3b0, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0097.301] GetClientRect (in: hWnd=0x7002e, lpRect=0x19e3f8 | out: lpRect=0x19e3f8) returned 1 [0097.301] GetCurrentObject (hdc=0xf0105ee, type=0x1) returned 0xb00017 [0097.301] GetCurrentObject (hdc=0xf0105ee, type=0x2) returned 0x900010 [0097.302] GetCurrentObject (hdc=0xf0105ee, type=0x7) returned 0x6a0507be [0097.302] GetCurrentObject (hdc=0xf0105ee, type=0x6) returned 0x8a01c2 [0097.302] SaveDC (hdc=0xf0105ee) returned 1 [0097.302] GetNearestColor (hdc=0xf0105ee, color=0xf0f0f0) returned 0xf0f0f0 [0097.302] CreateSolidBrush (color=0xf0f0f0) returned 0x491007eb [0097.302] FillRect (hDC=0xf0105ee, lprc=0x19e298, hbr=0x491007eb) returned 1 [0097.302] DeleteObject (ho=0x491007eb) returned 1 [0097.302] RestoreDC (hdc=0xf0105ee, nSavedDC=-1) returned 1 [0097.305] SendMessageW (hWnd=0x30202, Msg=0x80, wParam=0x1, lParam=0x90127) returned 0x0 [0097.307] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0097.307] GetWindowTextLengthW (hWnd=0x7002e) returned 11 [0097.307] GetSystemMetrics (nIndex=42) returned 0 [0097.307] GetWindowTextW (in: hWnd=0x7002e, lpString=0x19eccc, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0097.307] GetWindowTextLengthW (hWnd=0x7002e) returned 11 [0097.308] GetSystemMetrics (nIndex=42) returned 0 [0097.308] GetWindowTextW (in: hWnd=0x7002e, lpString=0x19eccc, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0097.310] SetWindowPos (hWnd=0x7002e, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0097.335] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x19eab4 | out: lpwndpl=0x19eab4) returned 1 [0097.336] GetClientRect (in: hWnd=0x7002e, lpRect=0x19ea60 | out: lpRect=0x19ea60) returned 1 [0097.336] GetWindowTextLengthW (hWnd=0x7002e) returned 11 [0097.336] GetSystemMetrics (nIndex=42) returned 0 [0097.336] GetWindowTextW (in: hWnd=0x7002e, lpString=0x19e920, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0097.336] GetClientRect (in: hWnd=0x7002e, lpRect=0x19e968 | out: lpRect=0x19e968) returned 1 [0097.336] GetCurrentObject (hdc=0x10105d6, type=0x1) returned 0xb00017 [0097.336] GetCurrentObject (hdc=0x10105d6, type=0x2) returned 0x900010 [0097.336] GetCurrentObject (hdc=0x10105d6, type=0x7) returned 0x6a0507be [0097.336] GetCurrentObject (hdc=0x10105d6, type=0x6) returned 0x8a01c2 [0097.336] SaveDC (hdc=0x10105d6) returned 1 [0097.336] GetNearestColor (hdc=0x10105d6, color=0xf0f0f0) returned 0xf0f0f0 [0097.336] CreateSolidBrush (color=0xf0f0f0) returned 0x4a1007eb [0097.336] FillRect (hDC=0x10105d6, lprc=0x19e808, hbr=0x4a1007eb) returned 1 [0097.337] DeleteObject (ho=0x4a1007eb) returned 1 [0097.337] RestoreDC (hdc=0x10105d6, nSavedDC=-1) returned 1 [0097.337] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x19ea98 | out: lpwndpl=0x19ea98) returned 1 [0097.337] GetClientRect (in: hWnd=0x7002e, lpRect=0x19ea48 | out: lpRect=0x19ea48) returned 1 [0097.337] GetWindowRect (in: hWnd=0x7002e, lpRect=0x19ea48 | out: lpRect=0x19ea48) returned 1 [0097.338] GetSystemMenu (hWnd=0x7002e, bRevert=0) returned 0x2b00e1 [0097.338] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x19eda0 | out: lpwndpl=0x19eda0) returned 1 [0097.339] EnableMenuItem (hMenu=0x2b00e1, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0097.339] EnableMenuItem (hMenu=0x2b00e1, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0097.339] EnableMenuItem (hMenu=0x2b00e1, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0097.339] EnableMenuItem (hMenu=0x2b00e1, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0097.339] EnableMenuItem (hMenu=0x2b00e1, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0097.454] GetFullPathNameW (in: lpFileName="C:\\FD1HVy\\Rand123", nBufferLength=0x105, lpBuffer=0x19e924, lpFilePart=0x0 | out: lpBuffer="C:\\FD1HVy\\Rand123", lpFilePart=0x0) returned 0x11 [0097.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edd4) returned 1 [0097.454] GetFileAttributesExW (in: lpFileName="C:\\FD1HVy\\Rand123" (normalized: "c:\\fd1hvy\\rand123"), fInfoLevelId=0x0, lpFileInformation=0x19ee50 | out: lpFileInformation=0x19ee50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0097.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edd0) returned 1 [0097.454] GetFullPathNameW (in: lpFileName="C:\\FD1HVy\\Rand123", nBufferLength=0x105, lpBuffer=0x19e92c, lpFilePart=0x0 | out: lpBuffer="C:\\FD1HVy\\Rand123", lpFilePart=0x0) returned 0x11 [0097.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed68) returned 1 [0097.455] GetFileAttributesExW (in: lpFileName="C:\\FD1HVy\\Rand123" (normalized: "c:\\fd1hvy\\rand123"), fInfoLevelId=0x0, lpFileInformation=0x19ede4 | out: lpFileInformation=0x19ede4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0097.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed64) returned 1 [0097.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed68) returned 1 [0097.456] GetFileAttributesExW (in: lpFileName="C:\\FD1HVy\\Rand123" (normalized: "c:\\fd1hvy\\rand123"), fInfoLevelId=0x0, lpFileInformation=0x19ede4 | out: lpFileInformation=0x19ede4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0097.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed64) returned 1 [0097.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed68) returned 1 [0097.456] GetFileAttributesExW (in: lpFileName="C:\\FD1HVy" (normalized: "c:\\fd1hvy"), fInfoLevelId=0x0, lpFileInformation=0x19ede4 | out: lpFileInformation=0x19ede4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0097.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed64) returned 1 [0097.458] CreateDirectoryW (lpPathName="C:\\FD1HVy" (normalized: "c:\\fd1hvy"), lpSecurityAttributes=0x0) returned 1 [0097.460] CreateDirectoryW (lpPathName="C:\\FD1HVy\\Rand123" (normalized: "c:\\fd1hvy\\rand123"), lpSecurityAttributes=0x0) returned 1 [0097.463] GetCurrentProcessId () returned 0xef8 [0097.471] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x19e75c | out: lpLuid=0x19e75c*(LowPart=0x14, HighPart=0)) returned 1 [0097.478] GetCurrentProcess () returned 0xffffffff [0097.478] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x19e758 | out: TokenHandle=0x19e758*=0x3dc) returned 1 [0097.479] AdjustTokenPrivileges (in: TokenHandle=0x3dc, DisableAllPrivileges=0, NewState=0x266f374*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0097.479] CloseHandle (hObject=0x3dc) returned 1 [0097.483] lstrlenW (lpString="obsidium.dll") returned 12 [0097.483] lstrlenW (lpString="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ntdll.dll") returned 90 [0097.488] lstrlenW (lpString="obsidium.dll") returned 12 [0097.488] lstrlenW (lpString="ntdll.dll") returned 9 [0097.489] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3651a48, Length=0x20000, ResultLength=0x19ee44 | out: SystemInformation=0x3651a48, ResultLength=0x19ee44*=0x24c50) returned 0xc0000004 [0097.548] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3671a68, Length=0x27450, ResultLength=0x19ee44 | out: SystemInformation=0x3671a68, ResultLength=0x19ee44*=0x1abd0) returned 0x0 [0097.578] CoTaskMemAlloc (cb=0x20e) returned 0x7618f8 [0097.578] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x7618f8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0097.578] CoTaskMemFree (pv=0x7618f8) [0097.580] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe", nBufferLength=0x105, lpBuffer=0x19e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe", lpFilePart=0x0) returned 0x27 [0097.580] GetFullPathNameW (in: lpFileName="C:\\FD1HVy\\Rand123\\local.exe", nBufferLength=0x105, lpBuffer=0x19e938, lpFilePart=0x0 | out: lpBuffer="C:\\FD1HVy\\Rand123\\local.exe", lpFilePart=0x0) returned 0x1b [0097.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edec) returned 1 [0097.580] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\hidden-tear.exe"), fInfoLevelId=0x0, lpFileInformation=0x19ee68 | out: lpFileInformation=0x19ee68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73790780, ftCreationTime.dwHighDateTime=0x1d675cf, ftLastAccessTime.dwLowDateTime=0x73790780, ftLastAccessTime.dwHighDateTime=0x1d675cf, ftLastWriteTime.dwLowDateTime=0x75d46500, ftLastWriteTime.dwHighDateTime=0x1d675c1, nFileSizeHigh=0x0, nFileSizeLow=0x5a2f0)) returned 1 [0097.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede8) returned 1 [0097.581] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\hidden-tear.exe"), lpNewFileName="C:\\FD1HVy\\Rand123\\local.exe" (normalized: "c:\\fd1hvy\\rand123\\local.exe")) returned 1 [0097.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed98) returned 1 [0097.724] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x105, lpBuffer=0x19e84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0097.725] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\*", lpFindFileData=0x19eac0 | out: lpFindFileData=0x19eac0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x86b15b98, ftLastAccessTime.dwHighDateTime=0x1d675cf, ftLastWriteTime.dwLowDateTime=0xaf6c3bb0, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x708478 [0097.727] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x86b15b98, ftLastAccessTime.dwHighDateTime=0x1d675cf, ftLastWriteTime.dwLowDateTime=0xaf6c3bb0, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.727] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7eb0890, ftCreationTime.dwHighDateTime=0x1d5ebfb, ftLastAccessTime.dwLowDateTime=0x79d80da0, ftLastAccessTime.dwHighDateTime=0x1d5e750, ftLastWriteTime.dwLowDateTime=0x79d80da0, ftLastWriteTime.dwHighDateTime=0x1d5e750, nFileSizeHigh=0x0, nFileSizeLow=0x2cf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="-47zDmLsrM5Zlxp.pdf", cAlternateFileName="-47ZDM~1.PDF")) returned 1 [0097.727] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8a3570, ftCreationTime.dwHighDateTime=0x1d5ef40, ftLastAccessTime.dwLowDateTime=0x7723d850, ftLastAccessTime.dwHighDateTime=0x1d5e83b, ftLastWriteTime.dwLowDateTime=0x7723d850, ftLastWriteTime.dwHighDateTime=0x1d5e83b, nFileSizeHigh=0x0, nFileSizeLow=0x439a, dwReserved0=0x0, dwReserved1=0x0, cFileName="1Kgxn5i.flv", cAlternateFileName="")) returned 1 [0097.728] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda8f480, ftCreationTime.dwHighDateTime=0x1d5e199, ftLastAccessTime.dwLowDateTime=0x59f693c0, ftLastAccessTime.dwHighDateTime=0x1d5edf5, ftLastWriteTime.dwLowDateTime=0x59f693c0, ftLastWriteTime.dwHighDateTime=0x1d5edf5, nFileSizeHigh=0x0, nFileSizeLow=0x18df3, dwReserved0=0x0, dwReserved1=0x0, cFileName="3rJdOON4hNmP6e0EHCh.m4a", cAlternateFileName="3RJDOO~1.M4A")) returned 1 [0097.728] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29974740, ftCreationTime.dwHighDateTime=0x1d5efa5, ftLastAccessTime.dwLowDateTime=0xbb41ade0, ftLastAccessTime.dwHighDateTime=0x1d5eb5c, ftLastWriteTime.dwLowDateTime=0xbb41ade0, ftLastWriteTime.dwHighDateTime=0x1d5eb5c, nFileSizeHigh=0x0, nFileSizeLow=0xec80, dwReserved0=0x0, dwReserved1=0x0, cFileName="4Q6AfqT.avi", cAlternateFileName="")) returned 1 [0097.728] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6376180, ftCreationTime.dwHighDateTime=0x1d5e0d8, ftLastAccessTime.dwLowDateTime=0xccd62180, ftLastAccessTime.dwHighDateTime=0x1d5ea7b, ftLastWriteTime.dwLowDateTime=0xccd62180, ftLastWriteTime.dwHighDateTime=0x1d5ea7b, nFileSizeHigh=0x0, nFileSizeLow=0x18d59, dwReserved0=0x0, dwReserved1=0x0, cFileName="9c3g-_Bopd2ctLelrM.wav", cAlternateFileName="9C3G-_~1.WAV")) returned 1 [0097.728] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0097.728] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbda4b120, ftCreationTime.dwHighDateTime=0x1d5e5eb, ftLastAccessTime.dwLowDateTime=0x2173e770, ftLastAccessTime.dwHighDateTime=0x1d5e81c, ftLastWriteTime.dwLowDateTime=0x2173e770, ftLastWriteTime.dwHighDateTime=0x1d5e81c, nFileSizeHigh=0x0, nFileSizeLow=0xc65, dwReserved0=0x0, dwReserved1=0x0, cFileName="dTNP.mp4", cAlternateFileName="")) returned 1 [0097.729] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2e15fa0, ftCreationTime.dwHighDateTime=0x1d5e101, ftLastAccessTime.dwLowDateTime=0x28f23750, ftLastAccessTime.dwHighDateTime=0x1d5e6d6, ftLastWriteTime.dwLowDateTime=0x28f23750, ftLastWriteTime.dwHighDateTime=0x1d5e6d6, nFileSizeHigh=0x0, nFileSizeLow=0x3c6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DUCGlGpLhZ7ehP0yEx.mp3", cAlternateFileName="DUCGLG~1.MP3")) returned 1 [0097.729] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2b5ee70, ftCreationTime.dwHighDateTime=0x1d5e75f, ftLastAccessTime.dwLowDateTime=0x5bdb62e0, ftLastAccessTime.dwHighDateTime=0x1d5e91f, ftLastWriteTime.dwLowDateTime=0x5bdb62e0, ftLastWriteTime.dwHighDateTime=0x1d5e91f, nFileSizeHigh=0x0, nFileSizeLow=0xdf26, dwReserved0=0x0, dwReserved1=0x0, cFileName="EmgId2OIYKEN.wav", cAlternateFileName="EMGID2~1.WAV")) returned 1 [0097.729] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbe49440, ftCreationTime.dwHighDateTime=0x1d5e1fe, ftLastAccessTime.dwLowDateTime=0x5019f40, ftLastAccessTime.dwHighDateTime=0x1d5e814, ftLastWriteTime.dwLowDateTime=0x5019f40, ftLastWriteTime.dwHighDateTime=0x1d5e814, nFileSizeHigh=0x0, nFileSizeLow=0x2f07, dwReserved0=0x0, dwReserved1=0x0, cFileName="gqKfeceE.mkv", cAlternateFileName="")) returned 1 [0097.729] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f5a9210, ftCreationTime.dwHighDateTime=0x1d5e58a, ftLastAccessTime.dwLowDateTime=0xa09741e0, ftLastAccessTime.dwHighDateTime=0x1d5ebab, ftLastWriteTime.dwLowDateTime=0xa09741e0, ftLastWriteTime.dwHighDateTime=0x1d5ebab, nFileSizeHigh=0x0, nFileSizeLow=0x57a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="hC4J1IJ.m4a", cAlternateFileName="")) returned 1 [0097.729] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x489b0110, ftCreationTime.dwHighDateTime=0x1d5e52b, ftLastAccessTime.dwLowDateTime=0xb49d0d70, ftLastAccessTime.dwHighDateTime=0x1d5eca8, ftLastWriteTime.dwLowDateTime=0xb49d0d70, ftLastWriteTime.dwHighDateTime=0x1d5eca8, nFileSizeHigh=0x0, nFileSizeLow=0xf0cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="IuuHCN.mp3", cAlternateFileName="")) returned 1 [0097.729] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eb39880, ftCreationTime.dwHighDateTime=0x1d5e84f, ftLastAccessTime.dwLowDateTime=0x206e43a0, ftLastAccessTime.dwHighDateTime=0x1d5e571, ftLastWriteTime.dwLowDateTime=0x206e43a0, ftLastWriteTime.dwHighDateTime=0x1d5e571, nFileSizeHigh=0x0, nFileSizeLow=0x1355e, dwReserved0=0x0, dwReserved1=0x0, cFileName="izq8n6_qgBXoY.png", cAlternateFileName="IZQ8N6~1.PNG")) returned 1 [0097.730] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x952c3a40, ftCreationTime.dwHighDateTime=0x1d5ee6c, ftLastAccessTime.dwLowDateTime=0x1f8e42e0, ftLastAccessTime.dwHighDateTime=0x1d5ea5e, ftLastWriteTime.dwLowDateTime=0x1f8e42e0, ftLastWriteTime.dwHighDateTime=0x1d5ea5e, nFileSizeHigh=0x0, nFileSizeLow=0xfc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="jGYH8Y8r9kj.jpg", cAlternateFileName="JGYH8Y~1.JPG")) returned 1 [0097.730] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0957f40, ftCreationTime.dwHighDateTime=0x1d5eeb4, ftLastAccessTime.dwLowDateTime=0x1ce0f9d0, ftLastAccessTime.dwHighDateTime=0x1d5ef17, ftLastWriteTime.dwLowDateTime=0x1ce0f9d0, ftLastWriteTime.dwHighDateTime=0x1d5ef17, nFileSizeHigh=0x0, nFileSizeLow=0x6d70, dwReserved0=0x0, dwReserved1=0x0, cFileName="jUesZvd-s.jpg", cAlternateFileName="JUESZV~1.JPG")) returned 1 [0097.730] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b1c4680, ftCreationTime.dwHighDateTime=0x1d5e923, ftLastAccessTime.dwLowDateTime=0x9c92a910, ftLastAccessTime.dwHighDateTime=0x1d5ef5a, ftLastWriteTime.dwLowDateTime=0x9c92a910, ftLastWriteTime.dwHighDateTime=0x1d5ef5a, nFileSizeHigh=0x0, nFileSizeLow=0xf714, dwReserved0=0x0, dwReserved1=0x0, cFileName="juhe8-MFzDg4vFSNwTUJ.ots", cAlternateFileName="JUHE8-~1.OTS")) returned 1 [0097.731] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb136100, ftCreationTime.dwHighDateTime=0x1d5ee60, ftLastAccessTime.dwLowDateTime=0xc1dd2290, ftLastAccessTime.dwHighDateTime=0x1d5ef1e, ftLastWriteTime.dwLowDateTime=0xc1dd2290, ftLastWriteTime.dwHighDateTime=0x1d5ef1e, nFileSizeHigh=0x0, nFileSizeLow=0x17f50, dwReserved0=0x0, dwReserved1=0x0, cFileName="mmcdT0ssmgFqSRwRvCY.mkv", cAlternateFileName="MMCDT0~1.MKV")) returned 1 [0097.731] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3890690, ftCreationTime.dwHighDateTime=0x1d5efcf, ftLastAccessTime.dwLowDateTime=0x6237dcf0, ftLastAccessTime.dwHighDateTime=0x1d5e2d4, ftLastWriteTime.dwLowDateTime=0x6237dcf0, ftLastWriteTime.dwHighDateTime=0x1d5e2d4, nFileSizeHigh=0x0, nFileSizeLow=0x16ae5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OJ6j-3IF-8uQrVieY52.m4a", cAlternateFileName="OJ6J-3~1.M4A")) returned 1 [0097.731] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9129b00, ftCreationTime.dwHighDateTime=0x1d5e4dc, ftLastAccessTime.dwLowDateTime=0xc34165f0, ftLastAccessTime.dwHighDateTime=0x1d5e538, ftLastWriteTime.dwLowDateTime=0xc34165f0, ftLastWriteTime.dwHighDateTime=0x1d5e538, nFileSizeHigh=0x0, nFileSizeLow=0x17d99, dwReserved0=0x0, dwReserved1=0x0, cFileName="oXn8yyFK6hp.png", cAlternateFileName="OXN8YY~1.PNG")) returned 1 [0097.731] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a5dc40, ftCreationTime.dwHighDateTime=0x1d5e367, ftLastAccessTime.dwLowDateTime=0xf5961ca0, ftLastAccessTime.dwHighDateTime=0x1d5e342, ftLastWriteTime.dwLowDateTime=0xf5961ca0, ftLastWriteTime.dwHighDateTime=0x1d5e342, nFileSizeHigh=0x0, nFileSizeLow=0x819f, dwReserved0=0x0, dwReserved1=0x0, cFileName="QAhgTD.xlsx", cAlternateFileName="QAHGTD~1.XLS")) returned 1 [0097.731] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d687c90, ftCreationTime.dwHighDateTime=0x1d5e556, ftLastAccessTime.dwLowDateTime=0x6be66c40, ftLastAccessTime.dwHighDateTime=0x1d5e7ce, ftLastWriteTime.dwLowDateTime=0x6be66c40, ftLastWriteTime.dwHighDateTime=0x1d5e7ce, nFileSizeHigh=0x0, nFileSizeLow=0x60c, dwReserved0=0x0, dwReserved1=0x0, cFileName="qBFdm0Is5lnF mFj.wav", cAlternateFileName="QBFDM0~1.WAV")) returned 1 [0097.731] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5c460, ftCreationTime.dwHighDateTime=0x1d5ef1d, ftLastAccessTime.dwLowDateTime=0x60c57260, ftLastAccessTime.dwHighDateTime=0x1d5e720, ftLastWriteTime.dwLowDateTime=0x60c57260, ftLastWriteTime.dwHighDateTime=0x1d5e720, nFileSizeHigh=0x0, nFileSizeLow=0x5689, dwReserved0=0x0, dwReserved1=0x0, cFileName="qIE7cRi_s5t08y7Zd.flv", cAlternateFileName="QIE7CR~1.FLV")) returned 1 [0097.732] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ed06370, ftCreationTime.dwHighDateTime=0x1d5efaf, ftLastAccessTime.dwLowDateTime=0xc46abbc0, ftLastAccessTime.dwHighDateTime=0x1d5e84e, ftLastWriteTime.dwLowDateTime=0xc46abbc0, ftLastWriteTime.dwHighDateTime=0x1d5e84e, nFileSizeHigh=0x0, nFileSizeLow=0x1027, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rwl9j7XAHVz8.png", cAlternateFileName="RWL9J7~1.PNG")) returned 1 [0097.732] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4292da0, ftCreationTime.dwHighDateTime=0x1d5e8bd, ftLastAccessTime.dwLowDateTime=0xa59b6b90, ftLastAccessTime.dwHighDateTime=0x1d5efab, ftLastWriteTime.dwLowDateTime=0xa59b6b90, ftLastWriteTime.dwHighDateTime=0x1d5efab, nFileSizeHigh=0x0, nFileSizeLow=0xc9a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="tcazK41Fi.odt", cAlternateFileName="TCAZK4~1.ODT")) returned 1 [0097.732] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c7e1380, ftCreationTime.dwHighDateTime=0x1d5e82b, ftLastAccessTime.dwLowDateTime=0x3aa24780, ftLastAccessTime.dwHighDateTime=0x1d5e7dd, ftLastWriteTime.dwLowDateTime=0x3aa24780, ftLastWriteTime.dwHighDateTime=0x1d5e7dd, nFileSizeHigh=0x0, nFileSizeLow=0x14bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="tnfUvyOeuyO.gif", cAlternateFileName="TNFUVY~1.GIF")) returned 1 [0097.732] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdee46e0, ftCreationTime.dwHighDateTime=0x1d5ea15, ftLastAccessTime.dwLowDateTime=0x65aff860, ftLastAccessTime.dwHighDateTime=0x1d5e3b3, ftLastWriteTime.dwLowDateTime=0x65aff860, ftLastWriteTime.dwHighDateTime=0x1d5e3b3, nFileSizeHigh=0x0, nFileSizeLow=0xf385, dwReserved0=0x0, dwReserved1=0x0, cFileName="U2OUpUA6HKwM.wav", cAlternateFileName="U2OUPU~1.WAV")) returned 1 [0097.732] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905d89f0, ftCreationTime.dwHighDateTime=0x1d5e873, ftLastAccessTime.dwLowDateTime=0xee96aa00, ftLastAccessTime.dwHighDateTime=0x1d5e9c8, ftLastWriteTime.dwLowDateTime=0xee96aa00, ftLastWriteTime.dwHighDateTime=0x1d5e9c8, nFileSizeHigh=0x0, nFileSizeLow=0x9372, dwReserved0=0x0, dwReserved1=0x0, cFileName="v8t4CtjbLuJ4D9yyWCY.csv", cAlternateFileName="V8T4CT~1.CSV")) returned 1 [0097.733] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e03f0, ftCreationTime.dwHighDateTime=0x1d5effd, ftLastAccessTime.dwLowDateTime=0xd6287700, ftLastAccessTime.dwHighDateTime=0x1d5e4b4, ftLastWriteTime.dwLowDateTime=0xd6287700, ftLastWriteTime.dwHighDateTime=0x1d5e4b4, nFileSizeHigh=0x0, nFileSizeLow=0x7588, dwReserved0=0x0, dwReserved1=0x0, cFileName="vrvFJk_XLdEa.ots", cAlternateFileName="VRVFJK~1.OTS")) returned 1 [0097.733] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe62f0290, ftCreationTime.dwHighDateTime=0x1d5e41e, ftLastAccessTime.dwLowDateTime=0x6c5d7080, ftLastAccessTime.dwHighDateTime=0x1d5edee, ftLastWriteTime.dwLowDateTime=0x6c5d7080, ftLastWriteTime.dwHighDateTime=0x1d5edee, nFileSizeHigh=0x0, nFileSizeLow=0x18db6, dwReserved0=0x0, dwReserved1=0x0, cFileName="vvZTWTV8FICU-m4A.mkv", cAlternateFileName="VVZTWT~1.MKV")) returned 1 [0097.733] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb77bc140, ftCreationTime.dwHighDateTime=0x1d5e211, ftLastAccessTime.dwLowDateTime=0xe4da2640, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe4da2640, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0xc1c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Whoz y9gOm9hnbG0fVu.avi", cAlternateFileName="WHOZY9~1.AVI")) returned 1 [0097.733] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729eec90, ftCreationTime.dwHighDateTime=0x1d5e442, ftLastAccessTime.dwLowDateTime=0x3d5a22d0, ftLastAccessTime.dwHighDateTime=0x1d5e0fe, ftLastWriteTime.dwLowDateTime=0x3d5a22d0, ftLastWriteTime.dwHighDateTime=0x1d5e0fe, nFileSizeHigh=0x0, nFileSizeLow=0x17f79, dwReserved0=0x0, dwReserved1=0x0, cFileName="XHwpWMtf0Ll_vF0.csv", cAlternateFileName="XHWPWM~1.CSV")) returned 1 [0097.733] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88ebc310, ftCreationTime.dwHighDateTime=0x1d5e61d, ftLastAccessTime.dwLowDateTime=0xe8ac500, ftLastAccessTime.dwHighDateTime=0x1d5e6a7, ftLastWriteTime.dwLowDateTime=0xe8ac500, ftLastWriteTime.dwHighDateTime=0x1d5e6a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XuEywee1k", cAlternateFileName="XUEYWE~1")) returned 1 [0097.734] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c5e00, ftCreationTime.dwHighDateTime=0x1d5e1e5, ftLastAccessTime.dwLowDateTime=0x5a2476f0, ftLastAccessTime.dwHighDateTime=0x1d5e765, ftLastWriteTime.dwLowDateTime=0x5a2476f0, ftLastWriteTime.dwHighDateTime=0x1d5e765, nFileSizeHigh=0x0, nFileSizeLow=0x270f, dwReserved0=0x0, dwReserved1=0x0, cFileName="yyMfsjbfc_l4hZT41.pptx", cAlternateFileName="YYMFSJ~1.PPT")) returned 1 [0097.734] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36777fc0, ftCreationTime.dwHighDateTime=0x1d5efc3, ftLastAccessTime.dwLowDateTime=0x680fb8d0, ftLastAccessTime.dwHighDateTime=0x1d5ec4f, ftLastWriteTime.dwLowDateTime=0x680fb8d0, ftLastWriteTime.dwHighDateTime=0x1d5ec4f, nFileSizeHigh=0x0, nFileSizeLow=0xed18, dwReserved0=0x0, dwReserved1=0x0, cFileName="z7rP0.mkv", cAlternateFileName="")) returned 1 [0097.734] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b86cee0, ftCreationTime.dwHighDateTime=0x1d5e6dd, ftLastAccessTime.dwLowDateTime=0x8a021de0, ftLastAccessTime.dwHighDateTime=0x1d5e806, ftLastWriteTime.dwLowDateTime=0x8a021de0, ftLastWriteTime.dwHighDateTime=0x1d5e806, nFileSizeHigh=0x0, nFileSizeLow=0x9af1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z8kOJnO7DOG.m4a", cAlternateFileName="Z8KOJN~1.M4A")) returned 1 [0097.734] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a402310, ftCreationTime.dwHighDateTime=0x1d5e483, ftLastAccessTime.dwLowDateTime=0x375f8c90, ftLastAccessTime.dwHighDateTime=0x1d5e972, ftLastWriteTime.dwLowDateTime=0x375f8c90, ftLastWriteTime.dwHighDateTime=0x1d5e972, nFileSizeHigh=0x0, nFileSizeLow=0x7080, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zd_0jo8eYB83T.ppt", cAlternateFileName="ZD_0JO~1.PPT")) returned 1 [0097.734] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cd42af0, ftCreationTime.dwHighDateTime=0x1d5ecda, ftLastAccessTime.dwLowDateTime=0x4d220560, ftLastAccessTime.dwHighDateTime=0x1d5ed66, ftLastWriteTime.dwLowDateTime=0x4d220560, ftLastWriteTime.dwHighDateTime=0x1d5ed66, nFileSizeHigh=0x0, nFileSizeLow=0x13a08, dwReserved0=0x0, dwReserved1=0x0, cFileName="zgTRfP_2OhRR.bmp", cAlternateFileName="ZGTRFP~1.BMP")) returned 1 [0097.735] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c366b60, ftCreationTime.dwHighDateTime=0x1d5e70e, ftLastAccessTime.dwLowDateTime=0xed0b18c0, ftLastAccessTime.dwHighDateTime=0x1d5e89b, ftLastWriteTime.dwLowDateTime=0xed0b18c0, ftLastWriteTime.dwHighDateTime=0x1d5e89b, nFileSizeHigh=0x0, nFileSizeLow=0x624b, dwReserved0=0x0, dwReserved1=0x0, cFileName="_pd3xKHZBnocQk_.odt", cAlternateFileName="_PD3XK~1.ODT")) returned 1 [0097.735] FindNextFileW (in: hFindFile=0x708478, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0097.735] FindClose (in: hFindFile=0x708478 | out: hFindFile=0x708478) returned 1 [0097.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed54) returned 1 [0097.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed60) returned 1 [0097.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed98) returned 1 [0097.736] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x105, lpBuffer=0x19e84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0097.736] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\*", lpFindFileData=0x19eac0 | out: lpFindFileData=0x19eac0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xaf6c3bb0, ftLastAccessTime.dwHighDateTime=0x1d675cf, ftLastWriteTime.dwLowDateTime=0xaf6c3bb0, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7087f8 [0097.737] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xaf6c3bb0, ftLastAccessTime.dwHighDateTime=0x1d675cf, ftLastWriteTime.dwLowDateTime=0xaf6c3bb0, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.737] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7eb0890, ftCreationTime.dwHighDateTime=0x1d5ebfb, ftLastAccessTime.dwLowDateTime=0x79d80da0, ftLastAccessTime.dwHighDateTime=0x1d5e750, ftLastWriteTime.dwLowDateTime=0x79d80da0, ftLastWriteTime.dwHighDateTime=0x1d5e750, nFileSizeHigh=0x0, nFileSizeLow=0x2cf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="-47zDmLsrM5Zlxp.pdf", cAlternateFileName="-47ZDM~1.PDF")) returned 1 [0097.737] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8a3570, ftCreationTime.dwHighDateTime=0x1d5ef40, ftLastAccessTime.dwLowDateTime=0x7723d850, ftLastAccessTime.dwHighDateTime=0x1d5e83b, ftLastWriteTime.dwLowDateTime=0x7723d850, ftLastWriteTime.dwHighDateTime=0x1d5e83b, nFileSizeHigh=0x0, nFileSizeLow=0x439a, dwReserved0=0x0, dwReserved1=0x0, cFileName="1Kgxn5i.flv", cAlternateFileName="")) returned 1 [0097.737] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda8f480, ftCreationTime.dwHighDateTime=0x1d5e199, ftLastAccessTime.dwLowDateTime=0x59f693c0, ftLastAccessTime.dwHighDateTime=0x1d5edf5, ftLastWriteTime.dwLowDateTime=0x59f693c0, ftLastWriteTime.dwHighDateTime=0x1d5edf5, nFileSizeHigh=0x0, nFileSizeLow=0x18df3, dwReserved0=0x0, dwReserved1=0x0, cFileName="3rJdOON4hNmP6e0EHCh.m4a", cAlternateFileName="3RJDOO~1.M4A")) returned 1 [0097.738] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29974740, ftCreationTime.dwHighDateTime=0x1d5efa5, ftLastAccessTime.dwLowDateTime=0xbb41ade0, ftLastAccessTime.dwHighDateTime=0x1d5eb5c, ftLastWriteTime.dwLowDateTime=0xbb41ade0, ftLastWriteTime.dwHighDateTime=0x1d5eb5c, nFileSizeHigh=0x0, nFileSizeLow=0xec80, dwReserved0=0x0, dwReserved1=0x0, cFileName="4Q6AfqT.avi", cAlternateFileName="")) returned 1 [0097.738] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6376180, ftCreationTime.dwHighDateTime=0x1d5e0d8, ftLastAccessTime.dwLowDateTime=0xccd62180, ftLastAccessTime.dwHighDateTime=0x1d5ea7b, ftLastWriteTime.dwLowDateTime=0xccd62180, ftLastWriteTime.dwHighDateTime=0x1d5ea7b, nFileSizeHigh=0x0, nFileSizeLow=0x18d59, dwReserved0=0x0, dwReserved1=0x0, cFileName="9c3g-_Bopd2ctLelrM.wav", cAlternateFileName="9C3G-_~1.WAV")) returned 1 [0097.738] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0097.738] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbda4b120, ftCreationTime.dwHighDateTime=0x1d5e5eb, ftLastAccessTime.dwLowDateTime=0x2173e770, ftLastAccessTime.dwHighDateTime=0x1d5e81c, ftLastWriteTime.dwLowDateTime=0x2173e770, ftLastWriteTime.dwHighDateTime=0x1d5e81c, nFileSizeHigh=0x0, nFileSizeLow=0xc65, dwReserved0=0x0, dwReserved1=0x0, cFileName="dTNP.mp4", cAlternateFileName="")) returned 1 [0097.738] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2e15fa0, ftCreationTime.dwHighDateTime=0x1d5e101, ftLastAccessTime.dwLowDateTime=0x28f23750, ftLastAccessTime.dwHighDateTime=0x1d5e6d6, ftLastWriteTime.dwLowDateTime=0x28f23750, ftLastWriteTime.dwHighDateTime=0x1d5e6d6, nFileSizeHigh=0x0, nFileSizeLow=0x3c6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DUCGlGpLhZ7ehP0yEx.mp3", cAlternateFileName="DUCGLG~1.MP3")) returned 1 [0097.739] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2b5ee70, ftCreationTime.dwHighDateTime=0x1d5e75f, ftLastAccessTime.dwLowDateTime=0x5bdb62e0, ftLastAccessTime.dwHighDateTime=0x1d5e91f, ftLastWriteTime.dwLowDateTime=0x5bdb62e0, ftLastWriteTime.dwHighDateTime=0x1d5e91f, nFileSizeHigh=0x0, nFileSizeLow=0xdf26, dwReserved0=0x0, dwReserved1=0x0, cFileName="EmgId2OIYKEN.wav", cAlternateFileName="EMGID2~1.WAV")) returned 1 [0097.739] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbe49440, ftCreationTime.dwHighDateTime=0x1d5e1fe, ftLastAccessTime.dwLowDateTime=0x5019f40, ftLastAccessTime.dwHighDateTime=0x1d5e814, ftLastWriteTime.dwLowDateTime=0x5019f40, ftLastWriteTime.dwHighDateTime=0x1d5e814, nFileSizeHigh=0x0, nFileSizeLow=0x2f07, dwReserved0=0x0, dwReserved1=0x0, cFileName="gqKfeceE.mkv", cAlternateFileName="")) returned 1 [0097.739] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f5a9210, ftCreationTime.dwHighDateTime=0x1d5e58a, ftLastAccessTime.dwLowDateTime=0xa09741e0, ftLastAccessTime.dwHighDateTime=0x1d5ebab, ftLastWriteTime.dwLowDateTime=0xa09741e0, ftLastWriteTime.dwHighDateTime=0x1d5ebab, nFileSizeHigh=0x0, nFileSizeLow=0x57a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="hC4J1IJ.m4a", cAlternateFileName="")) returned 1 [0097.739] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x489b0110, ftCreationTime.dwHighDateTime=0x1d5e52b, ftLastAccessTime.dwLowDateTime=0xb49d0d70, ftLastAccessTime.dwHighDateTime=0x1d5eca8, ftLastWriteTime.dwLowDateTime=0xb49d0d70, ftLastWriteTime.dwHighDateTime=0x1d5eca8, nFileSizeHigh=0x0, nFileSizeLow=0xf0cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="IuuHCN.mp3", cAlternateFileName="")) returned 1 [0097.740] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eb39880, ftCreationTime.dwHighDateTime=0x1d5e84f, ftLastAccessTime.dwLowDateTime=0x206e43a0, ftLastAccessTime.dwHighDateTime=0x1d5e571, ftLastWriteTime.dwLowDateTime=0x206e43a0, ftLastWriteTime.dwHighDateTime=0x1d5e571, nFileSizeHigh=0x0, nFileSizeLow=0x1355e, dwReserved0=0x0, dwReserved1=0x0, cFileName="izq8n6_qgBXoY.png", cAlternateFileName="IZQ8N6~1.PNG")) returned 1 [0097.740] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x952c3a40, ftCreationTime.dwHighDateTime=0x1d5ee6c, ftLastAccessTime.dwLowDateTime=0x1f8e42e0, ftLastAccessTime.dwHighDateTime=0x1d5ea5e, ftLastWriteTime.dwLowDateTime=0x1f8e42e0, ftLastWriteTime.dwHighDateTime=0x1d5ea5e, nFileSizeHigh=0x0, nFileSizeLow=0xfc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="jGYH8Y8r9kj.jpg", cAlternateFileName="JGYH8Y~1.JPG")) returned 1 [0097.740] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0957f40, ftCreationTime.dwHighDateTime=0x1d5eeb4, ftLastAccessTime.dwLowDateTime=0x1ce0f9d0, ftLastAccessTime.dwHighDateTime=0x1d5ef17, ftLastWriteTime.dwLowDateTime=0x1ce0f9d0, ftLastWriteTime.dwHighDateTime=0x1d5ef17, nFileSizeHigh=0x0, nFileSizeLow=0x6d70, dwReserved0=0x0, dwReserved1=0x0, cFileName="jUesZvd-s.jpg", cAlternateFileName="JUESZV~1.JPG")) returned 1 [0097.740] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b1c4680, ftCreationTime.dwHighDateTime=0x1d5e923, ftLastAccessTime.dwLowDateTime=0x9c92a910, ftLastAccessTime.dwHighDateTime=0x1d5ef5a, ftLastWriteTime.dwLowDateTime=0x9c92a910, ftLastWriteTime.dwHighDateTime=0x1d5ef5a, nFileSizeHigh=0x0, nFileSizeLow=0xf714, dwReserved0=0x0, dwReserved1=0x0, cFileName="juhe8-MFzDg4vFSNwTUJ.ots", cAlternateFileName="JUHE8-~1.OTS")) returned 1 [0097.741] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb136100, ftCreationTime.dwHighDateTime=0x1d5ee60, ftLastAccessTime.dwLowDateTime=0xc1dd2290, ftLastAccessTime.dwHighDateTime=0x1d5ef1e, ftLastWriteTime.dwLowDateTime=0xc1dd2290, ftLastWriteTime.dwHighDateTime=0x1d5ef1e, nFileSizeHigh=0x0, nFileSizeLow=0x17f50, dwReserved0=0x0, dwReserved1=0x0, cFileName="mmcdT0ssmgFqSRwRvCY.mkv", cAlternateFileName="MMCDT0~1.MKV")) returned 1 [0097.741] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3890690, ftCreationTime.dwHighDateTime=0x1d5efcf, ftLastAccessTime.dwLowDateTime=0x6237dcf0, ftLastAccessTime.dwHighDateTime=0x1d5e2d4, ftLastWriteTime.dwLowDateTime=0x6237dcf0, ftLastWriteTime.dwHighDateTime=0x1d5e2d4, nFileSizeHigh=0x0, nFileSizeLow=0x16ae5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OJ6j-3IF-8uQrVieY52.m4a", cAlternateFileName="OJ6J-3~1.M4A")) returned 1 [0097.741] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9129b00, ftCreationTime.dwHighDateTime=0x1d5e4dc, ftLastAccessTime.dwLowDateTime=0xc34165f0, ftLastAccessTime.dwHighDateTime=0x1d5e538, ftLastWriteTime.dwLowDateTime=0xc34165f0, ftLastWriteTime.dwHighDateTime=0x1d5e538, nFileSizeHigh=0x0, nFileSizeLow=0x17d99, dwReserved0=0x0, dwReserved1=0x0, cFileName="oXn8yyFK6hp.png", cAlternateFileName="OXN8YY~1.PNG")) returned 1 [0097.741] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a5dc40, ftCreationTime.dwHighDateTime=0x1d5e367, ftLastAccessTime.dwLowDateTime=0xf5961ca0, ftLastAccessTime.dwHighDateTime=0x1d5e342, ftLastWriteTime.dwLowDateTime=0xf5961ca0, ftLastWriteTime.dwHighDateTime=0x1d5e342, nFileSizeHigh=0x0, nFileSizeLow=0x819f, dwReserved0=0x0, dwReserved1=0x0, cFileName="QAhgTD.xlsx", cAlternateFileName="QAHGTD~1.XLS")) returned 1 [0097.741] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d687c90, ftCreationTime.dwHighDateTime=0x1d5e556, ftLastAccessTime.dwLowDateTime=0x6be66c40, ftLastAccessTime.dwHighDateTime=0x1d5e7ce, ftLastWriteTime.dwLowDateTime=0x6be66c40, ftLastWriteTime.dwHighDateTime=0x1d5e7ce, nFileSizeHigh=0x0, nFileSizeLow=0x60c, dwReserved0=0x0, dwReserved1=0x0, cFileName="qBFdm0Is5lnF mFj.wav", cAlternateFileName="QBFDM0~1.WAV")) returned 1 [0097.742] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5c460, ftCreationTime.dwHighDateTime=0x1d5ef1d, ftLastAccessTime.dwLowDateTime=0x60c57260, ftLastAccessTime.dwHighDateTime=0x1d5e720, ftLastWriteTime.dwLowDateTime=0x60c57260, ftLastWriteTime.dwHighDateTime=0x1d5e720, nFileSizeHigh=0x0, nFileSizeLow=0x5689, dwReserved0=0x0, dwReserved1=0x0, cFileName="qIE7cRi_s5t08y7Zd.flv", cAlternateFileName="QIE7CR~1.FLV")) returned 1 [0097.742] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ed06370, ftCreationTime.dwHighDateTime=0x1d5efaf, ftLastAccessTime.dwLowDateTime=0xc46abbc0, ftLastAccessTime.dwHighDateTime=0x1d5e84e, ftLastWriteTime.dwLowDateTime=0xc46abbc0, ftLastWriteTime.dwHighDateTime=0x1d5e84e, nFileSizeHigh=0x0, nFileSizeLow=0x1027, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rwl9j7XAHVz8.png", cAlternateFileName="RWL9J7~1.PNG")) returned 1 [0097.742] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4292da0, ftCreationTime.dwHighDateTime=0x1d5e8bd, ftLastAccessTime.dwLowDateTime=0xa59b6b90, ftLastAccessTime.dwHighDateTime=0x1d5efab, ftLastWriteTime.dwLowDateTime=0xa59b6b90, ftLastWriteTime.dwHighDateTime=0x1d5efab, nFileSizeHigh=0x0, nFileSizeLow=0xc9a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="tcazK41Fi.odt", cAlternateFileName="TCAZK4~1.ODT")) returned 1 [0097.742] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c7e1380, ftCreationTime.dwHighDateTime=0x1d5e82b, ftLastAccessTime.dwLowDateTime=0x3aa24780, ftLastAccessTime.dwHighDateTime=0x1d5e7dd, ftLastWriteTime.dwLowDateTime=0x3aa24780, ftLastWriteTime.dwHighDateTime=0x1d5e7dd, nFileSizeHigh=0x0, nFileSizeLow=0x14bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="tnfUvyOeuyO.gif", cAlternateFileName="TNFUVY~1.GIF")) returned 1 [0097.742] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdee46e0, ftCreationTime.dwHighDateTime=0x1d5ea15, ftLastAccessTime.dwLowDateTime=0x65aff860, ftLastAccessTime.dwHighDateTime=0x1d5e3b3, ftLastWriteTime.dwLowDateTime=0x65aff860, ftLastWriteTime.dwHighDateTime=0x1d5e3b3, nFileSizeHigh=0x0, nFileSizeLow=0xf385, dwReserved0=0x0, dwReserved1=0x0, cFileName="U2OUpUA6HKwM.wav", cAlternateFileName="U2OUPU~1.WAV")) returned 1 [0097.743] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905d89f0, ftCreationTime.dwHighDateTime=0x1d5e873, ftLastAccessTime.dwLowDateTime=0xee96aa00, ftLastAccessTime.dwHighDateTime=0x1d5e9c8, ftLastWriteTime.dwLowDateTime=0xee96aa00, ftLastWriteTime.dwHighDateTime=0x1d5e9c8, nFileSizeHigh=0x0, nFileSizeLow=0x9372, dwReserved0=0x0, dwReserved1=0x0, cFileName="v8t4CtjbLuJ4D9yyWCY.csv", cAlternateFileName="V8T4CT~1.CSV")) returned 1 [0097.743] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e03f0, ftCreationTime.dwHighDateTime=0x1d5effd, ftLastAccessTime.dwLowDateTime=0xd6287700, ftLastAccessTime.dwHighDateTime=0x1d5e4b4, ftLastWriteTime.dwLowDateTime=0xd6287700, ftLastWriteTime.dwHighDateTime=0x1d5e4b4, nFileSizeHigh=0x0, nFileSizeLow=0x7588, dwReserved0=0x0, dwReserved1=0x0, cFileName="vrvFJk_XLdEa.ots", cAlternateFileName="VRVFJK~1.OTS")) returned 1 [0097.743] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe62f0290, ftCreationTime.dwHighDateTime=0x1d5e41e, ftLastAccessTime.dwLowDateTime=0x6c5d7080, ftLastAccessTime.dwHighDateTime=0x1d5edee, ftLastWriteTime.dwLowDateTime=0x6c5d7080, ftLastWriteTime.dwHighDateTime=0x1d5edee, nFileSizeHigh=0x0, nFileSizeLow=0x18db6, dwReserved0=0x0, dwReserved1=0x0, cFileName="vvZTWTV8FICU-m4A.mkv", cAlternateFileName="VVZTWT~1.MKV")) returned 1 [0097.743] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb77bc140, ftCreationTime.dwHighDateTime=0x1d5e211, ftLastAccessTime.dwLowDateTime=0xe4da2640, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe4da2640, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0xc1c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Whoz y9gOm9hnbG0fVu.avi", cAlternateFileName="WHOZY9~1.AVI")) returned 1 [0097.744] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729eec90, ftCreationTime.dwHighDateTime=0x1d5e442, ftLastAccessTime.dwLowDateTime=0x3d5a22d0, ftLastAccessTime.dwHighDateTime=0x1d5e0fe, ftLastWriteTime.dwLowDateTime=0x3d5a22d0, ftLastWriteTime.dwHighDateTime=0x1d5e0fe, nFileSizeHigh=0x0, nFileSizeLow=0x17f79, dwReserved0=0x0, dwReserved1=0x0, cFileName="XHwpWMtf0Ll_vF0.csv", cAlternateFileName="XHWPWM~1.CSV")) returned 1 [0097.744] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88ebc310, ftCreationTime.dwHighDateTime=0x1d5e61d, ftLastAccessTime.dwLowDateTime=0xe8ac500, ftLastAccessTime.dwHighDateTime=0x1d5e6a7, ftLastWriteTime.dwLowDateTime=0xe8ac500, ftLastWriteTime.dwHighDateTime=0x1d5e6a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XuEywee1k", cAlternateFileName="XUEYWE~1")) returned 1 [0097.744] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c5e00, ftCreationTime.dwHighDateTime=0x1d5e1e5, ftLastAccessTime.dwLowDateTime=0x5a2476f0, ftLastAccessTime.dwHighDateTime=0x1d5e765, ftLastWriteTime.dwLowDateTime=0x5a2476f0, ftLastWriteTime.dwHighDateTime=0x1d5e765, nFileSizeHigh=0x0, nFileSizeLow=0x270f, dwReserved0=0x0, dwReserved1=0x0, cFileName="yyMfsjbfc_l4hZT41.pptx", cAlternateFileName="YYMFSJ~1.PPT")) returned 1 [0097.744] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36777fc0, ftCreationTime.dwHighDateTime=0x1d5efc3, ftLastAccessTime.dwLowDateTime=0x680fb8d0, ftLastAccessTime.dwHighDateTime=0x1d5ec4f, ftLastWriteTime.dwLowDateTime=0x680fb8d0, ftLastWriteTime.dwHighDateTime=0x1d5ec4f, nFileSizeHigh=0x0, nFileSizeLow=0xed18, dwReserved0=0x0, dwReserved1=0x0, cFileName="z7rP0.mkv", cAlternateFileName="")) returned 1 [0097.745] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b86cee0, ftCreationTime.dwHighDateTime=0x1d5e6dd, ftLastAccessTime.dwLowDateTime=0x8a021de0, ftLastAccessTime.dwHighDateTime=0x1d5e806, ftLastWriteTime.dwLowDateTime=0x8a021de0, ftLastWriteTime.dwHighDateTime=0x1d5e806, nFileSizeHigh=0x0, nFileSizeLow=0x9af1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z8kOJnO7DOG.m4a", cAlternateFileName="Z8KOJN~1.M4A")) returned 1 [0097.745] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a402310, ftCreationTime.dwHighDateTime=0x1d5e483, ftLastAccessTime.dwLowDateTime=0x375f8c90, ftLastAccessTime.dwHighDateTime=0x1d5e972, ftLastWriteTime.dwLowDateTime=0x375f8c90, ftLastWriteTime.dwHighDateTime=0x1d5e972, nFileSizeHigh=0x0, nFileSizeLow=0x7080, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zd_0jo8eYB83T.ppt", cAlternateFileName="ZD_0JO~1.PPT")) returned 1 [0097.745] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cd42af0, ftCreationTime.dwHighDateTime=0x1d5ecda, ftLastAccessTime.dwLowDateTime=0x4d220560, ftLastAccessTime.dwHighDateTime=0x1d5ed66, ftLastWriteTime.dwLowDateTime=0x4d220560, ftLastWriteTime.dwHighDateTime=0x1d5ed66, nFileSizeHigh=0x0, nFileSizeLow=0x13a08, dwReserved0=0x0, dwReserved1=0x0, cFileName="zgTRfP_2OhRR.bmp", cAlternateFileName="ZGTRFP~1.BMP")) returned 1 [0097.745] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c366b60, ftCreationTime.dwHighDateTime=0x1d5e70e, ftLastAccessTime.dwLowDateTime=0xed0b18c0, ftLastAccessTime.dwHighDateTime=0x1d5e89b, ftLastWriteTime.dwLowDateTime=0xed0b18c0, ftLastWriteTime.dwHighDateTime=0x1d5e89b, nFileSizeHigh=0x0, nFileSizeLow=0x624b, dwReserved0=0x0, dwReserved1=0x0, cFileName="_pd3xKHZBnocQk_.odt", cAlternateFileName="_PD3XK~1.ODT")) returned 1 [0097.967] FindNextFileW (in: hFindFile=0x7087f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c366b60, ftCreationTime.dwHighDateTime=0x1d5e70e, ftLastAccessTime.dwLowDateTime=0xed0b18c0, ftLastAccessTime.dwHighDateTime=0x1d5e89b, ftLastWriteTime.dwLowDateTime=0xed0b18c0, ftLastWriteTime.dwHighDateTime=0x1d5e89b, nFileSizeHigh=0x0, nFileSizeLow=0x624b, dwReserved0=0x0, dwReserved1=0x0, cFileName="_pd3xKHZBnocQk_.odt", cAlternateFileName="_PD3XK~1.ODT")) returned 0 [0097.967] FindClose (in: hFindFile=0x7087f8 | out: hFindFile=0x7087f8) returned 1 [0097.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed54) returned 1 [0097.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed60) returned 1 [0097.987] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-47zDmLsrM5Zlxp.pdf", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-47zDmLsrM5Zlxp.pdf", lpFilePart=0x0) returned 0x2b [0097.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0097.987] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-47zDmLsrM5Zlxp.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\-47zdmlsrm5zlxp.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3dc [0097.988] GetFileType (hFile=0x3dc) returned 0x1 [0097.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0097.988] GetFileType (hFile=0x3dc) returned 0x1 [0097.988] GetFileSize (in: hFile=0x3dc, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x2cf7 [0097.989] ReadFile (in: hFile=0x3dc, lpBuffer=0x26a034c, nNumberOfBytesToRead=0x2cf7, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x26a034c*, lpNumberOfBytesRead=0x19ecec*=0x2cf7, lpOverlapped=0x0) returned 1 [0097.989] CloseHandle (hObject=0x3dc) returned 1 [0097.995] lstrlenW (lpString="obsidium.dll") returned 12 [0097.996] lstrlenW (lpString="advapi32.dll") returned 12 [0097.999] CloseHandle (hObject=0x3dc) returned 1 [0097.999] lstrlenW (lpString="obsidium.dll") returned 12 [0097.999] lstrlenW (lpString="shell32.dll") returned 11 [0098.001] GetModuleHandleA (lpModuleName="msvcrt.dll") returned 0x77640000 [0098.001] GetModuleHandleA (lpModuleName="api-ms-win-core-heap-l2-1-0.dll") returned 0x74bc0000 [0098.002] GetModuleHandleA (lpModuleName="api-ms-win-core-registry-l1-1-0.dll") returned 0x74bc0000 [0098.002] GetModuleHandleA (lpModuleName="api-ms-win-core-libraryloader-l1-2-0.dll") returned 0x74bc0000 [0098.002] GetModuleHandleA (lpModuleName="api-ms-win-core-sysinfo-l1-2-1.dll") returned 0x74bc0000 [0098.003] GetModuleHandleA (lpModuleName="api-ms-win-core-memory-l1-1-2.dll") returned 0x74bc0000 [0098.003] GetModuleHandleA (lpModuleName="api-ms-win-core-file-l1-2-1.dll") returned 0x74bc0000 [0098.003] GetModuleHandleA (lpModuleName="api-ms-win-core-handle-l1-1-0.dll") returned 0x74bc0000 [0098.004] GetModuleHandleA (lpModuleName="api-ms-win-core-libraryloader-l1-2-2.dll") returned 0x74bc0000 [0098.004] GetModuleHandleA (lpModuleName="api-ms-win-core-string-l1-1-0.dll") returned 0x74bc0000 [0098.004] GetModuleHandleA (lpModuleName="api-ms-win-core-synch-l1-2-0.dll") returned 0x74bc0000 [0098.005] GetModuleHandleA (lpModuleName="api-ms-win-core-errorhandling-l1-1-1.dll") returned 0x74bc0000 [0098.005] GetModuleHandleA (lpModuleName="api-ms-win-core-processthreads-l1-1-2.dll") returned 0x772d0000 [0098.005] GetModuleHandleA (lpModuleName="api-ms-win-core-string-l2-1-0.dll") returned 0x74bc0000 [0098.006] GetModuleHandleA (lpModuleName="api-ms-win-core-file-l2-1-1.dll") returned 0x74bc0000 [0098.006] GetModuleHandleA (lpModuleName="api-ms-win-core-processenvironment-l1-2-0.dll") returned 0x74bc0000 [0098.006] GetModuleHandleA (lpModuleName="api-ms-win-core-localization-l1-2-1.dll") returned 0x74bc0000 [0098.007] GetModuleHandleA (lpModuleName="api-ms-win-security-base-l1-2-0.dll") returned 0x74bc0000 [0098.007] GetModuleHandleA (lpModuleName="api-ms-win-core-heap-l1-2-0.dll") returned 0x74bc0000 [0098.007] GetModuleHandleA (lpModuleName="api-ms-win-core-util-l1-1-0.dll") returned 0x772d0000 [0098.008] GetModuleHandleA (lpModuleName="api-ms-win-core-debug-l1-1-1.dll") returned 0x74bc0000 [0098.008] GetModuleHandleA (lpModuleName="api-ms-win-core-timezone-l1-1-0.dll") returned 0x74bc0000 [0098.008] GetModuleHandleA (lpModuleName="api-ms-win-core-psapi-l1-1-0.dll") returned 0x74bc0000 [0098.008] GetModuleHandleA (lpModuleName="api-ms-win-core-path-l1-1-0.dll") returned 0x74bc0000 [0098.009] GetModuleHandleA (lpModuleName="api-ms-win-core-io-l1-1-1.dll") returned 0x772d0000 [0098.009] GetModuleHandleA (lpModuleName="api-ms-win-core-datetime-l1-1-1.dll") returned 0x74bc0000 [0098.010] GetModuleHandleA (lpModuleName="api-ms-win-core-threadpool-l1-2-0.dll") returned 0x74bc0000 [0098.010] GetModuleHandleA (lpModuleName="api-ms-win-core-profile-l1-1-0.dll") returned 0x74bc0000 [0098.010] GetModuleHandleA (lpModuleName="api-ms-win-core-registry-l1-1-1.dll") returned 0x74bc0000 [0098.011] GetModuleHandleA (lpModuleName="api-ms-win-core-string-l2-1-1.dll") returned 0x74bc0000 [0098.011] GetModuleHandleA (lpModuleName="api-ms-win-core-synch-l1-2-1.dll") returned 0x74bc0000 [0098.011] GetModuleHandleA (lpModuleName="api-ms-win-core-file-l2-1-2.dll") returned 0x74bc0000 [0098.012] GetModuleHandleA (lpModuleName="api-ms-win-core-wow64-l1-1-0.dll") returned 0x74bc0000 [0098.012] GetModuleHandleA (lpModuleName="api-ms-win-core-localization-l1-2-2.dll") returned 0x74bc0000 [0098.012] GetModuleHandleA (lpModuleName="api-ms-win-core-realtime-l1-1-0.dll") returned 0x74bc0000 [0098.013] GetModuleHandleA (lpModuleName="api-ms-win-core-localization-l2-1-0.dll") returned 0x74bc0000 [0098.013] GetModuleHandleA (lpModuleName="api-ms-win-devices-config-l1-1-1.dll") returned 0x744b0000 [0098.171] GetModuleHandleA (lpModuleName="api-ms-win-core-wow64-l1-1-1.dll") returned 0x74bc0000 [0098.171] GetModuleHandleA (lpModuleName="api-ms-win-core-version-l1-1-0.dll") returned 0x74bc0000 [0098.171] GetModuleHandleA (lpModuleName="api-ms-win-core-sysinfo-l1-2-3.dll") returned 0x74bc0000 [0098.172] GetModuleHandleA (lpModuleName="api-ms-win-eventing-provider-l1-1-0.dll") returned 0x74bc0000 [0098.172] GetModuleHandleA (lpModuleName="api-ms-win-eventing-classicprovider-l1-1-0.dll") returned 0x74bc0000 [0098.172] GetModuleHandleA (lpModuleName="api-ms-win-core-interlocked-l1-2-0.dll") returned 0x74bc0000 [0098.172] GetModuleHandleA (lpModuleName="api-ms-win-core-shlwapi-obsolete-l1-2-0.dll") returned 0x74bc0000 [0098.173] GetModuleHandleA (lpModuleName="api-ms-win-core-string-obsolete-l1-1-0.dll") returned 0x772d0000 [0098.173] GetModuleHandleA (lpModuleName="api-ms-win-core-stringansi-l1-1-0.dll") returned 0x74bc0000 [0098.173] GetModuleHandleA (lpModuleName="api-ms-win-core-privateprofile-l1-1-1.dll") returned 0x772d0000 [0098.174] GetModuleHandleA (lpModuleName="api-ms-win-core-heap-obsolete-l1-1-0.dll") returned 0x772d0000 [0098.174] GetModuleHandleA (lpModuleName="api-ms-win-core-localization-obsolete-l1-3-0.dll") returned 0x74bc0000 [0098.174] GetModuleHandleA (lpModuleName="api-ms-win-core-atoms-l1-1-0.dll") returned 0x772d0000 [0098.175] GetModuleHandleA (lpModuleName="api-ms-win-core-shlwapi-legacy-l1-1-0.dll") returned 0x74bc0000 [0098.175] GetModuleHandleA (lpModuleName="api-ms-win-core-kernel32-legacy-l1-1-1.dll") returned 0x772d0000 [0098.175] GetModuleHandleA (lpModuleName="api-ms-win-core-threadpool-legacy-l1-1-0.dll") returned 0x74bc0000 [0098.176] GetModuleHandleA (lpModuleName="api-ms-win-core-kernel32-legacy-l1-1-5.dll") returned 0x772d0000 [0098.176] GetModuleHandleA (lpModuleName="api-ms-win-core-url-l1-1-0.dll") returned 0x74bc0000 [0098.176] GetModuleHandleA (lpModuleName="api-ms-win-core-registryuserspecific-l1-1-0.dll") returned 0x74bc0000 [0098.177] GetModuleHandleA (lpModuleName="api-ms-win-core-kernel32-private-l1-1-1.dll") returned 0x772d0000 [0098.177] GetModuleHandleA (lpModuleName="api-ms-win-core-kernel32-private-l1-1-2.dll") returned 0x772d0000 [0098.177] GetModuleHandleA (lpModuleName="api-ms-win-core-sidebyside-l1-1-0.dll") returned 0x74bc0000 [0098.178] GetModuleHandleA (lpModuleName="api-ms-win-core-windowserrorreporting-l1-1-0.dll") returned 0x74bc0000 [0098.178] GetModuleHandleA (lpModuleName="api-ms-win-shcore-path-l1-1-0.dll") returned 0x77750000 [0098.180] GetModuleHandleA (lpModuleName="api-ms-win-storage-exports-internal-l1-1-0.dll") returned 0x76d40000 [0098.182] GetModuleHandleA (lpModuleName="api-ms-win-storage-exports-external-l1-1-0.dll") returned 0x76d40000 [0098.182] GetModuleHandleA (lpModuleName="api-ms-win-shell-shellcom-l1-1-0.dll") returned 0x74bc0000 [0098.183] GetModuleHandleA (lpModuleName="api-ms-win-shell-shellfolders-l1-1-0.dll") returned 0x76d40000 [0098.183] GetModuleHandleA (lpModuleName="KERNELBASE.dll") returned 0x74bc0000 [0098.184] GetModuleHandleA (lpModuleName="USER32.dll") returned 0x750c0000 [0098.184] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77970000 [0098.185] GetModuleHandleA (lpModuleName="GDI32.dll") returned 0x74910000 [0098.185] GetModuleHandleA (lpModuleName="api-ms-win-core-delayload-l1-1-1.dll") returned 0x74bc0000 [0098.185] GetModuleHandleA (lpModuleName="api-ms-win-core-apiquery-l1-1-0.dll") returned 0x77970000 [0098.186] GetModuleHandleA (lpModuleName="api-ms-win-core-job-l2-1-0.dll") returned 0x772d0000 [0098.186] GetModuleHandleA (lpModuleName="api-ms-win-security-capability-l1-1-0.dll") returned 0x77700000 [0098.375] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x19e694, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0098.376] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x19e6f8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0098.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebac) returned 1 [0098.377] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19ec28 | out: lpFileInformation=0x19ec28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0098.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eba8) returned 1 [0098.379] lstrlenW (lpString="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config") returned 67 [0098.379] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3e0 [0098.397] ReadFile (in: hFile=0x3e0, lpBuffer=0x77ad00, nNumberOfBytesToRead=0xfff, lpNumberOfBytesRead=0x19e810, lpOverlapped=0x0 | out: lpBuffer=0x77ad00*, lpNumberOfBytesRead=0x19e810*=0xfff, lpOverlapped=0x0) returned 1 [0098.410] ReadFile (in: hFile=0x3e0, lpBuffer=0x778cf8, nNumberOfBytesToRead=0x17f7, lpNumberOfBytesRead=0x19e7f8, lpOverlapped=0x0 | out: lpBuffer=0x778cf8*, lpNumberOfBytesRead=0x19e7f8*=0x17f7, lpOverlapped=0x0) returned 1 [0098.498] ReadFile (in: hFile=0x3e0, lpBuffer=0x778cf8, nNumberOfBytesToRead=0x1001, lpNumberOfBytesRead=0x19e808, lpOverlapped=0x0 | out: lpBuffer=0x778cf8*, lpNumberOfBytesRead=0x19e808*=0x1001, lpOverlapped=0x0) returned 1 [0098.500] ReadFile (in: hFile=0x3e0, lpBuffer=0x778cf8, nNumberOfBytesToRead=0x1002, lpNumberOfBytesRead=0x19e808, lpOverlapped=0x0 | out: lpBuffer=0x778cf8*, lpNumberOfBytesRead=0x19e808*=0x1002, lpOverlapped=0x0) returned 1 [0098.502] ReadFile (in: hFile=0x3e0, lpBuffer=0x77fd10, nNumberOfBytesToRead=0x1f28, lpNumberOfBytesRead=0x19e7fc, lpOverlapped=0x0 | out: lpBuffer=0x77fd10*, lpNumberOfBytesRead=0x19e7fc*=0x1f28, lpOverlapped=0x0) returned 1 [0098.506] ReadFile (in: hFile=0x3e0, lpBuffer=0x77fd10, nNumberOfBytesToRead=0x10a7, lpNumberOfBytesRead=0x19e808, lpOverlapped=0x0 | out: lpBuffer=0x77fd10*, lpNumberOfBytesRead=0x19e808*=0x10a7, lpOverlapped=0x0) returned 1 [0098.509] ReadFile (in: hFile=0x3e0, lpBuffer=0x77fd10, nNumberOfBytesToRead=0x1019, lpNumberOfBytesRead=0x19e808, lpOverlapped=0x0 | out: lpBuffer=0x77fd10*, lpNumberOfBytesRead=0x19e808*=0x1019, lpOverlapped=0x0) returned 1 [0098.512] ReadFile (in: hFile=0x3e0, lpBuffer=0x77fd10, nNumberOfBytesToRead=0x109d, lpNumberOfBytesRead=0x19e7fc, lpOverlapped=0x0 | out: lpBuffer=0x77fd10*, lpNumberOfBytesRead=0x19e7fc*=0x4ae, lpOverlapped=0x0) returned 1 [0098.513] ReadFile (in: hFile=0x3e0, lpBuffer=0x781c40, nNumberOfBytesToRead=0x1feb, lpNumberOfBytesRead=0x19e7fc, lpOverlapped=0x0 | out: lpBuffer=0x781c40*, lpNumberOfBytesRead=0x19e7fc*=0x0, lpOverlapped=0x0) returned 1 [0098.513] CloseHandle (hObject=0x3e0) returned 1 [0098.948] lstrlenW (lpString="obsidium.dll") returned 12 [0098.948] lstrlenW (lpString="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\bcrypt.dll") returned 91 [0098.953] lstrlenW (lpString="obsidium.dll") returned 12 [0098.953] lstrlenW (lpString="bcrypt.dll") returned 10 [0099.588] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77970000 [0099.588] GetModuleHandleA (lpModuleName="api-ms-win-core-libraryloader-l1-2-0.dll") returned 0x74bc0000 [0099.588] GetModuleHandleA (lpModuleName="api-ms-win-core-errorhandling-l1-1-1.dll") returned 0x74bc0000 [0099.589] GetModuleHandleA (lpModuleName="api-ms-win-core-processthreads-l1-1-2.dll") returned 0x772d0000 [0099.589] GetModuleHandleA (lpModuleName="api-ms-win-core-handle-l1-1-0.dll") returned 0x74bc0000 [0099.589] GetModuleHandleA (lpModuleName="api-ms-win-security-base-l1-2-0.dll") returned 0x74bc0000 [0099.590] GetModuleHandleA (lpModuleName="api-ms-win-core-synch-l1-2-0.dll") returned 0x74bc0000 [0099.590] GetModuleHandleA (lpModuleName="api-ms-win-eventing-provider-l1-1-0.dll") returned 0x74bc0000 [0099.590] GetModuleHandleA (lpModuleName="api-ms-win-core-psapi-l1-1-0.dll") returned 0x74bc0000 [0099.591] GetModuleHandleA (lpModuleName="api-ms-win-core-sysinfo-l1-2-1.dll") returned 0x74bc0000 [0099.591] GetModuleHandleA (lpModuleName="api-ms-win-core-threadpool-private-l1-1-0.dll") returned 0x74bc0000 [0099.591] GetModuleHandleA (lpModuleName="api-ms-win-core-threadpool-legacy-l1-1-0.dll") returned 0x74bc0000 [0099.592] GetModuleHandleA (lpModuleName="api-ms-win-core-memory-l1-1-2.dll") returned 0x74bc0000 [0099.592] GetModuleHandleA (lpModuleName="api-ms-win-core-delayload-l1-1-1.dll") returned 0x74bc0000 [0099.593] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x19eb04 | out: pfEnabled=0x19eb04) returned 0x0 [0101.507] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0101.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0101.507] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0101.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0101.507] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-47zDmLsrM5Zlxp.pdf", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-47zDmLsrM5Zlxp.pdf", lpFilePart=0x0) returned 0x2b [0101.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0101.507] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-47zDmLsrM5Zlxp.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\-47zdmlsrm5zlxp.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x410 [0101.509] GetFileType (hFile=0x410) returned 0x1 [0101.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0101.509] GetFileType (hFile=0x410) returned 0x1 [0101.509] WriteFile (in: hFile=0x410, lpBuffer=0x2725630*, nNumberOfBytesToWrite=0x2d00, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x2725630*, lpNumberOfBytesWritten=0x19ece0*=0x2d00, lpOverlapped=0x0) returned 1 [0101.510] CloseHandle (hObject=0x410) returned 1 [0101.512] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-47zDmLsrM5Zlxp.pdf", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-47zDmLsrM5Zlxp.pdf", lpFilePart=0x0) returned 0x2b [0101.512] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-47zDmLsrM5Zlxp.pdf.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-47zDmLsrM5Zlxp.pdf.spybuster", lpFilePart=0x0) returned 0x35 [0101.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0101.512] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-47zDmLsrM5Zlxp.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\-47zdmlsrm5zlxp.pdf"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7eb0890, ftCreationTime.dwHighDateTime=0x1d5ebfb, ftLastAccessTime.dwLowDateTime=0x79d80da0, ftLastAccessTime.dwHighDateTime=0x1d5e750, ftLastWriteTime.dwLowDateTime=0xb1c3c873, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x2d00)) returned 1 [0101.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0101.512] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\-47zDmLsrM5Zlxp.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\-47zdmlsrm5zlxp.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\-47zDmLsrM5Zlxp.pdf.spybuster" (normalized: "c:\\users\\fd1hvy\\desktop\\-47zdmlsrm5zlxp.pdf.spybuster")) returned 1 [0101.513] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\4Q6AfqT.avi", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\4Q6AfqT.avi", lpFilePart=0x0) returned 0x23 [0101.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0101.513] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\4Q6AfqT.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\4q6afqt.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x410 [0101.513] GetFileType (hFile=0x410) returned 0x1 [0101.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0101.514] GetFileType (hFile=0x410) returned 0x1 [0101.514] GetFileSize (in: hFile=0x410, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0xec80 [0101.515] ReadFile (in: hFile=0x410, lpBuffer=0x27287c4, nNumberOfBytesToRead=0xec80, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x27287c4*, lpNumberOfBytesRead=0x19ecec*=0xec80, lpOverlapped=0x0) returned 1 [0101.516] CloseHandle (hObject=0x410) returned 1 [0101.653] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0101.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0101.653] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0101.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0101.653] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\4Q6AfqT.avi", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\4Q6AfqT.avi", lpFilePart=0x0) returned 0x23 [0101.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0101.654] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\4Q6AfqT.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\4q6afqt.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x410 [0101.784] GetFileType (hFile=0x410) returned 0x1 [0101.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0101.784] GetFileType (hFile=0x410) returned 0x1 [0101.784] WriteFile (in: hFile=0x410, lpBuffer=0x27a1b70*, nNumberOfBytesToWrite=0xec90, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x27a1b70*, lpNumberOfBytesWritten=0x19ece0*=0xec90, lpOverlapped=0x0) returned 1 [0101.786] CloseHandle (hObject=0x410) returned 1 [0101.947] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\4Q6AfqT.avi", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\4Q6AfqT.avi", lpFilePart=0x0) returned 0x23 [0101.947] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\4Q6AfqT.avi.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\4Q6AfqT.avi.spybuster", lpFilePart=0x0) returned 0x2d [0101.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0101.948] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\4Q6AfqT.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\4q6afqt.avi"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29974740, ftCreationTime.dwHighDateTime=0x1d5efa5, ftLastAccessTime.dwLowDateTime=0xbb41ade0, ftLastAccessTime.dwHighDateTime=0x1d5eb5c, ftLastWriteTime.dwLowDateTime=0xb1eeb368, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xec90)) returned 1 [0101.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0101.948] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\4Q6AfqT.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\4q6afqt.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\4Q6AfqT.avi.spybuster" (normalized: "c:\\users\\fd1hvy\\desktop\\4q6afqt.avi.spybuster")) returned 1 [0102.037] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\dTNP.mp4", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\dTNP.mp4", lpFilePart=0x0) returned 0x20 [0102.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0102.038] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\dTNP.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\dtnp.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x410 [0102.038] GetFileType (hFile=0x410) returned 0x1 [0102.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0102.038] GetFileType (hFile=0x410) returned 0x1 [0102.038] GetFileSize (in: hFile=0x410, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0xc65 [0102.038] ReadFile (in: hFile=0x410, lpBuffer=0x27b18b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x27b18b0*, lpNumberOfBytesRead=0x19ecec*=0xc65, lpOverlapped=0x0) returned 1 [0102.039] CloseHandle (hObject=0x410) returned 1 [0102.228] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0102.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0102.228] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0102.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0102.228] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\dTNP.mp4", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\dTNP.mp4", lpFilePart=0x0) returned 0x20 [0102.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0102.228] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\dTNP.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\dtnp.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x410 [0102.319] GetFileType (hFile=0x410) returned 0x1 [0102.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0102.319] GetFileType (hFile=0x410) returned 0x1 [0102.320] WriteFile (in: hFile=0x410, lpBuffer=0x28036d0*, nNumberOfBytesToWrite=0xc70, lpNumberOfBytesWritten=0x19ecb4, lpOverlapped=0x0 | out: lpBuffer=0x28036d0*, lpNumberOfBytesWritten=0x19ecb4*=0xc70, lpOverlapped=0x0) returned 1 [0102.321] CloseHandle (hObject=0x410) returned 1 [0102.435] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\dTNP.mp4", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\dTNP.mp4", lpFilePart=0x0) returned 0x20 [0102.435] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\dTNP.mp4.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\dTNP.mp4.spybuster", lpFilePart=0x0) returned 0x2a [0102.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0102.435] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\dTNP.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\dtnp.mp4"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbda4b120, ftCreationTime.dwHighDateTime=0x1d5e5eb, ftLastAccessTime.dwLowDateTime=0x2173e770, ftLastAccessTime.dwHighDateTime=0x1d5e81c, ftLastWriteTime.dwLowDateTime=0xb2401b37, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xc70)) returned 1 [0102.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0102.435] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\dTNP.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\dtnp.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\dTNP.mp4.spybuster" (normalized: "c:\\users\\fd1hvy\\desktop\\dtnp.mp4.spybuster")) returned 1 [0102.523] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\DUCGlGpLhZ7ehP0yEx.mp3", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\DUCGlGpLhZ7ehP0yEx.mp3", lpFilePart=0x0) returned 0x2e [0102.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0102.523] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DUCGlGpLhZ7ehP0yEx.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\ducglgplhz7ehp0yex.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x410 [0102.523] GetFileType (hFile=0x410) returned 0x1 [0102.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0102.524] GetFileType (hFile=0x410) returned 0x1 [0102.524] GetFileSize (in: hFile=0x410, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x3c6c [0102.524] ReadFile (in: hFile=0x410, lpBuffer=0x2804910, nNumberOfBytesToRead=0x3c6c, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x2804910*, lpNumberOfBytesRead=0x19ecec*=0x3c6c, lpOverlapped=0x0) returned 1 [0102.525] CloseHandle (hObject=0x410) returned 1 [0103.048] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0103.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0103.049] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0103.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0103.049] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\DUCGlGpLhZ7ehP0yEx.mp3", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\DUCGlGpLhZ7ehP0yEx.mp3", lpFilePart=0x0) returned 0x2e [0103.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0103.049] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DUCGlGpLhZ7ehP0yEx.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\ducglgplhz7ehp0yex.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0103.229] GetFileType (hFile=0x37c) returned 0x1 [0103.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0103.229] GetFileType (hFile=0x37c) returned 0x1 [0103.229] WriteFile (in: hFile=0x37c, lpBuffer=0x26950e4*, nNumberOfBytesToWrite=0x3c70, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x26950e4*, lpNumberOfBytesWritten=0x19ece0*=0x3c70, lpOverlapped=0x0) returned 1 [0103.230] CloseHandle (hObject=0x37c) returned 1 [0103.232] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\DUCGlGpLhZ7ehP0yEx.mp3", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\DUCGlGpLhZ7ehP0yEx.mp3", lpFilePart=0x0) returned 0x2e [0103.232] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\DUCGlGpLhZ7ehP0yEx.mp3.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\DUCGlGpLhZ7ehP0yEx.mp3.spybuster", lpFilePart=0x0) returned 0x38 [0103.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0103.232] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\DUCGlGpLhZ7ehP0yEx.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\ducglgplhz7ehp0yex.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2e15fa0, ftCreationTime.dwHighDateTime=0x1d5e101, ftLastAccessTime.dwLowDateTime=0x28f23750, ftLastAccessTime.dwHighDateTime=0x1d5e6d6, ftLastWriteTime.dwLowDateTime=0xb2ca6362, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x3c70)) returned 1 [0103.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0103.232] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\DUCGlGpLhZ7ehP0yEx.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\ducglgplhz7ehp0yex.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\DUCGlGpLhZ7ehP0yEx.mp3.spybuster" (normalized: "c:\\users\\fd1hvy\\desktop\\ducglgplhz7ehp0yex.mp3.spybuster")) returned 1 [0103.233] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\gqKfeceE.mkv", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\gqKfeceE.mkv", lpFilePart=0x0) returned 0x24 [0103.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0103.233] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\gqKfeceE.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\gqkfecee.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0103.233] GetFileType (hFile=0x37c) returned 0x1 [0103.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0103.233] GetFileType (hFile=0x37c) returned 0x1 [0103.233] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x2f07 [0103.233] ReadFile (in: hFile=0x37c, lpBuffer=0x2699200, nNumberOfBytesToRead=0x2f07, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x2699200*, lpNumberOfBytesRead=0x19ecec*=0x2f07, lpOverlapped=0x0) returned 1 [0103.233] CloseHandle (hObject=0x37c) returned 1 [0103.250] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0103.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0103.250] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0103.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0103.251] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\gqKfeceE.mkv", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\gqKfeceE.mkv", lpFilePart=0x0) returned 0x24 [0103.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0103.251] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\gqKfeceE.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\gqkfecee.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0103.252] GetFileType (hFile=0x37c) returned 0x1 [0103.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0103.252] GetFileType (hFile=0x37c) returned 0x1 [0103.252] WriteFile (in: hFile=0x37c, lpBuffer=0x26f4c98*, nNumberOfBytesToWrite=0x2f10, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x26f4c98*, lpNumberOfBytesWritten=0x19ece0*=0x2f10, lpOverlapped=0x0) returned 1 [0103.253] CloseHandle (hObject=0x37c) returned 1 [0103.255] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\gqKfeceE.mkv", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\gqKfeceE.mkv", lpFilePart=0x0) returned 0x24 [0103.255] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\gqKfeceE.mkv.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\gqKfeceE.mkv.spybuster", lpFilePart=0x0) returned 0x2e [0103.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0103.255] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\gqKfeceE.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\gqkfecee.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbe49440, ftCreationTime.dwHighDateTime=0x1d5e1fe, ftLastAccessTime.dwLowDateTime=0x5019f40, ftLastAccessTime.dwHighDateTime=0x1d5e814, ftLastWriteTime.dwLowDateTime=0xb2ccc8b4, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x2f10)) returned 1 [0103.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0103.255] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\gqKfeceE.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\gqkfecee.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\gqKfeceE.mkv.spybuster" (normalized: "c:\\users\\fd1hvy\\desktop\\gqkfecee.mkv.spybuster")) returned 1 [0103.476] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\IuuHCN.mp3", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\IuuHCN.mp3", lpFilePart=0x0) returned 0x22 [0103.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0103.477] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\IuuHCN.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\iuuhcn.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0103.477] GetFileType (hFile=0x37c) returned 0x1 [0103.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0103.477] GetFileType (hFile=0x37c) returned 0x1 [0103.477] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0xf0cc [0103.477] ReadFile (in: hFile=0x37c, lpBuffer=0x26f7fe8, nNumberOfBytesToRead=0xf0cc, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x26f7fe8*, lpNumberOfBytesRead=0x19ecec*=0xf0cc, lpOverlapped=0x0) returned 1 [0103.477] CloseHandle (hObject=0x37c) returned 1 [0103.497] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0103.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0103.497] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0103.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0103.497] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\IuuHCN.mp3", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\IuuHCN.mp3", lpFilePart=0x0) returned 0x22 [0103.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0103.498] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\IuuHCN.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\iuuhcn.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0103.499] GetFileType (hFile=0x37c) returned 0x1 [0103.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0103.499] GetFileType (hFile=0x37c) returned 0x1 [0103.499] WriteFile (in: hFile=0x37c, lpBuffer=0x2772054*, nNumberOfBytesToWrite=0xf0d0, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x2772054*, lpNumberOfBytesWritten=0x19ece0*=0xf0d0, lpOverlapped=0x0) returned 1 [0103.501] CloseHandle (hObject=0x37c) returned 1 [0103.503] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\IuuHCN.mp3", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\IuuHCN.mp3", lpFilePart=0x0) returned 0x22 [0103.503] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\IuuHCN.mp3.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\IuuHCN.mp3.spybuster", lpFilePart=0x0) returned 0x2c [0103.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0103.503] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\IuuHCN.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\iuuhcn.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x489b0110, ftCreationTime.dwHighDateTime=0x1d5e52b, ftLastAccessTime.dwLowDateTime=0xb49d0d70, ftLastAccessTime.dwHighDateTime=0x1d5eca8, ftLastWriteTime.dwLowDateTime=0xb2f2ea58, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xf0d0)) returned 1 [0103.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0103.503] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\IuuHCN.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\iuuhcn.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\IuuHCN.mp3.spybuster" (normalized: "c:\\users\\fd1hvy\\desktop\\iuuhcn.mp3.spybuster")) returned 1 [0103.504] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\izq8n6_qgBXoY.png", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\izq8n6_qgBXoY.png", lpFilePart=0x0) returned 0x29 [0103.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0103.504] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\izq8n6_qgBXoY.png" (normalized: "c:\\users\\fd1hvy\\desktop\\izq8n6_qgbxoy.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0103.504] GetFileType (hFile=0x37c) returned 0x1 [0103.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0103.504] GetFileType (hFile=0x37c) returned 0x1 [0103.504] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x1355e [0103.504] ReadFile (in: hFile=0x37c, lpBuffer=0x2781550, nNumberOfBytesToRead=0x1355e, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x2781550*, lpNumberOfBytesRead=0x19ecec*=0x1355e, lpOverlapped=0x0) returned 1 [0103.505] CloseHandle (hObject=0x37c) returned 1 [0103.576] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0103.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0103.576] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0103.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0103.577] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\izq8n6_qgBXoY.png", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\izq8n6_qgBXoY.png", lpFilePart=0x0) returned 0x29 [0103.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0103.577] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\izq8n6_qgBXoY.png" (normalized: "c:\\users\\fd1hvy\\desktop\\izq8n6_qgbxoy.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0103.578] GetFileType (hFile=0x37c) returned 0x1 [0103.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0103.578] GetFileType (hFile=0x37c) returned 0x1 [0103.578] WriteFile (in: hFile=0x37c, lpBuffer=0x2808370*, nNumberOfBytesToWrite=0x13560, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x2808370*, lpNumberOfBytesWritten=0x19ece0*=0x13560, lpOverlapped=0x0) returned 1 [0103.580] CloseHandle (hObject=0x37c) returned 1 [0103.583] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\izq8n6_qgBXoY.png", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\izq8n6_qgBXoY.png", lpFilePart=0x0) returned 0x29 [0103.583] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\izq8n6_qgBXoY.png.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\izq8n6_qgBXoY.png.spybuster", lpFilePart=0x0) returned 0x33 [0103.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0103.583] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\izq8n6_qgBXoY.png" (normalized: "c:\\users\\fd1hvy\\desktop\\izq8n6_qgbxoy.png"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eb39880, ftCreationTime.dwHighDateTime=0x1d5e84f, ftLastAccessTime.dwLowDateTime=0x206e43a0, ftLastAccessTime.dwHighDateTime=0x1d5e571, ftLastWriteTime.dwLowDateTime=0xb2fed726, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x13560)) returned 1 [0103.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0103.583] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\izq8n6_qgBXoY.png" (normalized: "c:\\users\\fd1hvy\\desktop\\izq8n6_qgbxoy.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\izq8n6_qgBXoY.png.spybuster" (normalized: "c:\\users\\fd1hvy\\desktop\\izq8n6_qgbxoy.png.spybuster")) returned 1 [0103.584] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\jGYH8Y8r9kj.jpg", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\jGYH8Y8r9kj.jpg", lpFilePart=0x0) returned 0x27 [0103.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0103.584] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\jGYH8Y8r9kj.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\jgyh8y8r9kj.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0103.585] GetFileType (hFile=0x37c) returned 0x1 [0103.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0103.585] GetFileType (hFile=0x37c) returned 0x1 [0103.585] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0xfc72 [0103.585] ReadFile (in: hFile=0x37c, lpBuffer=0x281bd30, nNumberOfBytesToRead=0xfc72, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x281bd30*, lpNumberOfBytesRead=0x19ecec*=0xfc72, lpOverlapped=0x0) returned 1 [0103.585] CloseHandle (hObject=0x37c) returned 1 [0103.675] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0103.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0103.675] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0103.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0103.676] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\jGYH8Y8r9kj.jpg", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\jGYH8Y8r9kj.jpg", lpFilePart=0x0) returned 0x27 [0103.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0103.676] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\jGYH8Y8r9kj.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\jgyh8y8r9kj.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0103.680] GetFileType (hFile=0x37c) returned 0x1 [0103.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0103.680] GetFileType (hFile=0x37c) returned 0x1 [0103.680] WriteFile (in: hFile=0x37c, lpBuffer=0x28980b0*, nNumberOfBytesToWrite=0xfc80, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x28980b0*, lpNumberOfBytesWritten=0x19ece0*=0xfc80, lpOverlapped=0x0) returned 1 [0103.683] CloseHandle (hObject=0x37c) returned 1 [0103.690] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\jGYH8Y8r9kj.jpg", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\jGYH8Y8r9kj.jpg", lpFilePart=0x0) returned 0x27 [0103.690] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\jGYH8Y8r9kj.jpg.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\jGYH8Y8r9kj.jpg.spybuster", lpFilePart=0x0) returned 0x31 [0103.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0103.690] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\jGYH8Y8r9kj.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\jgyh8y8r9kj.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x952c3a40, ftCreationTime.dwHighDateTime=0x1d5ee6c, ftLastAccessTime.dwLowDateTime=0x1f8e42e0, ftLastAccessTime.dwHighDateTime=0x1d5ea5e, ftLastWriteTime.dwLowDateTime=0xb30f87c2, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xfc80)) returned 1 [0103.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0103.690] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\jGYH8Y8r9kj.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\jgyh8y8r9kj.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\jGYH8Y8r9kj.jpg.spybuster" (normalized: "c:\\users\\fd1hvy\\desktop\\jgyh8y8r9kj.jpg.spybuster")) returned 1 [0103.691] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\jUesZvd-s.jpg", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\jUesZvd-s.jpg", lpFilePart=0x0) returned 0x25 [0103.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0103.691] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\jUesZvd-s.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\jueszvd-s.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0103.691] GetFileType (hFile=0x37c) returned 0x1 [0103.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0103.691] GetFileType (hFile=0x37c) returned 0x1 [0103.691] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x6d70 [0103.692] ReadFile (in: hFile=0x37c, lpBuffer=0x28a8174, nNumberOfBytesToRead=0x6d70, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x28a8174*, lpNumberOfBytesRead=0x19ecec*=0x6d70, lpOverlapped=0x0) returned 1 [0103.692] CloseHandle (hObject=0x37c) returned 1 [0103.796] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0103.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0103.796] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0103.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0103.796] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\jUesZvd-s.jpg", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\jUesZvd-s.jpg", lpFilePart=0x0) returned 0x25 [0103.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0103.797] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\jUesZvd-s.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\jueszvd-s.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0103.798] GetFileType (hFile=0x37c) returned 0x1 [0103.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0103.798] GetFileType (hFile=0x37c) returned 0x1 [0103.798] WriteFile (in: hFile=0x37c, lpBuffer=0x29172dc*, nNumberOfBytesToWrite=0x6d80, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x29172dc*, lpNumberOfBytesWritten=0x19ece0*=0x6d80, lpOverlapped=0x0) returned 1 [0103.799] CloseHandle (hObject=0x37c) returned 1 [0103.801] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\jUesZvd-s.jpg", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\jUesZvd-s.jpg", lpFilePart=0x0) returned 0x25 [0103.801] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\jUesZvd-s.jpg.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\jUesZvd-s.jpg.spybuster", lpFilePart=0x0) returned 0x2f [0103.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0103.801] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\jUesZvd-s.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\jueszvd-s.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0957f40, ftCreationTime.dwHighDateTime=0x1d5eeb4, ftLastAccessTime.dwLowDateTime=0x1ce0f9d0, ftLastAccessTime.dwHighDateTime=0x1d5ef17, ftLastWriteTime.dwLowDateTime=0xb320368c, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x6d80)) returned 1 [0103.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0103.801] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\jUesZvd-s.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\jueszvd-s.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\jUesZvd-s.jpg.spybuster" (normalized: "c:\\users\\fd1hvy\\desktop\\jueszvd-s.jpg.spybuster")) returned 1 [0103.802] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mmcdT0ssmgFqSRwRvCY.mkv", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\mmcdT0ssmgFqSRwRvCY.mkv", lpFilePart=0x0) returned 0x2f [0103.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0103.802] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\mmcdT0ssmgFqSRwRvCY.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\mmcdt0ssmgfqsrwrvcy.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0103.802] GetFileType (hFile=0x37c) returned 0x1 [0103.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0103.802] GetFileType (hFile=0x37c) returned 0x1 [0103.802] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x17f50 [0103.803] ReadFile (in: hFile=0x37c, lpBuffer=0x371ad58, nNumberOfBytesToRead=0x17f50, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x371ad58*, lpNumberOfBytesRead=0x19ecec*=0x17f50, lpOverlapped=0x0) returned 1 [0103.805] CloseHandle (hObject=0x37c) returned 1 [0104.045] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0104.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0104.045] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0104.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0104.045] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mmcdT0ssmgFqSRwRvCY.mkv", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\mmcdT0ssmgFqSRwRvCY.mkv", lpFilePart=0x0) returned 0x2f [0104.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0104.045] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\mmcdT0ssmgFqSRwRvCY.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\mmcdt0ssmgfqsrwrvcy.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0104.047] GetFileType (hFile=0x37c) returned 0x1 [0104.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0104.047] GetFileType (hFile=0x37c) returned 0x1 [0104.047] WriteFile (in: hFile=0x37c, lpBuffer=0x3792a68*, nNumberOfBytesToWrite=0x17f60, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x3792a68*, lpNumberOfBytesWritten=0x19ece0*=0x17f60, lpOverlapped=0x0) returned 1 [0104.049] CloseHandle (hObject=0x37c) returned 1 [0104.052] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mmcdT0ssmgFqSRwRvCY.mkv", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\mmcdT0ssmgFqSRwRvCY.mkv", lpFilePart=0x0) returned 0x2f [0104.052] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mmcdT0ssmgFqSRwRvCY.mkv.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\mmcdT0ssmgFqSRwRvCY.mkv.spybuster", lpFilePart=0x0) returned 0x39 [0104.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0104.052] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mmcdT0ssmgFqSRwRvCY.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\mmcdt0ssmgfqsrwrvcy.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb136100, ftCreationTime.dwHighDateTime=0x1d5ee60, ftLastAccessTime.dwLowDateTime=0xc1dd2290, ftLastAccessTime.dwHighDateTime=0x1d5ef1e, ftLastWriteTime.dwLowDateTime=0xb3465dec, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x17f60)) returned 1 [0104.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0104.112] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\mmcdT0ssmgFqSRwRvCY.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\mmcdt0ssmgfqsrwrvcy.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\mmcdT0ssmgFqSRwRvCY.mkv.spybuster" (normalized: "c:\\users\\fd1hvy\\desktop\\mmcdt0ssmgfqsrwrvcy.mkv.spybuster")) returned 1 [0104.112] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\oXn8yyFK6hp.png", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\oXn8yyFK6hp.png", lpFilePart=0x0) returned 0x27 [0104.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0104.112] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\oXn8yyFK6hp.png" (normalized: "c:\\users\\fd1hvy\\desktop\\oxn8yyfk6hp.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0104.113] GetFileType (hFile=0x37c) returned 0x1 [0104.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0104.113] GetFileType (hFile=0x37c) returned 0x1 [0104.113] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x17d99 [0104.113] ReadFile (in: hFile=0x37c, lpBuffer=0x37aa9e8, nNumberOfBytesToRead=0x17d99, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x37aa9e8*, lpNumberOfBytesRead=0x19ecec*=0x17d99, lpOverlapped=0x0) returned 1 [0104.115] CloseHandle (hObject=0x37c) returned 1 [0104.258] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0104.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0104.258] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0104.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0104.258] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\oXn8yyFK6hp.png", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\oXn8yyFK6hp.png", lpFilePart=0x0) returned 0x27 [0104.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0104.258] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\oXn8yyFK6hp.png" (normalized: "c:\\users\\fd1hvy\\desktop\\oxn8yyfk6hp.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0104.260] GetFileType (hFile=0x37c) returned 0x1 [0104.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0104.260] GetFileType (hFile=0x37c) returned 0x1 [0104.260] WriteFile (in: hFile=0x37c, lpBuffer=0x3821e40*, nNumberOfBytesToWrite=0x17da0, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x3821e40*, lpNumberOfBytesWritten=0x19ece0*=0x17da0, lpOverlapped=0x0) returned 1 [0104.262] CloseHandle (hObject=0x37c) returned 1 [0104.266] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\oXn8yyFK6hp.png", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\oXn8yyFK6hp.png", lpFilePart=0x0) returned 0x27 [0104.266] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\oXn8yyFK6hp.png.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\oXn8yyFK6hp.png.spybuster", lpFilePart=0x0) returned 0x31 [0104.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0104.266] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\oXn8yyFK6hp.png" (normalized: "c:\\users\\fd1hvy\\desktop\\oxn8yyfk6hp.png"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9129b00, ftCreationTime.dwHighDateTime=0x1d5e4dc, ftLastAccessTime.dwLowDateTime=0xc34165f0, ftLastAccessTime.dwHighDateTime=0x1d5e538, ftLastWriteTime.dwLowDateTime=0xb367be17, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x17da0)) returned 1 [0104.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0104.266] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\oXn8yyFK6hp.png" (normalized: "c:\\users\\fd1hvy\\desktop\\oxn8yyfk6hp.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\oXn8yyFK6hp.png.spybuster" (normalized: "c:\\users\\fd1hvy\\desktop\\oxn8yyfk6hp.png.spybuster")) returned 1 [0104.267] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\QAhgTD.xlsx", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\QAhgTD.xlsx", lpFilePart=0x0) returned 0x23 [0104.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0104.267] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\QAhgTD.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\qahgtd.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0104.267] GetFileType (hFile=0x37c) returned 0x1 [0104.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0104.267] GetFileType (hFile=0x37c) returned 0x1 [0104.267] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x819f [0104.268] ReadFile (in: hFile=0x37c, lpBuffer=0x29b89ac, nNumberOfBytesToRead=0x819f, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x29b89ac*, lpNumberOfBytesRead=0x19ecec*=0x819f, lpOverlapped=0x0) returned 1 [0104.269] CloseHandle (hObject=0x37c) returned 1 [0104.387] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0104.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0104.388] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0104.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0104.388] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\QAhgTD.xlsx", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\QAhgTD.xlsx", lpFilePart=0x0) returned 0x23 [0104.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0104.388] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\QAhgTD.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\qahgtd.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0104.389] GetFileType (hFile=0x37c) returned 0x1 [0104.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0104.389] GetFileType (hFile=0x37c) returned 0x1 [0104.389] WriteFile (in: hFile=0x37c, lpBuffer=0x2682420*, nNumberOfBytesToWrite=0x81a0, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x2682420*, lpNumberOfBytesWritten=0x19ece0*=0x81a0, lpOverlapped=0x0) returned 1 [0104.391] CloseHandle (hObject=0x37c) returned 1 [0104.393] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\QAhgTD.xlsx", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\QAhgTD.xlsx", lpFilePart=0x0) returned 0x23 [0104.393] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\QAhgTD.xlsx.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\QAhgTD.xlsx.spybuster", lpFilePart=0x0) returned 0x2d [0104.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0104.393] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\QAhgTD.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\qahgtd.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a5dc40, ftCreationTime.dwHighDateTime=0x1d5e367, ftLastAccessTime.dwLowDateTime=0xf5961ca0, ftLastAccessTime.dwHighDateTime=0x1d5e342, ftLastWriteTime.dwLowDateTime=0xb37ad5f3, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x81a0)) returned 1 [0104.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0104.393] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\QAhgTD.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\qahgtd.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\QAhgTD.xlsx.spybuster" (normalized: "c:\\users\\fd1hvy\\desktop\\qahgtd.xlsx.spybuster")) returned 1 [0104.394] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Rwl9j7XAHVz8.png", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Rwl9j7XAHVz8.png", lpFilePart=0x0) returned 0x28 [0104.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0104.394] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Rwl9j7XAHVz8.png" (normalized: "c:\\users\\fd1hvy\\desktop\\rwl9j7xahvz8.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0104.394] GetFileType (hFile=0x37c) returned 0x1 [0104.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0104.394] GetFileType (hFile=0x37c) returned 0x1 [0104.394] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x1027 [0104.394] ReadFile (in: hFile=0x37c, lpBuffer=0x268aa1c, nNumberOfBytesToRead=0x1027, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x268aa1c*, lpNumberOfBytesRead=0x19ecec*=0x1027, lpOverlapped=0x0) returned 1 [0104.394] CloseHandle (hObject=0x37c) returned 1 [0104.410] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0104.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0104.410] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0104.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0104.411] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Rwl9j7XAHVz8.png", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Rwl9j7XAHVz8.png", lpFilePart=0x0) returned 0x28 [0104.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0104.411] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Rwl9j7XAHVz8.png" (normalized: "c:\\users\\fd1hvy\\desktop\\rwl9j7xahvz8.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0104.465] GetFileType (hFile=0x37c) returned 0x1 [0104.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0104.466] GetFileType (hFile=0x37c) returned 0x1 [0104.466] WriteFile (in: hFile=0x37c, lpBuffer=0x26dca54*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x26dca54*, lpNumberOfBytesWritten=0x19ece0*=0x1030, lpOverlapped=0x0) returned 1 [0104.467] CloseHandle (hObject=0x37c) returned 1 [0104.468] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Rwl9j7XAHVz8.png", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Rwl9j7XAHVz8.png", lpFilePart=0x0) returned 0x28 [0104.468] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Rwl9j7XAHVz8.png.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Rwl9j7XAHVz8.png.spybuster", lpFilePart=0x0) returned 0x32 [0104.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0104.468] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Rwl9j7XAHVz8.png" (normalized: "c:\\users\\fd1hvy\\desktop\\rwl9j7xahvz8.png"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ed06370, ftCreationTime.dwHighDateTime=0x1d5efaf, ftLastAccessTime.dwLowDateTime=0xc46abbc0, ftLastAccessTime.dwHighDateTime=0x1d5e84e, ftLastWriteTime.dwLowDateTime=0xb386bcf3, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x1030)) returned 1 [0104.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0104.468] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\Rwl9j7XAHVz8.png" (normalized: "c:\\users\\fd1hvy\\desktop\\rwl9j7xahvz8.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\Rwl9j7XAHVz8.png.spybuster" (normalized: "c:\\users\\fd1hvy\\desktop\\rwl9j7xahvz8.png.spybuster")) returned 1 [0104.469] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tcazK41Fi.odt", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tcazK41Fi.odt", lpFilePart=0x0) returned 0x25 [0104.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0104.469] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tcazK41Fi.odt" (normalized: "c:\\users\\fd1hvy\\desktop\\tcazk41fi.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0104.469] GetFileType (hFile=0x37c) returned 0x1 [0104.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0104.469] GetFileType (hFile=0x37c) returned 0x1 [0104.469] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0xc9a7 [0104.469] ReadFile (in: hFile=0x37c, lpBuffer=0x26ddedc, nNumberOfBytesToRead=0xc9a7, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x26ddedc*, lpNumberOfBytesRead=0x19ecec*=0xc9a7, lpOverlapped=0x0) returned 1 [0104.470] CloseHandle (hObject=0x37c) returned 1 [0104.489] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0104.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0104.489] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0104.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0104.490] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tcazK41Fi.odt", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tcazK41Fi.odt", lpFilePart=0x0) returned 0x25 [0104.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0104.490] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tcazK41Fi.odt" (normalized: "c:\\users\\fd1hvy\\desktop\\tcazk41fi.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0104.491] GetFileType (hFile=0x37c) returned 0x1 [0104.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0104.492] GetFileType (hFile=0x37c) returned 0x1 [0104.492] WriteFile (in: hFile=0x37c, lpBuffer=0x27509ec*, nNumberOfBytesToWrite=0xc9b0, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x27509ec*, lpNumberOfBytesWritten=0x19ece0*=0xc9b0, lpOverlapped=0x0) returned 1 [0104.493] CloseHandle (hObject=0x37c) returned 1 [0104.495] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tcazK41Fi.odt", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tcazK41Fi.odt", lpFilePart=0x0) returned 0x25 [0104.495] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tcazK41Fi.odt.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tcazK41Fi.odt.spybuster", lpFilePart=0x0) returned 0x2f [0104.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0104.496] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tcazK41Fi.odt" (normalized: "c:\\users\\fd1hvy\\desktop\\tcazk41fi.odt"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4292da0, ftCreationTime.dwHighDateTime=0x1d5e8bd, ftLastAccessTime.dwLowDateTime=0xa59b6b90, ftLastAccessTime.dwHighDateTime=0x1d5efab, ftLastWriteTime.dwLowDateTime=0xb38b8212, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xc9b0)) returned 1 [0104.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0104.496] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\tcazK41Fi.odt" (normalized: "c:\\users\\fd1hvy\\desktop\\tcazk41fi.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\tcazK41Fi.odt.spybuster" (normalized: "c:\\users\\fd1hvy\\desktop\\tcazk41fi.odt.spybuster")) returned 1 [0104.496] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\v8t4CtjbLuJ4D9yyWCY.csv", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\v8t4CtjbLuJ4D9yyWCY.csv", lpFilePart=0x0) returned 0x2f [0104.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0104.497] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\v8t4CtjbLuJ4D9yyWCY.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\v8t4ctjbluj4d9yywcy.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0104.497] GetFileType (hFile=0x37c) returned 0x1 [0104.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0104.497] GetFileType (hFile=0x37c) returned 0x1 [0104.497] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x9372 [0104.497] ReadFile (in: hFile=0x37c, lpBuffer=0x275d824, nNumberOfBytesToRead=0x9372, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x275d824*, lpNumberOfBytesRead=0x19ecec*=0x9372, lpOverlapped=0x0) returned 1 [0104.498] CloseHandle (hObject=0x37c) returned 1 [0104.632] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0104.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0104.632] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0104.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0104.632] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\v8t4CtjbLuJ4D9yyWCY.csv", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\v8t4CtjbLuJ4D9yyWCY.csv", lpFilePart=0x0) returned 0x2f [0104.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0104.632] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\v8t4CtjbLuJ4D9yyWCY.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\v8t4ctjbluj4d9yywcy.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0104.633] GetFileType (hFile=0x37c) returned 0x1 [0104.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0104.634] GetFileType (hFile=0x37c) returned 0x1 [0104.634] WriteFile (in: hFile=0x37c, lpBuffer=0x27d8790*, nNumberOfBytesToWrite=0x9380, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x27d8790*, lpNumberOfBytesWritten=0x19ece0*=0x9380, lpOverlapped=0x0) returned 1 [0104.635] CloseHandle (hObject=0x37c) returned 1 [0104.637] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\v8t4CtjbLuJ4D9yyWCY.csv", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\v8t4CtjbLuJ4D9yyWCY.csv", lpFilePart=0x0) returned 0x2f [0104.637] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\v8t4CtjbLuJ4D9yyWCY.csv.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\v8t4CtjbLuJ4D9yyWCY.csv.spybuster", lpFilePart=0x0) returned 0x39 [0104.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0104.637] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\v8t4CtjbLuJ4D9yyWCY.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\v8t4ctjbluj4d9yywcy.csv"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905d89f0, ftCreationTime.dwHighDateTime=0x1d5e873, ftLastAccessTime.dwLowDateTime=0xee96aa00, ftLastAccessTime.dwHighDateTime=0x1d5e9c8, ftLastWriteTime.dwLowDateTime=0xb3a0f648, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x9380)) returned 1 [0104.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0104.638] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\v8t4CtjbLuJ4D9yyWCY.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\v8t4ctjbluj4d9yywcy.csv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\v8t4CtjbLuJ4D9yyWCY.csv.spybuster" (normalized: "c:\\users\\fd1hvy\\desktop\\v8t4ctjbluj4d9yywcy.csv.spybuster")) returned 1 [0104.638] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vvZTWTV8FICU-m4A.mkv", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vvZTWTV8FICU-m4A.mkv", lpFilePart=0x0) returned 0x2c [0104.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0104.638] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vvZTWTV8FICU-m4A.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\vvztwtv8ficu-m4a.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0104.639] GetFileType (hFile=0x37c) returned 0x1 [0104.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0104.639] GetFileType (hFile=0x37c) returned 0x1 [0104.639] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x18db6 [0104.640] ReadFile (in: hFile=0x37c, lpBuffer=0x3852f60, nNumberOfBytesToRead=0x18db6, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x3852f60*, lpNumberOfBytesRead=0x19ecec*=0x18db6, lpOverlapped=0x0) returned 1 [0104.642] CloseHandle (hObject=0x37c) returned 1 [0104.742] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0104.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0104.742] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0104.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0104.742] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vvZTWTV8FICU-m4A.mkv", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vvZTWTV8FICU-m4A.mkv", lpFilePart=0x0) returned 0x2c [0104.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0104.743] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vvZTWTV8FICU-m4A.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\vvztwtv8ficu-m4a.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0104.745] GetFileType (hFile=0x37c) returned 0x1 [0104.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0104.745] GetFileType (hFile=0x37c) returned 0x1 [0104.745] WriteFile (in: hFile=0x37c, lpBuffer=0x38cf458*, nNumberOfBytesToWrite=0x18dc0, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x38cf458*, lpNumberOfBytesWritten=0x19ece0*=0x18dc0, lpOverlapped=0x0) returned 1 [0104.748] CloseHandle (hObject=0x37c) returned 1 [0104.752] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vvZTWTV8FICU-m4A.mkv", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vvZTWTV8FICU-m4A.mkv", lpFilePart=0x0) returned 0x2c [0104.752] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vvZTWTV8FICU-m4A.mkv.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vvZTWTV8FICU-m4A.mkv.spybuster", lpFilePart=0x0) returned 0x36 [0104.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0104.752] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vvZTWTV8FICU-m4A.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\vvztwtv8ficu-m4a.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe62f0290, ftCreationTime.dwHighDateTime=0x1d5e41e, ftLastAccessTime.dwLowDateTime=0x6c5d7080, ftLastAccessTime.dwHighDateTime=0x1d5edee, ftLastWriteTime.dwLowDateTime=0xb3b1a7e0, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x18dc0)) returned 1 [0104.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0104.752] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\vvZTWTV8FICU-m4A.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\vvztwtv8ficu-m4a.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\vvZTWTV8FICU-m4A.mkv.spybuster" (normalized: "c:\\users\\fd1hvy\\desktop\\vvztwtv8ficu-m4a.mkv.spybuster")) returned 1 [0104.792] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Whoz y9gOm9hnbG0fVu.avi", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Whoz y9gOm9hnbG0fVu.avi", lpFilePart=0x0) returned 0x2f [0104.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0104.793] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Whoz y9gOm9hnbG0fVu.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\whoz y9gom9hnbg0fvu.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0104.793] GetFileType (hFile=0x37c) returned 0x1 [0104.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0104.793] GetFileType (hFile=0x37c) returned 0x1 [0104.793] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0xc1c2 [0104.793] ReadFile (in: hFile=0x37c, lpBuffer=0x282f27c, nNumberOfBytesToRead=0xc1c2, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x282f27c*, lpNumberOfBytesRead=0x19ecec*=0xc1c2, lpOverlapped=0x0) returned 1 [0104.794] CloseHandle (hObject=0x37c) returned 1 [0104.871] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0104.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0104.871] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0104.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0104.871] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Whoz y9gOm9hnbG0fVu.avi", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Whoz y9gOm9hnbG0fVu.avi", lpFilePart=0x0) returned 0x2f [0104.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0104.871] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Whoz y9gOm9hnbG0fVu.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\whoz y9gom9hnbg0fvu.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0104.873] GetFileType (hFile=0x37c) returned 0x1 [0104.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0104.873] GetFileType (hFile=0x37c) returned 0x1 [0104.873] WriteFile (in: hFile=0x37c, lpBuffer=0x2687e30*, nNumberOfBytesToWrite=0xc1d0, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x2687e30*, lpNumberOfBytesWritten=0x19ece0*=0xc1d0, lpOverlapped=0x0) returned 1 [0104.875] CloseHandle (hObject=0x37c) returned 1 [0104.878] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Whoz y9gOm9hnbG0fVu.avi", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Whoz y9gOm9hnbG0fVu.avi", lpFilePart=0x0) returned 0x2f [0104.878] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Whoz y9gOm9hnbG0fVu.avi.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Whoz y9gOm9hnbG0fVu.avi.spybuster", lpFilePart=0x0) returned 0x39 [0104.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0104.878] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Whoz y9gOm9hnbG0fVu.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\whoz y9gom9hnbg0fvu.avi"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb77bc140, ftCreationTime.dwHighDateTime=0x1d5e211, ftLastAccessTime.dwLowDateTime=0xe4da2640, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xb3c4baf9, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xc1d0)) returned 1 [0104.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0104.879] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\Whoz y9gOm9hnbG0fVu.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\whoz y9gom9hnbg0fvu.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\Whoz y9gOm9hnbG0fVu.avi.spybuster" (normalized: "c:\\users\\fd1hvy\\desktop\\whoz y9gom9hnbg0fvu.avi.spybuster")) returned 1 [0104.879] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XHwpWMtf0Ll_vF0.csv", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XHwpWMtf0Ll_vF0.csv", lpFilePart=0x0) returned 0x2b [0104.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0104.879] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\XHwpWMtf0Ll_vF0.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\xhwpwmtf0ll_vf0.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0104.880] GetFileType (hFile=0x37c) returned 0x1 [0104.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0104.880] GetFileType (hFile=0x37c) returned 0x1 [0104.880] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x17f79 [0105.048] ReadFile (in: hFile=0x37c, lpBuffer=0x39005d8, nNumberOfBytesToRead=0x17f79, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x39005d8*, lpNumberOfBytesRead=0x19ecec*=0x17f79, lpOverlapped=0x0) returned 1 [0105.051] CloseHandle (hObject=0x37c) returned 1 [0105.464] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0105.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0105.464] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0105.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0105.464] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XHwpWMtf0Ll_vF0.csv", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XHwpWMtf0Ll_vF0.csv", lpFilePart=0x0) returned 0x2b [0105.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0105.464] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\XHwpWMtf0Ll_vF0.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\xhwpwmtf0ll_vf0.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0105.467] GetFileType (hFile=0x37c) returned 0x1 [0105.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0105.467] GetFileType (hFile=0x37c) returned 0x1 [0105.467] WriteFile (in: hFile=0x37c, lpBuffer=0x3651a48*, nNumberOfBytesToWrite=0x17f80, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x3651a48*, lpNumberOfBytesWritten=0x19ece0*=0x17f80, lpOverlapped=0x0) returned 1 [0105.470] CloseHandle (hObject=0x37c) returned 1 [0105.475] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XHwpWMtf0Ll_vF0.csv", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XHwpWMtf0Ll_vF0.csv", lpFilePart=0x0) returned 0x2b [0105.475] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XHwpWMtf0Ll_vF0.csv.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XHwpWMtf0Ll_vF0.csv.spybuster", lpFilePart=0x0) returned 0x35 [0105.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0105.475] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XHwpWMtf0Ll_vF0.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\xhwpwmtf0ll_vf0.csv"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729eec90, ftCreationTime.dwHighDateTime=0x1d5e442, ftLastAccessTime.dwLowDateTime=0x3d5a22d0, ftLastAccessTime.dwHighDateTime=0x1d5e0fe, ftLastWriteTime.dwLowDateTime=0xb41f527f, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x17f80)) returned 1 [0105.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0105.475] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\XHwpWMtf0Ll_vF0.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\xhwpwmtf0ll_vf0.csv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\XHwpWMtf0Ll_vF0.csv.spybuster" (normalized: "c:\\users\\fd1hvy\\desktop\\xhwpwmtf0ll_vf0.csv.spybuster")) returned 1 [0105.476] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\yyMfsjbfc_l4hZT41.pptx", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\yyMfsjbfc_l4hZT41.pptx", lpFilePart=0x0) returned 0x2e [0105.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0105.476] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\yyMfsjbfc_l4hZT41.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\yymfsjbfc_l4hzt41.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0105.476] GetFileType (hFile=0x37c) returned 0x1 [0105.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0105.476] GetFileType (hFile=0x37c) returned 0x1 [0105.476] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x270f [0105.476] ReadFile (in: hFile=0x37c, lpBuffer=0x265e1d0, nNumberOfBytesToRead=0x270f, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x265e1d0*, lpNumberOfBytesRead=0x19ecec*=0x270f, lpOverlapped=0x0) returned 1 [0105.477] CloseHandle (hObject=0x37c) returned 1 [0105.539] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0105.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0105.539] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0105.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0105.540] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\yyMfsjbfc_l4hZT41.pptx", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\yyMfsjbfc_l4hZT41.pptx", lpFilePart=0x0) returned 0x2e [0105.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0105.540] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\yyMfsjbfc_l4hZT41.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\yymfsjbfc_l4hzt41.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0105.541] GetFileType (hFile=0x37c) returned 0x1 [0105.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0105.541] GetFileType (hFile=0x37c) returned 0x1 [0105.541] WriteFile (in: hFile=0x37c, lpBuffer=0x26b7468*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x26b7468*, lpNumberOfBytesWritten=0x19ece0*=0x2710, lpOverlapped=0x0) returned 1 [0105.543] CloseHandle (hObject=0x37c) returned 1 [0105.544] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\yyMfsjbfc_l4hZT41.pptx", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\yyMfsjbfc_l4hZT41.pptx", lpFilePart=0x0) returned 0x2e [0105.544] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\yyMfsjbfc_l4hZT41.pptx.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\yyMfsjbfc_l4hZT41.pptx.spybuster", lpFilePart=0x0) returned 0x38 [0105.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0105.544] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\yyMfsjbfc_l4hZT41.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\yymfsjbfc_l4hzt41.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c5e00, ftCreationTime.dwHighDateTime=0x1d5e1e5, ftLastAccessTime.dwLowDateTime=0x5a2476f0, ftLastAccessTime.dwHighDateTime=0x1d5e765, ftLastWriteTime.dwLowDateTime=0xb42b3f78, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x2710)) returned 1 [0105.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0105.544] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\yyMfsjbfc_l4hZT41.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\yymfsjbfc_l4hzt41.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\yyMfsjbfc_l4hZT41.pptx.spybuster" (normalized: "c:\\users\\fd1hvy\\desktop\\yymfsjbfc_l4hzt41.pptx.spybuster")) returned 1 [0105.545] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\z7rP0.mkv", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\z7rP0.mkv", lpFilePart=0x0) returned 0x21 [0105.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0105.545] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\z7rP0.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\z7rp0.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0105.545] GetFileType (hFile=0x37c) returned 0x1 [0105.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0105.545] GetFileType (hFile=0x37c) returned 0x1 [0105.545] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0xed18 [0105.545] ReadFile (in: hFile=0x37c, lpBuffer=0x26b9ffc, nNumberOfBytesToRead=0xed18, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x26b9ffc*, lpNumberOfBytesRead=0x19ecec*=0xed18, lpOverlapped=0x0) returned 1 [0105.546] CloseHandle (hObject=0x37c) returned 1 [0105.572] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0105.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0105.572] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0105.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0105.572] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\z7rP0.mkv", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\z7rP0.mkv", lpFilePart=0x0) returned 0x21 [0105.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0105.573] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\z7rP0.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\z7rp0.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0105.574] GetFileType (hFile=0x37c) returned 0x1 [0105.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0105.574] GetFileType (hFile=0x37c) returned 0x1 [0105.574] WriteFile (in: hFile=0x37c, lpBuffer=0x2733558*, nNumberOfBytesToWrite=0xed20, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x2733558*, lpNumberOfBytesWritten=0x19ece0*=0xed20, lpOverlapped=0x0) returned 1 [0105.577] CloseHandle (hObject=0x37c) returned 1 [0105.579] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\z7rP0.mkv", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\z7rP0.mkv", lpFilePart=0x0) returned 0x21 [0105.579] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\z7rP0.mkv.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\z7rP0.mkv.spybuster", lpFilePart=0x0) returned 0x2b [0105.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0105.580] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\z7rP0.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\z7rp0.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36777fc0, ftCreationTime.dwHighDateTime=0x1d5efc3, ftLastAccessTime.dwLowDateTime=0x680fb8d0, ftLastAccessTime.dwHighDateTime=0x1d5ec4f, ftLastWriteTime.dwLowDateTime=0xb4300424, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xed20)) returned 1 [0105.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0105.580] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\z7rP0.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\z7rp0.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\z7rP0.mkv.spybuster" (normalized: "c:\\users\\fd1hvy\\desktop\\z7rp0.mkv.spybuster")) returned 1 [0105.580] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Zd_0jo8eYB83T.ppt", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Zd_0jo8eYB83T.ppt", lpFilePart=0x0) returned 0x29 [0105.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0105.581] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Zd_0jo8eYB83T.ppt" (normalized: "c:\\users\\fd1hvy\\desktop\\zd_0jo8eyb83t.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0105.581] GetFileType (hFile=0x37c) returned 0x1 [0105.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0105.581] GetFileType (hFile=0x37c) returned 0x1 [0105.581] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x7080 [0105.581] ReadFile (in: hFile=0x37c, lpBuffer=0x27426a8, nNumberOfBytesToRead=0x7080, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x27426a8*, lpNumberOfBytesRead=0x19ecec*=0x7080, lpOverlapped=0x0) returned 1 [0105.581] CloseHandle (hObject=0x37c) returned 1 [0105.641] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0105.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0105.641] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0105.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0105.641] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Zd_0jo8eYB83T.ppt", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Zd_0jo8eYB83T.ppt", lpFilePart=0x0) returned 0x29 [0105.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0105.641] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Zd_0jo8eYB83T.ppt" (normalized: "c:\\users\\fd1hvy\\desktop\\zd_0jo8eyb83t.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0105.643] GetFileType (hFile=0x37c) returned 0x1 [0105.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0105.643] GetFileType (hFile=0x37c) returned 0x1 [0105.643] WriteFile (in: hFile=0x37c, lpBuffer=0x27b2760*, nNumberOfBytesToWrite=0x7090, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x27b2760*, lpNumberOfBytesWritten=0x19ece0*=0x7090, lpOverlapped=0x0) returned 1 [0105.645] CloseHandle (hObject=0x37c) returned 1 [0105.647] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Zd_0jo8eYB83T.ppt", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Zd_0jo8eYB83T.ppt", lpFilePart=0x0) returned 0x29 [0105.647] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Zd_0jo8eYB83T.ppt.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Zd_0jo8eYB83T.ppt.spybuster", lpFilePart=0x0) returned 0x33 [0105.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0105.647] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Zd_0jo8eYB83T.ppt" (normalized: "c:\\users\\fd1hvy\\desktop\\zd_0jo8eyb83t.ppt"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a402310, ftCreationTime.dwHighDateTime=0x1d5e483, ftLastAccessTime.dwLowDateTime=0x375f8c90, ftLastAccessTime.dwHighDateTime=0x1d5e972, ftLastWriteTime.dwLowDateTime=0xb43c06f3, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x7090)) returned 1 [0105.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0105.647] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\Zd_0jo8eYB83T.ppt" (normalized: "c:\\users\\fd1hvy\\desktop\\zd_0jo8eyb83t.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\Zd_0jo8eYB83T.ppt.spybuster" (normalized: "c:\\users\\fd1hvy\\desktop\\zd_0jo8eyb83t.ppt.spybuster")) returned 1 [0105.648] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\zgTRfP_2OhRR.bmp", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\zgTRfP_2OhRR.bmp", lpFilePart=0x0) returned 0x28 [0105.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0105.648] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\zgTRfP_2OhRR.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\zgtrfp_2ohrr.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0105.648] GetFileType (hFile=0x37c) returned 0x1 [0105.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0105.648] GetFileType (hFile=0x37c) returned 0x1 [0105.648] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x13a08 [0105.649] ReadFile (in: hFile=0x37c, lpBuffer=0x27b9c58, nNumberOfBytesToRead=0x13a08, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x27b9c58*, lpNumberOfBytesRead=0x19ecec*=0x13a08, lpOverlapped=0x0) returned 1 [0105.649] CloseHandle (hObject=0x37c) returned 1 [0105.732] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0105.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0105.732] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0105.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0105.733] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\zgTRfP_2OhRR.bmp", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\zgTRfP_2OhRR.bmp", lpFilePart=0x0) returned 0x28 [0105.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0105.733] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\zgTRfP_2OhRR.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\zgtrfp_2ohrr.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0105.735] GetFileType (hFile=0x37c) returned 0x1 [0105.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0105.735] GetFileType (hFile=0x37c) returned 0x1 [0105.735] WriteFile (in: hFile=0x37c, lpBuffer=0x2841884*, nNumberOfBytesToWrite=0x13a10, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x2841884*, lpNumberOfBytesWritten=0x19ece0*=0x13a10, lpOverlapped=0x0) returned 1 [0105.739] CloseHandle (hObject=0x37c) returned 1 [0105.805] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\zgTRfP_2OhRR.bmp", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\zgTRfP_2OhRR.bmp", lpFilePart=0x0) returned 0x28 [0105.806] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\zgTRfP_2OhRR.bmp.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\zgTRfP_2OhRR.bmp.spybuster", lpFilePart=0x0) returned 0x32 [0105.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0105.806] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\zgTRfP_2OhRR.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\zgtrfp_2ohrr.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cd42af0, ftCreationTime.dwHighDateTime=0x1d5ecda, ftLastAccessTime.dwLowDateTime=0x4d220560, ftLastAccessTime.dwHighDateTime=0x1d5ed66, ftLastWriteTime.dwLowDateTime=0xb453c724, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x13a10)) returned 1 [0105.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0105.806] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\zgTRfP_2OhRR.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\zgtrfp_2ohrr.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\zgTRfP_2OhRR.bmp.spybuster" (normalized: "c:\\users\\fd1hvy\\desktop\\zgtrfp_2ohrr.bmp.spybuster")) returned 1 [0105.807] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\_pd3xKHZBnocQk_.odt", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\_pd3xKHZBnocQk_.odt", lpFilePart=0x0) returned 0x2b [0105.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0105.807] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\_pd3xKHZBnocQk_.odt" (normalized: "c:\\users\\fd1hvy\\desktop\\_pd3xkhzbnocqk_.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0105.807] GetFileType (hFile=0x37c) returned 0x1 [0105.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0105.807] GetFileType (hFile=0x37c) returned 0x1 [0105.807] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x624b [0105.807] ReadFile (in: hFile=0x37c, lpBuffer=0x2855704, nNumberOfBytesToRead=0x624b, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x2855704*, lpNumberOfBytesRead=0x19ecec*=0x624b, lpOverlapped=0x0) returned 1 [0105.808] CloseHandle (hObject=0x37c) returned 1 [0106.065] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0106.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0106.065] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0106.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0106.065] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\_pd3xKHZBnocQk_.odt", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\_pd3xKHZBnocQk_.odt", lpFilePart=0x0) returned 0x2b [0106.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0106.066] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\_pd3xKHZBnocQk_.odt" (normalized: "c:\\users\\fd1hvy\\desktop\\_pd3xkhzbnocqk_.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0106.067] GetFileType (hFile=0x37c) returned 0x1 [0106.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0106.067] GetFileType (hFile=0x37c) returned 0x1 [0106.067] WriteFile (in: hFile=0x37c, lpBuffer=0x26c78d0*, nNumberOfBytesToWrite=0x6250, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x26c78d0*, lpNumberOfBytesWritten=0x19ece0*=0x6250, lpOverlapped=0x0) returned 1 [0106.069] CloseHandle (hObject=0x37c) returned 1 [0106.071] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\_pd3xKHZBnocQk_.odt", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\_pd3xKHZBnocQk_.odt", lpFilePart=0x0) returned 0x2b [0106.071] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\_pd3xKHZBnocQk_.odt.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\_pd3xKHZBnocQk_.odt.spybuster", lpFilePart=0x0) returned 0x35 [0106.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0106.071] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\_pd3xKHZBnocQk_.odt" (normalized: "c:\\users\\fd1hvy\\desktop\\_pd3xkhzbnocqk_.odt"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c366b60, ftCreationTime.dwHighDateTime=0x1d5e70e, ftLastAccessTime.dwLowDateTime=0xed0b18c0, ftLastAccessTime.dwHighDateTime=0x1d5e89b, ftLastWriteTime.dwLowDateTime=0xb47c4fc2, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x6250)) returned 1 [0106.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0106.071] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\_pd3xKHZBnocQk_.odt" (normalized: "c:\\users\\fd1hvy\\desktop\\_pd3xkhzbnocqk_.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\_pd3xKHZBnocQk_.odt.spybuster" (normalized: "c:\\users\\fd1hvy\\desktop\\_pd3xkhzbnocqk_.odt.spybuster")) returned 1 [0106.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed24) returned 1 [0106.072] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k", nBufferLength=0x105, lpBuffer=0x19e7d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k", lpFilePart=0x0) returned 0x21 [0106.072] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\*", lpFindFileData=0x19ea4c | out: lpFindFileData=0x19ea4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88ebc310, ftCreationTime.dwHighDateTime=0x1d5e61d, ftLastAccessTime.dwLowDateTime=0xe8ac500, ftLastAccessTime.dwHighDateTime=0x1d5e6a7, ftLastWriteTime.dwLowDateTime=0xe8ac500, ftLastWriteTime.dwHighDateTime=0x1d5e6a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b538 [0106.073] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88ebc310, ftCreationTime.dwHighDateTime=0x1d5e61d, ftLastAccessTime.dwLowDateTime=0xe8ac500, ftLastAccessTime.dwHighDateTime=0x1d5e6a7, ftLastWriteTime.dwLowDateTime=0xe8ac500, ftLastWriteTime.dwHighDateTime=0x1d5e6a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.073] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46742e70, ftCreationTime.dwHighDateTime=0x1d5ec47, ftLastAccessTime.dwLowDateTime=0xc7d15cf0, ftLastAccessTime.dwHighDateTime=0x1d5e92b, ftLastWriteTime.dwLowDateTime=0xc7d15cf0, ftLastWriteTime.dwHighDateTime=0x1d5e92b, nFileSizeHigh=0x0, nFileSizeLow=0x13afd, dwReserved0=0x0, dwReserved1=0x0, cFileName="37LV1pcPLl0DszL.avi", cAlternateFileName="37LV1P~1.AVI")) returned 1 [0106.073] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f092b0, ftCreationTime.dwHighDateTime=0x1d5eb6f, ftLastAccessTime.dwLowDateTime=0xc165ba60, ftLastAccessTime.dwHighDateTime=0x1d5e2c2, ftLastWriteTime.dwLowDateTime=0xc165ba60, ftLastWriteTime.dwHighDateTime=0x1d5e2c2, nFileSizeHigh=0x0, nFileSizeLow=0x18bf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="5fdudcLMeirUJUqZB.flv", cAlternateFileName="5FDUDC~1.FLV")) returned 1 [0106.073] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2effa0d0, ftCreationTime.dwHighDateTime=0x1d5e319, ftLastAccessTime.dwLowDateTime=0x67b77790, ftLastAccessTime.dwHighDateTime=0x1d5e4b8, ftLastWriteTime.dwLowDateTime=0x67b77790, ftLastWriteTime.dwHighDateTime=0x1d5e4b8, nFileSizeHigh=0x0, nFileSizeLow=0xc05f, dwReserved0=0x0, dwReserved1=0x0, cFileName="g1iy9RNnpm3E.m4a", cAlternateFileName="G1IY9R~1.M4A")) returned 1 [0106.073] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf7e8c00, ftCreationTime.dwHighDateTime=0x1d5ea30, ftLastAccessTime.dwLowDateTime=0xc73e2990, ftLastAccessTime.dwHighDateTime=0x1d5ee4d, ftLastWriteTime.dwLowDateTime=0xc73e2990, ftLastWriteTime.dwHighDateTime=0x1d5ee4d, nFileSizeHigh=0x0, nFileSizeLow=0x7847, dwReserved0=0x0, dwReserved1=0x0, cFileName="gtCKc0bFZ4FIiVAA.avi", cAlternateFileName="GTCKC0~1.AVI")) returned 1 [0106.074] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a0f9200, ftCreationTime.dwHighDateTime=0x1d5f0e5, ftLastAccessTime.dwLowDateTime=0x336c8840, ftLastAccessTime.dwHighDateTime=0x1d5e413, ftLastWriteTime.dwLowDateTime=0x336c8840, ftLastWriteTime.dwHighDateTime=0x1d5e413, nFileSizeHigh=0x0, nFileSizeLow=0x240f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ja_53_R4GZ.wav", cAlternateFileName="JA_53_~1.WAV")) returned 1 [0106.074] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x715292f0, ftCreationTime.dwHighDateTime=0x1d5e812, ftLastAccessTime.dwLowDateTime=0xc1dd10b0, ftLastAccessTime.dwHighDateTime=0x1d5e709, ftLastWriteTime.dwLowDateTime=0xc1dd10b0, ftLastWriteTime.dwHighDateTime=0x1d5e709, nFileSizeHigh=0x0, nFileSizeLow=0x14c7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="kDVwA8SOo2.pptx", cAlternateFileName="KDVWA8~1.PPT")) returned 1 [0106.074] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7025b80, ftCreationTime.dwHighDateTime=0x1d5ee5a, ftLastAccessTime.dwLowDateTime=0x920d7920, ftLastAccessTime.dwHighDateTime=0x1d5e0fa, ftLastWriteTime.dwLowDateTime=0x920d7920, ftLastWriteTime.dwHighDateTime=0x1d5e0fa, nFileSizeHigh=0x0, nFileSizeLow=0xcfa4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ktRNe.bmp", cAlternateFileName="")) returned 1 [0106.074] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd08cc2f0, ftCreationTime.dwHighDateTime=0x1d5e4bf, ftLastAccessTime.dwLowDateTime=0x11985c00, ftLastAccessTime.dwHighDateTime=0x1d5e2ea, ftLastWriteTime.dwLowDateTime=0x11985c00, ftLastWriteTime.dwHighDateTime=0x1d5e2ea, nFileSizeHigh=0x0, nFileSizeLow=0xda05, dwReserved0=0x0, dwReserved1=0x0, cFileName="mBOHZ.flv", cAlternateFileName="")) returned 1 [0106.074] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5b3acd0, ftCreationTime.dwHighDateTime=0x1d5ec3b, ftLastAccessTime.dwLowDateTime=0x9d6fef0, ftLastAccessTime.dwHighDateTime=0x1d5e92e, ftLastWriteTime.dwLowDateTime=0x9d6fef0, ftLastWriteTime.dwHighDateTime=0x1d5e92e, nFileSizeHigh=0x0, nFileSizeLow=0x14131, dwReserved0=0x0, dwReserved1=0x0, cFileName="O6OfXra9cBHeO1YcjK.mkv", cAlternateFileName="O6OFXR~1.MKV")) returned 1 [0106.074] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x234e0ad0, ftCreationTime.dwHighDateTime=0x1d5e2db, ftLastAccessTime.dwLowDateTime=0x3fac8db0, ftLastAccessTime.dwHighDateTime=0x1d5e6e5, ftLastWriteTime.dwLowDateTime=0x3fac8db0, ftLastWriteTime.dwHighDateTime=0x1d5e6e5, nFileSizeHigh=0x0, nFileSizeLow=0x97cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="qegWvUuLpi.jpg", cAlternateFileName="QEGWVU~1.JPG")) returned 1 [0106.074] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b36a810, ftCreationTime.dwHighDateTime=0x1d5ecd4, ftLastAccessTime.dwLowDateTime=0xb2f688c0, ftLastAccessTime.dwHighDateTime=0x1d5e5aa, ftLastWriteTime.dwLowDateTime=0xb2f688c0, ftLastWriteTime.dwHighDateTime=0x1d5e5aa, nFileSizeHigh=0x0, nFileSizeLow=0x10194, dwReserved0=0x0, dwReserved1=0x0, cFileName="qr_1C2yCGZbM1XeZG.pps", cAlternateFileName="QR_1C2~1.PPS")) returned 1 [0106.075] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704c2760, ftCreationTime.dwHighDateTime=0x1d5ed60, ftLastAccessTime.dwLowDateTime=0xa32225c0, ftLastAccessTime.dwHighDateTime=0x1d5e448, ftLastWriteTime.dwLowDateTime=0xa32225c0, ftLastWriteTime.dwHighDateTime=0x1d5e448, nFileSizeHigh=0x0, nFileSizeLow=0x2f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="S3uubf.ppt", cAlternateFileName="")) returned 1 [0106.075] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac6e730, ftCreationTime.dwHighDateTime=0x1d5e787, ftLastAccessTime.dwLowDateTime=0x5b6db310, ftLastAccessTime.dwHighDateTime=0x1d5f119, ftLastWriteTime.dwLowDateTime=0x5b6db310, ftLastWriteTime.dwHighDateTime=0x1d5f119, nFileSizeHigh=0x0, nFileSizeLow=0x77f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="WFupxD4xWvOPahG.jpg", cAlternateFileName="WFUPXD~1.JPG")) returned 1 [0106.075] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0106.075] FindClose (in: hFindFile=0x77b538 | out: hFindFile=0x77b538) returned 1 [0106.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ece0) returned 1 [0106.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecec) returned 1 [0106.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed24) returned 1 [0106.075] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k", nBufferLength=0x105, lpBuffer=0x19e7d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k", lpFilePart=0x0) returned 0x21 [0106.076] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\*", lpFindFileData=0x19ea4c | out: lpFindFileData=0x19ea4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88ebc310, ftCreationTime.dwHighDateTime=0x1d5e61d, ftLastAccessTime.dwLowDateTime=0xe8ac500, ftLastAccessTime.dwHighDateTime=0x1d5e6a7, ftLastWriteTime.dwLowDateTime=0xe8ac500, ftLastWriteTime.dwHighDateTime=0x1d5e6a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b978 [0106.076] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88ebc310, ftCreationTime.dwHighDateTime=0x1d5e61d, ftLastAccessTime.dwLowDateTime=0xe8ac500, ftLastAccessTime.dwHighDateTime=0x1d5e6a7, ftLastWriteTime.dwLowDateTime=0xe8ac500, ftLastWriteTime.dwHighDateTime=0x1d5e6a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.076] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46742e70, ftCreationTime.dwHighDateTime=0x1d5ec47, ftLastAccessTime.dwLowDateTime=0xc7d15cf0, ftLastAccessTime.dwHighDateTime=0x1d5e92b, ftLastWriteTime.dwLowDateTime=0xc7d15cf0, ftLastWriteTime.dwHighDateTime=0x1d5e92b, nFileSizeHigh=0x0, nFileSizeLow=0x13afd, dwReserved0=0x0, dwReserved1=0x0, cFileName="37LV1pcPLl0DszL.avi", cAlternateFileName="37LV1P~1.AVI")) returned 1 [0106.076] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f092b0, ftCreationTime.dwHighDateTime=0x1d5eb6f, ftLastAccessTime.dwLowDateTime=0xc165ba60, ftLastAccessTime.dwHighDateTime=0x1d5e2c2, ftLastWriteTime.dwLowDateTime=0xc165ba60, ftLastWriteTime.dwHighDateTime=0x1d5e2c2, nFileSizeHigh=0x0, nFileSizeLow=0x18bf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="5fdudcLMeirUJUqZB.flv", cAlternateFileName="5FDUDC~1.FLV")) returned 1 [0106.076] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2effa0d0, ftCreationTime.dwHighDateTime=0x1d5e319, ftLastAccessTime.dwLowDateTime=0x67b77790, ftLastAccessTime.dwHighDateTime=0x1d5e4b8, ftLastWriteTime.dwLowDateTime=0x67b77790, ftLastWriteTime.dwHighDateTime=0x1d5e4b8, nFileSizeHigh=0x0, nFileSizeLow=0xc05f, dwReserved0=0x0, dwReserved1=0x0, cFileName="g1iy9RNnpm3E.m4a", cAlternateFileName="G1IY9R~1.M4A")) returned 1 [0106.077] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf7e8c00, ftCreationTime.dwHighDateTime=0x1d5ea30, ftLastAccessTime.dwLowDateTime=0xc73e2990, ftLastAccessTime.dwHighDateTime=0x1d5ee4d, ftLastWriteTime.dwLowDateTime=0xc73e2990, ftLastWriteTime.dwHighDateTime=0x1d5ee4d, nFileSizeHigh=0x0, nFileSizeLow=0x7847, dwReserved0=0x0, dwReserved1=0x0, cFileName="gtCKc0bFZ4FIiVAA.avi", cAlternateFileName="GTCKC0~1.AVI")) returned 1 [0106.077] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a0f9200, ftCreationTime.dwHighDateTime=0x1d5f0e5, ftLastAccessTime.dwLowDateTime=0x336c8840, ftLastAccessTime.dwHighDateTime=0x1d5e413, ftLastWriteTime.dwLowDateTime=0x336c8840, ftLastWriteTime.dwHighDateTime=0x1d5e413, nFileSizeHigh=0x0, nFileSizeLow=0x240f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ja_53_R4GZ.wav", cAlternateFileName="JA_53_~1.WAV")) returned 1 [0106.077] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x715292f0, ftCreationTime.dwHighDateTime=0x1d5e812, ftLastAccessTime.dwLowDateTime=0xc1dd10b0, ftLastAccessTime.dwHighDateTime=0x1d5e709, ftLastWriteTime.dwLowDateTime=0xc1dd10b0, ftLastWriteTime.dwHighDateTime=0x1d5e709, nFileSizeHigh=0x0, nFileSizeLow=0x14c7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="kDVwA8SOo2.pptx", cAlternateFileName="KDVWA8~1.PPT")) returned 1 [0106.077] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7025b80, ftCreationTime.dwHighDateTime=0x1d5ee5a, ftLastAccessTime.dwLowDateTime=0x920d7920, ftLastAccessTime.dwHighDateTime=0x1d5e0fa, ftLastWriteTime.dwLowDateTime=0x920d7920, ftLastWriteTime.dwHighDateTime=0x1d5e0fa, nFileSizeHigh=0x0, nFileSizeLow=0xcfa4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ktRNe.bmp", cAlternateFileName="")) returned 1 [0106.077] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd08cc2f0, ftCreationTime.dwHighDateTime=0x1d5e4bf, ftLastAccessTime.dwLowDateTime=0x11985c00, ftLastAccessTime.dwHighDateTime=0x1d5e2ea, ftLastWriteTime.dwLowDateTime=0x11985c00, ftLastWriteTime.dwHighDateTime=0x1d5e2ea, nFileSizeHigh=0x0, nFileSizeLow=0xda05, dwReserved0=0x0, dwReserved1=0x0, cFileName="mBOHZ.flv", cAlternateFileName="")) returned 1 [0106.078] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5b3acd0, ftCreationTime.dwHighDateTime=0x1d5ec3b, ftLastAccessTime.dwLowDateTime=0x9d6fef0, ftLastAccessTime.dwHighDateTime=0x1d5e92e, ftLastWriteTime.dwLowDateTime=0x9d6fef0, ftLastWriteTime.dwHighDateTime=0x1d5e92e, nFileSizeHigh=0x0, nFileSizeLow=0x14131, dwReserved0=0x0, dwReserved1=0x0, cFileName="O6OfXra9cBHeO1YcjK.mkv", cAlternateFileName="O6OFXR~1.MKV")) returned 1 [0106.078] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x234e0ad0, ftCreationTime.dwHighDateTime=0x1d5e2db, ftLastAccessTime.dwLowDateTime=0x3fac8db0, ftLastAccessTime.dwHighDateTime=0x1d5e6e5, ftLastWriteTime.dwLowDateTime=0x3fac8db0, ftLastWriteTime.dwHighDateTime=0x1d5e6e5, nFileSizeHigh=0x0, nFileSizeLow=0x97cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="qegWvUuLpi.jpg", cAlternateFileName="QEGWVU~1.JPG")) returned 1 [0106.078] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b36a810, ftCreationTime.dwHighDateTime=0x1d5ecd4, ftLastAccessTime.dwLowDateTime=0xb2f688c0, ftLastAccessTime.dwHighDateTime=0x1d5e5aa, ftLastWriteTime.dwLowDateTime=0xb2f688c0, ftLastWriteTime.dwHighDateTime=0x1d5e5aa, nFileSizeHigh=0x0, nFileSizeLow=0x10194, dwReserved0=0x0, dwReserved1=0x0, cFileName="qr_1C2yCGZbM1XeZG.pps", cAlternateFileName="QR_1C2~1.PPS")) returned 1 [0106.078] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704c2760, ftCreationTime.dwHighDateTime=0x1d5ed60, ftLastAccessTime.dwLowDateTime=0xa32225c0, ftLastAccessTime.dwHighDateTime=0x1d5e448, ftLastWriteTime.dwLowDateTime=0xa32225c0, ftLastWriteTime.dwHighDateTime=0x1d5e448, nFileSizeHigh=0x0, nFileSizeLow=0x2f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="S3uubf.ppt", cAlternateFileName="")) returned 1 [0106.078] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac6e730, ftCreationTime.dwHighDateTime=0x1d5e787, ftLastAccessTime.dwLowDateTime=0x5b6db310, ftLastAccessTime.dwHighDateTime=0x1d5f119, ftLastWriteTime.dwLowDateTime=0x5b6db310, ftLastWriteTime.dwHighDateTime=0x1d5f119, nFileSizeHigh=0x0, nFileSizeLow=0x77f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="WFupxD4xWvOPahG.jpg", cAlternateFileName="WFUPXD~1.JPG")) returned 1 [0106.079] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac6e730, ftCreationTime.dwHighDateTime=0x1d5e787, ftLastAccessTime.dwLowDateTime=0x5b6db310, ftLastAccessTime.dwHighDateTime=0x1d5f119, ftLastWriteTime.dwLowDateTime=0x5b6db310, ftLastWriteTime.dwHighDateTime=0x1d5f119, nFileSizeHigh=0x0, nFileSizeLow=0x77f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="WFupxD4xWvOPahG.jpg", cAlternateFileName="WFUPXD~1.JPG")) returned 0 [0106.079] FindClose (in: hFindFile=0x77b978 | out: hFindFile=0x77b978) returned 1 [0106.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ece0) returned 1 [0106.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecec) returned 1 [0106.079] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\37LV1pcPLl0DszL.avi", nBufferLength=0x105, lpBuffer=0x19e68c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\37LV1pcPLl0DszL.avi", lpFilePart=0x0) returned 0x35 [0106.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0106.079] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\37LV1pcPLl0DszL.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\37lv1pcpll0dszl.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0106.079] GetFileType (hFile=0x37c) returned 0x1 [0106.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0106.079] GetFileType (hFile=0x37c) returned 0x1 [0106.080] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19eccc | out: lpFileSizeHigh=0x19eccc*=0x0) returned 0x13afd [0106.080] ReadFile (in: hFile=0x37c, lpBuffer=0x26d10dc, nNumberOfBytesToRead=0x13afd, lpNumberOfBytesRead=0x19ec78, lpOverlapped=0x0 | out: lpBuffer=0x26d10dc*, lpNumberOfBytesRead=0x19ec78*=0x13afd, lpOverlapped=0x0) returned 1 [0106.081] CloseHandle (hObject=0x37c) returned 1 [0106.490] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e790, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0106.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0106.490] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ecc0 | out: lpFileInformation=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0106.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0106.491] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\37LV1pcPLl0DszL.avi", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\37LV1pcPLl0DszL.avi", lpFilePart=0x0) returned 0x35 [0106.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0106.491] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\37LV1pcPLl0DszL.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\37lv1pcpll0dszl.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0106.491] GetFileType (hFile=0x37c) returned 0x1 [0106.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0106.491] GetFileType (hFile=0x37c) returned 0x1 [0106.491] WriteFile (in: hFile=0x37c, lpBuffer=0x2759138*, nNumberOfBytesToWrite=0x13b00, lpNumberOfBytesWritten=0x19ec6c, lpOverlapped=0x0 | out: lpBuffer=0x2759138*, lpNumberOfBytesWritten=0x19ec6c*=0x13b00, lpOverlapped=0x0) returned 1 [0106.494] CloseHandle (hObject=0x37c) returned 1 [0106.497] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\37LV1pcPLl0DszL.avi", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\37LV1pcPLl0DszL.avi", lpFilePart=0x0) returned 0x35 [0106.498] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\37LV1pcPLl0DszL.avi.spybuster", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\37LV1pcPLl0DszL.avi.spybuster", lpFilePart=0x0) returned 0x3f [0106.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec50) returned 1 [0106.498] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\37LV1pcPLl0DszL.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\37lv1pcpll0dszl.avi"), fInfoLevelId=0x0, lpFileInformation=0x19eccc | out: lpFileInformation=0x19eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46742e70, ftCreationTime.dwHighDateTime=0x1d5ec47, ftLastAccessTime.dwLowDateTime=0xc7d15cf0, ftLastAccessTime.dwHighDateTime=0x1d5e92b, ftLastWriteTime.dwLowDateTime=0xb4bcaf19, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x13b00)) returned 1 [0106.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0106.498] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\37LV1pcPLl0DszL.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\37lv1pcpll0dszl.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\37LV1pcPLl0DszL.avi.spybuster" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\37lv1pcpll0dszl.avi.spybuster")) returned 1 [0106.499] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\gtCKc0bFZ4FIiVAA.avi", nBufferLength=0x105, lpBuffer=0x19e68c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\gtCKc0bFZ4FIiVAA.avi", lpFilePart=0x0) returned 0x36 [0106.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0106.499] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\gtCKc0bFZ4FIiVAA.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\gtckc0bfz4fiivaa.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0106.499] GetFileType (hFile=0x37c) returned 0x1 [0106.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0106.499] GetFileType (hFile=0x37c) returned 0x1 [0106.499] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19eccc | out: lpFileSizeHigh=0x19eccc*=0x0) returned 0x7847 [0106.499] ReadFile (in: hFile=0x37c, lpBuffer=0x276d158, nNumberOfBytesToRead=0x7847, lpNumberOfBytesRead=0x19ec78, lpOverlapped=0x0 | out: lpBuffer=0x276d158*, lpNumberOfBytesRead=0x19ec78*=0x7847, lpOverlapped=0x0) returned 1 [0106.500] CloseHandle (hObject=0x37c) returned 1 [0106.583] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e790, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0106.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0106.583] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ecc0 | out: lpFileInformation=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0106.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0106.585] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\gtCKc0bFZ4FIiVAA.avi", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\gtCKc0bFZ4FIiVAA.avi", lpFilePart=0x0) returned 0x36 [0106.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0106.585] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\gtCKc0bFZ4FIiVAA.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\gtckc0bfz4fiivaa.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0106.587] GetFileType (hFile=0x37c) returned 0x1 [0106.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0106.587] GetFileType (hFile=0x37c) returned 0x1 [0106.587] WriteFile (in: hFile=0x37c, lpBuffer=0x27df8d4*, nNumberOfBytesToWrite=0x7850, lpNumberOfBytesWritten=0x19ec6c, lpOverlapped=0x0 | out: lpBuffer=0x27df8d4*, lpNumberOfBytesWritten=0x19ec6c*=0x7850, lpOverlapped=0x0) returned 1 [0106.589] CloseHandle (hObject=0x37c) returned 1 [0106.596] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\gtCKc0bFZ4FIiVAA.avi", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\gtCKc0bFZ4FIiVAA.avi", lpFilePart=0x0) returned 0x36 [0106.596] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\gtCKc0bFZ4FIiVAA.avi.spybuster", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\gtCKc0bFZ4FIiVAA.avi.spybuster", lpFilePart=0x0) returned 0x40 [0106.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec50) returned 1 [0106.596] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\gtCKc0bFZ4FIiVAA.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\gtckc0bfz4fiivaa.avi"), fInfoLevelId=0x0, lpFileInformation=0x19eccc | out: lpFileInformation=0x19eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf7e8c00, ftCreationTime.dwHighDateTime=0x1d5ea30, ftLastAccessTime.dwLowDateTime=0xc73e2990, ftLastAccessTime.dwHighDateTime=0x1d5ee4d, ftLastWriteTime.dwLowDateTime=0xb4cafd04, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x7850)) returned 1 [0106.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0106.596] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\gtCKc0bFZ4FIiVAA.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\gtckc0bfz4fiivaa.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\gtCKc0bFZ4FIiVAA.avi.spybuster" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\gtckc0bfz4fiivaa.avi.spybuster")) returned 1 [0106.597] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\kDVwA8SOo2.pptx", nBufferLength=0x105, lpBuffer=0x19e68c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\kDVwA8SOo2.pptx", lpFilePart=0x0) returned 0x31 [0106.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0106.597] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\kDVwA8SOo2.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\kdvwa8soo2.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0106.597] GetFileType (hFile=0x37c) returned 0x1 [0106.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0106.598] GetFileType (hFile=0x37c) returned 0x1 [0106.598] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19eccc | out: lpFileSizeHigh=0x19eccc*=0x0) returned 0x14c7c [0106.598] ReadFile (in: hFile=0x37c, lpBuffer=0x3918570, nNumberOfBytesToRead=0x14c7c, lpNumberOfBytesRead=0x19ec78, lpOverlapped=0x0 | out: lpBuffer=0x3918570*, lpNumberOfBytesRead=0x19ec78*=0x14c7c, lpOverlapped=0x0) returned 1 [0106.600] CloseHandle (hObject=0x37c) returned 1 [0106.692] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e790, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0106.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0106.693] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ecc0 | out: lpFileInformation=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0106.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0106.693] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\kDVwA8SOo2.pptx", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\kDVwA8SOo2.pptx", lpFilePart=0x0) returned 0x31 [0106.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0106.693] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\kDVwA8SOo2.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\kdvwa8soo2.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0106.695] GetFileType (hFile=0x37c) returned 0x1 [0106.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0106.695] GetFileType (hFile=0x37c) returned 0x1 [0106.695] WriteFile (in: hFile=0x37c, lpBuffer=0x3788458*, nNumberOfBytesToWrite=0x14c80, lpNumberOfBytesWritten=0x19ec6c, lpOverlapped=0x0 | out: lpBuffer=0x3788458*, lpNumberOfBytesWritten=0x19ec6c*=0x14c80, lpOverlapped=0x0) returned 1 [0106.698] CloseHandle (hObject=0x37c) returned 1 [0106.702] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\kDVwA8SOo2.pptx", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\kDVwA8SOo2.pptx", lpFilePart=0x0) returned 0x31 [0106.702] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\kDVwA8SOo2.pptx.spybuster", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\kDVwA8SOo2.pptx.spybuster", lpFilePart=0x0) returned 0x3b [0106.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec50) returned 1 [0106.703] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\kDVwA8SOo2.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\kdvwa8soo2.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19eccc | out: lpFileInformation=0x19eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x715292f0, ftCreationTime.dwHighDateTime=0x1d5e812, ftLastAccessTime.dwLowDateTime=0xc1dd10b0, ftLastAccessTime.dwHighDateTime=0x1d5e709, ftLastWriteTime.dwLowDateTime=0xb4dbada8, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x14c80)) returned 1 [0106.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0106.703] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\kDVwA8SOo2.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\kdvwa8soo2.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\kDVwA8SOo2.pptx.spybuster" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\kdvwa8soo2.pptx.spybuster")) returned 1 [0106.704] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\ktRNe.bmp", nBufferLength=0x105, lpBuffer=0x19e68c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\ktRNe.bmp", lpFilePart=0x0) returned 0x2b [0106.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0106.704] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\ktRNe.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\ktrne.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0106.704] GetFileType (hFile=0x37c) returned 0x1 [0106.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0106.704] GetFileType (hFile=0x37c) returned 0x1 [0106.704] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19eccc | out: lpFileSizeHigh=0x19eccc*=0x0) returned 0xcfa4 [0106.704] ReadFile (in: hFile=0x37c, lpBuffer=0x28348b0, nNumberOfBytesToRead=0xcfa4, lpNumberOfBytesRead=0x19ec78, lpOverlapped=0x0 | out: lpBuffer=0x28348b0*, lpNumberOfBytesRead=0x19ec78*=0xcfa4, lpOverlapped=0x0) returned 1 [0106.705] CloseHandle (hObject=0x37c) returned 1 [0106.806] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e790, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0106.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0106.806] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ecc0 | out: lpFileInformation=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0106.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0106.806] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\ktRNe.bmp", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\ktRNe.bmp", lpFilePart=0x0) returned 0x2b [0106.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0106.806] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\ktRNe.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\ktrne.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0106.808] GetFileType (hFile=0x37c) returned 0x1 [0106.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0106.808] GetFileType (hFile=0x37c) returned 0x1 [0106.808] WriteFile (in: hFile=0x37c, lpBuffer=0x26c27a0*, nNumberOfBytesToWrite=0xcfb0, lpNumberOfBytesWritten=0x19ec6c, lpOverlapped=0x0 | out: lpBuffer=0x26c27a0*, lpNumberOfBytesWritten=0x19ec6c*=0xcfb0, lpOverlapped=0x0) returned 1 [0106.810] CloseHandle (hObject=0x37c) returned 1 [0106.816] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\ktRNe.bmp", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\ktRNe.bmp", lpFilePart=0x0) returned 0x2b [0106.816] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\ktRNe.bmp.spybuster", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\ktRNe.bmp.spybuster", lpFilePart=0x0) returned 0x35 [0106.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec50) returned 1 [0106.816] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\ktRNe.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\ktrne.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19eccc | out: lpFileInformation=0x19eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7025b80, ftCreationTime.dwHighDateTime=0x1d5ee5a, ftLastAccessTime.dwLowDateTime=0x920d7920, ftLastAccessTime.dwHighDateTime=0x1d5e0fa, ftLastWriteTime.dwLowDateTime=0xb4ec5e35, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xcfb0)) returned 1 [0106.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0106.817] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\ktRNe.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\ktrne.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\ktRNe.bmp.spybuster" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\ktrne.bmp.spybuster")) returned 1 [0106.817] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\O6OfXra9cBHeO1YcjK.mkv", nBufferLength=0x105, lpBuffer=0x19e68c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\O6OfXra9cBHeO1YcjK.mkv", lpFilePart=0x0) returned 0x38 [0106.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0106.818] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\O6OfXra9cBHeO1YcjK.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\o6ofxra9cbheo1ycjk.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0106.818] GetFileType (hFile=0x37c) returned 0x1 [0106.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0106.818] GetFileType (hFile=0x37c) returned 0x1 [0106.818] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19eccc | out: lpFileSizeHigh=0x19eccc*=0x0) returned 0x14131 [0106.818] ReadFile (in: hFile=0x37c, lpBuffer=0x26cfbfc, nNumberOfBytesToRead=0x14131, lpNumberOfBytesRead=0x19ec78, lpOverlapped=0x0 | out: lpBuffer=0x26cfbfc*, lpNumberOfBytesRead=0x19ec78*=0x14131, lpOverlapped=0x0) returned 1 [0106.820] CloseHandle (hObject=0x37c) returned 1 [0107.088] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e790, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0107.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0107.089] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ecc0 | out: lpFileInformation=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0107.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0107.089] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\O6OfXra9cBHeO1YcjK.mkv", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\O6OfXra9cBHeO1YcjK.mkv", lpFilePart=0x0) returned 0x38 [0107.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0107.089] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\O6OfXra9cBHeO1YcjK.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\o6ofxra9cbheo1ycjk.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0107.094] GetFileType (hFile=0x37c) returned 0x1 [0107.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0107.094] GetFileType (hFile=0x37c) returned 0x1 [0107.094] WriteFile (in: hFile=0x37c, lpBuffer=0x2758f18*, nNumberOfBytesToWrite=0x14140, lpNumberOfBytesWritten=0x19ec6c, lpOverlapped=0x0 | out: lpBuffer=0x2758f18*, lpNumberOfBytesWritten=0x19ec6c*=0x14140, lpOverlapped=0x0) returned 1 [0107.096] CloseHandle (hObject=0x37c) returned 1 [0107.102] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\O6OfXra9cBHeO1YcjK.mkv", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\O6OfXra9cBHeO1YcjK.mkv", lpFilePart=0x0) returned 0x38 [0107.102] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\O6OfXra9cBHeO1YcjK.mkv.spybuster", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\O6OfXra9cBHeO1YcjK.mkv.spybuster", lpFilePart=0x0) returned 0x42 [0107.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec50) returned 1 [0107.102] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\O6OfXra9cBHeO1YcjK.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\o6ofxra9cbheo1ycjk.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19eccc | out: lpFileInformation=0x19eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5b3acd0, ftCreationTime.dwHighDateTime=0x1d5ec3b, ftLastAccessTime.dwLowDateTime=0x9d6fef0, ftLastAccessTime.dwHighDateTime=0x1d5e92e, ftLastWriteTime.dwLowDateTime=0xb51a0a67, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x14140)) returned 1 [0107.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0107.103] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\O6OfXra9cBHeO1YcjK.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\o6ofxra9cbheo1ycjk.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\O6OfXra9cBHeO1YcjK.mkv.spybuster" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\o6ofxra9cbheo1ycjk.mkv.spybuster")) returned 1 [0107.103] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\qegWvUuLpi.jpg", nBufferLength=0x105, lpBuffer=0x19e68c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\qegWvUuLpi.jpg", lpFilePart=0x0) returned 0x30 [0107.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0107.104] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\qegWvUuLpi.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\qegwvuulpi.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0107.104] GetFileType (hFile=0x37c) returned 0x1 [0107.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0107.104] GetFileType (hFile=0x37c) returned 0x1 [0107.104] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19eccc | out: lpFileSizeHigh=0x19eccc*=0x0) returned 0x97cf [0107.104] ReadFile (in: hFile=0x37c, lpBuffer=0x276d558, nNumberOfBytesToRead=0x97cf, lpNumberOfBytesRead=0x19ec78, lpOverlapped=0x0 | out: lpBuffer=0x276d558*, lpNumberOfBytesRead=0x19ec78*=0x97cf, lpOverlapped=0x0) returned 1 [0107.105] CloseHandle (hObject=0x37c) returned 1 [0107.181] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e790, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0107.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0107.181] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ecc0 | out: lpFileInformation=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0107.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0107.182] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\qegWvUuLpi.jpg", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\qegWvUuLpi.jpg", lpFilePart=0x0) returned 0x30 [0107.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0107.182] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\qegWvUuLpi.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\qegwvuulpi.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0107.183] GetFileType (hFile=0x37c) returned 0x1 [0107.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0107.183] GetFileType (hFile=0x37c) returned 0x1 [0107.184] WriteFile (in: hFile=0x37c, lpBuffer=0x27e9a54*, nNumberOfBytesToWrite=0x97d0, lpNumberOfBytesWritten=0x19ec6c, lpOverlapped=0x0 | out: lpBuffer=0x27e9a54*, lpNumberOfBytesWritten=0x19ec6c*=0x97d0, lpOverlapped=0x0) returned 1 [0107.187] CloseHandle (hObject=0x37c) returned 1 [0107.189] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\qegWvUuLpi.jpg", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\qegWvUuLpi.jpg", lpFilePart=0x0) returned 0x30 [0107.189] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\qegWvUuLpi.jpg.spybuster", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\qegWvUuLpi.jpg.spybuster", lpFilePart=0x0) returned 0x3a [0107.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec50) returned 1 [0107.189] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\qegWvUuLpi.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\qegwvuulpi.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19eccc | out: lpFileInformation=0x19eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x234e0ad0, ftCreationTime.dwHighDateTime=0x1d5e2db, ftLastAccessTime.dwLowDateTime=0x3fac8db0, ftLastAccessTime.dwHighDateTime=0x1d5e6e5, ftLastWriteTime.dwLowDateTime=0xb5269486, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x97d0)) returned 1 [0107.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0107.189] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\qegWvUuLpi.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\qegwvuulpi.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\qegWvUuLpi.jpg.spybuster" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\qegwvuulpi.jpg.spybuster")) returned 1 [0107.190] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\S3uubf.ppt", nBufferLength=0x105, lpBuffer=0x19e68c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\S3uubf.ppt", lpFilePart=0x0) returned 0x2c [0107.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0107.190] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\S3uubf.ppt" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\s3uubf.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0107.190] GetFileType (hFile=0x37c) returned 0x1 [0107.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0107.191] GetFileType (hFile=0x37c) returned 0x1 [0107.191] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19eccc | out: lpFileSizeHigh=0x19eccc*=0x0) returned 0x2f78 [0107.191] ReadFile (in: hFile=0x37c, lpBuffer=0x27f36dc, nNumberOfBytesToRead=0x2f78, lpNumberOfBytesRead=0x19ec78, lpOverlapped=0x0 | out: lpBuffer=0x27f36dc*, lpNumberOfBytesRead=0x19ec78*=0x2f78, lpOverlapped=0x0) returned 1 [0107.192] CloseHandle (hObject=0x37c) returned 1 [0107.285] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e790, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0107.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0107.285] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ecc0 | out: lpFileInformation=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0107.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0107.286] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\S3uubf.ppt", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\S3uubf.ppt", lpFilePart=0x0) returned 0x2c [0107.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0107.286] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\S3uubf.ppt" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\s3uubf.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0107.371] GetFileType (hFile=0x37c) returned 0x1 [0107.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0107.371] GetFileType (hFile=0x37c) returned 0x1 [0107.371] WriteFile (in: hFile=0x37c, lpBuffer=0x284f244*, nNumberOfBytesToWrite=0x2f80, lpNumberOfBytesWritten=0x19ec6c, lpOverlapped=0x0 | out: lpBuffer=0x284f244*, lpNumberOfBytesWritten=0x19ec6c*=0x2f80, lpOverlapped=0x0) returned 1 [0107.373] CloseHandle (hObject=0x37c) returned 1 [0107.434] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\S3uubf.ppt", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\S3uubf.ppt", lpFilePart=0x0) returned 0x2c [0107.434] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\S3uubf.ppt.spybuster", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\S3uubf.ppt.spybuster", lpFilePart=0x0) returned 0x36 [0107.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec50) returned 1 [0107.435] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\S3uubf.ppt" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\s3uubf.ppt"), fInfoLevelId=0x0, lpFileInformation=0x19eccc | out: lpFileInformation=0x19eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704c2760, ftCreationTime.dwHighDateTime=0x1d5ed60, ftLastAccessTime.dwLowDateTime=0xa32225c0, ftLastAccessTime.dwHighDateTime=0x1d5e448, ftLastWriteTime.dwLowDateTime=0xb5432f8c, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x2f80)) returned 1 [0107.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0107.435] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\S3uubf.ppt" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\s3uubf.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\S3uubf.ppt.spybuster" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\s3uubf.ppt.spybuster")) returned 1 [0107.548] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\WFupxD4xWvOPahG.jpg", nBufferLength=0x105, lpBuffer=0x19e68c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\WFupxD4xWvOPahG.jpg", lpFilePart=0x0) returned 0x35 [0107.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0107.548] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\WFupxD4xWvOPahG.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\wfupxd4xwvopahg.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0107.549] GetFileType (hFile=0x37c) returned 0x1 [0107.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0107.549] GetFileType (hFile=0x37c) returned 0x1 [0107.549] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19eccc | out: lpFileSizeHigh=0x19eccc*=0x0) returned 0x77f7 [0107.549] ReadFile (in: hFile=0x37c, lpBuffer=0x285265c, nNumberOfBytesToRead=0x77f7, lpNumberOfBytesRead=0x19ec78, lpOverlapped=0x0 | out: lpBuffer=0x285265c*, lpNumberOfBytesRead=0x19ec78*=0x77f7, lpOverlapped=0x0) returned 1 [0107.550] CloseHandle (hObject=0x37c) returned 1 [0107.634] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e790, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0107.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0107.635] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ecc0 | out: lpFileInformation=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0107.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0107.635] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\WFupxD4xWvOPahG.jpg", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\WFupxD4xWvOPahG.jpg", lpFilePart=0x0) returned 0x35 [0107.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0107.635] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\WFupxD4xWvOPahG.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\wfupxd4xwvopahg.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0107.695] GetFileType (hFile=0x37c) returned 0x1 [0107.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0107.695] GetFileType (hFile=0x37c) returned 0x1 [0107.695] WriteFile (in: hFile=0x37c, lpBuffer=0x26cca84*, nNumberOfBytesToWrite=0x7800, lpNumberOfBytesWritten=0x19ec6c, lpOverlapped=0x0 | out: lpBuffer=0x26cca84*, lpNumberOfBytesWritten=0x19ec6c*=0x7800, lpOverlapped=0x0) returned 1 [0107.697] CloseHandle (hObject=0x37c) returned 1 [0107.718] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\WFupxD4xWvOPahG.jpg", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\WFupxD4xWvOPahG.jpg", lpFilePart=0x0) returned 0x35 [0107.718] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\WFupxD4xWvOPahG.jpg.spybuster", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\WFupxD4xWvOPahG.jpg.spybuster", lpFilePart=0x0) returned 0x3f [0107.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec50) returned 1 [0107.719] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\WFupxD4xWvOPahG.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\wfupxd4xwvopahg.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19eccc | out: lpFileInformation=0x19eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac6e730, ftCreationTime.dwHighDateTime=0x1d5e787, ftLastAccessTime.dwLowDateTime=0x5b6db310, ftLastAccessTime.dwHighDateTime=0x1d5f119, ftLastWriteTime.dwLowDateTime=0xb572e065, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x7800)) returned 1 [0107.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0107.719] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\WFupxD4xWvOPahG.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\wfupxd4xwvopahg.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\WFupxD4xWvOPahG.jpg.spybuster" (normalized: "c:\\users\\fd1hvy\\desktop\\xueywee1k\\wfupxd4xwvopahg.jpg.spybuster")) returned 1 [0108.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed98) returned 1 [0108.026] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links", nBufferLength=0x105, lpBuffer=0x19e84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links", lpFilePart=0x0) returned 0x15 [0108.028] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\*", lpFindFileData=0x19eac0 | out: lpFindFileData=0x19eac0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b5b8 [0108.031] FindNextFileW (in: hFindFile=0x77b5b8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.032] FindNextFileW (in: hFindFile=0x77b5b8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcee4480b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0108.032] FindNextFileW (in: hFindFile=0x77b5b8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4428f2bb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4428f2bb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce90d59d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0108.032] FindNextFileW (in: hFindFile=0x77b5b8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442b54f3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x442b54f3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcec7abde, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x3ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0108.034] FindNextFileW (in: hFindFile=0x77b5b8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x94664823, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 1 [0108.034] FindNextFileW (in: hFindFile=0x77b5b8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0108.034] FindClose (in: hFindFile=0x77b5b8 | out: hFindFile=0x77b5b8) returned 1 [0108.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed54) returned 1 [0108.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed60) returned 1 [0108.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed98) returned 1 [0108.036] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links", nBufferLength=0x105, lpBuffer=0x19e84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links", lpFilePart=0x0) returned 0x15 [0108.036] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\*", lpFindFileData=0x19eac0 | out: lpFindFileData=0x19eac0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b6f8 [0108.037] FindNextFileW (in: hFindFile=0x77b6f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.039] FindNextFileW (in: hFindFile=0x77b6f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcee4480b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0108.039] FindNextFileW (in: hFindFile=0x77b6f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4428f2bb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4428f2bb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce90d59d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0108.040] FindNextFileW (in: hFindFile=0x77b6f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442b54f3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x442b54f3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcec7abde, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x3ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0108.040] FindNextFileW (in: hFindFile=0x77b6f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x94664823, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 1 [0108.040] FindNextFileW (in: hFindFile=0x77b6f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x94664823, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 0 [0108.040] FindClose (in: hFindFile=0x77b6f8 | out: hFindFile=0x77b6f8) returned 1 [0108.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed54) returned 1 [0108.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed60) returned 1 [0108.041] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x21 [0108.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0108.041] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0108.042] GetFileType (hFile=0x37c) returned 0x1 [0108.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0108.042] GetFileType (hFile=0x37c) returned 0x1 [0108.042] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x1f5 [0108.042] ReadFile (in: hFile=0x37c, lpBuffer=0x26d5b68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x26d5b68*, lpNumberOfBytesRead=0x19ecec*=0x1f5, lpOverlapped=0x0) returned 1 [0108.043] CloseHandle (hObject=0x37c) returned 1 [0108.060] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0108.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0108.060] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0108.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0108.061] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x21 [0108.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0108.061] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0108.062] GetFileType (hFile=0x37c) returned 0x1 [0108.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0108.062] GetFileType (hFile=0x37c) returned 0x1 [0108.062] WriteFile (in: hFile=0x37c, lpBuffer=0x27246b8*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x19ecb4, lpOverlapped=0x0 | out: lpBuffer=0x27246b8*, lpNumberOfBytesWritten=0x19ecb4*=0x200, lpOverlapped=0x0) returned 1 [0108.063] CloseHandle (hObject=0x37c) returned 1 [0108.064] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x21 [0108.064] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Desktop.lnk.spybuster", lpFilePart=0x0) returned 0x2b [0108.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0108.064] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4428f2bb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4428f2bb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xb5ac1ba1, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x200)) returned 1 [0108.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0108.064] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk.spybuster" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk.spybuster")) returned 1 [0108.065] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x23 [0108.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0108.065] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0108.065] GetFileType (hFile=0x37c) returned 0x1 [0108.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0108.065] GetFileType (hFile=0x37c) returned 0x1 [0108.065] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x3ae [0108.066] ReadFile (in: hFile=0x37c, lpBuffer=0x2725c88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x2725c88*, lpNumberOfBytesRead=0x19ecec*=0x3ae, lpOverlapped=0x0) returned 1 [0108.089] CloseHandle (hObject=0x37c) returned 1 [0108.141] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0108.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0108.141] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0108.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0108.141] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x23 [0108.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0108.141] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0108.142] GetFileType (hFile=0x37c) returned 0x1 [0108.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0108.143] GetFileType (hFile=0x37c) returned 0x1 [0108.143] WriteFile (in: hFile=0x37c, lpBuffer=0x2774eec*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x19ecb4, lpOverlapped=0x0 | out: lpBuffer=0x2774eec*, lpNumberOfBytesWritten=0x19ecb4*=0x3b0, lpOverlapped=0x0) returned 1 [0108.144] CloseHandle (hObject=0x37c) returned 1 [0108.145] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x23 [0108.145] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Downloads.lnk.spybuster", lpFilePart=0x0) returned 0x2d [0108.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0108.145] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442b54f3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x442b54f3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xb5b806ec, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x3b0)) returned 1 [0108.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0108.145] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk.spybuster" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk.spybuster")) returned 1 [0108.146] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", lpFilePart=0x0) returned 0x22 [0108.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0108.146] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0108.146] GetFileType (hFile=0x37c) returned 0x1 [0108.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0108.146] GetFileType (hFile=0x37c) returned 0x1 [0108.147] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x53a [0108.147] ReadFile (in: hFile=0x37c, lpBuffer=0x2776654, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x2776654*, lpNumberOfBytesRead=0x19ecec*=0x53a, lpOverlapped=0x0) returned 1 [0108.148] CloseHandle (hObject=0x37c) returned 1 [0108.247] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0108.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0108.247] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0108.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0108.247] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", lpFilePart=0x0) returned 0x22 [0108.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0108.247] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0108.248] GetFileType (hFile=0x37c) returned 0x1 [0108.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0108.248] GetFileType (hFile=0x37c) returned 0x1 [0108.248] WriteFile (in: hFile=0x37c, lpBuffer=0x27c608c*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x19ecb4, lpOverlapped=0x0 | out: lpBuffer=0x27c608c*, lpNumberOfBytesWritten=0x19ecb4*=0x540, lpOverlapped=0x0) returned 1 [0108.249] CloseHandle (hObject=0x37c) returned 1 [0108.250] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", lpFilePart=0x0) returned 0x22 [0108.250] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk.spybuster", lpFilePart=0x0) returned 0x2c [0108.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0108.251] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xb5c76921, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x540)) returned 1 [0108.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0108.251] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk.spybuster" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk.spybuster")) returned 1 [0108.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed98) returned 1 [0108.253] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Contacts", nBufferLength=0x105, lpBuffer=0x19e84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Contacts", lpFilePart=0x0) returned 0x18 [0108.253] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Contacts\\*", lpFindFileData=0x19eac0 | out: lpFindFileData=0x19eac0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b9f8 [0108.253] FindNextFileW (in: hFindFile=0x77b9f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.253] FindNextFileW (in: hFindFile=0x77b9f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0108.253] FindNextFileW (in: hFindFile=0x77b9f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0108.254] FindClose (in: hFindFile=0x77b9f8 | out: hFindFile=0x77b9f8) returned 1 [0108.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed54) returned 1 [0108.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed60) returned 1 [0108.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed98) returned 1 [0108.254] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Contacts", nBufferLength=0x105, lpBuffer=0x19e84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Contacts", lpFilePart=0x0) returned 0x18 [0108.254] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Contacts\\*", lpFindFileData=0x19eac0 | out: lpFindFileData=0x19eac0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77bc78 [0108.254] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.254] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0108.254] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0108.255] FindClose (in: hFindFile=0x77bc78 | out: hFindFile=0x77bc78) returned 1 [0108.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed54) returned 1 [0108.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed60) returned 1 [0108.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed98) returned 1 [0108.255] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x105, lpBuffer=0x19e84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0108.255] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\*", lpFindFileData=0x19eac0 | out: lpFindFileData=0x19eac0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb47c4fc2, ftLastAccessTime.dwHighDateTime=0x1d675cf, ftLastWriteTime.dwLowDateTime=0xb47c4fc2, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77bc78 [0108.255] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb47c4fc2, ftLastAccessTime.dwHighDateTime=0x1d675cf, ftLastWriteTime.dwLowDateTime=0xb47c4fc2, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.255] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7eb0890, ftCreationTime.dwHighDateTime=0x1d5ebfb, ftLastAccessTime.dwLowDateTime=0x79d80da0, ftLastAccessTime.dwHighDateTime=0x1d5e750, ftLastWriteTime.dwLowDateTime=0xb1c3c873, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x2d00, dwReserved0=0x0, dwReserved1=0x0, cFileName="-47zDmLsrM5Zlxp.pdf.spybuster", cAlternateFileName="-47ZDM~1.SPY")) returned 1 [0108.255] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8a3570, ftCreationTime.dwHighDateTime=0x1d5ef40, ftLastAccessTime.dwLowDateTime=0x7723d850, ftLastAccessTime.dwHighDateTime=0x1d5e83b, ftLastWriteTime.dwLowDateTime=0x7723d850, ftLastWriteTime.dwHighDateTime=0x1d5e83b, nFileSizeHigh=0x0, nFileSizeLow=0x439a, dwReserved0=0x0, dwReserved1=0x0, cFileName="1Kgxn5i.flv", cAlternateFileName="")) returned 1 [0108.256] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda8f480, ftCreationTime.dwHighDateTime=0x1d5e199, ftLastAccessTime.dwLowDateTime=0x59f693c0, ftLastAccessTime.dwHighDateTime=0x1d5edf5, ftLastWriteTime.dwLowDateTime=0x59f693c0, ftLastWriteTime.dwHighDateTime=0x1d5edf5, nFileSizeHigh=0x0, nFileSizeLow=0x18df3, dwReserved0=0x0, dwReserved1=0x0, cFileName="3rJdOON4hNmP6e0EHCh.m4a", cAlternateFileName="3RJDOO~1.M4A")) returned 1 [0108.256] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29974740, ftCreationTime.dwHighDateTime=0x1d5efa5, ftLastAccessTime.dwLowDateTime=0xbb41ade0, ftLastAccessTime.dwHighDateTime=0x1d5eb5c, ftLastWriteTime.dwLowDateTime=0xb1eeb368, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xec90, dwReserved0=0x0, dwReserved1=0x0, cFileName="4Q6AfqT.avi.spybuster", cAlternateFileName="4Q6AFQ~1.SPY")) returned 1 [0108.256] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6376180, ftCreationTime.dwHighDateTime=0x1d5e0d8, ftLastAccessTime.dwLowDateTime=0xccd62180, ftLastAccessTime.dwHighDateTime=0x1d5ea7b, ftLastWriteTime.dwLowDateTime=0xccd62180, ftLastWriteTime.dwHighDateTime=0x1d5ea7b, nFileSizeHigh=0x0, nFileSizeLow=0x18d59, dwReserved0=0x0, dwReserved1=0x0, cFileName="9c3g-_Bopd2ctLelrM.wav", cAlternateFileName="9C3G-_~1.WAV")) returned 1 [0108.256] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0108.256] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbda4b120, ftCreationTime.dwHighDateTime=0x1d5e5eb, ftLastAccessTime.dwLowDateTime=0x2173e770, ftLastAccessTime.dwHighDateTime=0x1d5e81c, ftLastWriteTime.dwLowDateTime=0xb2401b37, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xc70, dwReserved0=0x0, dwReserved1=0x0, cFileName="dTNP.mp4.spybuster", cAlternateFileName="DTNPMP~1.SPY")) returned 1 [0108.256] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2e15fa0, ftCreationTime.dwHighDateTime=0x1d5e101, ftLastAccessTime.dwLowDateTime=0x28f23750, ftLastAccessTime.dwHighDateTime=0x1d5e6d6, ftLastWriteTime.dwLowDateTime=0xb2ca6362, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x3c70, dwReserved0=0x0, dwReserved1=0x0, cFileName="DUCGlGpLhZ7ehP0yEx.mp3.spybuster", cAlternateFileName="DUCGLG~1.SPY")) returned 1 [0108.256] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2b5ee70, ftCreationTime.dwHighDateTime=0x1d5e75f, ftLastAccessTime.dwLowDateTime=0x5bdb62e0, ftLastAccessTime.dwHighDateTime=0x1d5e91f, ftLastWriteTime.dwLowDateTime=0x5bdb62e0, ftLastWriteTime.dwHighDateTime=0x1d5e91f, nFileSizeHigh=0x0, nFileSizeLow=0xdf26, dwReserved0=0x0, dwReserved1=0x0, cFileName="EmgId2OIYKEN.wav", cAlternateFileName="EMGID2~1.WAV")) returned 1 [0108.256] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbe49440, ftCreationTime.dwHighDateTime=0x1d5e1fe, ftLastAccessTime.dwLowDateTime=0x5019f40, ftLastAccessTime.dwHighDateTime=0x1d5e814, ftLastWriteTime.dwLowDateTime=0xb2ccc8b4, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x2f10, dwReserved0=0x0, dwReserved1=0x0, cFileName="gqKfeceE.mkv.spybuster", cAlternateFileName="GQKFEC~1.SPY")) returned 1 [0108.257] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f5a9210, ftCreationTime.dwHighDateTime=0x1d5e58a, ftLastAccessTime.dwLowDateTime=0xa09741e0, ftLastAccessTime.dwHighDateTime=0x1d5ebab, ftLastWriteTime.dwLowDateTime=0xa09741e0, ftLastWriteTime.dwHighDateTime=0x1d5ebab, nFileSizeHigh=0x0, nFileSizeLow=0x57a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="hC4J1IJ.m4a", cAlternateFileName="")) returned 1 [0108.257] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x489b0110, ftCreationTime.dwHighDateTime=0x1d5e52b, ftLastAccessTime.dwLowDateTime=0xb49d0d70, ftLastAccessTime.dwHighDateTime=0x1d5eca8, ftLastWriteTime.dwLowDateTime=0xb2f2ea58, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xf0d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IuuHCN.mp3.spybuster", cAlternateFileName="IUUHCN~1.SPY")) returned 1 [0108.257] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eb39880, ftCreationTime.dwHighDateTime=0x1d5e84f, ftLastAccessTime.dwLowDateTime=0x206e43a0, ftLastAccessTime.dwHighDateTime=0x1d5e571, ftLastWriteTime.dwLowDateTime=0xb2fed726, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="izq8n6_qgBXoY.png.spybuster", cAlternateFileName="IZQ8N6~1.SPY")) returned 1 [0108.257] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x952c3a40, ftCreationTime.dwHighDateTime=0x1d5ee6c, ftLastAccessTime.dwLowDateTime=0x1f8e42e0, ftLastAccessTime.dwHighDateTime=0x1d5ea5e, ftLastWriteTime.dwLowDateTime=0xb30f87c2, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xfc80, dwReserved0=0x0, dwReserved1=0x0, cFileName="jGYH8Y8r9kj.jpg.spybuster", cAlternateFileName="JGYH8Y~1.SPY")) returned 1 [0108.257] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0957f40, ftCreationTime.dwHighDateTime=0x1d5eeb4, ftLastAccessTime.dwLowDateTime=0x1ce0f9d0, ftLastAccessTime.dwHighDateTime=0x1d5ef17, ftLastWriteTime.dwLowDateTime=0xb320368c, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x6d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="jUesZvd-s.jpg.spybuster", cAlternateFileName="JUESZV~1.SPY")) returned 1 [0108.257] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b1c4680, ftCreationTime.dwHighDateTime=0x1d5e923, ftLastAccessTime.dwLowDateTime=0x9c92a910, ftLastAccessTime.dwHighDateTime=0x1d5ef5a, ftLastWriteTime.dwLowDateTime=0x9c92a910, ftLastWriteTime.dwHighDateTime=0x1d5ef5a, nFileSizeHigh=0x0, nFileSizeLow=0xf714, dwReserved0=0x0, dwReserved1=0x0, cFileName="juhe8-MFzDg4vFSNwTUJ.ots", cAlternateFileName="JUHE8-~1.OTS")) returned 1 [0108.257] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb136100, ftCreationTime.dwHighDateTime=0x1d5ee60, ftLastAccessTime.dwLowDateTime=0xc1dd2290, ftLastAccessTime.dwHighDateTime=0x1d5ef1e, ftLastWriteTime.dwLowDateTime=0xb3465dec, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x17f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="mmcdT0ssmgFqSRwRvCY.mkv.spybuster", cAlternateFileName="MMCDT0~1.SPY")) returned 1 [0108.258] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3890690, ftCreationTime.dwHighDateTime=0x1d5efcf, ftLastAccessTime.dwLowDateTime=0x6237dcf0, ftLastAccessTime.dwHighDateTime=0x1d5e2d4, ftLastWriteTime.dwLowDateTime=0x6237dcf0, ftLastWriteTime.dwHighDateTime=0x1d5e2d4, nFileSizeHigh=0x0, nFileSizeLow=0x16ae5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OJ6j-3IF-8uQrVieY52.m4a", cAlternateFileName="OJ6J-3~1.M4A")) returned 1 [0108.258] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9129b00, ftCreationTime.dwHighDateTime=0x1d5e4dc, ftLastAccessTime.dwLowDateTime=0xc34165f0, ftLastAccessTime.dwHighDateTime=0x1d5e538, ftLastWriteTime.dwLowDateTime=0xb367be17, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x17da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oXn8yyFK6hp.png.spybuster", cAlternateFileName="OXN8YY~1.SPY")) returned 1 [0108.258] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a5dc40, ftCreationTime.dwHighDateTime=0x1d5e367, ftLastAccessTime.dwLowDateTime=0xf5961ca0, ftLastAccessTime.dwHighDateTime=0x1d5e342, ftLastWriteTime.dwLowDateTime=0xb37ad5f3, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x81a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QAhgTD.xlsx.spybuster", cAlternateFileName="QAHGTD~1.SPY")) returned 1 [0108.258] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d687c90, ftCreationTime.dwHighDateTime=0x1d5e556, ftLastAccessTime.dwLowDateTime=0x6be66c40, ftLastAccessTime.dwHighDateTime=0x1d5e7ce, ftLastWriteTime.dwLowDateTime=0x6be66c40, ftLastWriteTime.dwHighDateTime=0x1d5e7ce, nFileSizeHigh=0x0, nFileSizeLow=0x60c, dwReserved0=0x0, dwReserved1=0x0, cFileName="qBFdm0Is5lnF mFj.wav", cAlternateFileName="QBFDM0~1.WAV")) returned 1 [0108.258] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5c460, ftCreationTime.dwHighDateTime=0x1d5ef1d, ftLastAccessTime.dwLowDateTime=0x60c57260, ftLastAccessTime.dwHighDateTime=0x1d5e720, ftLastWriteTime.dwLowDateTime=0x60c57260, ftLastWriteTime.dwHighDateTime=0x1d5e720, nFileSizeHigh=0x0, nFileSizeLow=0x5689, dwReserved0=0x0, dwReserved1=0x0, cFileName="qIE7cRi_s5t08y7Zd.flv", cAlternateFileName="QIE7CR~1.FLV")) returned 1 [0108.258] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ed06370, ftCreationTime.dwHighDateTime=0x1d5efaf, ftLastAccessTime.dwLowDateTime=0xc46abbc0, ftLastAccessTime.dwHighDateTime=0x1d5e84e, ftLastWriteTime.dwLowDateTime=0xb386bcf3, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x1030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rwl9j7XAHVz8.png.spybuster", cAlternateFileName="RWL9J7~1.SPY")) returned 1 [0108.258] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4292da0, ftCreationTime.dwHighDateTime=0x1d5e8bd, ftLastAccessTime.dwLowDateTime=0xa59b6b90, ftLastAccessTime.dwHighDateTime=0x1d5efab, ftLastWriteTime.dwLowDateTime=0xb38b8212, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xc9b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tcazK41Fi.odt.spybuster", cAlternateFileName="TCAZK4~1.SPY")) returned 1 [0108.258] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c7e1380, ftCreationTime.dwHighDateTime=0x1d5e82b, ftLastAccessTime.dwLowDateTime=0x3aa24780, ftLastAccessTime.dwHighDateTime=0x1d5e7dd, ftLastWriteTime.dwLowDateTime=0x3aa24780, ftLastWriteTime.dwHighDateTime=0x1d5e7dd, nFileSizeHigh=0x0, nFileSizeLow=0x14bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="tnfUvyOeuyO.gif", cAlternateFileName="TNFUVY~1.GIF")) returned 1 [0108.259] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdee46e0, ftCreationTime.dwHighDateTime=0x1d5ea15, ftLastAccessTime.dwLowDateTime=0x65aff860, ftLastAccessTime.dwHighDateTime=0x1d5e3b3, ftLastWriteTime.dwLowDateTime=0x65aff860, ftLastWriteTime.dwHighDateTime=0x1d5e3b3, nFileSizeHigh=0x0, nFileSizeLow=0xf385, dwReserved0=0x0, dwReserved1=0x0, cFileName="U2OUpUA6HKwM.wav", cAlternateFileName="U2OUPU~1.WAV")) returned 1 [0108.259] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905d89f0, ftCreationTime.dwHighDateTime=0x1d5e873, ftLastAccessTime.dwLowDateTime=0xee96aa00, ftLastAccessTime.dwHighDateTime=0x1d5e9c8, ftLastWriteTime.dwLowDateTime=0xb3a0f648, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x9380, dwReserved0=0x0, dwReserved1=0x0, cFileName="v8t4CtjbLuJ4D9yyWCY.csv.spybuster", cAlternateFileName="V8T4CT~1.SPY")) returned 1 [0108.259] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e03f0, ftCreationTime.dwHighDateTime=0x1d5effd, ftLastAccessTime.dwLowDateTime=0xd6287700, ftLastAccessTime.dwHighDateTime=0x1d5e4b4, ftLastWriteTime.dwLowDateTime=0xd6287700, ftLastWriteTime.dwHighDateTime=0x1d5e4b4, nFileSizeHigh=0x0, nFileSizeLow=0x7588, dwReserved0=0x0, dwReserved1=0x0, cFileName="vrvFJk_XLdEa.ots", cAlternateFileName="VRVFJK~1.OTS")) returned 1 [0108.259] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe62f0290, ftCreationTime.dwHighDateTime=0x1d5e41e, ftLastAccessTime.dwLowDateTime=0x6c5d7080, ftLastAccessTime.dwHighDateTime=0x1d5edee, ftLastWriteTime.dwLowDateTime=0xb3b1a7e0, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x18dc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vvZTWTV8FICU-m4A.mkv.spybuster", cAlternateFileName="VVZTWT~1.SPY")) returned 1 [0108.259] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb77bc140, ftCreationTime.dwHighDateTime=0x1d5e211, ftLastAccessTime.dwLowDateTime=0xe4da2640, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xb3c4baf9, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xc1d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Whoz y9gOm9hnbG0fVu.avi.spybuster", cAlternateFileName="WHOZY9~1.SPY")) returned 1 [0108.259] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729eec90, ftCreationTime.dwHighDateTime=0x1d5e442, ftLastAccessTime.dwLowDateTime=0x3d5a22d0, ftLastAccessTime.dwHighDateTime=0x1d5e0fe, ftLastWriteTime.dwLowDateTime=0xb41f527f, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x17f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="XHwpWMtf0Ll_vF0.csv.spybuster", cAlternateFileName="XHWPWM~1.SPY")) returned 1 [0108.259] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88ebc310, ftCreationTime.dwHighDateTime=0x1d5e61d, ftLastAccessTime.dwLowDateTime=0xb5812c85, ftLastAccessTime.dwHighDateTime=0x1d675cf, ftLastWriteTime.dwLowDateTime=0xb5812c85, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XuEywee1k", cAlternateFileName="XUEYWE~1")) returned 1 [0108.260] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c5e00, ftCreationTime.dwHighDateTime=0x1d5e1e5, ftLastAccessTime.dwLowDateTime=0x5a2476f0, ftLastAccessTime.dwHighDateTime=0x1d5e765, ftLastWriteTime.dwLowDateTime=0xb42b3f78, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x2710, dwReserved0=0x0, dwReserved1=0x0, cFileName="yyMfsjbfc_l4hZT41.pptx.spybuster", cAlternateFileName="YYMFSJ~1.SPY")) returned 1 [0108.260] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36777fc0, ftCreationTime.dwHighDateTime=0x1d5efc3, ftLastAccessTime.dwLowDateTime=0x680fb8d0, ftLastAccessTime.dwHighDateTime=0x1d5ec4f, ftLastWriteTime.dwLowDateTime=0xb4300424, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xed20, dwReserved0=0x0, dwReserved1=0x0, cFileName="z7rP0.mkv.spybuster", cAlternateFileName="Z7RP0M~1.SPY")) returned 1 [0108.260] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b86cee0, ftCreationTime.dwHighDateTime=0x1d5e6dd, ftLastAccessTime.dwLowDateTime=0x8a021de0, ftLastAccessTime.dwHighDateTime=0x1d5e806, ftLastWriteTime.dwLowDateTime=0x8a021de0, ftLastWriteTime.dwHighDateTime=0x1d5e806, nFileSizeHigh=0x0, nFileSizeLow=0x9af1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z8kOJnO7DOG.m4a", cAlternateFileName="Z8KOJN~1.M4A")) returned 1 [0108.260] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a402310, ftCreationTime.dwHighDateTime=0x1d5e483, ftLastAccessTime.dwLowDateTime=0x375f8c90, ftLastAccessTime.dwHighDateTime=0x1d5e972, ftLastWriteTime.dwLowDateTime=0xb43c06f3, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x7090, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zd_0jo8eYB83T.ppt.spybuster", cAlternateFileName="ZD_0JO~1.SPY")) returned 1 [0108.260] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cd42af0, ftCreationTime.dwHighDateTime=0x1d5ecda, ftLastAccessTime.dwLowDateTime=0x4d220560, ftLastAccessTime.dwHighDateTime=0x1d5ed66, ftLastWriteTime.dwLowDateTime=0xb453c724, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x13a10, dwReserved0=0x0, dwReserved1=0x0, cFileName="zgTRfP_2OhRR.bmp.spybuster", cAlternateFileName="ZGTRFP~1.SPY")) returned 1 [0108.260] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c366b60, ftCreationTime.dwHighDateTime=0x1d5e70e, ftLastAccessTime.dwLowDateTime=0xed0b18c0, ftLastAccessTime.dwHighDateTime=0x1d5e89b, ftLastWriteTime.dwLowDateTime=0xb47c4fc2, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x6250, dwReserved0=0x0, dwReserved1=0x0, cFileName="_pd3xKHZBnocQk_.odt.spybuster", cAlternateFileName="_PD3XK~1.SPY")) returned 1 [0108.261] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0108.261] FindClose (in: hFindFile=0x77bc78 | out: hFindFile=0x77bc78) returned 1 [0108.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed54) returned 1 [0108.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed60) returned 1 [0108.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed98) returned 1 [0108.261] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x105, lpBuffer=0x19e84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0108.261] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\*", lpFindFileData=0x19eac0 | out: lpFindFileData=0x19eac0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb47c4fc2, ftLastAccessTime.dwHighDateTime=0x1d675cf, ftLastWriteTime.dwLowDateTime=0xb47c4fc2, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77bc78 [0108.261] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb47c4fc2, ftLastAccessTime.dwHighDateTime=0x1d675cf, ftLastWriteTime.dwLowDateTime=0xb47c4fc2, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.261] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7eb0890, ftCreationTime.dwHighDateTime=0x1d5ebfb, ftLastAccessTime.dwLowDateTime=0x79d80da0, ftLastAccessTime.dwHighDateTime=0x1d5e750, ftLastWriteTime.dwLowDateTime=0xb1c3c873, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x2d00, dwReserved0=0x0, dwReserved1=0x0, cFileName="-47zDmLsrM5Zlxp.pdf.spybuster", cAlternateFileName="-47ZDM~1.SPY")) returned 1 [0108.262] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8a3570, ftCreationTime.dwHighDateTime=0x1d5ef40, ftLastAccessTime.dwLowDateTime=0x7723d850, ftLastAccessTime.dwHighDateTime=0x1d5e83b, ftLastWriteTime.dwLowDateTime=0x7723d850, ftLastWriteTime.dwHighDateTime=0x1d5e83b, nFileSizeHigh=0x0, nFileSizeLow=0x439a, dwReserved0=0x0, dwReserved1=0x0, cFileName="1Kgxn5i.flv", cAlternateFileName="")) returned 1 [0108.262] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda8f480, ftCreationTime.dwHighDateTime=0x1d5e199, ftLastAccessTime.dwLowDateTime=0x59f693c0, ftLastAccessTime.dwHighDateTime=0x1d5edf5, ftLastWriteTime.dwLowDateTime=0x59f693c0, ftLastWriteTime.dwHighDateTime=0x1d5edf5, nFileSizeHigh=0x0, nFileSizeLow=0x18df3, dwReserved0=0x0, dwReserved1=0x0, cFileName="3rJdOON4hNmP6e0EHCh.m4a", cAlternateFileName="3RJDOO~1.M4A")) returned 1 [0108.262] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29974740, ftCreationTime.dwHighDateTime=0x1d5efa5, ftLastAccessTime.dwLowDateTime=0xbb41ade0, ftLastAccessTime.dwHighDateTime=0x1d5eb5c, ftLastWriteTime.dwLowDateTime=0xb1eeb368, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xec90, dwReserved0=0x0, dwReserved1=0x0, cFileName="4Q6AfqT.avi.spybuster", cAlternateFileName="4Q6AFQ~1.SPY")) returned 1 [0108.262] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6376180, ftCreationTime.dwHighDateTime=0x1d5e0d8, ftLastAccessTime.dwLowDateTime=0xccd62180, ftLastAccessTime.dwHighDateTime=0x1d5ea7b, ftLastWriteTime.dwLowDateTime=0xccd62180, ftLastWriteTime.dwHighDateTime=0x1d5ea7b, nFileSizeHigh=0x0, nFileSizeLow=0x18d59, dwReserved0=0x0, dwReserved1=0x0, cFileName="9c3g-_Bopd2ctLelrM.wav", cAlternateFileName="9C3G-_~1.WAV")) returned 1 [0108.262] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0108.262] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbda4b120, ftCreationTime.dwHighDateTime=0x1d5e5eb, ftLastAccessTime.dwLowDateTime=0x2173e770, ftLastAccessTime.dwHighDateTime=0x1d5e81c, ftLastWriteTime.dwLowDateTime=0xb2401b37, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xc70, dwReserved0=0x0, dwReserved1=0x0, cFileName="dTNP.mp4.spybuster", cAlternateFileName="DTNPMP~1.SPY")) returned 1 [0108.263] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2e15fa0, ftCreationTime.dwHighDateTime=0x1d5e101, ftLastAccessTime.dwLowDateTime=0x28f23750, ftLastAccessTime.dwHighDateTime=0x1d5e6d6, ftLastWriteTime.dwLowDateTime=0xb2ca6362, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x3c70, dwReserved0=0x0, dwReserved1=0x0, cFileName="DUCGlGpLhZ7ehP0yEx.mp3.spybuster", cAlternateFileName="DUCGLG~1.SPY")) returned 1 [0108.263] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2b5ee70, ftCreationTime.dwHighDateTime=0x1d5e75f, ftLastAccessTime.dwLowDateTime=0x5bdb62e0, ftLastAccessTime.dwHighDateTime=0x1d5e91f, ftLastWriteTime.dwLowDateTime=0x5bdb62e0, ftLastWriteTime.dwHighDateTime=0x1d5e91f, nFileSizeHigh=0x0, nFileSizeLow=0xdf26, dwReserved0=0x0, dwReserved1=0x0, cFileName="EmgId2OIYKEN.wav", cAlternateFileName="EMGID2~1.WAV")) returned 1 [0108.263] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbe49440, ftCreationTime.dwHighDateTime=0x1d5e1fe, ftLastAccessTime.dwLowDateTime=0x5019f40, ftLastAccessTime.dwHighDateTime=0x1d5e814, ftLastWriteTime.dwLowDateTime=0xb2ccc8b4, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x2f10, dwReserved0=0x0, dwReserved1=0x0, cFileName="gqKfeceE.mkv.spybuster", cAlternateFileName="GQKFEC~1.SPY")) returned 1 [0108.263] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f5a9210, ftCreationTime.dwHighDateTime=0x1d5e58a, ftLastAccessTime.dwLowDateTime=0xa09741e0, ftLastAccessTime.dwHighDateTime=0x1d5ebab, ftLastWriteTime.dwLowDateTime=0xa09741e0, ftLastWriteTime.dwHighDateTime=0x1d5ebab, nFileSizeHigh=0x0, nFileSizeLow=0x57a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="hC4J1IJ.m4a", cAlternateFileName="")) returned 1 [0108.263] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x489b0110, ftCreationTime.dwHighDateTime=0x1d5e52b, ftLastAccessTime.dwLowDateTime=0xb49d0d70, ftLastAccessTime.dwHighDateTime=0x1d5eca8, ftLastWriteTime.dwLowDateTime=0xb2f2ea58, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xf0d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IuuHCN.mp3.spybuster", cAlternateFileName="IUUHCN~1.SPY")) returned 1 [0108.264] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eb39880, ftCreationTime.dwHighDateTime=0x1d5e84f, ftLastAccessTime.dwLowDateTime=0x206e43a0, ftLastAccessTime.dwHighDateTime=0x1d5e571, ftLastWriteTime.dwLowDateTime=0xb2fed726, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="izq8n6_qgBXoY.png.spybuster", cAlternateFileName="IZQ8N6~1.SPY")) returned 1 [0108.264] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x952c3a40, ftCreationTime.dwHighDateTime=0x1d5ee6c, ftLastAccessTime.dwLowDateTime=0x1f8e42e0, ftLastAccessTime.dwHighDateTime=0x1d5ea5e, ftLastWriteTime.dwLowDateTime=0xb30f87c2, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xfc80, dwReserved0=0x0, dwReserved1=0x0, cFileName="jGYH8Y8r9kj.jpg.spybuster", cAlternateFileName="JGYH8Y~1.SPY")) returned 1 [0108.264] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0957f40, ftCreationTime.dwHighDateTime=0x1d5eeb4, ftLastAccessTime.dwLowDateTime=0x1ce0f9d0, ftLastAccessTime.dwHighDateTime=0x1d5ef17, ftLastWriteTime.dwLowDateTime=0xb320368c, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x6d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="jUesZvd-s.jpg.spybuster", cAlternateFileName="JUESZV~1.SPY")) returned 1 [0108.264] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b1c4680, ftCreationTime.dwHighDateTime=0x1d5e923, ftLastAccessTime.dwLowDateTime=0x9c92a910, ftLastAccessTime.dwHighDateTime=0x1d5ef5a, ftLastWriteTime.dwLowDateTime=0x9c92a910, ftLastWriteTime.dwHighDateTime=0x1d5ef5a, nFileSizeHigh=0x0, nFileSizeLow=0xf714, dwReserved0=0x0, dwReserved1=0x0, cFileName="juhe8-MFzDg4vFSNwTUJ.ots", cAlternateFileName="JUHE8-~1.OTS")) returned 1 [0108.265] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb136100, ftCreationTime.dwHighDateTime=0x1d5ee60, ftLastAccessTime.dwLowDateTime=0xc1dd2290, ftLastAccessTime.dwHighDateTime=0x1d5ef1e, ftLastWriteTime.dwLowDateTime=0xb3465dec, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x17f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="mmcdT0ssmgFqSRwRvCY.mkv.spybuster", cAlternateFileName="MMCDT0~1.SPY")) returned 1 [0108.265] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3890690, ftCreationTime.dwHighDateTime=0x1d5efcf, ftLastAccessTime.dwLowDateTime=0x6237dcf0, ftLastAccessTime.dwHighDateTime=0x1d5e2d4, ftLastWriteTime.dwLowDateTime=0x6237dcf0, ftLastWriteTime.dwHighDateTime=0x1d5e2d4, nFileSizeHigh=0x0, nFileSizeLow=0x16ae5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OJ6j-3IF-8uQrVieY52.m4a", cAlternateFileName="OJ6J-3~1.M4A")) returned 1 [0108.265] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9129b00, ftCreationTime.dwHighDateTime=0x1d5e4dc, ftLastAccessTime.dwLowDateTime=0xc34165f0, ftLastAccessTime.dwHighDateTime=0x1d5e538, ftLastWriteTime.dwLowDateTime=0xb367be17, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x17da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oXn8yyFK6hp.png.spybuster", cAlternateFileName="OXN8YY~1.SPY")) returned 1 [0108.265] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a5dc40, ftCreationTime.dwHighDateTime=0x1d5e367, ftLastAccessTime.dwLowDateTime=0xf5961ca0, ftLastAccessTime.dwHighDateTime=0x1d5e342, ftLastWriteTime.dwLowDateTime=0xb37ad5f3, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x81a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QAhgTD.xlsx.spybuster", cAlternateFileName="QAHGTD~1.SPY")) returned 1 [0108.266] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d687c90, ftCreationTime.dwHighDateTime=0x1d5e556, ftLastAccessTime.dwLowDateTime=0x6be66c40, ftLastAccessTime.dwHighDateTime=0x1d5e7ce, ftLastWriteTime.dwLowDateTime=0x6be66c40, ftLastWriteTime.dwHighDateTime=0x1d5e7ce, nFileSizeHigh=0x0, nFileSizeLow=0x60c, dwReserved0=0x0, dwReserved1=0x0, cFileName="qBFdm0Is5lnF mFj.wav", cAlternateFileName="QBFDM0~1.WAV")) returned 1 [0108.266] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5c460, ftCreationTime.dwHighDateTime=0x1d5ef1d, ftLastAccessTime.dwLowDateTime=0x60c57260, ftLastAccessTime.dwHighDateTime=0x1d5e720, ftLastWriteTime.dwLowDateTime=0x60c57260, ftLastWriteTime.dwHighDateTime=0x1d5e720, nFileSizeHigh=0x0, nFileSizeLow=0x5689, dwReserved0=0x0, dwReserved1=0x0, cFileName="qIE7cRi_s5t08y7Zd.flv", cAlternateFileName="QIE7CR~1.FLV")) returned 1 [0108.266] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ed06370, ftCreationTime.dwHighDateTime=0x1d5efaf, ftLastAccessTime.dwLowDateTime=0xc46abbc0, ftLastAccessTime.dwHighDateTime=0x1d5e84e, ftLastWriteTime.dwLowDateTime=0xb386bcf3, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x1030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rwl9j7XAHVz8.png.spybuster", cAlternateFileName="RWL9J7~1.SPY")) returned 1 [0108.348] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4292da0, ftCreationTime.dwHighDateTime=0x1d5e8bd, ftLastAccessTime.dwLowDateTime=0xa59b6b90, ftLastAccessTime.dwHighDateTime=0x1d5efab, ftLastWriteTime.dwLowDateTime=0xb38b8212, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xc9b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tcazK41Fi.odt.spybuster", cAlternateFileName="TCAZK4~1.SPY")) returned 1 [0108.348] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c7e1380, ftCreationTime.dwHighDateTime=0x1d5e82b, ftLastAccessTime.dwLowDateTime=0x3aa24780, ftLastAccessTime.dwHighDateTime=0x1d5e7dd, ftLastWriteTime.dwLowDateTime=0x3aa24780, ftLastWriteTime.dwHighDateTime=0x1d5e7dd, nFileSizeHigh=0x0, nFileSizeLow=0x14bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="tnfUvyOeuyO.gif", cAlternateFileName="TNFUVY~1.GIF")) returned 1 [0108.348] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdee46e0, ftCreationTime.dwHighDateTime=0x1d5ea15, ftLastAccessTime.dwLowDateTime=0x65aff860, ftLastAccessTime.dwHighDateTime=0x1d5e3b3, ftLastWriteTime.dwLowDateTime=0x65aff860, ftLastWriteTime.dwHighDateTime=0x1d5e3b3, nFileSizeHigh=0x0, nFileSizeLow=0xf385, dwReserved0=0x0, dwReserved1=0x0, cFileName="U2OUpUA6HKwM.wav", cAlternateFileName="U2OUPU~1.WAV")) returned 1 [0108.348] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905d89f0, ftCreationTime.dwHighDateTime=0x1d5e873, ftLastAccessTime.dwLowDateTime=0xee96aa00, ftLastAccessTime.dwHighDateTime=0x1d5e9c8, ftLastWriteTime.dwLowDateTime=0xb3a0f648, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x9380, dwReserved0=0x0, dwReserved1=0x0, cFileName="v8t4CtjbLuJ4D9yyWCY.csv.spybuster", cAlternateFileName="V8T4CT~1.SPY")) returned 1 [0108.348] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e03f0, ftCreationTime.dwHighDateTime=0x1d5effd, ftLastAccessTime.dwLowDateTime=0xd6287700, ftLastAccessTime.dwHighDateTime=0x1d5e4b4, ftLastWriteTime.dwLowDateTime=0xd6287700, ftLastWriteTime.dwHighDateTime=0x1d5e4b4, nFileSizeHigh=0x0, nFileSizeLow=0x7588, dwReserved0=0x0, dwReserved1=0x0, cFileName="vrvFJk_XLdEa.ots", cAlternateFileName="VRVFJK~1.OTS")) returned 1 [0108.348] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe62f0290, ftCreationTime.dwHighDateTime=0x1d5e41e, ftLastAccessTime.dwLowDateTime=0x6c5d7080, ftLastAccessTime.dwHighDateTime=0x1d5edee, ftLastWriteTime.dwLowDateTime=0xb3b1a7e0, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x18dc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vvZTWTV8FICU-m4A.mkv.spybuster", cAlternateFileName="VVZTWT~1.SPY")) returned 1 [0108.349] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb77bc140, ftCreationTime.dwHighDateTime=0x1d5e211, ftLastAccessTime.dwLowDateTime=0xe4da2640, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xb3c4baf9, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xc1d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Whoz y9gOm9hnbG0fVu.avi.spybuster", cAlternateFileName="WHOZY9~1.SPY")) returned 1 [0108.349] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729eec90, ftCreationTime.dwHighDateTime=0x1d5e442, ftLastAccessTime.dwLowDateTime=0x3d5a22d0, ftLastAccessTime.dwHighDateTime=0x1d5e0fe, ftLastWriteTime.dwLowDateTime=0xb41f527f, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x17f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="XHwpWMtf0Ll_vF0.csv.spybuster", cAlternateFileName="XHWPWM~1.SPY")) returned 1 [0108.349] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88ebc310, ftCreationTime.dwHighDateTime=0x1d5e61d, ftLastAccessTime.dwLowDateTime=0xb5812c85, ftLastAccessTime.dwHighDateTime=0x1d675cf, ftLastWriteTime.dwLowDateTime=0xb5812c85, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XuEywee1k", cAlternateFileName="XUEYWE~1")) returned 1 [0108.349] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c5e00, ftCreationTime.dwHighDateTime=0x1d5e1e5, ftLastAccessTime.dwLowDateTime=0x5a2476f0, ftLastAccessTime.dwHighDateTime=0x1d5e765, ftLastWriteTime.dwLowDateTime=0xb42b3f78, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x2710, dwReserved0=0x0, dwReserved1=0x0, cFileName="yyMfsjbfc_l4hZT41.pptx.spybuster", cAlternateFileName="YYMFSJ~1.SPY")) returned 1 [0108.349] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36777fc0, ftCreationTime.dwHighDateTime=0x1d5efc3, ftLastAccessTime.dwLowDateTime=0x680fb8d0, ftLastAccessTime.dwHighDateTime=0x1d5ec4f, ftLastWriteTime.dwLowDateTime=0xb4300424, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xed20, dwReserved0=0x0, dwReserved1=0x0, cFileName="z7rP0.mkv.spybuster", cAlternateFileName="Z7RP0M~1.SPY")) returned 1 [0108.349] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b86cee0, ftCreationTime.dwHighDateTime=0x1d5e6dd, ftLastAccessTime.dwLowDateTime=0x8a021de0, ftLastAccessTime.dwHighDateTime=0x1d5e806, ftLastWriteTime.dwLowDateTime=0x8a021de0, ftLastWriteTime.dwHighDateTime=0x1d5e806, nFileSizeHigh=0x0, nFileSizeLow=0x9af1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z8kOJnO7DOG.m4a", cAlternateFileName="Z8KOJN~1.M4A")) returned 1 [0108.350] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a402310, ftCreationTime.dwHighDateTime=0x1d5e483, ftLastAccessTime.dwLowDateTime=0x375f8c90, ftLastAccessTime.dwHighDateTime=0x1d5e972, ftLastWriteTime.dwLowDateTime=0xb43c06f3, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x7090, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zd_0jo8eYB83T.ppt.spybuster", cAlternateFileName="ZD_0JO~1.SPY")) returned 1 [0108.350] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cd42af0, ftCreationTime.dwHighDateTime=0x1d5ecda, ftLastAccessTime.dwLowDateTime=0x4d220560, ftLastAccessTime.dwHighDateTime=0x1d5ed66, ftLastWriteTime.dwLowDateTime=0xb453c724, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x13a10, dwReserved0=0x0, dwReserved1=0x0, cFileName="zgTRfP_2OhRR.bmp.spybuster", cAlternateFileName="ZGTRFP~1.SPY")) returned 1 [0108.350] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c366b60, ftCreationTime.dwHighDateTime=0x1d5e70e, ftLastAccessTime.dwLowDateTime=0xed0b18c0, ftLastAccessTime.dwHighDateTime=0x1d5e89b, ftLastWriteTime.dwLowDateTime=0xb47c4fc2, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x6250, dwReserved0=0x0, dwReserved1=0x0, cFileName="_pd3xKHZBnocQk_.odt.spybuster", cAlternateFileName="_PD3XK~1.SPY")) returned 1 [0108.350] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c366b60, ftCreationTime.dwHighDateTime=0x1d5e70e, ftLastAccessTime.dwLowDateTime=0xed0b18c0, ftLastAccessTime.dwHighDateTime=0x1d5e89b, ftLastWriteTime.dwLowDateTime=0xb47c4fc2, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x6250, dwReserved0=0x0, dwReserved1=0x0, cFileName="_pd3xKHZBnocQk_.odt.spybuster", cAlternateFileName="_PD3XK~1.SPY")) returned 0 [0108.350] FindClose (in: hFindFile=0x77bc78 | out: hFindFile=0x77bc78) returned 1 [0108.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed54) returned 1 [0108.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed60) returned 1 [0108.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed24) returned 1 [0108.351] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k", nBufferLength=0x105, lpBuffer=0x19e7d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k", lpFilePart=0x0) returned 0x21 [0108.351] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\*", lpFindFileData=0x19ea4c | out: lpFindFileData=0x19ea4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88ebc310, ftCreationTime.dwHighDateTime=0x1d5e61d, ftLastAccessTime.dwLowDateTime=0xb5812c85, ftLastAccessTime.dwHighDateTime=0x1d675cf, ftLastWriteTime.dwLowDateTime=0xb5812c85, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77bc78 [0108.351] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88ebc310, ftCreationTime.dwHighDateTime=0x1d5e61d, ftLastAccessTime.dwLowDateTime=0xb5812c85, ftLastAccessTime.dwHighDateTime=0x1d675cf, ftLastWriteTime.dwLowDateTime=0xb5812c85, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.351] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46742e70, ftCreationTime.dwHighDateTime=0x1d5ec47, ftLastAccessTime.dwLowDateTime=0xc7d15cf0, ftLastAccessTime.dwHighDateTime=0x1d5e92b, ftLastWriteTime.dwLowDateTime=0xb4bcaf19, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x13b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="37LV1pcPLl0DszL.avi.spybuster", cAlternateFileName="37LV1P~1.SPY")) returned 1 [0108.351] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f092b0, ftCreationTime.dwHighDateTime=0x1d5eb6f, ftLastAccessTime.dwLowDateTime=0xc165ba60, ftLastAccessTime.dwHighDateTime=0x1d5e2c2, ftLastWriteTime.dwLowDateTime=0xc165ba60, ftLastWriteTime.dwHighDateTime=0x1d5e2c2, nFileSizeHigh=0x0, nFileSizeLow=0x18bf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="5fdudcLMeirUJUqZB.flv", cAlternateFileName="5FDUDC~1.FLV")) returned 1 [0108.351] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2effa0d0, ftCreationTime.dwHighDateTime=0x1d5e319, ftLastAccessTime.dwLowDateTime=0x67b77790, ftLastAccessTime.dwHighDateTime=0x1d5e4b8, ftLastWriteTime.dwLowDateTime=0x67b77790, ftLastWriteTime.dwHighDateTime=0x1d5e4b8, nFileSizeHigh=0x0, nFileSizeLow=0xc05f, dwReserved0=0x0, dwReserved1=0x0, cFileName="g1iy9RNnpm3E.m4a", cAlternateFileName="G1IY9R~1.M4A")) returned 1 [0108.351] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf7e8c00, ftCreationTime.dwHighDateTime=0x1d5ea30, ftLastAccessTime.dwLowDateTime=0xc73e2990, ftLastAccessTime.dwHighDateTime=0x1d5ee4d, ftLastWriteTime.dwLowDateTime=0xb4cafd04, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x7850, dwReserved0=0x0, dwReserved1=0x0, cFileName="gtCKc0bFZ4FIiVAA.avi.spybuster", cAlternateFileName="GTCKC0~1.SPY")) returned 1 [0108.352] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a0f9200, ftCreationTime.dwHighDateTime=0x1d5f0e5, ftLastAccessTime.dwLowDateTime=0x336c8840, ftLastAccessTime.dwHighDateTime=0x1d5e413, ftLastWriteTime.dwLowDateTime=0x336c8840, ftLastWriteTime.dwHighDateTime=0x1d5e413, nFileSizeHigh=0x0, nFileSizeLow=0x240f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ja_53_R4GZ.wav", cAlternateFileName="JA_53_~1.WAV")) returned 1 [0108.352] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x715292f0, ftCreationTime.dwHighDateTime=0x1d5e812, ftLastAccessTime.dwLowDateTime=0xc1dd10b0, ftLastAccessTime.dwHighDateTime=0x1d5e709, ftLastWriteTime.dwLowDateTime=0xb4dbada8, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x14c80, dwReserved0=0x0, dwReserved1=0x0, cFileName="kDVwA8SOo2.pptx.spybuster", cAlternateFileName="KDVWA8~1.SPY")) returned 1 [0108.352] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7025b80, ftCreationTime.dwHighDateTime=0x1d5ee5a, ftLastAccessTime.dwLowDateTime=0x920d7920, ftLastAccessTime.dwHighDateTime=0x1d5e0fa, ftLastWriteTime.dwLowDateTime=0xb4ec5e35, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xcfb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ktRNe.bmp.spybuster", cAlternateFileName="KTRNEB~1.SPY")) returned 1 [0108.352] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd08cc2f0, ftCreationTime.dwHighDateTime=0x1d5e4bf, ftLastAccessTime.dwLowDateTime=0x11985c00, ftLastAccessTime.dwHighDateTime=0x1d5e2ea, ftLastWriteTime.dwLowDateTime=0x11985c00, ftLastWriteTime.dwHighDateTime=0x1d5e2ea, nFileSizeHigh=0x0, nFileSizeLow=0xda05, dwReserved0=0x0, dwReserved1=0x0, cFileName="mBOHZ.flv", cAlternateFileName="")) returned 1 [0108.352] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5b3acd0, ftCreationTime.dwHighDateTime=0x1d5ec3b, ftLastAccessTime.dwLowDateTime=0x9d6fef0, ftLastAccessTime.dwHighDateTime=0x1d5e92e, ftLastWriteTime.dwLowDateTime=0xb51a0a67, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x14140, dwReserved0=0x0, dwReserved1=0x0, cFileName="O6OfXra9cBHeO1YcjK.mkv.spybuster", cAlternateFileName="O6OFXR~1.SPY")) returned 1 [0108.352] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x234e0ad0, ftCreationTime.dwHighDateTime=0x1d5e2db, ftLastAccessTime.dwLowDateTime=0x3fac8db0, ftLastAccessTime.dwHighDateTime=0x1d5e6e5, ftLastWriteTime.dwLowDateTime=0xb5269486, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x97d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qegWvUuLpi.jpg.spybuster", cAlternateFileName="QEGWVU~1.SPY")) returned 1 [0108.352] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b36a810, ftCreationTime.dwHighDateTime=0x1d5ecd4, ftLastAccessTime.dwLowDateTime=0xb2f688c0, ftLastAccessTime.dwHighDateTime=0x1d5e5aa, ftLastWriteTime.dwLowDateTime=0xb2f688c0, ftLastWriteTime.dwHighDateTime=0x1d5e5aa, nFileSizeHigh=0x0, nFileSizeLow=0x10194, dwReserved0=0x0, dwReserved1=0x0, cFileName="qr_1C2yCGZbM1XeZG.pps", cAlternateFileName="QR_1C2~1.PPS")) returned 1 [0108.353] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704c2760, ftCreationTime.dwHighDateTime=0x1d5ed60, ftLastAccessTime.dwLowDateTime=0xa32225c0, ftLastAccessTime.dwHighDateTime=0x1d5e448, ftLastWriteTime.dwLowDateTime=0xb5432f8c, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x2f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="S3uubf.ppt.spybuster", cAlternateFileName="S3UUBF~1.SPY")) returned 1 [0108.353] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac6e730, ftCreationTime.dwHighDateTime=0x1d5e787, ftLastAccessTime.dwLowDateTime=0x5b6db310, ftLastAccessTime.dwHighDateTime=0x1d5f119, ftLastWriteTime.dwLowDateTime=0xb572e065, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x7800, dwReserved0=0x0, dwReserved1=0x0, cFileName="WFupxD4xWvOPahG.jpg.spybuster", cAlternateFileName="WFUPXD~1.SPY")) returned 1 [0108.353] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0108.353] FindClose (in: hFindFile=0x77bc78 | out: hFindFile=0x77bc78) returned 1 [0108.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ece0) returned 1 [0108.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecec) returned 1 [0108.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed24) returned 1 [0108.353] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k", nBufferLength=0x105, lpBuffer=0x19e7d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k", lpFilePart=0x0) returned 0x21 [0108.353] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuEywee1k\\*", lpFindFileData=0x19ea4c | out: lpFindFileData=0x19ea4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88ebc310, ftCreationTime.dwHighDateTime=0x1d5e61d, ftLastAccessTime.dwLowDateTime=0xb5812c85, ftLastAccessTime.dwHighDateTime=0x1d675cf, ftLastWriteTime.dwLowDateTime=0xb5812c85, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b738 [0108.353] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88ebc310, ftCreationTime.dwHighDateTime=0x1d5e61d, ftLastAccessTime.dwLowDateTime=0xb5812c85, ftLastAccessTime.dwHighDateTime=0x1d675cf, ftLastWriteTime.dwLowDateTime=0xb5812c85, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.354] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46742e70, ftCreationTime.dwHighDateTime=0x1d5ec47, ftLastAccessTime.dwLowDateTime=0xc7d15cf0, ftLastAccessTime.dwHighDateTime=0x1d5e92b, ftLastWriteTime.dwLowDateTime=0xb4bcaf19, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x13b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="37LV1pcPLl0DszL.avi.spybuster", cAlternateFileName="37LV1P~1.SPY")) returned 1 [0108.354] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f092b0, ftCreationTime.dwHighDateTime=0x1d5eb6f, ftLastAccessTime.dwLowDateTime=0xc165ba60, ftLastAccessTime.dwHighDateTime=0x1d5e2c2, ftLastWriteTime.dwLowDateTime=0xc165ba60, ftLastWriteTime.dwHighDateTime=0x1d5e2c2, nFileSizeHigh=0x0, nFileSizeLow=0x18bf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="5fdudcLMeirUJUqZB.flv", cAlternateFileName="5FDUDC~1.FLV")) returned 1 [0108.354] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2effa0d0, ftCreationTime.dwHighDateTime=0x1d5e319, ftLastAccessTime.dwLowDateTime=0x67b77790, ftLastAccessTime.dwHighDateTime=0x1d5e4b8, ftLastWriteTime.dwLowDateTime=0x67b77790, ftLastWriteTime.dwHighDateTime=0x1d5e4b8, nFileSizeHigh=0x0, nFileSizeLow=0xc05f, dwReserved0=0x0, dwReserved1=0x0, cFileName="g1iy9RNnpm3E.m4a", cAlternateFileName="G1IY9R~1.M4A")) returned 1 [0108.354] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf7e8c00, ftCreationTime.dwHighDateTime=0x1d5ea30, ftLastAccessTime.dwLowDateTime=0xc73e2990, ftLastAccessTime.dwHighDateTime=0x1d5ee4d, ftLastWriteTime.dwLowDateTime=0xb4cafd04, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x7850, dwReserved0=0x0, dwReserved1=0x0, cFileName="gtCKc0bFZ4FIiVAA.avi.spybuster", cAlternateFileName="GTCKC0~1.SPY")) returned 1 [0108.354] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a0f9200, ftCreationTime.dwHighDateTime=0x1d5f0e5, ftLastAccessTime.dwLowDateTime=0x336c8840, ftLastAccessTime.dwHighDateTime=0x1d5e413, ftLastWriteTime.dwLowDateTime=0x336c8840, ftLastWriteTime.dwHighDateTime=0x1d5e413, nFileSizeHigh=0x0, nFileSizeLow=0x240f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ja_53_R4GZ.wav", cAlternateFileName="JA_53_~1.WAV")) returned 1 [0108.354] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x715292f0, ftCreationTime.dwHighDateTime=0x1d5e812, ftLastAccessTime.dwLowDateTime=0xc1dd10b0, ftLastAccessTime.dwHighDateTime=0x1d5e709, ftLastWriteTime.dwLowDateTime=0xb4dbada8, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x14c80, dwReserved0=0x0, dwReserved1=0x0, cFileName="kDVwA8SOo2.pptx.spybuster", cAlternateFileName="KDVWA8~1.SPY")) returned 1 [0108.354] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7025b80, ftCreationTime.dwHighDateTime=0x1d5ee5a, ftLastAccessTime.dwLowDateTime=0x920d7920, ftLastAccessTime.dwHighDateTime=0x1d5e0fa, ftLastWriteTime.dwLowDateTime=0xb4ec5e35, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xcfb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ktRNe.bmp.spybuster", cAlternateFileName="KTRNEB~1.SPY")) returned 1 [0108.354] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd08cc2f0, ftCreationTime.dwHighDateTime=0x1d5e4bf, ftLastAccessTime.dwLowDateTime=0x11985c00, ftLastAccessTime.dwHighDateTime=0x1d5e2ea, ftLastWriteTime.dwLowDateTime=0x11985c00, ftLastWriteTime.dwHighDateTime=0x1d5e2ea, nFileSizeHigh=0x0, nFileSizeLow=0xda05, dwReserved0=0x0, dwReserved1=0x0, cFileName="mBOHZ.flv", cAlternateFileName="")) returned 1 [0108.354] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5b3acd0, ftCreationTime.dwHighDateTime=0x1d5ec3b, ftLastAccessTime.dwLowDateTime=0x9d6fef0, ftLastAccessTime.dwHighDateTime=0x1d5e92e, ftLastWriteTime.dwLowDateTime=0xb51a0a67, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x14140, dwReserved0=0x0, dwReserved1=0x0, cFileName="O6OfXra9cBHeO1YcjK.mkv.spybuster", cAlternateFileName="O6OFXR~1.SPY")) returned 1 [0108.354] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x234e0ad0, ftCreationTime.dwHighDateTime=0x1d5e2db, ftLastAccessTime.dwLowDateTime=0x3fac8db0, ftLastAccessTime.dwHighDateTime=0x1d5e6e5, ftLastWriteTime.dwLowDateTime=0xb5269486, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x97d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qegWvUuLpi.jpg.spybuster", cAlternateFileName="QEGWVU~1.SPY")) returned 1 [0108.355] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b36a810, ftCreationTime.dwHighDateTime=0x1d5ecd4, ftLastAccessTime.dwLowDateTime=0xb2f688c0, ftLastAccessTime.dwHighDateTime=0x1d5e5aa, ftLastWriteTime.dwLowDateTime=0xb2f688c0, ftLastWriteTime.dwHighDateTime=0x1d5e5aa, nFileSizeHigh=0x0, nFileSizeLow=0x10194, dwReserved0=0x0, dwReserved1=0x0, cFileName="qr_1C2yCGZbM1XeZG.pps", cAlternateFileName="QR_1C2~1.PPS")) returned 1 [0108.355] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704c2760, ftCreationTime.dwHighDateTime=0x1d5ed60, ftLastAccessTime.dwLowDateTime=0xa32225c0, ftLastAccessTime.dwHighDateTime=0x1d5e448, ftLastWriteTime.dwLowDateTime=0xb5432f8c, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x2f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="S3uubf.ppt.spybuster", cAlternateFileName="S3UUBF~1.SPY")) returned 1 [0108.355] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac6e730, ftCreationTime.dwHighDateTime=0x1d5e787, ftLastAccessTime.dwLowDateTime=0x5b6db310, ftLastAccessTime.dwHighDateTime=0x1d5f119, ftLastWriteTime.dwLowDateTime=0xb572e065, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x7800, dwReserved0=0x0, dwReserved1=0x0, cFileName="WFupxD4xWvOPahG.jpg.spybuster", cAlternateFileName="WFUPXD~1.SPY")) returned 1 [0108.355] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac6e730, ftCreationTime.dwHighDateTime=0x1d5e787, ftLastAccessTime.dwLowDateTime=0x5b6db310, ftLastAccessTime.dwHighDateTime=0x1d5f119, ftLastWriteTime.dwLowDateTime=0xb572e065, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x7800, dwReserved0=0x0, dwReserved1=0x0, cFileName="WFupxD4xWvOPahG.jpg.spybuster", cAlternateFileName="WFUPXD~1.SPY")) returned 0 [0108.355] FindClose (in: hFindFile=0x77b738 | out: hFindFile=0x77b738) returned 1 [0108.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ece0) returned 1 [0108.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecec) returned 1 [0108.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed98) returned 1 [0108.355] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x19e84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0108.355] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x19eac0 | out: lpFindFileData=0x19eac0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe653c097, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe653c097, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b738 [0108.355] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe653c097, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe653c097, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.355] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58972110, ftCreationTime.dwHighDateTime=0x1d5e18f, ftLastAccessTime.dwLowDateTime=0x57177260, ftLastAccessTime.dwHighDateTime=0x1d5e1f1, ftLastWriteTime.dwLowDateTime=0x57177260, ftLastWriteTime.dwHighDateTime=0x1d5e1f1, nFileSizeHigh=0x0, nFileSizeLow=0xf76e, dwReserved0=0x0, dwReserved1=0x0, cFileName="0hrLyWpzFSh8iDlU_EN.ppt", cAlternateFileName="0HRLYW~1.PPT")) returned 1 [0108.355] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x449560d0, ftCreationTime.dwHighDateTime=0x1d570cb, ftLastAccessTime.dwLowDateTime=0xdc914960, ftLastAccessTime.dwHighDateTime=0x1d5b957, ftLastWriteTime.dwLowDateTime=0xdc914960, ftLastWriteTime.dwHighDateTime=0x1d5b957, nFileSizeHigh=0x0, nFileSizeLow=0x7fb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="0iqjuiG77sXaPmH31.docx", cAlternateFileName="0IQJUI~1.DOC")) returned 1 [0108.355] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46272ba0, ftCreationTime.dwHighDateTime=0x1d5947e, ftLastAccessTime.dwLowDateTime=0xb23397f0, ftLastAccessTime.dwHighDateTime=0x1d5e1ba, ftLastWriteTime.dwLowDateTime=0xb23397f0, ftLastWriteTime.dwHighDateTime=0x1d5e1ba, nFileSizeHigh=0x0, nFileSizeLow=0x64ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="0x5WsDIyIuI2wirE.xlsx", cAlternateFileName="0X5WSD~1.XLS")) returned 1 [0108.356] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33b782d0, ftCreationTime.dwHighDateTime=0x1d59bb8, ftLastAccessTime.dwLowDateTime=0x48305db0, ftLastAccessTime.dwHighDateTime=0x1d5ab6a, ftLastWriteTime.dwLowDateTime=0x48305db0, ftLastWriteTime.dwHighDateTime=0x1d5ab6a, nFileSizeHigh=0x0, nFileSizeLow=0x144a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="0Y9-__rSJ.docx", cAlternateFileName="0Y9-__~1.DOC")) returned 1 [0108.356] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4429cc0, ftCreationTime.dwHighDateTime=0x1d5e80c, ftLastAccessTime.dwLowDateTime=0x57f52cf0, ftLastAccessTime.dwHighDateTime=0x1d5c02b, ftLastWriteTime.dwLowDateTime=0x57f52cf0, ftLastWriteTime.dwHighDateTime=0x1d5c02b, nFileSizeHigh=0x0, nFileSizeLow=0x1860b, dwReserved0=0x0, dwReserved1=0x0, cFileName="64X8qB K7sxwMedQDRO.xlsx", cAlternateFileName="64X8QB~1.XLS")) returned 1 [0108.356] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf5020f0, ftCreationTime.dwHighDateTime=0x1d5f007, ftLastAccessTime.dwLowDateTime=0x6b09d420, ftLastAccessTime.dwHighDateTime=0x1d5e91c, ftLastWriteTime.dwLowDateTime=0x6b09d420, ftLastWriteTime.dwHighDateTime=0x1d5e91c, nFileSizeHigh=0x0, nFileSizeLow=0xc259, dwReserved0=0x0, dwReserved1=0x0, cFileName="A2kMnWa.pdf", cAlternateFileName="")) returned 1 [0108.356] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3efdf80, ftCreationTime.dwHighDateTime=0x1d5ed56, ftLastAccessTime.dwLowDateTime=0x89e6fc30, ftLastAccessTime.dwHighDateTime=0x1d5ee92, ftLastWriteTime.dwLowDateTime=0x89e6fc30, ftLastWriteTime.dwHighDateTime=0x1d5ee92, nFileSizeHigh=0x0, nFileSizeLow=0x7a47, dwReserved0=0x0, dwReserved1=0x0, cFileName="aEjhQMV_M2E DNJnk-z.pps", cAlternateFileName="AEJHQM~1.PPS")) returned 1 [0108.356] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x662de30, ftCreationTime.dwHighDateTime=0x1d5eebd, ftLastAccessTime.dwLowDateTime=0xe023d9d0, ftLastAccessTime.dwHighDateTime=0x1d5ea8a, ftLastWriteTime.dwLowDateTime=0xe023d9d0, ftLastWriteTime.dwHighDateTime=0x1d5ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="aYu2P_HjBi7kE 3 j", cAlternateFileName="AYU2P_~1")) returned 1 [0108.356] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b4acf0, ftCreationTime.dwHighDateTime=0x1d5ddda, ftLastAccessTime.dwLowDateTime=0xfc09ce90, ftLastAccessTime.dwHighDateTime=0x1d57193, ftLastWriteTime.dwLowDateTime=0xfc09ce90, ftLastWriteTime.dwHighDateTime=0x1d57193, nFileSizeHigh=0x0, nFileSizeLow=0x1198e, dwReserved0=0x0, dwReserved1=0x0, cFileName="d4HEHXi0kT8GlCKBE.pptx", cAlternateFileName="D4HEHX~1.PPT")) returned 1 [0108.356] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x9daec75b, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x55000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb", cAlternateFileName="DATABA~1.ACC")) returned 1 [0108.356] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440c5760, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440c5760, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0108.356] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75350eb0, ftCreationTime.dwHighDateTime=0x1d5f0a1, ftLastAccessTime.dwLowDateTime=0xbef96730, ftLastAccessTime.dwHighDateTime=0x1d57be9, ftLastWriteTime.dwLowDateTime=0xbef96730, ftLastWriteTime.dwHighDateTime=0x1d57be9, nFileSizeHigh=0x0, nFileSizeLow=0x10424, dwReserved0=0x0, dwReserved1=0x0, cFileName="DJWO5e.xlsx", cAlternateFileName="DJWO5E~1.XLS")) returned 1 [0108.356] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd15d51e0, ftCreationTime.dwHighDateTime=0x1d5b305, ftLastAccessTime.dwLowDateTime=0x78a1fbc0, ftLastAccessTime.dwHighDateTime=0x1d5dc25, ftLastWriteTime.dwLowDateTime=0x78a1fbc0, ftLastWriteTime.dwHighDateTime=0x1d5dc25, nFileSizeHigh=0x0, nFileSizeLow=0x7c66, dwReserved0=0x0, dwReserved1=0x0, cFileName="F6GMw-0.xlsx", cAlternateFileName="F6GMW-~1.XLS")) returned 1 [0108.356] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab0cca50, ftCreationTime.dwHighDateTime=0x1d5e697, ftLastAccessTime.dwLowDateTime=0xcf63fba0, ftLastAccessTime.dwHighDateTime=0x1d5e8f7, ftLastWriteTime.dwLowDateTime=0xcf63fba0, ftLastWriteTime.dwHighDateTime=0x1d5e8f7, nFileSizeHigh=0x0, nFileSizeLow=0xec25, dwReserved0=0x0, dwReserved1=0x0, cFileName="hJtdT1o6Kae.pps", cAlternateFileName="HJTDT1~1.PPS")) returned 1 [0108.356] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc041b400, ftCreationTime.dwHighDateTime=0x1d5f07c, ftLastAccessTime.dwLowDateTime=0xe189d9d0, ftLastAccessTime.dwHighDateTime=0x1d5e816, ftLastWriteTime.dwLowDateTime=0xe189d9d0, ftLastWriteTime.dwHighDateTime=0x1d5e816, nFileSizeHigh=0x0, nFileSizeLow=0xf431, dwReserved0=0x0, dwReserved1=0x0, cFileName="I7Ja fh.pptx", cAlternateFileName="I7JAFH~1.PPT")) returned 1 [0108.356] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc30b3aa0, ftCreationTime.dwHighDateTime=0x1d57401, ftLastAccessTime.dwLowDateTime=0x1ed3a2b0, ftLastAccessTime.dwHighDateTime=0x1d5d8c9, ftLastWriteTime.dwLowDateTime=0x1ed3a2b0, ftLastWriteTime.dwHighDateTime=0x1d5d8c9, nFileSizeHigh=0x0, nFileSizeLow=0x23a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ikl9qy750ufc-G.pptx", cAlternateFileName="IKL9QY~1.PPT")) returned 1 [0108.356] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e39200, ftCreationTime.dwHighDateTime=0x1d5ccca, ftLastAccessTime.dwLowDateTime=0xe6666d00, ftLastAccessTime.dwHighDateTime=0x1d5d0e8, ftLastWriteTime.dwLowDateTime=0xe6666d00, ftLastWriteTime.dwHighDateTime=0x1d5d0e8, nFileSizeHigh=0x0, nFileSizeLow=0x7c42, dwReserved0=0x0, dwReserved1=0x0, cFileName="J6NJtsVFM1f_Q-F9.docx", cAlternateFileName="J6NJTS~1.DOC")) returned 1 [0108.356] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd227aa40, ftCreationTime.dwHighDateTime=0x1d5e9cd, ftLastAccessTime.dwLowDateTime=0x9cbce5d0, ftLastAccessTime.dwHighDateTime=0x1d5ef38, ftLastWriteTime.dwLowDateTime=0x9cbce5d0, ftLastWriteTime.dwHighDateTime=0x1d5ef38, nFileSizeHigh=0x0, nFileSizeLow=0xc0e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="j8WnIHQK.pps", cAlternateFileName="")) returned 1 [0108.356] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bc4fd50, ftCreationTime.dwHighDateTime=0x1d5e872, ftLastAccessTime.dwLowDateTime=0xbf4f2500, ftLastAccessTime.dwHighDateTime=0x1d5edbb, ftLastWriteTime.dwLowDateTime=0xbf4f2500, ftLastWriteTime.dwHighDateTime=0x1d5edbb, nFileSizeHigh=0x0, nFileSizeLow=0x113bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="KP5HOwM2YcoP.ods", cAlternateFileName="KP5HOW~1.ODS")) returned 1 [0108.356] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x812f74e0, ftCreationTime.dwHighDateTime=0x1d5808e, ftLastAccessTime.dwLowDateTime=0xd130650, ftLastAccessTime.dwHighDateTime=0x1d56d8b, ftLastWriteTime.dwLowDateTime=0xd130650, ftLastWriteTime.dwHighDateTime=0x1d56d8b, nFileSizeHigh=0x0, nFileSizeLow=0x14fd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LNxMafDRKQVGv.xlsx", cAlternateFileName="LNXMAF~1.XLS")) returned 1 [0108.356] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d527570, ftCreationTime.dwHighDateTime=0x1d5ec0c, ftLastAccessTime.dwLowDateTime=0x3d6a3020, ftLastAccessTime.dwHighDateTime=0x1d5e145, ftLastWriteTime.dwLowDateTime=0x3d6a3020, ftLastWriteTime.dwHighDateTime=0x1d5e145, nFileSizeHigh=0x0, nFileSizeLow=0x96ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOrxufOFI.xlsx", cAlternateFileName="LORXUF~1.XLS")) returned 1 [0108.356] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0108.356] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0108.357] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0108.357] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0108.357] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x5ee892ad, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0108.357] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe976b700, ftCreationTime.dwHighDateTime=0x1d5ec83, ftLastAccessTime.dwLowDateTime=0x22565e60, ftLastAccessTime.dwHighDateTime=0x1d5ea70, ftLastWriteTime.dwLowDateTime=0x22565e60, ftLastWriteTime.dwHighDateTime=0x1d5ea70, nFileSizeHigh=0x0, nFileSizeLow=0x13bdb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pd7W-tx1l.ppt", cAlternateFileName="PD7W-T~1.PPT")) returned 1 [0108.357] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58b8f6d0, ftCreationTime.dwHighDateTime=0x1d5c639, ftLastAccessTime.dwLowDateTime=0x8095c1d0, ftLastAccessTime.dwHighDateTime=0x1d56543, ftLastWriteTime.dwLowDateTime=0x8095c1d0, ftLastWriteTime.dwHighDateTime=0x1d56543, nFileSizeHigh=0x0, nFileSizeLow=0x108f, dwReserved0=0x0, dwReserved1=0x0, cFileName="q3_wqcOFyz--unpL.docx", cAlternateFileName="Q3_WQC~1.DOC")) returned 1 [0108.357] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46523ab0, ftCreationTime.dwHighDateTime=0x1d5e1d7, ftLastAccessTime.dwLowDateTime=0x25025e60, ftLastAccessTime.dwHighDateTime=0x1d5e387, ftLastWriteTime.dwLowDateTime=0x25025e60, ftLastWriteTime.dwHighDateTime=0x1d5e387, nFileSizeHigh=0x0, nFileSizeLow=0x15a9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="qWUBFrC9 V.pps", cAlternateFileName="QWUBFR~1.PPS")) returned 1 [0108.357] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65eeaa80, ftCreationTime.dwHighDateTime=0x1d592df, ftLastAccessTime.dwLowDateTime=0x43ff5280, ftLastAccessTime.dwHighDateTime=0x1d5d40c, ftLastWriteTime.dwLowDateTime=0x43ff5280, ftLastWriteTime.dwHighDateTime=0x1d5d40c, nFileSizeHigh=0x0, nFileSizeLow=0x965e, dwReserved0=0x0, dwReserved1=0x0, cFileName="sSefU-IfjA72.pptx", cAlternateFileName="SSEFU-~1.PPT")) returned 1 [0108.357] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd52cd30, ftCreationTime.dwHighDateTime=0x1d5ed01, ftLastAccessTime.dwLowDateTime=0xa5b6ce10, ftLastAccessTime.dwHighDateTime=0x1d5e8a0, ftLastWriteTime.dwLowDateTime=0xa5b6ce10, ftLastWriteTime.dwHighDateTime=0x1d5e8a0, nFileSizeHigh=0x0, nFileSizeLow=0x33a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="TvkmtfbI.pps", cAlternateFileName="")) returned 1 [0108.357] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0f64940, ftCreationTime.dwHighDateTime=0x1d5d0b9, ftLastAccessTime.dwLowDateTime=0xcd40ed60, ftLastAccessTime.dwHighDateTime=0x1d5da79, ftLastWriteTime.dwLowDateTime=0xcd40ed60, ftLastWriteTime.dwHighDateTime=0x1d5da79, nFileSizeHigh=0x0, nFileSizeLow=0xa7b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="VmHknY5nzMK.pptx", cAlternateFileName="VMHKNY~1.PPT")) returned 1 [0108.357] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacaf0c60, ftCreationTime.dwHighDateTime=0x1d571da, ftLastAccessTime.dwLowDateTime=0xb75cc30, ftLastAccessTime.dwHighDateTime=0x1d5b307, ftLastWriteTime.dwLowDateTime=0xb75cc30, ftLastWriteTime.dwHighDateTime=0x1d5b307, nFileSizeHigh=0x0, nFileSizeLow=0xb1e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ynj2Cy37O15ozYze12.docx", cAlternateFileName="YNJ2CY~1.DOC")) returned 1 [0108.357] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x451448d0, ftCreationTime.dwHighDateTime=0x1d5df2c, ftLastAccessTime.dwLowDateTime=0x7e0c3460, ftLastAccessTime.dwHighDateTime=0x1d57102, ftLastWriteTime.dwLowDateTime=0x7e0c3460, ftLastWriteTime.dwHighDateTime=0x1d57102, nFileSizeHigh=0x0, nFileSizeLow=0x17a63, dwReserved0=0x0, dwReserved1=0x0, cFileName="z5krZTI-Nz8bW.pptx", cAlternateFileName="Z5KRZT~1.PPT")) returned 1 [0108.357] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42635b20, ftCreationTime.dwHighDateTime=0x1d5e2c5, ftLastAccessTime.dwLowDateTime=0x625789e0, ftLastAccessTime.dwHighDateTime=0x1d5e92a, ftLastWriteTime.dwLowDateTime=0x625789e0, ftLastWriteTime.dwHighDateTime=0x1d5e92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zEsXkxPFsoDWAZhIb1LP", cAlternateFileName="ZESXKX~1")) returned 1 [0108.357] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42635b20, ftCreationTime.dwHighDateTime=0x1d5e2c5, ftLastAccessTime.dwLowDateTime=0x625789e0, ftLastAccessTime.dwHighDateTime=0x1d5e92a, ftLastWriteTime.dwLowDateTime=0x625789e0, ftLastWriteTime.dwHighDateTime=0x1d5e92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zEsXkxPFsoDWAZhIb1LP", cAlternateFileName="ZESXKX~1")) returned 0 [0108.357] FindClose (in: hFindFile=0x77b738 | out: hFindFile=0x77b738) returned 1 [0108.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed54) returned 1 [0108.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed60) returned 1 [0108.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed98) returned 1 [0108.357] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x19e84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0108.358] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x19eac0 | out: lpFindFileData=0x19eac0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe653c097, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe653c097, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b838 [0108.358] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe653c097, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe653c097, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.358] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58972110, ftCreationTime.dwHighDateTime=0x1d5e18f, ftLastAccessTime.dwLowDateTime=0x57177260, ftLastAccessTime.dwHighDateTime=0x1d5e1f1, ftLastWriteTime.dwLowDateTime=0x57177260, ftLastWriteTime.dwHighDateTime=0x1d5e1f1, nFileSizeHigh=0x0, nFileSizeLow=0xf76e, dwReserved0=0x0, dwReserved1=0x0, cFileName="0hrLyWpzFSh8iDlU_EN.ppt", cAlternateFileName="0HRLYW~1.PPT")) returned 1 [0108.358] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x449560d0, ftCreationTime.dwHighDateTime=0x1d570cb, ftLastAccessTime.dwLowDateTime=0xdc914960, ftLastAccessTime.dwHighDateTime=0x1d5b957, ftLastWriteTime.dwLowDateTime=0xdc914960, ftLastWriteTime.dwHighDateTime=0x1d5b957, nFileSizeHigh=0x0, nFileSizeLow=0x7fb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="0iqjuiG77sXaPmH31.docx", cAlternateFileName="0IQJUI~1.DOC")) returned 1 [0108.358] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46272ba0, ftCreationTime.dwHighDateTime=0x1d5947e, ftLastAccessTime.dwLowDateTime=0xb23397f0, ftLastAccessTime.dwHighDateTime=0x1d5e1ba, ftLastWriteTime.dwLowDateTime=0xb23397f0, ftLastWriteTime.dwHighDateTime=0x1d5e1ba, nFileSizeHigh=0x0, nFileSizeLow=0x64ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="0x5WsDIyIuI2wirE.xlsx", cAlternateFileName="0X5WSD~1.XLS")) returned 1 [0108.358] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33b782d0, ftCreationTime.dwHighDateTime=0x1d59bb8, ftLastAccessTime.dwLowDateTime=0x48305db0, ftLastAccessTime.dwHighDateTime=0x1d5ab6a, ftLastWriteTime.dwLowDateTime=0x48305db0, ftLastWriteTime.dwHighDateTime=0x1d5ab6a, nFileSizeHigh=0x0, nFileSizeLow=0x144a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="0Y9-__rSJ.docx", cAlternateFileName="0Y9-__~1.DOC")) returned 1 [0108.358] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4429cc0, ftCreationTime.dwHighDateTime=0x1d5e80c, ftLastAccessTime.dwLowDateTime=0x57f52cf0, ftLastAccessTime.dwHighDateTime=0x1d5c02b, ftLastWriteTime.dwLowDateTime=0x57f52cf0, ftLastWriteTime.dwHighDateTime=0x1d5c02b, nFileSizeHigh=0x0, nFileSizeLow=0x1860b, dwReserved0=0x0, dwReserved1=0x0, cFileName="64X8qB K7sxwMedQDRO.xlsx", cAlternateFileName="64X8QB~1.XLS")) returned 1 [0108.358] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf5020f0, ftCreationTime.dwHighDateTime=0x1d5f007, ftLastAccessTime.dwLowDateTime=0x6b09d420, ftLastAccessTime.dwHighDateTime=0x1d5e91c, ftLastWriteTime.dwLowDateTime=0x6b09d420, ftLastWriteTime.dwHighDateTime=0x1d5e91c, nFileSizeHigh=0x0, nFileSizeLow=0xc259, dwReserved0=0x0, dwReserved1=0x0, cFileName="A2kMnWa.pdf", cAlternateFileName="")) returned 1 [0108.358] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3efdf80, ftCreationTime.dwHighDateTime=0x1d5ed56, ftLastAccessTime.dwLowDateTime=0x89e6fc30, ftLastAccessTime.dwHighDateTime=0x1d5ee92, ftLastWriteTime.dwLowDateTime=0x89e6fc30, ftLastWriteTime.dwHighDateTime=0x1d5ee92, nFileSizeHigh=0x0, nFileSizeLow=0x7a47, dwReserved0=0x0, dwReserved1=0x0, cFileName="aEjhQMV_M2E DNJnk-z.pps", cAlternateFileName="AEJHQM~1.PPS")) returned 1 [0108.358] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x662de30, ftCreationTime.dwHighDateTime=0x1d5eebd, ftLastAccessTime.dwLowDateTime=0xe023d9d0, ftLastAccessTime.dwHighDateTime=0x1d5ea8a, ftLastWriteTime.dwLowDateTime=0xe023d9d0, ftLastWriteTime.dwHighDateTime=0x1d5ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="aYu2P_HjBi7kE 3 j", cAlternateFileName="AYU2P_~1")) returned 1 [0108.358] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b4acf0, ftCreationTime.dwHighDateTime=0x1d5ddda, ftLastAccessTime.dwLowDateTime=0xfc09ce90, ftLastAccessTime.dwHighDateTime=0x1d57193, ftLastWriteTime.dwLowDateTime=0xfc09ce90, ftLastWriteTime.dwHighDateTime=0x1d57193, nFileSizeHigh=0x0, nFileSizeLow=0x1198e, dwReserved0=0x0, dwReserved1=0x0, cFileName="d4HEHXi0kT8GlCKBE.pptx", cAlternateFileName="D4HEHX~1.PPT")) returned 1 [0108.358] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x9daec75b, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x55000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb", cAlternateFileName="DATABA~1.ACC")) returned 1 [0108.358] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440c5760, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440c5760, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0108.358] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75350eb0, ftCreationTime.dwHighDateTime=0x1d5f0a1, ftLastAccessTime.dwLowDateTime=0xbef96730, ftLastAccessTime.dwHighDateTime=0x1d57be9, ftLastWriteTime.dwLowDateTime=0xbef96730, ftLastWriteTime.dwHighDateTime=0x1d57be9, nFileSizeHigh=0x0, nFileSizeLow=0x10424, dwReserved0=0x0, dwReserved1=0x0, cFileName="DJWO5e.xlsx", cAlternateFileName="DJWO5E~1.XLS")) returned 1 [0108.358] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd15d51e0, ftCreationTime.dwHighDateTime=0x1d5b305, ftLastAccessTime.dwLowDateTime=0x78a1fbc0, ftLastAccessTime.dwHighDateTime=0x1d5dc25, ftLastWriteTime.dwLowDateTime=0x78a1fbc0, ftLastWriteTime.dwHighDateTime=0x1d5dc25, nFileSizeHigh=0x0, nFileSizeLow=0x7c66, dwReserved0=0x0, dwReserved1=0x0, cFileName="F6GMw-0.xlsx", cAlternateFileName="F6GMW-~1.XLS")) returned 1 [0108.358] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab0cca50, ftCreationTime.dwHighDateTime=0x1d5e697, ftLastAccessTime.dwLowDateTime=0xcf63fba0, ftLastAccessTime.dwHighDateTime=0x1d5e8f7, ftLastWriteTime.dwLowDateTime=0xcf63fba0, ftLastWriteTime.dwHighDateTime=0x1d5e8f7, nFileSizeHigh=0x0, nFileSizeLow=0xec25, dwReserved0=0x0, dwReserved1=0x0, cFileName="hJtdT1o6Kae.pps", cAlternateFileName="HJTDT1~1.PPS")) returned 1 [0108.358] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc041b400, ftCreationTime.dwHighDateTime=0x1d5f07c, ftLastAccessTime.dwLowDateTime=0xe189d9d0, ftLastAccessTime.dwHighDateTime=0x1d5e816, ftLastWriteTime.dwLowDateTime=0xe189d9d0, ftLastWriteTime.dwHighDateTime=0x1d5e816, nFileSizeHigh=0x0, nFileSizeLow=0xf431, dwReserved0=0x0, dwReserved1=0x0, cFileName="I7Ja fh.pptx", cAlternateFileName="I7JAFH~1.PPT")) returned 1 [0108.358] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc30b3aa0, ftCreationTime.dwHighDateTime=0x1d57401, ftLastAccessTime.dwLowDateTime=0x1ed3a2b0, ftLastAccessTime.dwHighDateTime=0x1d5d8c9, ftLastWriteTime.dwLowDateTime=0x1ed3a2b0, ftLastWriteTime.dwHighDateTime=0x1d5d8c9, nFileSizeHigh=0x0, nFileSizeLow=0x23a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ikl9qy750ufc-G.pptx", cAlternateFileName="IKL9QY~1.PPT")) returned 1 [0108.359] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e39200, ftCreationTime.dwHighDateTime=0x1d5ccca, ftLastAccessTime.dwLowDateTime=0xe6666d00, ftLastAccessTime.dwHighDateTime=0x1d5d0e8, ftLastWriteTime.dwLowDateTime=0xe6666d00, ftLastWriteTime.dwHighDateTime=0x1d5d0e8, nFileSizeHigh=0x0, nFileSizeLow=0x7c42, dwReserved0=0x0, dwReserved1=0x0, cFileName="J6NJtsVFM1f_Q-F9.docx", cAlternateFileName="J6NJTS~1.DOC")) returned 1 [0108.359] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd227aa40, ftCreationTime.dwHighDateTime=0x1d5e9cd, ftLastAccessTime.dwLowDateTime=0x9cbce5d0, ftLastAccessTime.dwHighDateTime=0x1d5ef38, ftLastWriteTime.dwLowDateTime=0x9cbce5d0, ftLastWriteTime.dwHighDateTime=0x1d5ef38, nFileSizeHigh=0x0, nFileSizeLow=0xc0e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="j8WnIHQK.pps", cAlternateFileName="")) returned 1 [0108.359] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bc4fd50, ftCreationTime.dwHighDateTime=0x1d5e872, ftLastAccessTime.dwLowDateTime=0xbf4f2500, ftLastAccessTime.dwHighDateTime=0x1d5edbb, ftLastWriteTime.dwLowDateTime=0xbf4f2500, ftLastWriteTime.dwHighDateTime=0x1d5edbb, nFileSizeHigh=0x0, nFileSizeLow=0x113bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="KP5HOwM2YcoP.ods", cAlternateFileName="KP5HOW~1.ODS")) returned 1 [0108.359] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x812f74e0, ftCreationTime.dwHighDateTime=0x1d5808e, ftLastAccessTime.dwLowDateTime=0xd130650, ftLastAccessTime.dwHighDateTime=0x1d56d8b, ftLastWriteTime.dwLowDateTime=0xd130650, ftLastWriteTime.dwHighDateTime=0x1d56d8b, nFileSizeHigh=0x0, nFileSizeLow=0x14fd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LNxMafDRKQVGv.xlsx", cAlternateFileName="LNXMAF~1.XLS")) returned 1 [0108.359] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d527570, ftCreationTime.dwHighDateTime=0x1d5ec0c, ftLastAccessTime.dwLowDateTime=0x3d6a3020, ftLastAccessTime.dwHighDateTime=0x1d5e145, ftLastWriteTime.dwLowDateTime=0x3d6a3020, ftLastWriteTime.dwHighDateTime=0x1d5e145, nFileSizeHigh=0x0, nFileSizeLow=0x96ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOrxufOFI.xlsx", cAlternateFileName="LORXUF~1.XLS")) returned 1 [0108.359] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0108.359] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0108.359] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0108.359] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0108.359] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x5ee892ad, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0108.359] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe976b700, ftCreationTime.dwHighDateTime=0x1d5ec83, ftLastAccessTime.dwLowDateTime=0x22565e60, ftLastAccessTime.dwHighDateTime=0x1d5ea70, ftLastWriteTime.dwLowDateTime=0x22565e60, ftLastWriteTime.dwHighDateTime=0x1d5ea70, nFileSizeHigh=0x0, nFileSizeLow=0x13bdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="pd7W-tx1l.ppt", cAlternateFileName="PD7W-T~1.PPT")) returned 1 [0108.359] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58b8f6d0, ftCreationTime.dwHighDateTime=0x1d5c639, ftLastAccessTime.dwLowDateTime=0x8095c1d0, ftLastAccessTime.dwHighDateTime=0x1d56543, ftLastWriteTime.dwLowDateTime=0x8095c1d0, ftLastWriteTime.dwHighDateTime=0x1d56543, nFileSizeHigh=0x0, nFileSizeLow=0x108f, dwReserved0=0x0, dwReserved1=0x0, cFileName="q3_wqcOFyz--unpL.docx", cAlternateFileName="Q3_WQC~1.DOC")) returned 1 [0108.359] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46523ab0, ftCreationTime.dwHighDateTime=0x1d5e1d7, ftLastAccessTime.dwLowDateTime=0x25025e60, ftLastAccessTime.dwHighDateTime=0x1d5e387, ftLastWriteTime.dwLowDateTime=0x25025e60, ftLastWriteTime.dwHighDateTime=0x1d5e387, nFileSizeHigh=0x0, nFileSizeLow=0x15a9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="qWUBFrC9 V.pps", cAlternateFileName="QWUBFR~1.PPS")) returned 1 [0108.359] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65eeaa80, ftCreationTime.dwHighDateTime=0x1d592df, ftLastAccessTime.dwLowDateTime=0x43ff5280, ftLastAccessTime.dwHighDateTime=0x1d5d40c, ftLastWriteTime.dwLowDateTime=0x43ff5280, ftLastWriteTime.dwHighDateTime=0x1d5d40c, nFileSizeHigh=0x0, nFileSizeLow=0x965e, dwReserved0=0x0, dwReserved1=0x0, cFileName="sSefU-IfjA72.pptx", cAlternateFileName="SSEFU-~1.PPT")) returned 1 [0108.359] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd52cd30, ftCreationTime.dwHighDateTime=0x1d5ed01, ftLastAccessTime.dwLowDateTime=0xa5b6ce10, ftLastAccessTime.dwHighDateTime=0x1d5e8a0, ftLastWriteTime.dwLowDateTime=0xa5b6ce10, ftLastWriteTime.dwHighDateTime=0x1d5e8a0, nFileSizeHigh=0x0, nFileSizeLow=0x33a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="TvkmtfbI.pps", cAlternateFileName="")) returned 1 [0108.359] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0f64940, ftCreationTime.dwHighDateTime=0x1d5d0b9, ftLastAccessTime.dwLowDateTime=0xcd40ed60, ftLastAccessTime.dwHighDateTime=0x1d5da79, ftLastWriteTime.dwLowDateTime=0xcd40ed60, ftLastWriteTime.dwHighDateTime=0x1d5da79, nFileSizeHigh=0x0, nFileSizeLow=0xa7b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="VmHknY5nzMK.pptx", cAlternateFileName="VMHKNY~1.PPT")) returned 1 [0108.359] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacaf0c60, ftCreationTime.dwHighDateTime=0x1d571da, ftLastAccessTime.dwLowDateTime=0xb75cc30, ftLastAccessTime.dwHighDateTime=0x1d5b307, ftLastWriteTime.dwLowDateTime=0xb75cc30, ftLastWriteTime.dwHighDateTime=0x1d5b307, nFileSizeHigh=0x0, nFileSizeLow=0xb1e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ynj2Cy37O15ozYze12.docx", cAlternateFileName="YNJ2CY~1.DOC")) returned 1 [0108.359] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x451448d0, ftCreationTime.dwHighDateTime=0x1d5df2c, ftLastAccessTime.dwLowDateTime=0x7e0c3460, ftLastAccessTime.dwHighDateTime=0x1d57102, ftLastWriteTime.dwLowDateTime=0x7e0c3460, ftLastWriteTime.dwHighDateTime=0x1d57102, nFileSizeHigh=0x0, nFileSizeLow=0x17a63, dwReserved0=0x0, dwReserved1=0x0, cFileName="z5krZTI-Nz8bW.pptx", cAlternateFileName="Z5KRZT~1.PPT")) returned 1 [0108.359] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42635b20, ftCreationTime.dwHighDateTime=0x1d5e2c5, ftLastAccessTime.dwLowDateTime=0x625789e0, ftLastAccessTime.dwHighDateTime=0x1d5e92a, ftLastWriteTime.dwLowDateTime=0x625789e0, ftLastWriteTime.dwHighDateTime=0x1d5e92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zEsXkxPFsoDWAZhIb1LP", cAlternateFileName="ZESXKX~1")) returned 1 [0108.360] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0108.360] FindClose (in: hFindFile=0x77b838 | out: hFindFile=0x77b838) returned 1 [0108.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed54) returned 1 [0108.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed60) returned 1 [0108.360] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\0hrLyWpzFSh8iDlU_EN.ppt", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\0hrLyWpzFSh8iDlU_EN.ppt", lpFilePart=0x0) returned 0x31 [0108.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0108.360] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\0hrLyWpzFSh8iDlU_EN.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\0hrlywpzfsh8idlu_en.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0108.360] GetFileType (hFile=0x37c) returned 0x1 [0108.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0108.360] GetFileType (hFile=0x37c) returned 0x1 [0108.360] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0xf76e [0108.360] ReadFile (in: hFile=0x37c, lpBuffer=0x27d9a2c, nNumberOfBytesToRead=0xf76e, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x27d9a2c*, lpNumberOfBytesRead=0x19ecec*=0xf76e, lpOverlapped=0x0) returned 1 [0108.361] CloseHandle (hObject=0x37c) returned 1 [0108.383] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0108.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0108.383] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0108.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0108.383] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\0hrLyWpzFSh8iDlU_EN.ppt", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\0hrLyWpzFSh8iDlU_EN.ppt", lpFilePart=0x0) returned 0x31 [0108.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0108.383] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\0hrLyWpzFSh8iDlU_EN.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\0hrlywpzfsh8idlu_en.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0108.385] GetFileType (hFile=0x37c) returned 0x1 [0108.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0108.385] GetFileType (hFile=0x37c) returned 0x1 [0108.385] WriteFile (in: hFile=0x37c, lpBuffer=0x2854e7c*, nNumberOfBytesToWrite=0xf770, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x2854e7c*, lpNumberOfBytesWritten=0x19ece0*=0xf770, lpOverlapped=0x0) returned 1 [0108.387] CloseHandle (hObject=0x37c) returned 1 [0108.389] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\0hrLyWpzFSh8iDlU_EN.ppt", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\0hrLyWpzFSh8iDlU_EN.ppt", lpFilePart=0x0) returned 0x31 [0108.389] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\0hrLyWpzFSh8iDlU_EN.ppt.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\0hrLyWpzFSh8iDlU_EN.ppt.spybuster", lpFilePart=0x0) returned 0x3b [0108.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0108.389] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\0hrLyWpzFSh8iDlU_EN.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\0hrlywpzfsh8idlu_en.ppt"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58972110, ftCreationTime.dwHighDateTime=0x1d5e18f, ftLastAccessTime.dwLowDateTime=0x57177260, ftLastAccessTime.dwHighDateTime=0x1d5e1f1, ftLastWriteTime.dwLowDateTime=0xb5dcde40, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xf770)) returned 1 [0108.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0108.389] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\0hrLyWpzFSh8iDlU_EN.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\0hrlywpzfsh8idlu_en.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\0hrLyWpzFSh8iDlU_EN.ppt.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\0hrlywpzfsh8idlu_en.ppt.spybuster")) returned 1 [0108.390] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\0iqjuiG77sXaPmH31.docx", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\0iqjuiG77sXaPmH31.docx", lpFilePart=0x0) returned 0x30 [0108.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0108.390] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\0iqjuiG77sXaPmH31.docx" (normalized: "c:\\users\\fd1hvy\\documents\\0iqjuig77sxapmh31.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0108.390] GetFileType (hFile=0x37c) returned 0x1 [0108.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0108.390] GetFileType (hFile=0x37c) returned 0x1 [0108.390] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x7fb9 [0108.390] ReadFile (in: hFile=0x37c, lpBuffer=0x2864abc, nNumberOfBytesToRead=0x7fb9, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x2864abc*, lpNumberOfBytesRead=0x19ecec*=0x7fb9, lpOverlapped=0x0) returned 1 [0108.391] CloseHandle (hObject=0x37c) returned 1 [0108.480] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0108.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0108.480] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0108.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0108.481] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\0iqjuiG77sXaPmH31.docx", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\0iqjuiG77sXaPmH31.docx", lpFilePart=0x0) returned 0x30 [0108.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0108.481] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\0iqjuiG77sXaPmH31.docx" (normalized: "c:\\users\\fd1hvy\\documents\\0iqjuig77sxapmh31.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0108.482] GetFileType (hFile=0x37c) returned 0x1 [0108.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0108.482] GetFileType (hFile=0x37c) returned 0x1 [0108.482] WriteFile (in: hFile=0x37c, lpBuffer=0x26daec0*, nNumberOfBytesToWrite=0x7fc0, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x26daec0*, lpNumberOfBytesWritten=0x19ece0*=0x7fc0, lpOverlapped=0x0) returned 1 [0108.483] CloseHandle (hObject=0x37c) returned 1 [0108.485] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\0iqjuiG77sXaPmH31.docx", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\0iqjuiG77sXaPmH31.docx", lpFilePart=0x0) returned 0x30 [0108.485] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\0iqjuiG77sXaPmH31.docx.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\0iqjuiG77sXaPmH31.docx.spybuster", lpFilePart=0x0) returned 0x3a [0108.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0108.485] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\0iqjuiG77sXaPmH31.docx" (normalized: "c:\\users\\fd1hvy\\documents\\0iqjuig77sxapmh31.docx"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x449560d0, ftCreationTime.dwHighDateTime=0x1d570cb, ftLastAccessTime.dwLowDateTime=0xdc914960, ftLastAccessTime.dwHighDateTime=0x1d5b957, ftLastWriteTime.dwLowDateTime=0xb5eb2c60, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x7fc0)) returned 1 [0108.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0108.485] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\0iqjuiG77sXaPmH31.docx" (normalized: "c:\\users\\fd1hvy\\documents\\0iqjuig77sxapmh31.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\0iqjuiG77sXaPmH31.docx.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\0iqjuig77sxapmh31.docx.spybuster")) returned 1 [0108.486] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\0x5WsDIyIuI2wirE.xlsx", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\0x5WsDIyIuI2wirE.xlsx", lpFilePart=0x0) returned 0x2f [0108.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0108.486] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\0x5WsDIyIuI2wirE.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\0x5wsdiyiui2wire.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0108.486] GetFileType (hFile=0x37c) returned 0x1 [0108.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0108.486] GetFileType (hFile=0x37c) returned 0x1 [0108.486] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x64ac [0108.486] ReadFile (in: hFile=0x37c, lpBuffer=0x26e3348, nNumberOfBytesToRead=0x64ac, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x26e3348*, lpNumberOfBytesRead=0x19ecec*=0x64ac, lpOverlapped=0x0) returned 1 [0108.487] CloseHandle (hObject=0x37c) returned 1 [0108.551] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0108.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0108.551] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0108.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0108.551] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\0x5WsDIyIuI2wirE.xlsx", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\0x5WsDIyIuI2wirE.xlsx", lpFilePart=0x0) returned 0x2f [0108.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0108.551] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\0x5WsDIyIuI2wirE.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\0x5wsdiyiui2wire.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0108.553] GetFileType (hFile=0x37c) returned 0x1 [0108.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0108.553] GetFileType (hFile=0x37c) returned 0x1 [0108.553] WriteFile (in: hFile=0x37c, lpBuffer=0x274f9fc*, nNumberOfBytesToWrite=0x64b0, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x274f9fc*, lpNumberOfBytesWritten=0x19ece0*=0x64b0, lpOverlapped=0x0) returned 1 [0108.554] CloseHandle (hObject=0x37c) returned 1 [0108.559] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\0x5WsDIyIuI2wirE.xlsx", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\0x5WsDIyIuI2wirE.xlsx", lpFilePart=0x0) returned 0x2f [0108.559] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\0x5WsDIyIuI2wirE.xlsx.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\0x5WsDIyIuI2wirE.xlsx.spybuster", lpFilePart=0x0) returned 0x39 [0108.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0108.559] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\0x5WsDIyIuI2wirE.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\0x5wsdiyiui2wire.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46272ba0, ftCreationTime.dwHighDateTime=0x1d5947e, ftLastAccessTime.dwLowDateTime=0xb23397f0, ftLastAccessTime.dwHighDateTime=0x1d5e1ba, ftLastWriteTime.dwLowDateTime=0xb5f717cf, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x64b0)) returned 1 [0108.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0108.560] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\0x5WsDIyIuI2wirE.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\0x5wsdiyiui2wire.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\0x5WsDIyIuI2wirE.xlsx.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\0x5wsdiyiui2wire.xlsx.spybuster")) returned 1 [0108.560] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\0Y9-__rSJ.docx", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\0Y9-__rSJ.docx", lpFilePart=0x0) returned 0x28 [0108.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0108.560] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\0Y9-__rSJ.docx" (normalized: "c:\\users\\fd1hvy\\documents\\0y9-__rsj.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0108.560] GetFileType (hFile=0x37c) returned 0x1 [0108.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0108.560] GetFileType (hFile=0x37c) returned 0x1 [0108.560] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x144a7 [0108.561] ReadFile (in: hFile=0x37c, lpBuffer=0x2756348, nNumberOfBytesToRead=0x144a7, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x2756348*, lpNumberOfBytesRead=0x19ecec*=0x144a7, lpOverlapped=0x0) returned 1 [0108.562] CloseHandle (hObject=0x37c) returned 1 [0108.585] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0108.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0108.585] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0108.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0108.585] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\0Y9-__rSJ.docx", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\0Y9-__rSJ.docx", lpFilePart=0x0) returned 0x28 [0108.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0108.585] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\0Y9-__rSJ.docx" (normalized: "c:\\users\\fd1hvy\\documents\\0y9-__rsj.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0108.587] GetFileType (hFile=0x37c) returned 0x1 [0108.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0108.587] GetFileType (hFile=0x37c) returned 0x1 [0108.588] WriteFile (in: hFile=0x37c, lpBuffer=0x27dff58*, nNumberOfBytesToWrite=0x144b0, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x27dff58*, lpNumberOfBytesWritten=0x19ece0*=0x144b0, lpOverlapped=0x0) returned 1 [0108.590] CloseHandle (hObject=0x37c) returned 1 [0108.593] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\0Y9-__rSJ.docx", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\0Y9-__rSJ.docx", lpFilePart=0x0) returned 0x28 [0108.593] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\0Y9-__rSJ.docx.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\0Y9-__rSJ.docx.spybuster", lpFilePart=0x0) returned 0x32 [0108.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0108.593] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\0Y9-__rSJ.docx" (normalized: "c:\\users\\fd1hvy\\documents\\0y9-__rsj.docx"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33b782d0, ftCreationTime.dwHighDateTime=0x1d59bb8, ftLastAccessTime.dwLowDateTime=0x48305db0, ftLastAccessTime.dwHighDateTime=0x1d5ab6a, ftLastWriteTime.dwLowDateTime=0xb5fbdd2f, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x144b0)) returned 1 [0108.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0108.593] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\0Y9-__rSJ.docx" (normalized: "c:\\users\\fd1hvy\\documents\\0y9-__rsj.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\0Y9-__rSJ.docx.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\0y9-__rsj.docx.spybuster")) returned 1 [0108.594] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\64X8qB K7sxwMedQDRO.xlsx", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\64X8qB K7sxwMedQDRO.xlsx", lpFilePart=0x0) returned 0x32 [0108.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0108.594] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\64X8qB K7sxwMedQDRO.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\64x8qb k7sxwmedqdro.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0108.594] GetFileType (hFile=0x37c) returned 0x1 [0108.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0108.594] GetFileType (hFile=0x37c) returned 0x1 [0108.594] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x1860b [0108.595] ReadFile (in: hFile=0x37c, lpBuffer=0x3826b18, nNumberOfBytesToRead=0x1860b, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x3826b18*, lpNumberOfBytesRead=0x19ecec*=0x1860b, lpOverlapped=0x0) returned 1 [0108.596] CloseHandle (hObject=0x37c) returned 1 [0108.662] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0108.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0108.662] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0108.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0108.663] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\64X8qB K7sxwMedQDRO.xlsx", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\64X8qB K7sxwMedQDRO.xlsx", lpFilePart=0x0) returned 0x32 [0108.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0108.663] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\64X8qB K7sxwMedQDRO.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\64x8qb k7sxwmedqdro.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0108.665] GetFileType (hFile=0x37c) returned 0x1 [0108.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0108.665] GetFileType (hFile=0x37c) returned 0x1 [0108.665] WriteFile (in: hFile=0x37c, lpBuffer=0x38a09a0*, nNumberOfBytesToWrite=0x18610, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x38a09a0*, lpNumberOfBytesWritten=0x19ece0*=0x18610, lpOverlapped=0x0) returned 1 [0108.667] CloseHandle (hObject=0x37c) returned 1 [0108.670] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\64X8qB K7sxwMedQDRO.xlsx", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\64X8qB K7sxwMedQDRO.xlsx", lpFilePart=0x0) returned 0x32 [0108.670] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\64X8qB K7sxwMedQDRO.xlsx.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\64X8qB K7sxwMedQDRO.xlsx.spybuster", lpFilePart=0x0) returned 0x3c [0108.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0108.670] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\64X8qB K7sxwMedQDRO.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\64x8qb k7sxwmedqdro.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4429cc0, ftCreationTime.dwHighDateTime=0x1d5e80c, ftLastAccessTime.dwLowDateTime=0x57f52cf0, ftLastAccessTime.dwHighDateTime=0x1d5c02b, ftLastWriteTime.dwLowDateTime=0xb607c886, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x18610)) returned 1 [0108.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0108.670] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\64X8qB K7sxwMedQDRO.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\64x8qb k7sxwmedqdro.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\64X8qB K7sxwMedQDRO.xlsx.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\64x8qb k7sxwmedqdro.xlsx.spybuster")) returned 1 [0108.671] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\A2kMnWa.pdf", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\A2kMnWa.pdf", lpFilePart=0x0) returned 0x25 [0108.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0108.671] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\A2kMnWa.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\a2kmnwa.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0108.671] GetFileType (hFile=0x37c) returned 0x1 [0108.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0108.671] GetFileType (hFile=0x37c) returned 0x1 [0108.672] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0xc259 [0108.672] ReadFile (in: hFile=0x37c, lpBuffer=0x2841b38, nNumberOfBytesToRead=0xc259, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x2841b38*, lpNumberOfBytesRead=0x19ecec*=0xc259, lpOverlapped=0x0) returned 1 [0108.673] CloseHandle (hObject=0x37c) returned 1 [0108.745] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0108.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0108.745] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0108.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0108.745] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\A2kMnWa.pdf", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\A2kMnWa.pdf", lpFilePart=0x0) returned 0x25 [0108.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0108.745] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\A2kMnWa.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\a2kmnwa.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0108.747] GetFileType (hFile=0x37c) returned 0x1 [0108.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0108.747] GetFileType (hFile=0x37c) returned 0x1 [0108.747] WriteFile (in: hFile=0x37c, lpBuffer=0x26b7300*, nNumberOfBytesToWrite=0xc260, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x26b7300*, lpNumberOfBytesWritten=0x19ece0*=0xc260, lpOverlapped=0x0) returned 1 [0108.749] CloseHandle (hObject=0x37c) returned 1 [0108.751] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\A2kMnWa.pdf", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\A2kMnWa.pdf", lpFilePart=0x0) returned 0x25 [0108.751] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\A2kMnWa.pdf.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\A2kMnWa.pdf.spybuster", lpFilePart=0x0) returned 0x2f [0108.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0108.751] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\A2kMnWa.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\a2kmnwa.pdf"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf5020f0, ftCreationTime.dwHighDateTime=0x1d5f007, ftLastAccessTime.dwLowDateTime=0x6b09d420, ftLastAccessTime.dwHighDateTime=0x1d5e91c, ftLastWriteTime.dwLowDateTime=0xb613b3dc, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xc260)) returned 1 [0108.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0108.751] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\A2kMnWa.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\a2kmnwa.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\A2kMnWa.pdf.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\a2kmnwa.pdf.spybuster")) returned 1 [0108.752] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\d4HEHXi0kT8GlCKBE.pptx", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\d4HEHXi0kT8GlCKBE.pptx", lpFilePart=0x0) returned 0x30 [0108.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0108.752] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\d4HEHXi0kT8GlCKBE.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\d4hehxi0kt8glckbe.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0108.752] GetFileType (hFile=0x37c) returned 0x1 [0108.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0108.752] GetFileType (hFile=0x37c) returned 0x1 [0108.752] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x1198e [0108.752] ReadFile (in: hFile=0x37c, lpBuffer=0x26c39d0, nNumberOfBytesToRead=0x1198e, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x26c39d0*, lpNumberOfBytesRead=0x19ecec*=0x1198e, lpOverlapped=0x0) returned 1 [0108.753] CloseHandle (hObject=0x37c) returned 1 [0108.772] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0108.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0108.772] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0108.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0108.772] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\d4HEHXi0kT8GlCKBE.pptx", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\d4HEHXi0kT8GlCKBE.pptx", lpFilePart=0x0) returned 0x30 [0108.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0108.772] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\d4HEHXi0kT8GlCKBE.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\d4hehxi0kt8glckbe.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0108.774] GetFileType (hFile=0x37c) returned 0x1 [0108.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0108.774] GetFileType (hFile=0x37c) returned 0x1 [0108.774] WriteFile (in: hFile=0x37c, lpBuffer=0x27455dc*, nNumberOfBytesToWrite=0x11990, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x27455dc*, lpNumberOfBytesWritten=0x19ece0*=0x11990, lpOverlapped=0x0) returned 1 [0108.776] CloseHandle (hObject=0x37c) returned 1 [0108.779] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\d4HEHXi0kT8GlCKBE.pptx", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\d4HEHXi0kT8GlCKBE.pptx", lpFilePart=0x0) returned 0x30 [0108.779] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\d4HEHXi0kT8GlCKBE.pptx.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\d4HEHXi0kT8GlCKBE.pptx.spybuster", lpFilePart=0x0) returned 0x3a [0108.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0108.779] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\d4HEHXi0kT8GlCKBE.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\d4hehxi0kt8glckbe.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b4acf0, ftCreationTime.dwHighDateTime=0x1d5ddda, ftLastAccessTime.dwLowDateTime=0xfc09ce90, ftLastAccessTime.dwHighDateTime=0x1d57193, ftLastWriteTime.dwLowDateTime=0xb6187968, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x11990)) returned 1 [0108.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0108.779] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\d4HEHXi0kT8GlCKBE.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\d4hehxi0kt8glckbe.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\d4HEHXi0kT8GlCKBE.pptx.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\d4hehxi0kt8glckbe.pptx.spybuster")) returned 1 [0108.780] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\DJWO5e.xlsx", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\DJWO5e.xlsx", lpFilePart=0x0) returned 0x25 [0108.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0108.780] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\DJWO5e.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\djwo5e.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0108.780] GetFileType (hFile=0x37c) returned 0x1 [0108.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0108.780] GetFileType (hFile=0x37c) returned 0x1 [0108.780] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x10424 [0108.780] ReadFile (in: hFile=0x37c, lpBuffer=0x2757440, nNumberOfBytesToRead=0x10424, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x2757440*, lpNumberOfBytesRead=0x19ecec*=0x10424, lpOverlapped=0x0) returned 1 [0108.782] CloseHandle (hObject=0x37c) returned 1 [0108.868] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0108.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0108.868] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0108.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0108.868] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\DJWO5e.xlsx", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\DJWO5e.xlsx", lpFilePart=0x0) returned 0x25 [0108.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0108.868] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\DJWO5e.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\djwo5e.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0108.869] GetFileType (hFile=0x37c) returned 0x1 [0108.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0108.869] GetFileType (hFile=0x37c) returned 0x1 [0108.870] WriteFile (in: hFile=0x37c, lpBuffer=0x27d4ecc*, nNumberOfBytesToWrite=0x10430, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x27d4ecc*, lpNumberOfBytesWritten=0x19ece0*=0x10430, lpOverlapped=0x0) returned 1 [0108.871] CloseHandle (hObject=0x37c) returned 1 [0108.873] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\DJWO5e.xlsx", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\DJWO5e.xlsx", lpFilePart=0x0) returned 0x25 [0108.874] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\DJWO5e.xlsx.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\DJWO5e.xlsx.spybuster", lpFilePart=0x0) returned 0x2f [0108.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0108.874] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\DJWO5e.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\djwo5e.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75350eb0, ftCreationTime.dwHighDateTime=0x1d5f0a1, ftLastAccessTime.dwLowDateTime=0xbef96730, ftLastAccessTime.dwHighDateTime=0x1d57be9, ftLastWriteTime.dwLowDateTime=0xb626c749, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x10430)) returned 1 [0108.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0108.874] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\DJWO5e.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\djwo5e.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\DJWO5e.xlsx.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\djwo5e.xlsx.spybuster")) returned 1 [0108.874] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\F6GMw-0.xlsx", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\F6GMw-0.xlsx", lpFilePart=0x0) returned 0x26 [0108.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0108.874] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\F6GMw-0.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\f6gmw-0.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0108.875] GetFileType (hFile=0x37c) returned 0x1 [0108.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0108.875] GetFileType (hFile=0x37c) returned 0x1 [0108.875] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x7c66 [0108.875] ReadFile (in: hFile=0x37c, lpBuffer=0x27e572c, nNumberOfBytesToRead=0x7c66, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x27e572c*, lpNumberOfBytesRead=0x19ecec*=0x7c66, lpOverlapped=0x0) returned 1 [0108.876] CloseHandle (hObject=0x37c) returned 1 [0108.989] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0108.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0108.990] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0108.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0108.990] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\F6GMw-0.xlsx", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\F6GMw-0.xlsx", lpFilePart=0x0) returned 0x26 [0108.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0108.990] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\F6GMw-0.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\f6gmw-0.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0108.991] GetFileType (hFile=0x37c) returned 0x1 [0108.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0108.991] GetFileType (hFile=0x37c) returned 0x1 [0108.991] WriteFile (in: hFile=0x37c, lpBuffer=0x2859348*, nNumberOfBytesToWrite=0x7c70, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x2859348*, lpNumberOfBytesWritten=0x19ece0*=0x7c70, lpOverlapped=0x0) returned 1 [0108.993] CloseHandle (hObject=0x37c) returned 1 [0108.998] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\F6GMw-0.xlsx", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\F6GMw-0.xlsx", lpFilePart=0x0) returned 0x26 [0108.998] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\F6GMw-0.xlsx.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\F6GMw-0.xlsx.spybuster", lpFilePart=0x0) returned 0x30 [0108.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0108.999] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\F6GMw-0.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\f6gmw-0.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd15d51e0, ftCreationTime.dwHighDateTime=0x1d5b305, ftLastAccessTime.dwLowDateTime=0x78a1fbc0, ftLastAccessTime.dwHighDateTime=0x1d5dc25, ftLastWriteTime.dwLowDateTime=0xb639da46, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x7c70)) returned 1 [0108.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0108.999] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\F6GMw-0.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\f6gmw-0.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\F6GMw-0.xlsx.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\f6gmw-0.xlsx.spybuster")) returned 1 [0109.000] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\I7Ja fh.pptx", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\I7Ja fh.pptx", lpFilePart=0x0) returned 0x26 [0109.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0109.000] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\I7Ja fh.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\i7ja fh.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0109.000] GetFileType (hFile=0x37c) returned 0x1 [0109.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0109.000] GetFileType (hFile=0x37c) returned 0x1 [0109.000] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0xf431 [0109.000] ReadFile (in: hFile=0x37c, lpBuffer=0x2861414, nNumberOfBytesToRead=0xf431, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x2861414*, lpNumberOfBytesRead=0x19ecec*=0xf431, lpOverlapped=0x0) returned 1 [0109.001] CloseHandle (hObject=0x37c) returned 1 [0109.032] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0109.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0109.032] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0109.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0109.032] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\I7Ja fh.pptx", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\I7Ja fh.pptx", lpFilePart=0x0) returned 0x26 [0109.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0109.032] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\I7Ja fh.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\i7ja fh.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0109.034] GetFileType (hFile=0x37c) returned 0x1 [0109.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0109.034] GetFileType (hFile=0x37c) returned 0x1 [0109.034] WriteFile (in: hFile=0x37c, lpBuffer=0x26df054*, nNumberOfBytesToWrite=0xf440, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x26df054*, lpNumberOfBytesWritten=0x19ece0*=0xf440, lpOverlapped=0x0) returned 1 [0109.084] CloseHandle (hObject=0x37c) returned 1 [0109.089] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\I7Ja fh.pptx", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\I7Ja fh.pptx", lpFilePart=0x0) returned 0x26 [0109.089] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\I7Ja fh.pptx.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\I7Ja fh.pptx.spybuster", lpFilePart=0x0) returned 0x30 [0109.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0109.089] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\I7Ja fh.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\i7ja fh.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc041b400, ftCreationTime.dwHighDateTime=0x1d5f07c, ftLastAccessTime.dwLowDateTime=0xe189d9d0, ftLastAccessTime.dwHighDateTime=0x1d5e816, ftLastWriteTime.dwLowDateTime=0xb6482863, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xf440)) returned 1 [0109.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0109.089] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\I7Ja fh.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\i7ja fh.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\I7Ja fh.pptx.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\i7ja fh.pptx.spybuster")) returned 1 [0109.090] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Ikl9qy750ufc-G.pptx", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Ikl9qy750ufc-G.pptx", lpFilePart=0x0) returned 0x2d [0109.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0109.090] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Ikl9qy750ufc-G.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ikl9qy750ufc-g.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0109.090] GetFileType (hFile=0x37c) returned 0x1 [0109.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0109.090] GetFileType (hFile=0x37c) returned 0x1 [0109.090] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x23a4 [0109.090] ReadFile (in: hFile=0x37c, lpBuffer=0x26ee8f0, nNumberOfBytesToRead=0x23a4, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x26ee8f0*, lpNumberOfBytesRead=0x19ecec*=0x23a4, lpOverlapped=0x0) returned 1 [0109.091] CloseHandle (hObject=0x37c) returned 1 [0109.107] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0109.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0109.107] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0109.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0109.108] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Ikl9qy750ufc-G.pptx", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Ikl9qy750ufc-G.pptx", lpFilePart=0x0) returned 0x2d [0109.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0109.108] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Ikl9qy750ufc-G.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ikl9qy750ufc-g.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0109.109] GetFileType (hFile=0x37c) returned 0x1 [0109.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0109.109] GetFileType (hFile=0x37c) returned 0x1 [0109.109] WriteFile (in: hFile=0x37c, lpBuffer=0x2746aa4*, nNumberOfBytesToWrite=0x23b0, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x2746aa4*, lpNumberOfBytesWritten=0x19ece0*=0x23b0, lpOverlapped=0x0) returned 1 [0109.110] CloseHandle (hObject=0x37c) returned 1 [0109.111] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Ikl9qy750ufc-G.pptx", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Ikl9qy750ufc-G.pptx", lpFilePart=0x0) returned 0x2d [0109.111] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Ikl9qy750ufc-G.pptx.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Ikl9qy750ufc-G.pptx.spybuster", lpFilePart=0x0) returned 0x37 [0109.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0109.111] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Ikl9qy750ufc-G.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ikl9qy750ufc-g.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc30b3aa0, ftCreationTime.dwHighDateTime=0x1d57401, ftLastAccessTime.dwLowDateTime=0x1ed3a2b0, ftLastAccessTime.dwHighDateTime=0x1d5d8c9, ftLastWriteTime.dwLowDateTime=0xb64a8b8d, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x23b0)) returned 1 [0109.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0109.111] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Ikl9qy750ufc-G.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ikl9qy750ufc-g.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Ikl9qy750ufc-G.pptx.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\ikl9qy750ufc-g.pptx.spybuster")) returned 1 [0109.112] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\J6NJtsVFM1f_Q-F9.docx", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\J6NJtsVFM1f_Q-F9.docx", lpFilePart=0x0) returned 0x2f [0109.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0109.112] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\J6NJtsVFM1f_Q-F9.docx" (normalized: "c:\\users\\fd1hvy\\documents\\j6njtsvfm1f_q-f9.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0109.112] GetFileType (hFile=0x37c) returned 0x1 [0109.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0109.113] GetFileType (hFile=0x37c) returned 0x1 [0109.113] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x7c42 [0109.113] ReadFile (in: hFile=0x37c, lpBuffer=0x27492f4, nNumberOfBytesToRead=0x7c42, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x27492f4*, lpNumberOfBytesRead=0x19ecec*=0x7c42, lpOverlapped=0x0) returned 1 [0109.114] CloseHandle (hObject=0x37c) returned 1 [0109.181] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0109.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0109.181] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0109.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0109.181] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\J6NJtsVFM1f_Q-F9.docx", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\J6NJtsVFM1f_Q-F9.docx", lpFilePart=0x0) returned 0x2f [0109.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0109.181] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\J6NJtsVFM1f_Q-F9.docx" (normalized: "c:\\users\\fd1hvy\\documents\\j6njtsvfm1f_q-f9.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0109.183] GetFileType (hFile=0x37c) returned 0x1 [0109.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0109.183] GetFileType (hFile=0x37c) returned 0x1 [0109.183] WriteFile (in: hFile=0x37c, lpBuffer=0x27bce70*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x27bce70*, lpNumberOfBytesWritten=0x19ece0*=0x7c50, lpOverlapped=0x0) returned 1 [0109.185] CloseHandle (hObject=0x37c) returned 1 [0109.187] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\J6NJtsVFM1f_Q-F9.docx", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\J6NJtsVFM1f_Q-F9.docx", lpFilePart=0x0) returned 0x2f [0109.187] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\J6NJtsVFM1f_Q-F9.docx.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\J6NJtsVFM1f_Q-F9.docx.spybuster", lpFilePart=0x0) returned 0x39 [0109.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0109.187] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\J6NJtsVFM1f_Q-F9.docx" (normalized: "c:\\users\\fd1hvy\\documents\\j6njtsvfm1f_q-f9.docx"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e39200, ftCreationTime.dwHighDateTime=0x1d5ccca, ftLastAccessTime.dwLowDateTime=0xe6666d00, ftLastAccessTime.dwHighDateTime=0x1d5d0e8, ftLastWriteTime.dwLowDateTime=0xb65676e0, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x7c50)) returned 1 [0109.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0109.188] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\J6NJtsVFM1f_Q-F9.docx" (normalized: "c:\\users\\fd1hvy\\documents\\j6njtsvfm1f_q-f9.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\J6NJtsVFM1f_Q-F9.docx.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\j6njtsvfm1f_q-f9.docx.spybuster")) returned 1 [0109.189] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\LNxMafDRKQVGv.xlsx", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\LNxMafDRKQVGv.xlsx", lpFilePart=0x0) returned 0x2c [0109.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0109.189] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\LNxMafDRKQVGv.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\lnxmafdrkqvgv.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0109.189] GetFileType (hFile=0x37c) returned 0x1 [0109.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0109.189] GetFileType (hFile=0x37c) returned 0x1 [0109.189] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x14fd8 [0109.190] ReadFile (in: hFile=0x37c, lpBuffer=0x3987570, nNumberOfBytesToRead=0x14fd8, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x3987570*, lpNumberOfBytesRead=0x19ecec*=0x14fd8, lpOverlapped=0x0) returned 1 [0109.195] CloseHandle (hObject=0x37c) returned 1 [0109.284] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0109.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0109.284] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0109.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0109.284] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\LNxMafDRKQVGv.xlsx", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\LNxMafDRKQVGv.xlsx", lpFilePart=0x0) returned 0x2c [0109.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0109.284] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\LNxMafDRKQVGv.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\lnxmafdrkqvgv.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0109.287] GetFileType (hFile=0x37c) returned 0x1 [0109.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0109.287] GetFileType (hFile=0x37c) returned 0x1 [0109.287] WriteFile (in: hFile=0x37c, lpBuffer=0x3651a48*, nNumberOfBytesToWrite=0x14fe0, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x3651a48*, lpNumberOfBytesWritten=0x19ece0*=0x14fe0, lpOverlapped=0x0) returned 1 [0109.289] CloseHandle (hObject=0x37c) returned 1 [0109.292] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\LNxMafDRKQVGv.xlsx", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\LNxMafDRKQVGv.xlsx", lpFilePart=0x0) returned 0x2c [0109.292] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\LNxMafDRKQVGv.xlsx.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\LNxMafDRKQVGv.xlsx.spybuster", lpFilePart=0x0) returned 0x36 [0109.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0109.292] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\LNxMafDRKQVGv.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\lnxmafdrkqvgv.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x812f74e0, ftCreationTime.dwHighDateTime=0x1d5808e, ftLastAccessTime.dwLowDateTime=0xd130650, ftLastAccessTime.dwHighDateTime=0x1d56d8b, ftLastWriteTime.dwLowDateTime=0xb667266e, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x14fe0)) returned 1 [0109.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0109.292] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\LNxMafDRKQVGv.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\lnxmafdrkqvgv.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\LNxMafDRKQVGv.xlsx.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\lnxmafdrkqvgv.xlsx.spybuster")) returned 1 [0109.293] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\LOrxufOFI.xlsx", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\LOrxufOFI.xlsx", lpFilePart=0x0) returned 0x28 [0109.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0109.293] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\LOrxufOFI.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\lorxufofi.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0109.293] GetFileType (hFile=0x37c) returned 0x1 [0109.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0109.293] GetFileType (hFile=0x37c) returned 0x1 [0109.293] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x96ae [0109.293] ReadFile (in: hFile=0x37c, lpBuffer=0x265e1cc, nNumberOfBytesToRead=0x96ae, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x265e1cc*, lpNumberOfBytesRead=0x19ecec*=0x96ae, lpOverlapped=0x0) returned 1 [0109.294] CloseHandle (hObject=0x37c) returned 1 [0109.362] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0109.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0109.362] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0109.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0109.362] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\LOrxufOFI.xlsx", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\LOrxufOFI.xlsx", lpFilePart=0x0) returned 0x28 [0109.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0109.362] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\LOrxufOFI.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\lorxufofi.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0109.415] GetFileType (hFile=0x37c) returned 0x1 [0109.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0109.416] GetFileType (hFile=0x37c) returned 0x1 [0109.416] WriteFile (in: hFile=0x37c, lpBuffer=0x26da284*, nNumberOfBytesToWrite=0x96b0, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x26da284*, lpNumberOfBytesWritten=0x19ece0*=0x96b0, lpOverlapped=0x0) returned 1 [0109.418] CloseHandle (hObject=0x37c) returned 1 [0109.422] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\LOrxufOFI.xlsx", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\LOrxufOFI.xlsx", lpFilePart=0x0) returned 0x28 [0109.422] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\LOrxufOFI.xlsx.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\LOrxufOFI.xlsx.spybuster", lpFilePart=0x0) returned 0x32 [0109.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0109.422] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\LOrxufOFI.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\lorxufofi.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d527570, ftCreationTime.dwHighDateTime=0x1d5ec0c, ftLastAccessTime.dwLowDateTime=0x3d6a3020, ftLastAccessTime.dwHighDateTime=0x1d5e145, ftLastWriteTime.dwLowDateTime=0xb67a397f, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x96b0)) returned 1 [0109.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0109.423] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\LOrxufOFI.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\lorxufofi.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\LOrxufOFI.xlsx.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\lorxufofi.xlsx.spybuster")) returned 1 [0109.423] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\pd7W-tx1l.ppt", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\pd7W-tx1l.ppt", lpFilePart=0x0) returned 0x27 [0109.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0109.423] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\pd7W-tx1l.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\pd7w-tx1l.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0109.424] GetFileType (hFile=0x37c) returned 0x1 [0109.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0109.424] GetFileType (hFile=0x37c) returned 0x1 [0109.424] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x13bdb [0109.424] ReadFile (in: hFile=0x37c, lpBuffer=0x26e3d8c, nNumberOfBytesToRead=0x13bdb, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x26e3d8c*, lpNumberOfBytesRead=0x19ecec*=0x13bdb, lpOverlapped=0x0) returned 1 [0109.426] CloseHandle (hObject=0x37c) returned 1 [0109.451] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0109.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0109.451] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0109.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0109.451] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\pd7W-tx1l.ppt", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\pd7W-tx1l.ppt", lpFilePart=0x0) returned 0x27 [0109.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0109.452] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\pd7W-tx1l.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\pd7w-tx1l.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0109.453] GetFileType (hFile=0x37c) returned 0x1 [0109.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0109.453] GetFileType (hFile=0x37c) returned 0x1 [0109.453] WriteFile (in: hFile=0x37c, lpBuffer=0x276bf2c*, nNumberOfBytesToWrite=0x13be0, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x276bf2c*, lpNumberOfBytesWritten=0x19ece0*=0x13be0, lpOverlapped=0x0) returned 1 [0109.456] CloseHandle (hObject=0x37c) returned 1 [0109.573] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\pd7W-tx1l.ppt", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\pd7W-tx1l.ppt", lpFilePart=0x0) returned 0x27 [0109.573] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\pd7W-tx1l.ppt.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\pd7W-tx1l.ppt.spybuster", lpFilePart=0x0) returned 0x31 [0109.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0109.573] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\pd7W-tx1l.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\pd7w-tx1l.ppt"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe976b700, ftCreationTime.dwHighDateTime=0x1d5ec83, ftLastAccessTime.dwLowDateTime=0x22565e60, ftLastAccessTime.dwHighDateTime=0x1d5ea70, ftLastWriteTime.dwLowDateTime=0xb68886a4, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x13be0)) returned 1 [0109.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0109.574] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\pd7W-tx1l.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\pd7w-tx1l.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\pd7W-tx1l.ppt.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\pd7w-tx1l.ppt.spybuster")) returned 1 [0109.578] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\q3_wqcOFyz--unpL.docx", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\q3_wqcOFyz--unpL.docx", lpFilePart=0x0) returned 0x2f [0109.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0109.578] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\q3_wqcOFyz--unpL.docx" (normalized: "c:\\users\\fd1hvy\\documents\\q3_wqcofyz--unpl.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0109.578] GetFileType (hFile=0x37c) returned 0x1 [0109.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0109.578] GetFileType (hFile=0x37c) returned 0x1 [0109.578] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x108f [0109.579] ReadFile (in: hFile=0x37c, lpBuffer=0x277ff70, nNumberOfBytesToRead=0x108f, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x277ff70*, lpNumberOfBytesRead=0x19ecec*=0x108f, lpOverlapped=0x0) returned 1 [0109.580] CloseHandle (hObject=0x37c) returned 1 [0109.604] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0109.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0109.604] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0109.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0109.604] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\q3_wqcOFyz--unpL.docx", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\q3_wqcOFyz--unpL.docx", lpFilePart=0x0) returned 0x2f [0109.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0109.604] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\q3_wqcOFyz--unpL.docx" (normalized: "c:\\users\\fd1hvy\\documents\\q3_wqcofyz--unpl.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0109.606] GetFileType (hFile=0x37c) returned 0x1 [0109.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0109.606] GetFileType (hFile=0x37c) returned 0x1 [0109.606] WriteFile (in: hFile=0x37c, lpBuffer=0x27d202c*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x27d202c*, lpNumberOfBytesWritten=0x19ece0*=0x1090, lpOverlapped=0x0) returned 1 [0109.607] CloseHandle (hObject=0x37c) returned 1 [0109.608] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\q3_wqcOFyz--unpL.docx", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\q3_wqcOFyz--unpL.docx", lpFilePart=0x0) returned 0x2f [0109.608] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\q3_wqcOFyz--unpL.docx.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\q3_wqcOFyz--unpL.docx.spybuster", lpFilePart=0x0) returned 0x39 [0109.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0109.608] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\q3_wqcOFyz--unpL.docx" (normalized: "c:\\users\\fd1hvy\\documents\\q3_wqcofyz--unpl.docx"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58b8f6d0, ftCreationTime.dwHighDateTime=0x1d5c639, ftLastAccessTime.dwLowDateTime=0x8095c1d0, ftLastAccessTime.dwHighDateTime=0x1d56543, ftLastWriteTime.dwLowDateTime=0xb696d6d5, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x1090)) returned 1 [0109.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0109.609] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\q3_wqcOFyz--unpL.docx" (normalized: "c:\\users\\fd1hvy\\documents\\q3_wqcofyz--unpl.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\q3_wqcOFyz--unpL.docx.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\q3_wqcofyz--unpl.docx.spybuster")) returned 1 [0109.610] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sSefU-IfjA72.pptx", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\sSefU-IfjA72.pptx", lpFilePart=0x0) returned 0x2b [0109.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0109.610] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sSefU-IfjA72.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ssefu-ifja72.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0109.610] GetFileType (hFile=0x37c) returned 0x1 [0109.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0109.610] GetFileType (hFile=0x37c) returned 0x1 [0109.610] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x965e [0109.610] ReadFile (in: hFile=0x37c, lpBuffer=0x27d3578, nNumberOfBytesToRead=0x965e, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x27d3578*, lpNumberOfBytesRead=0x19ecec*=0x965e, lpOverlapped=0x0) returned 1 [0109.611] CloseHandle (hObject=0x37c) returned 1 [0109.677] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0109.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0109.678] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0109.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0109.678] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sSefU-IfjA72.pptx", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\sSefU-IfjA72.pptx", lpFilePart=0x0) returned 0x2b [0109.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0109.678] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sSefU-IfjA72.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ssefu-ifja72.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0109.680] GetFileType (hFile=0x37c) returned 0x1 [0109.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0109.680] GetFileType (hFile=0x37c) returned 0x1 [0109.680] WriteFile (in: hFile=0x37c, lpBuffer=0x284f344*, nNumberOfBytesToWrite=0x9660, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x284f344*, lpNumberOfBytesWritten=0x19ece0*=0x9660, lpOverlapped=0x0) returned 1 [0109.681] CloseHandle (hObject=0x37c) returned 1 [0109.684] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sSefU-IfjA72.pptx", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\sSefU-IfjA72.pptx", lpFilePart=0x0) returned 0x2b [0109.684] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sSefU-IfjA72.pptx.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\sSefU-IfjA72.pptx.spybuster", lpFilePart=0x0) returned 0x35 [0109.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0109.684] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sSefU-IfjA72.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ssefu-ifja72.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65eeaa80, ftCreationTime.dwHighDateTime=0x1d592df, ftLastAccessTime.dwLowDateTime=0x43ff5280, ftLastAccessTime.dwHighDateTime=0x1d5d40c, ftLastWriteTime.dwLowDateTime=0xb6a2c164, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x9660)) returned 1 [0109.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0109.684] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sSefU-IfjA72.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ssefu-ifja72.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sSefU-IfjA72.pptx.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\ssefu-ifja72.pptx.spybuster")) returned 1 [0109.685] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VmHknY5nzMK.pptx", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VmHknY5nzMK.pptx", lpFilePart=0x0) returned 0x2a [0109.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0109.685] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\VmHknY5nzMK.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vmhkny5nzmk.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0109.685] GetFileType (hFile=0x37c) returned 0x1 [0109.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0109.685] GetFileType (hFile=0x37c) returned 0x1 [0109.685] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0xa7b1 [0109.685] ReadFile (in: hFile=0x37c, lpBuffer=0x2858e38, nNumberOfBytesToRead=0xa7b1, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x2858e38*, lpNumberOfBytesRead=0x19ecec*=0xa7b1, lpOverlapped=0x0) returned 1 [0109.686] CloseHandle (hObject=0x37c) returned 1 [0109.721] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0109.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0109.721] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0109.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0109.721] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VmHknY5nzMK.pptx", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VmHknY5nzMK.pptx", lpFilePart=0x0) returned 0x2a [0109.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0109.721] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\VmHknY5nzMK.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vmhkny5nzmk.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0109.723] GetFileType (hFile=0x37c) returned 0x1 [0109.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0109.723] GetFileType (hFile=0x37c) returned 0x1 [0109.723] WriteFile (in: hFile=0x37c, lpBuffer=0x26c99fc*, nNumberOfBytesToWrite=0xa7c0, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x26c99fc*, lpNumberOfBytesWritten=0x19ece0*=0xa7c0, lpOverlapped=0x0) returned 1 [0109.725] CloseHandle (hObject=0x37c) returned 1 [0109.730] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VmHknY5nzMK.pptx", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VmHknY5nzMK.pptx", lpFilePart=0x0) returned 0x2a [0109.730] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VmHknY5nzMK.pptx.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VmHknY5nzMK.pptx.spybuster", lpFilePart=0x0) returned 0x34 [0109.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0109.730] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VmHknY5nzMK.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vmhkny5nzmk.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0f64940, ftCreationTime.dwHighDateTime=0x1d5d0b9, ftLastAccessTime.dwLowDateTime=0xcd40ed60, ftLastAccessTime.dwHighDateTime=0x1d5da79, ftLastWriteTime.dwLowDateTime=0xb6a9e975, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xa7c0)) returned 1 [0109.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0109.730] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\VmHknY5nzMK.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vmhkny5nzmk.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\VmHknY5nzMK.pptx.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\vmhkny5nzmk.pptx.spybuster")) returned 1 [0109.731] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Ynj2Cy37O15ozYze12.docx", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Ynj2Cy37O15ozYze12.docx", lpFilePart=0x0) returned 0x31 [0109.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0109.731] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Ynj2Cy37O15ozYze12.docx" (normalized: "c:\\users\\fd1hvy\\documents\\ynj2cy37o15ozyze12.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0109.731] GetFileType (hFile=0x37c) returned 0x1 [0109.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0109.731] GetFileType (hFile=0x37c) returned 0x1 [0109.731] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0xb1e6 [0109.731] ReadFile (in: hFile=0x37c, lpBuffer=0x26d4650, nNumberOfBytesToRead=0xb1e6, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x26d4650*, lpNumberOfBytesRead=0x19ecec*=0xb1e6, lpOverlapped=0x0) returned 1 [0109.732] CloseHandle (hObject=0x37c) returned 1 [0109.764] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0109.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0109.764] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0109.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0109.764] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Ynj2Cy37O15ozYze12.docx", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Ynj2Cy37O15ozYze12.docx", lpFilePart=0x0) returned 0x31 [0109.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0109.764] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Ynj2Cy37O15ozYze12.docx" (normalized: "c:\\users\\fd1hvy\\documents\\ynj2cy37o15ozyze12.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0109.766] GetFileType (hFile=0x37c) returned 0x1 [0109.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0109.766] GetFileType (hFile=0x37c) returned 0x1 [0109.766] WriteFile (in: hFile=0x37c, lpBuffer=0x2742b7c*, nNumberOfBytesToWrite=0xb1f0, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x2742b7c*, lpNumberOfBytesWritten=0x19ece0*=0xb1f0, lpOverlapped=0x0) returned 1 [0109.768] CloseHandle (hObject=0x37c) returned 1 [0109.771] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Ynj2Cy37O15ozYze12.docx", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Ynj2Cy37O15ozYze12.docx", lpFilePart=0x0) returned 0x31 [0109.771] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Ynj2Cy37O15ozYze12.docx.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Ynj2Cy37O15ozYze12.docx.spybuster", lpFilePart=0x0) returned 0x3b [0109.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0109.771] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Ynj2Cy37O15ozYze12.docx" (normalized: "c:\\users\\fd1hvy\\documents\\ynj2cy37o15ozyze12.docx"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacaf0c60, ftCreationTime.dwHighDateTime=0x1d571da, ftLastAccessTime.dwLowDateTime=0xb75cc30, ftLastAccessTime.dwHighDateTime=0x1d5b307, ftLastWriteTime.dwLowDateTime=0xb6b11007, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xb1f0)) returned 1 [0109.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0109.771] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Ynj2Cy37O15ozYze12.docx" (normalized: "c:\\users\\fd1hvy\\documents\\ynj2cy37o15ozyze12.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Ynj2Cy37O15ozYze12.docx.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\ynj2cy37o15ozyze12.docx.spybuster")) returned 1 [0109.772] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\z5krZTI-Nz8bW.pptx", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\z5krZTI-Nz8bW.pptx", lpFilePart=0x0) returned 0x2c [0109.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0109.772] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\z5krZTI-Nz8bW.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\z5krzti-nz8bw.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0109.772] GetFileType (hFile=0x37c) returned 0x1 [0109.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0109.772] GetFileType (hFile=0x37c) returned 0x1 [0109.772] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x17a63 [0109.773] ReadFile (in: hFile=0x37c, lpBuffer=0x3700a38, nNumberOfBytesToRead=0x17a63, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x3700a38*, lpNumberOfBytesRead=0x19ecec*=0x17a63, lpOverlapped=0x0) returned 1 [0109.774] CloseHandle (hObject=0x37c) returned 1 [0109.800] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0109.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0109.801] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0109.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0109.801] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\z5krZTI-Nz8bW.pptx", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\z5krZTI-Nz8bW.pptx", lpFilePart=0x0) returned 0x2c [0109.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0109.801] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\z5krZTI-Nz8bW.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\z5krzti-nz8bw.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0109.803] GetFileType (hFile=0x37c) returned 0x1 [0109.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0109.803] GetFileType (hFile=0x37c) returned 0x1 [0109.803] WriteFile (in: hFile=0x37c, lpBuffer=0x3776e98*, nNumberOfBytesToWrite=0x17a70, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x3776e98*, lpNumberOfBytesWritten=0x19ece0*=0x17a70, lpOverlapped=0x0) returned 1 [0109.805] CloseHandle (hObject=0x37c) returned 1 [0109.808] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\z5krZTI-Nz8bW.pptx", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\z5krZTI-Nz8bW.pptx", lpFilePart=0x0) returned 0x2c [0109.808] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\z5krZTI-Nz8bW.pptx.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\z5krZTI-Nz8bW.pptx.spybuster", lpFilePart=0x0) returned 0x36 [0109.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0109.808] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\z5krZTI-Nz8bW.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\z5krzti-nz8bw.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x451448d0, ftCreationTime.dwHighDateTime=0x1d5df2c, ftLastAccessTime.dwLowDateTime=0x7e0c3460, ftLastAccessTime.dwHighDateTime=0x1d57102, ftLastWriteTime.dwLowDateTime=0xb6b5d640, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x17a70)) returned 1 [0109.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0109.808] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\z5krZTI-Nz8bW.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\z5krzti-nz8bw.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\z5krZTI-Nz8bW.pptx.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\z5krzti-nz8bw.pptx.spybuster")) returned 1 [0109.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed24) returned 1 [0109.809] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\aYu2P_HjBi7kE 3 j", nBufferLength=0x105, lpBuffer=0x19e7d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\aYu2P_HjBi7kE 3 j", lpFilePart=0x0) returned 0x2b [0109.809] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\aYu2P_HjBi7kE 3 j\\*", lpFindFileData=0x19ea4c | out: lpFindFileData=0x19ea4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x662de30, ftCreationTime.dwHighDateTime=0x1d5eebd, ftLastAccessTime.dwLowDateTime=0xe023d9d0, ftLastAccessTime.dwHighDateTime=0x1d5ea8a, ftLastWriteTime.dwLowDateTime=0xe023d9d0, ftLastWriteTime.dwHighDateTime=0x1d5ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77bb38 [0109.809] FindNextFileW (in: hFindFile=0x77bb38, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x662de30, ftCreationTime.dwHighDateTime=0x1d5eebd, ftLastAccessTime.dwLowDateTime=0xe023d9d0, ftLastAccessTime.dwHighDateTime=0x1d5ea8a, ftLastWriteTime.dwLowDateTime=0xe023d9d0, ftLastWriteTime.dwHighDateTime=0x1d5ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.809] FindNextFileW (in: hFindFile=0x77bb38, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8241d060, ftCreationTime.dwHighDateTime=0x1d5ecd8, ftLastAccessTime.dwLowDateTime=0x8ad195e0, ftLastAccessTime.dwHighDateTime=0x1d5efe8, ftLastWriteTime.dwLowDateTime=0x8ad195e0, ftLastWriteTime.dwHighDateTime=0x1d5efe8, nFileSizeHigh=0x0, nFileSizeLow=0x17127, dwReserved0=0x0, dwReserved1=0x0, cFileName="EcUAKJSp7uA1nOU18lPn.xls", cAlternateFileName="ECUAKJ~1.XLS")) returned 1 [0109.809] FindNextFileW (in: hFindFile=0x77bb38, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48e145c0, ftCreationTime.dwHighDateTime=0x1d5e2a2, ftLastAccessTime.dwLowDateTime=0xad626890, ftLastAccessTime.dwHighDateTime=0x1d5e6e3, ftLastWriteTime.dwLowDateTime=0xad626890, ftLastWriteTime.dwHighDateTime=0x1d5e6e3, nFileSizeHigh=0x0, nFileSizeLow=0xadf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J91bWa5LxWbG7ZvqLKQ.ots", cAlternateFileName="J91BWA~1.OTS")) returned 1 [0109.809] FindNextFileW (in: hFindFile=0x77bb38, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x967d9910, ftCreationTime.dwHighDateTime=0x1d5e6cf, ftLastAccessTime.dwLowDateTime=0x37464190, ftLastAccessTime.dwHighDateTime=0x1d5e477, ftLastWriteTime.dwLowDateTime=0x37464190, ftLastWriteTime.dwHighDateTime=0x1d5e477, nFileSizeHigh=0x0, nFileSizeLow=0x4f1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="pMgw582rYBWtsIcH.ods", cAlternateFileName="PMGW58~1.ODS")) returned 1 [0109.809] FindNextFileW (in: hFindFile=0x77bb38, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc1e19c0, ftCreationTime.dwHighDateTime=0x1d5ea20, ftLastAccessTime.dwLowDateTime=0x69f5f900, ftLastAccessTime.dwHighDateTime=0x1d5ea62, ftLastWriteTime.dwLowDateTime=0x69f5f900, ftLastWriteTime.dwHighDateTime=0x1d5ea62, nFileSizeHigh=0x0, nFileSizeLow=0x13dac, dwReserved0=0x0, dwReserved1=0x0, cFileName="uWslzdPxvlQ9H.ods", cAlternateFileName="UWSLZD~1.ODS")) returned 1 [0109.809] FindNextFileW (in: hFindFile=0x77bb38, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c5f9570, ftCreationTime.dwHighDateTime=0x1d5ea55, ftLastAccessTime.dwLowDateTime=0xedeec820, ftLastAccessTime.dwHighDateTime=0x1d5e6d1, ftLastWriteTime.dwLowDateTime=0xedeec820, ftLastWriteTime.dwHighDateTime=0x1d5e6d1, nFileSizeHigh=0x0, nFileSizeLow=0x1513, dwReserved0=0x0, dwReserved1=0x0, cFileName="W7Du.odp", cAlternateFileName="")) returned 1 [0109.809] FindNextFileW (in: hFindFile=0x77bb38, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8138a1f0, ftCreationTime.dwHighDateTime=0x1d5e7ef, ftLastAccessTime.dwLowDateTime=0x55972c70, ftLastAccessTime.dwHighDateTime=0x1d5ebe0, ftLastWriteTime.dwLowDateTime=0x55972c70, ftLastWriteTime.dwHighDateTime=0x1d5ebe0, nFileSizeHigh=0x0, nFileSizeLow=0x15f29, dwReserved0=0x0, dwReserved1=0x0, cFileName="_017ax.odt", cAlternateFileName="")) returned 1 [0109.809] FindNextFileW (in: hFindFile=0x77bb38, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0109.809] FindClose (in: hFindFile=0x77bb38 | out: hFindFile=0x77bb38) returned 1 [0109.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ece0) returned 1 [0109.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecec) returned 1 [0109.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed24) returned 1 [0109.810] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\aYu2P_HjBi7kE 3 j", nBufferLength=0x105, lpBuffer=0x19e7d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\aYu2P_HjBi7kE 3 j", lpFilePart=0x0) returned 0x2b [0109.810] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\aYu2P_HjBi7kE 3 j\\*", lpFindFileData=0x19ea4c | out: lpFindFileData=0x19ea4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x662de30, ftCreationTime.dwHighDateTime=0x1d5eebd, ftLastAccessTime.dwLowDateTime=0xe023d9d0, ftLastAccessTime.dwHighDateTime=0x1d5ea8a, ftLastWriteTime.dwLowDateTime=0xe023d9d0, ftLastWriteTime.dwHighDateTime=0x1d5ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b5b8 [0109.810] FindNextFileW (in: hFindFile=0x77b5b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x662de30, ftCreationTime.dwHighDateTime=0x1d5eebd, ftLastAccessTime.dwLowDateTime=0xe023d9d0, ftLastAccessTime.dwHighDateTime=0x1d5ea8a, ftLastWriteTime.dwLowDateTime=0xe023d9d0, ftLastWriteTime.dwHighDateTime=0x1d5ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.810] FindNextFileW (in: hFindFile=0x77b5b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8241d060, ftCreationTime.dwHighDateTime=0x1d5ecd8, ftLastAccessTime.dwLowDateTime=0x8ad195e0, ftLastAccessTime.dwHighDateTime=0x1d5efe8, ftLastWriteTime.dwLowDateTime=0x8ad195e0, ftLastWriteTime.dwHighDateTime=0x1d5efe8, nFileSizeHigh=0x0, nFileSizeLow=0x17127, dwReserved0=0x0, dwReserved1=0x0, cFileName="EcUAKJSp7uA1nOU18lPn.xls", cAlternateFileName="ECUAKJ~1.XLS")) returned 1 [0109.810] FindNextFileW (in: hFindFile=0x77b5b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48e145c0, ftCreationTime.dwHighDateTime=0x1d5e2a2, ftLastAccessTime.dwLowDateTime=0xad626890, ftLastAccessTime.dwHighDateTime=0x1d5e6e3, ftLastWriteTime.dwLowDateTime=0xad626890, ftLastWriteTime.dwHighDateTime=0x1d5e6e3, nFileSizeHigh=0x0, nFileSizeLow=0xadf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J91bWa5LxWbG7ZvqLKQ.ots", cAlternateFileName="J91BWA~1.OTS")) returned 1 [0109.810] FindNextFileW (in: hFindFile=0x77b5b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x967d9910, ftCreationTime.dwHighDateTime=0x1d5e6cf, ftLastAccessTime.dwLowDateTime=0x37464190, ftLastAccessTime.dwHighDateTime=0x1d5e477, ftLastWriteTime.dwLowDateTime=0x37464190, ftLastWriteTime.dwHighDateTime=0x1d5e477, nFileSizeHigh=0x0, nFileSizeLow=0x4f1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="pMgw582rYBWtsIcH.ods", cAlternateFileName="PMGW58~1.ODS")) returned 1 [0109.810] FindNextFileW (in: hFindFile=0x77b5b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc1e19c0, ftCreationTime.dwHighDateTime=0x1d5ea20, ftLastAccessTime.dwLowDateTime=0x69f5f900, ftLastAccessTime.dwHighDateTime=0x1d5ea62, ftLastWriteTime.dwLowDateTime=0x69f5f900, ftLastWriteTime.dwHighDateTime=0x1d5ea62, nFileSizeHigh=0x0, nFileSizeLow=0x13dac, dwReserved0=0x0, dwReserved1=0x0, cFileName="uWslzdPxvlQ9H.ods", cAlternateFileName="UWSLZD~1.ODS")) returned 1 [0109.810] FindNextFileW (in: hFindFile=0x77b5b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c5f9570, ftCreationTime.dwHighDateTime=0x1d5ea55, ftLastAccessTime.dwLowDateTime=0xedeec820, ftLastAccessTime.dwHighDateTime=0x1d5e6d1, ftLastWriteTime.dwLowDateTime=0xedeec820, ftLastWriteTime.dwHighDateTime=0x1d5e6d1, nFileSizeHigh=0x0, nFileSizeLow=0x1513, dwReserved0=0x0, dwReserved1=0x0, cFileName="W7Du.odp", cAlternateFileName="")) returned 1 [0109.810] FindNextFileW (in: hFindFile=0x77b5b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8138a1f0, ftCreationTime.dwHighDateTime=0x1d5e7ef, ftLastAccessTime.dwLowDateTime=0x55972c70, ftLastAccessTime.dwHighDateTime=0x1d5ebe0, ftLastWriteTime.dwLowDateTime=0x55972c70, ftLastWriteTime.dwHighDateTime=0x1d5ebe0, nFileSizeHigh=0x0, nFileSizeLow=0x15f29, dwReserved0=0x0, dwReserved1=0x0, cFileName="_017ax.odt", cAlternateFileName="")) returned 1 [0109.810] FindNextFileW (in: hFindFile=0x77b5b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8138a1f0, ftCreationTime.dwHighDateTime=0x1d5e7ef, ftLastAccessTime.dwLowDateTime=0x55972c70, ftLastAccessTime.dwHighDateTime=0x1d5ebe0, ftLastWriteTime.dwLowDateTime=0x55972c70, ftLastWriteTime.dwHighDateTime=0x1d5ebe0, nFileSizeHigh=0x0, nFileSizeLow=0x15f29, dwReserved0=0x0, dwReserved1=0x0, cFileName="_017ax.odt", cAlternateFileName="")) returned 0 [0109.810] FindClose (in: hFindFile=0x77b5b8 | out: hFindFile=0x77b5b8) returned 1 [0109.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ece0) returned 1 [0109.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecec) returned 1 [0109.810] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\aYu2P_HjBi7kE 3 j\\EcUAKJSp7uA1nOU18lPn.xls", nBufferLength=0x105, lpBuffer=0x19e68c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\aYu2P_HjBi7kE 3 j\\EcUAKJSp7uA1nOU18lPn.xls", lpFilePart=0x0) returned 0x44 [0109.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0109.810] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\aYu2P_HjBi7kE 3 j\\EcUAKJSp7uA1nOU18lPn.xls" (normalized: "c:\\users\\fd1hvy\\documents\\ayu2p_hjbi7ke 3 j\\ecuakjsp7ua1nou18lpn.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0109.811] GetFileType (hFile=0x37c) returned 0x1 [0109.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0109.811] GetFileType (hFile=0x37c) returned 0x1 [0109.811] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19eccc | out: lpFileSizeHigh=0x19eccc*=0x0) returned 0x17127 [0109.811] ReadFile (in: hFile=0x37c, lpBuffer=0x378e928, nNumberOfBytesToRead=0x17127, lpNumberOfBytesRead=0x19ec78, lpOverlapped=0x0 | out: lpBuffer=0x378e928*, lpNumberOfBytesRead=0x19ec78*=0x17127, lpOverlapped=0x0) returned 1 [0109.812] CloseHandle (hObject=0x37c) returned 1 [0109.830] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e790, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0109.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0109.830] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ecc0 | out: lpFileInformation=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0109.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0109.830] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\aYu2P_HjBi7kE 3 j\\EcUAKJSp7uA1nOU18lPn.xls", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\aYu2P_HjBi7kE 3 j\\EcUAKJSp7uA1nOU18lPn.xls", lpFilePart=0x0) returned 0x44 [0109.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0109.830] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\aYu2P_HjBi7kE 3 j\\EcUAKJSp7uA1nOU18lPn.xls" (normalized: "c:\\users\\fd1hvy\\documents\\ayu2p_hjbi7ke 3 j\\ecuakjsp7ua1nou18lpn.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0109.874] GetFileType (hFile=0x37c) returned 0x1 [0109.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0109.875] GetFileType (hFile=0x37c) returned 0x1 [0109.875] WriteFile (in: hFile=0x37c, lpBuffer=0x3801f50*, nNumberOfBytesToWrite=0x17130, lpNumberOfBytesWritten=0x19ec6c, lpOverlapped=0x0 | out: lpBuffer=0x3801f50*, lpNumberOfBytesWritten=0x19ec6c*=0x17130, lpOverlapped=0x0) returned 1 [0109.877] CloseHandle (hObject=0x37c) returned 1 [0109.881] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\aYu2P_HjBi7kE 3 j\\EcUAKJSp7uA1nOU18lPn.xls", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\aYu2P_HjBi7kE 3 j\\EcUAKJSp7uA1nOU18lPn.xls", lpFilePart=0x0) returned 0x44 [0109.881] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\aYu2P_HjBi7kE 3 j\\EcUAKJSp7uA1nOU18lPn.xls.spybuster", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\aYu2P_HjBi7kE 3 j\\EcUAKJSp7uA1nOU18lPn.xls.spybuster", lpFilePart=0x0) returned 0x4e [0109.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec50) returned 1 [0109.882] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\aYu2P_HjBi7kE 3 j\\EcUAKJSp7uA1nOU18lPn.xls" (normalized: "c:\\users\\fd1hvy\\documents\\ayu2p_hjbi7ke 3 j\\ecuakjsp7ua1nou18lpn.xls"), fInfoLevelId=0x0, lpFileInformation=0x19eccc | out: lpFileInformation=0x19eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8241d060, ftCreationTime.dwHighDateTime=0x1d5ecd8, ftLastAccessTime.dwLowDateTime=0x8ad195e0, ftLastAccessTime.dwHighDateTime=0x1d5efe8, ftLastWriteTime.dwLowDateTime=0xb6c226a5, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x17130)) returned 1 [0109.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0109.882] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\aYu2P_HjBi7kE 3 j\\EcUAKJSp7uA1nOU18lPn.xls" (normalized: "c:\\users\\fd1hvy\\documents\\ayu2p_hjbi7ke 3 j\\ecuakjsp7ua1nou18lpn.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\aYu2P_HjBi7kE 3 j\\EcUAKJSp7uA1nOU18lPn.xls.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\ayu2p_hjbi7ke 3 j\\ecuakjsp7ua1nou18lpn.xls.spybuster")) returned 1 [0109.883] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\aYu2P_HjBi7kE 3 j\\_017ax.odt", nBufferLength=0x105, lpBuffer=0x19e68c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\aYu2P_HjBi7kE 3 j\\_017ax.odt", lpFilePart=0x0) returned 0x36 [0109.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0109.883] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\aYu2P_HjBi7kE 3 j\\_017ax.odt" (normalized: "c:\\users\\fd1hvy\\documents\\ayu2p_hjbi7ke 3 j\\_017ax.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0109.883] GetFileType (hFile=0x37c) returned 0x1 [0109.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0109.883] GetFileType (hFile=0x37c) returned 0x1 [0109.883] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19eccc | out: lpFileSizeHigh=0x19eccc*=0x0) returned 0x15f29 [0109.883] ReadFile (in: hFile=0x37c, lpBuffer=0x38190a0, nNumberOfBytesToRead=0x15f29, lpNumberOfBytesRead=0x19ec78, lpOverlapped=0x0 | out: lpBuffer=0x38190a0*, lpNumberOfBytesRead=0x19ec78*=0x15f29, lpOverlapped=0x0) returned 1 [0109.884] CloseHandle (hObject=0x37c) returned 1 [0109.927] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e790, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0109.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0109.927] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ecc0 | out: lpFileInformation=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0109.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0109.927] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\aYu2P_HjBi7kE 3 j\\_017ax.odt", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\aYu2P_HjBi7kE 3 j\\_017ax.odt", lpFilePart=0x0) returned 0x36 [0109.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0109.927] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\aYu2P_HjBi7kE 3 j\\_017ax.odt" (normalized: "c:\\users\\fd1hvy\\documents\\ayu2p_hjbi7ke 3 j\\_017ax.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0109.929] GetFileType (hFile=0x37c) returned 0x1 [0109.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0109.929] GetFileType (hFile=0x37c) returned 0x1 [0109.929] WriteFile (in: hFile=0x37c, lpBuffer=0x3886cc8*, nNumberOfBytesToWrite=0x15f30, lpNumberOfBytesWritten=0x19ec6c, lpOverlapped=0x0 | out: lpBuffer=0x3886cc8*, lpNumberOfBytesWritten=0x19ec6c*=0x15f30, lpOverlapped=0x0) returned 1 [0109.931] CloseHandle (hObject=0x37c) returned 1 [0109.934] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\aYu2P_HjBi7kE 3 j\\_017ax.odt", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\aYu2P_HjBi7kE 3 j\\_017ax.odt", lpFilePart=0x0) returned 0x36 [0109.934] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\aYu2P_HjBi7kE 3 j\\_017ax.odt.spybuster", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\aYu2P_HjBi7kE 3 j\\_017ax.odt.spybuster", lpFilePart=0x0) returned 0x40 [0109.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec50) returned 1 [0109.934] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\aYu2P_HjBi7kE 3 j\\_017ax.odt" (normalized: "c:\\users\\fd1hvy\\documents\\ayu2p_hjbi7ke 3 j\\_017ax.odt"), fInfoLevelId=0x0, lpFileInformation=0x19eccc | out: lpFileInformation=0x19eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8138a1f0, ftCreationTime.dwHighDateTime=0x1d5e7ef, ftLastAccessTime.dwLowDateTime=0x55972c70, ftLastAccessTime.dwHighDateTime=0x1d5ebe0, ftLastWriteTime.dwLowDateTime=0xb6c8e6c9, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x15f30)) returned 1 [0109.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0109.934] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\aYu2P_HjBi7kE 3 j\\_017ax.odt" (normalized: "c:\\users\\fd1hvy\\documents\\ayu2p_hjbi7ke 3 j\\_017ax.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\aYu2P_HjBi7kE 3 j\\_017ax.odt.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\ayu2p_hjbi7ke 3 j\\_017ax.odt.spybuster")) returned 1 [0109.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed24) returned 1 [0109.934] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x19e7d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Music", lpFilePart=0x0) returned 0x22 [0109.935] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Music\\*", lpFindFileData=0x19ea4c | out: lpFindFileData=0x19ea4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0109.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ece8) returned 1 [0109.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed24) returned 1 [0109.968] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x19e7d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Pictures", lpFilePart=0x0) returned 0x25 [0109.968] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Pictures\\*", lpFindFileData=0x19ea4c | out: lpFindFileData=0x19ea4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0109.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ece8) returned 1 [0109.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed24) returned 1 [0109.970] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x19e7d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes", lpFilePart=0x0) returned 0x23 [0109.970] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*", lpFindFileData=0x19ea4c | out: lpFindFileData=0x19ea4c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b6b8 [0109.971] FindNextFileW (in: hFindFile=0x77b6b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.971] FindNextFileW (in: hFindFile=0x77b6b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0109.971] FindNextFileW (in: hFindFile=0x77b6b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1a0f60e, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1a0f60e, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites.vssx", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0109.972] FindNextFileW (in: hFindFile=0x77b6b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0109.972] FindNextFileW (in: hFindFile=0x77b6b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0 [0109.972] FindClose (in: hFindFile=0x77b6b8 | out: hFindFile=0x77b6b8) returned 1 [0109.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ece0) returned 1 [0109.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecec) returned 1 [0109.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed24) returned 1 [0109.978] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x19e7d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes", lpFilePart=0x0) returned 0x23 [0109.978] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*", lpFindFileData=0x19ea4c | out: lpFindFileData=0x19ea4c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77bbb8 [0109.979] FindNextFileW (in: hFindFile=0x77bbb8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.979] FindNextFileW (in: hFindFile=0x77bbb8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0109.979] FindNextFileW (in: hFindFile=0x77bbb8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1a0f60e, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1a0f60e, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites.vssx", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0109.979] FindNextFileW (in: hFindFile=0x77bbb8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0109.979] FindNextFileW (in: hFindFile=0x77bbb8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0109.979] FindClose (in: hFindFile=0x77bbb8 | out: hFindFile=0x77bbb8) returned 1 [0109.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ece0) returned 1 [0109.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecec) returned 1 [0109.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb0) returned 1 [0109.980] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x19e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x2c [0109.980] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x19e9d8 | out: lpFindFileData=0x19e9d8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b6b8 [0109.981] FindNextFileW (in: hFindFile=0x77b6b8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.981] FindNextFileW (in: hFindFile=0x77b6b8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0109.981] FindNextFileW (in: hFindFile=0x77b6b8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0109.981] FindClose (in: hFindFile=0x77b6b8 | out: hFindFile=0x77b6b8) returned 1 [0109.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec6c) returned 1 [0109.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec78) returned 1 [0109.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb0) returned 1 [0109.981] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x19e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x2c [0109.981] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x19e9d8 | out: lpFindFileData=0x19e9d8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b6b8 [0109.982] FindNextFileW (in: hFindFile=0x77b6b8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.982] FindNextFileW (in: hFindFile=0x77b6b8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0109.982] FindNextFileW (in: hFindFile=0x77b6b8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0109.982] FindClose (in: hFindFile=0x77b6b8 | out: hFindFile=0x77b6b8) returned 1 [0109.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec6c) returned 1 [0109.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec78) returned 1 [0109.982] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", nBufferLength=0x105, lpBuffer=0x19e618, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", lpFilePart=0x0) returned 0x37 [0109.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb5c) returned 1 [0109.983] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0109.983] GetFileType (hFile=0x37c) returned 0x1 [0109.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb58) returned 1 [0109.983] GetFileType (hFile=0x37c) returned 0x1 [0109.983] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ec58 | out: lpFileSizeHigh=0x19ec58*=0x0) returned 0x74e6 [0109.983] ReadFile (in: hFile=0x37c, lpBuffer=0x283c9d8, nNumberOfBytesToRead=0x74e6, lpNumberOfBytesRead=0x19ec04, lpOverlapped=0x0 | out: lpBuffer=0x283c9d8*, lpNumberOfBytesRead=0x19ec04*=0x74e6, lpOverlapped=0x0) returned 1 [0109.985] CloseHandle (hObject=0x37c) returned 1 [0110.095] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e71c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0110.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0110.095] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ec4c | out: lpFileInformation=0x19ec4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0110.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0110.095] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", nBufferLength=0x105, lpBuffer=0x19e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", lpFilePart=0x0) returned 0x37 [0110.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb48) returned 1 [0110.096] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0110.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19cee0) returned 1 [0110.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed24) returned 1 [0110.157] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x19e7d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Videos", lpFilePart=0x0) returned 0x23 [0110.157] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Videos\\*", lpFindFileData=0x19ea4c | out: lpFindFileData=0x19ea4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0110.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ece8) returned 1 [0110.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed24) returned 1 [0110.159] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x19e7d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x27 [0110.159] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*", lpFindFileData=0x19ea4c | out: lpFindFileData=0x19ea4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b538 [0110.160] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.160] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 1 [0110.160] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0110.160] FindClose (in: hFindFile=0x77b538 | out: hFindFile=0x77b538) returned 1 [0110.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ece0) returned 1 [0110.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecec) returned 1 [0110.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed24) returned 1 [0110.161] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x19e7d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x27 [0110.161] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*", lpFindFileData=0x19ea4c | out: lpFindFileData=0x19ea4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77ba78 [0110.161] FindNextFileW (in: hFindFile=0x77ba78, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.161] FindNextFileW (in: hFindFile=0x77ba78, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 1 [0110.162] FindNextFileW (in: hFindFile=0x77ba78, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 0 [0110.162] FindClose (in: hFindFile=0x77ba78 | out: hFindFile=0x77ba78) returned 1 [0110.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ece0) returned 1 [0110.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecec) returned 1 [0110.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed24) returned 1 [0110.162] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP", nBufferLength=0x105, lpBuffer=0x19e7d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP", lpFilePart=0x0) returned 0x2e [0110.162] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\*", lpFindFileData=0x19ea4c | out: lpFindFileData=0x19ea4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42635b20, ftCreationTime.dwHighDateTime=0x1d5e2c5, ftLastAccessTime.dwLowDateTime=0x625789e0, ftLastAccessTime.dwHighDateTime=0x1d5e92a, ftLastWriteTime.dwLowDateTime=0x625789e0, ftLastWriteTime.dwHighDateTime=0x1d5e92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77bbf8 [0110.162] FindNextFileW (in: hFindFile=0x77bbf8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42635b20, ftCreationTime.dwHighDateTime=0x1d5e2c5, ftLastAccessTime.dwLowDateTime=0x625789e0, ftLastAccessTime.dwHighDateTime=0x1d5e92a, ftLastWriteTime.dwLowDateTime=0x625789e0, ftLastWriteTime.dwHighDateTime=0x1d5e92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.163] FindNextFileW (in: hFindFile=0x77bbf8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4f89aa0, ftCreationTime.dwHighDateTime=0x1d5f055, ftLastAccessTime.dwLowDateTime=0x560ad830, ftLastAccessTime.dwHighDateTime=0x1d5f0f6, ftLastWriteTime.dwLowDateTime=0x560ad830, ftLastWriteTime.dwHighDateTime=0x1d5f0f6, nFileSizeHigh=0x0, nFileSizeLow=0x1670c, dwReserved0=0x0, dwReserved1=0x0, cFileName="2xJB4WmajVCEC7.pdf", cAlternateFileName="2XJB4W~1.PDF")) returned 1 [0110.163] FindNextFileW (in: hFindFile=0x77bbf8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1d35f0, ftCreationTime.dwHighDateTime=0x1d5ece5, ftLastAccessTime.dwLowDateTime=0x80e5b9f0, ftLastAccessTime.dwHighDateTime=0x1d5ee24, ftLastWriteTime.dwLowDateTime=0x80e5b9f0, ftLastWriteTime.dwHighDateTime=0x1d5ee24, nFileSizeHigh=0x0, nFileSizeLow=0x3e08, dwReserved0=0x0, dwReserved1=0x0, cFileName="65fOXdLkoc_7A-ir4OV.csv", cAlternateFileName="65FOXD~1.CSV")) returned 1 [0110.163] FindNextFileW (in: hFindFile=0x77bbf8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a1fda10, ftCreationTime.dwHighDateTime=0x1d5e2bf, ftLastAccessTime.dwLowDateTime=0x9195510, ftLastAccessTime.dwHighDateTime=0x1d5ede0, ftLastWriteTime.dwLowDateTime=0x9195510, ftLastWriteTime.dwHighDateTime=0x1d5ede0, nFileSizeHigh=0x0, nFileSizeLow=0x10cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="cKNpYvVFpawzB_mnB.pdf", cAlternateFileName="CKNPYV~1.PDF")) returned 1 [0110.163] FindNextFileW (in: hFindFile=0x77bbf8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x567f93c0, ftCreationTime.dwHighDateTime=0x1d5e555, ftLastAccessTime.dwLowDateTime=0x96502710, ftLastAccessTime.dwHighDateTime=0x1d5e156, ftLastWriteTime.dwLowDateTime=0x96502710, ftLastWriteTime.dwHighDateTime=0x1d5e156, nFileSizeHigh=0x0, nFileSizeLow=0xd671, dwReserved0=0x0, dwReserved1=0x0, cFileName="KkBd5L9InIUv.ods", cAlternateFileName="KKBD5L~1.ODS")) returned 1 [0110.163] FindNextFileW (in: hFindFile=0x77bbf8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20ae86e0, ftCreationTime.dwHighDateTime=0x1d5efb7, ftLastAccessTime.dwLowDateTime=0x654d8700, ftLastAccessTime.dwHighDateTime=0x1d5e248, ftLastWriteTime.dwLowDateTime=0x654d8700, ftLastWriteTime.dwHighDateTime=0x1d5e248, nFileSizeHigh=0x0, nFileSizeLow=0x15ffe, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONUnU.ods", cAlternateFileName="")) returned 1 [0110.164] FindNextFileW (in: hFindFile=0x77bbf8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x936960d0, ftCreationTime.dwHighDateTime=0x1d5e867, ftLastAccessTime.dwLowDateTime=0x35217270, ftLastAccessTime.dwHighDateTime=0x1d5ea2d, ftLastWriteTime.dwLowDateTime=0x35217270, ftLastWriteTime.dwHighDateTime=0x1d5ea2d, nFileSizeHigh=0x0, nFileSizeLow=0x16a39, dwReserved0=0x0, dwReserved1=0x0, cFileName="oxYk7ESnPUTbU.docx", cAlternateFileName="OXYK7E~1.DOC")) returned 1 [0110.164] FindNextFileW (in: hFindFile=0x77bbf8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23e89770, ftCreationTime.dwHighDateTime=0x1d5eb7e, ftLastAccessTime.dwLowDateTime=0x83cbc360, ftLastAccessTime.dwHighDateTime=0x1d5ece6, ftLastWriteTime.dwLowDateTime=0x83cbc360, ftLastWriteTime.dwHighDateTime=0x1d5ece6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uHgh", cAlternateFileName="")) returned 1 [0110.164] FindNextFileW (in: hFindFile=0x77bbf8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9dc7e80, ftCreationTime.dwHighDateTime=0x1d5ec05, ftLastAccessTime.dwLowDateTime=0xb4886580, ftLastAccessTime.dwHighDateTime=0x1d5e99e, ftLastWriteTime.dwLowDateTime=0xb4886580, ftLastWriteTime.dwHighDateTime=0x1d5e99e, nFileSizeHigh=0x0, nFileSizeLow=0xeda9, dwReserved0=0x0, dwReserved1=0x0, cFileName="x4Pz6X-xTM2KRGJ.xlsx", cAlternateFileName="X4PZ6X~1.XLS")) returned 1 [0110.164] FindNextFileW (in: hFindFile=0x77bbf8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x216d8f40, ftCreationTime.dwHighDateTime=0x1d5e210, ftLastAccessTime.dwLowDateTime=0x86fca0e0, ftLastAccessTime.dwHighDateTime=0x1d5ef6b, ftLastWriteTime.dwLowDateTime=0x86fca0e0, ftLastWriteTime.dwHighDateTime=0x1d5ef6b, nFileSizeHigh=0x0, nFileSizeLow=0xe463, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zr4ou.doc", cAlternateFileName="")) returned 1 [0110.164] FindNextFileW (in: hFindFile=0x77bbf8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0110.164] FindClose (in: hFindFile=0x77bbf8 | out: hFindFile=0x77bbf8) returned 1 [0110.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ece0) returned 1 [0110.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecec) returned 1 [0110.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed24) returned 1 [0110.165] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP", nBufferLength=0x105, lpBuffer=0x19e7d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP", lpFilePart=0x0) returned 0x2e [0110.165] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\*", lpFindFileData=0x19ea4c | out: lpFindFileData=0x19ea4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42635b20, ftCreationTime.dwHighDateTime=0x1d5e2c5, ftLastAccessTime.dwLowDateTime=0x625789e0, ftLastAccessTime.dwHighDateTime=0x1d5e92a, ftLastWriteTime.dwLowDateTime=0x625789e0, ftLastWriteTime.dwHighDateTime=0x1d5e92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b678 [0110.165] FindNextFileW (in: hFindFile=0x77b678, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42635b20, ftCreationTime.dwHighDateTime=0x1d5e2c5, ftLastAccessTime.dwLowDateTime=0x625789e0, ftLastAccessTime.dwHighDateTime=0x1d5e92a, ftLastWriteTime.dwLowDateTime=0x625789e0, ftLastWriteTime.dwHighDateTime=0x1d5e92a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.165] FindNextFileW (in: hFindFile=0x77b678, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4f89aa0, ftCreationTime.dwHighDateTime=0x1d5f055, ftLastAccessTime.dwLowDateTime=0x560ad830, ftLastAccessTime.dwHighDateTime=0x1d5f0f6, ftLastWriteTime.dwLowDateTime=0x560ad830, ftLastWriteTime.dwHighDateTime=0x1d5f0f6, nFileSizeHigh=0x0, nFileSizeLow=0x1670c, dwReserved0=0x0, dwReserved1=0x0, cFileName="2xJB4WmajVCEC7.pdf", cAlternateFileName="2XJB4W~1.PDF")) returned 1 [0110.166] FindNextFileW (in: hFindFile=0x77b678, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1d35f0, ftCreationTime.dwHighDateTime=0x1d5ece5, ftLastAccessTime.dwLowDateTime=0x80e5b9f0, ftLastAccessTime.dwHighDateTime=0x1d5ee24, ftLastWriteTime.dwLowDateTime=0x80e5b9f0, ftLastWriteTime.dwHighDateTime=0x1d5ee24, nFileSizeHigh=0x0, nFileSizeLow=0x3e08, dwReserved0=0x0, dwReserved1=0x0, cFileName="65fOXdLkoc_7A-ir4OV.csv", cAlternateFileName="65FOXD~1.CSV")) returned 1 [0110.166] FindNextFileW (in: hFindFile=0x77b678, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a1fda10, ftCreationTime.dwHighDateTime=0x1d5e2bf, ftLastAccessTime.dwLowDateTime=0x9195510, ftLastAccessTime.dwHighDateTime=0x1d5ede0, ftLastWriteTime.dwLowDateTime=0x9195510, ftLastWriteTime.dwHighDateTime=0x1d5ede0, nFileSizeHigh=0x0, nFileSizeLow=0x10cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="cKNpYvVFpawzB_mnB.pdf", cAlternateFileName="CKNPYV~1.PDF")) returned 1 [0110.166] FindNextFileW (in: hFindFile=0x77b678, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x567f93c0, ftCreationTime.dwHighDateTime=0x1d5e555, ftLastAccessTime.dwLowDateTime=0x96502710, ftLastAccessTime.dwHighDateTime=0x1d5e156, ftLastWriteTime.dwLowDateTime=0x96502710, ftLastWriteTime.dwHighDateTime=0x1d5e156, nFileSizeHigh=0x0, nFileSizeLow=0xd671, dwReserved0=0x0, dwReserved1=0x0, cFileName="KkBd5L9InIUv.ods", cAlternateFileName="KKBD5L~1.ODS")) returned 1 [0110.166] FindNextFileW (in: hFindFile=0x77b678, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20ae86e0, ftCreationTime.dwHighDateTime=0x1d5efb7, ftLastAccessTime.dwLowDateTime=0x654d8700, ftLastAccessTime.dwHighDateTime=0x1d5e248, ftLastWriteTime.dwLowDateTime=0x654d8700, ftLastWriteTime.dwHighDateTime=0x1d5e248, nFileSizeHigh=0x0, nFileSizeLow=0x15ffe, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONUnU.ods", cAlternateFileName="")) returned 1 [0110.166] FindNextFileW (in: hFindFile=0x77b678, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x936960d0, ftCreationTime.dwHighDateTime=0x1d5e867, ftLastAccessTime.dwLowDateTime=0x35217270, ftLastAccessTime.dwHighDateTime=0x1d5ea2d, ftLastWriteTime.dwLowDateTime=0x35217270, ftLastWriteTime.dwHighDateTime=0x1d5ea2d, nFileSizeHigh=0x0, nFileSizeLow=0x16a39, dwReserved0=0x0, dwReserved1=0x0, cFileName="oxYk7ESnPUTbU.docx", cAlternateFileName="OXYK7E~1.DOC")) returned 1 [0110.167] FindNextFileW (in: hFindFile=0x77b678, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23e89770, ftCreationTime.dwHighDateTime=0x1d5eb7e, ftLastAccessTime.dwLowDateTime=0x83cbc360, ftLastAccessTime.dwHighDateTime=0x1d5ece6, ftLastWriteTime.dwLowDateTime=0x83cbc360, ftLastWriteTime.dwHighDateTime=0x1d5ece6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uHgh", cAlternateFileName="")) returned 1 [0110.167] FindNextFileW (in: hFindFile=0x77b678, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9dc7e80, ftCreationTime.dwHighDateTime=0x1d5ec05, ftLastAccessTime.dwLowDateTime=0xb4886580, ftLastAccessTime.dwHighDateTime=0x1d5e99e, ftLastWriteTime.dwLowDateTime=0xb4886580, ftLastWriteTime.dwHighDateTime=0x1d5e99e, nFileSizeHigh=0x0, nFileSizeLow=0xeda9, dwReserved0=0x0, dwReserved1=0x0, cFileName="x4Pz6X-xTM2KRGJ.xlsx", cAlternateFileName="X4PZ6X~1.XLS")) returned 1 [0110.167] FindNextFileW (in: hFindFile=0x77b678, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x216d8f40, ftCreationTime.dwHighDateTime=0x1d5e210, ftLastAccessTime.dwLowDateTime=0x86fca0e0, ftLastAccessTime.dwHighDateTime=0x1d5ef6b, ftLastWriteTime.dwLowDateTime=0x86fca0e0, ftLastWriteTime.dwHighDateTime=0x1d5ef6b, nFileSizeHigh=0x0, nFileSizeLow=0xe463, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zr4ou.doc", cAlternateFileName="")) returned 1 [0110.167] FindNextFileW (in: hFindFile=0x77b678, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x216d8f40, ftCreationTime.dwHighDateTime=0x1d5e210, ftLastAccessTime.dwLowDateTime=0x86fca0e0, ftLastAccessTime.dwHighDateTime=0x1d5ef6b, ftLastWriteTime.dwLowDateTime=0x86fca0e0, ftLastWriteTime.dwHighDateTime=0x1d5ef6b, nFileSizeHigh=0x0, nFileSizeLow=0xe463, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zr4ou.doc", cAlternateFileName="")) returned 0 [0110.167] FindClose (in: hFindFile=0x77b678 | out: hFindFile=0x77b678) returned 1 [0110.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ece0) returned 1 [0110.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecec) returned 1 [0110.168] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\2xJB4WmajVCEC7.pdf", nBufferLength=0x105, lpBuffer=0x19e68c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\2xJB4WmajVCEC7.pdf", lpFilePart=0x0) returned 0x41 [0110.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0110.168] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\2xJB4WmajVCEC7.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\2xjb4wmajvcec7.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0110.168] GetFileType (hFile=0x37c) returned 0x1 [0110.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0110.168] GetFileType (hFile=0x37c) returned 0x1 [0110.168] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19eccc | out: lpFileSizeHigh=0x19eccc*=0x0) returned 0x1670c [0110.168] ReadFile (in: hFile=0x37c, lpBuffer=0x389cc18, nNumberOfBytesToRead=0x1670c, lpNumberOfBytesRead=0x19ec78, lpOverlapped=0x0 | out: lpBuffer=0x389cc18*, lpNumberOfBytesRead=0x19ec78*=0x1670c, lpOverlapped=0x0) returned 1 [0110.170] CloseHandle (hObject=0x37c) returned 1 [0110.307] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e790, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0110.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0110.308] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ecc0 | out: lpFileInformation=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0110.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0110.308] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\2xJB4WmajVCEC7.pdf", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\2xJB4WmajVCEC7.pdf", lpFilePart=0x0) returned 0x41 [0110.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0110.308] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\2xJB4WmajVCEC7.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\2xjb4wmajvcec7.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0110.310] GetFileType (hFile=0x37c) returned 0x1 [0110.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0110.310] GetFileType (hFile=0x37c) returned 0x1 [0110.310] WriteFile (in: hFile=0x37c, lpBuffer=0x390cfa0*, nNumberOfBytesToWrite=0x16710, lpNumberOfBytesWritten=0x19ec6c, lpOverlapped=0x0 | out: lpBuffer=0x390cfa0*, lpNumberOfBytesWritten=0x19ec6c*=0x16710, lpOverlapped=0x0) returned 1 [0110.312] CloseHandle (hObject=0x37c) returned 1 [0110.321] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\2xJB4WmajVCEC7.pdf", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\2xJB4WmajVCEC7.pdf", lpFilePart=0x0) returned 0x41 [0110.321] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\2xJB4WmajVCEC7.pdf.spybuster", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\2xJB4WmajVCEC7.pdf.spybuster", lpFilePart=0x0) returned 0x4b [0110.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec50) returned 1 [0110.321] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\2xJB4WmajVCEC7.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\2xjb4wmajvcec7.pdf"), fInfoLevelId=0x0, lpFileInformation=0x19eccc | out: lpFileInformation=0x19eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4f89aa0, ftCreationTime.dwHighDateTime=0x1d5f055, ftLastAccessTime.dwLowDateTime=0x560ad830, ftLastAccessTime.dwHighDateTime=0x1d5f0f6, ftLastWriteTime.dwLowDateTime=0xb7053b26, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x16710)) returned 1 [0110.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0110.322] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\2xJB4WmajVCEC7.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\2xjb4wmajvcec7.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\2xJB4WmajVCEC7.pdf.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\2xjb4wmajvcec7.pdf.spybuster")) returned 1 [0110.323] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\65fOXdLkoc_7A-ir4OV.csv", nBufferLength=0x105, lpBuffer=0x19e68c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\65fOXdLkoc_7A-ir4OV.csv", lpFilePart=0x0) returned 0x46 [0110.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0110.323] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\65fOXdLkoc_7A-ir4OV.csv" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\65foxdlkoc_7a-ir4ov.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0110.323] GetFileType (hFile=0x37c) returned 0x1 [0110.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0110.323] GetFileType (hFile=0x37c) returned 0x1 [0110.323] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19eccc | out: lpFileSizeHigh=0x19eccc*=0x0) returned 0x3e08 [0110.323] ReadFile (in: hFile=0x37c, lpBuffer=0x2710018, nNumberOfBytesToRead=0x3e08, lpNumberOfBytesRead=0x19ec78, lpOverlapped=0x0 | out: lpBuffer=0x2710018*, lpNumberOfBytesRead=0x19ec78*=0x3e08, lpOverlapped=0x0) returned 1 [0110.324] CloseHandle (hObject=0x37c) returned 1 [0110.365] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e790, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0110.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0110.366] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ecc0 | out: lpFileInformation=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0110.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0110.367] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\65fOXdLkoc_7A-ir4OV.csv", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\65fOXdLkoc_7A-ir4OV.csv", lpFilePart=0x0) returned 0x46 [0110.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0110.367] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\65fOXdLkoc_7A-ir4OV.csv" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\65foxdlkoc_7a-ir4ov.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0110.372] GetFileType (hFile=0x37c) returned 0x1 [0110.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0110.374] GetFileType (hFile=0x37c) returned 0x1 [0110.374] WriteFile (in: hFile=0x37c, lpBuffer=0x2770450*, nNumberOfBytesToWrite=0x3e10, lpNumberOfBytesWritten=0x19ec6c, lpOverlapped=0x0 | out: lpBuffer=0x2770450*, lpNumberOfBytesWritten=0x19ec6c*=0x3e10, lpOverlapped=0x0) returned 1 [0110.403] CloseHandle (hObject=0x37c) returned 1 [0110.405] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\65fOXdLkoc_7A-ir4OV.csv", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\65fOXdLkoc_7A-ir4OV.csv", lpFilePart=0x0) returned 0x46 [0110.405] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\65fOXdLkoc_7A-ir4OV.csv.spybuster", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\65fOXdLkoc_7A-ir4OV.csv.spybuster", lpFilePart=0x0) returned 0x50 [0110.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec50) returned 1 [0110.405] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\65fOXdLkoc_7A-ir4OV.csv" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\65foxdlkoc_7a-ir4ov.csv"), fInfoLevelId=0x0, lpFileInformation=0x19eccc | out: lpFileInformation=0x19eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1d35f0, ftCreationTime.dwHighDateTime=0x1d5ece5, ftLastAccessTime.dwLowDateTime=0x80e5b9f0, ftLastAccessTime.dwHighDateTime=0x1d5ee24, ftLastWriteTime.dwLowDateTime=0xb7106e3d, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x3e10)) returned 1 [0110.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0110.405] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\65fOXdLkoc_7A-ir4OV.csv" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\65foxdlkoc_7a-ir4ov.csv"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\65fOXdLkoc_7A-ir4OV.csv.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\65foxdlkoc_7a-ir4ov.csv.spybuster")) returned 1 [0110.406] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\cKNpYvVFpawzB_mnB.pdf", nBufferLength=0x105, lpBuffer=0x19e68c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\cKNpYvVFpawzB_mnB.pdf", lpFilePart=0x0) returned 0x44 [0110.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0110.406] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\cKNpYvVFpawzB_mnB.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\cknpyvvfpawzb_mnb.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0110.406] GetFileType (hFile=0x37c) returned 0x1 [0110.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0110.406] GetFileType (hFile=0x37c) returned 0x1 [0110.406] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19eccc | out: lpFileSizeHigh=0x19eccc*=0x0) returned 0x10cde [0110.407] ReadFile (in: hFile=0x37c, lpBuffer=0x2774804, nNumberOfBytesToRead=0x10cde, lpNumberOfBytesRead=0x19ec78, lpOverlapped=0x0 | out: lpBuffer=0x2774804*, lpNumberOfBytesRead=0x19ec78*=0x10cde, lpOverlapped=0x0) returned 1 [0110.408] CloseHandle (hObject=0x37c) returned 1 [0110.434] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e790, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0110.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0110.434] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ecc0 | out: lpFileInformation=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0110.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0110.435] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\cKNpYvVFpawzB_mnB.pdf", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\cKNpYvVFpawzB_mnB.pdf", lpFilePart=0x0) returned 0x44 [0110.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0110.435] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\cKNpYvVFpawzB_mnB.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\cknpyvvfpawzb_mnb.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0110.437] GetFileType (hFile=0x37c) returned 0x1 [0110.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0110.437] GetFileType (hFile=0x37c) returned 0x1 [0110.437] WriteFile (in: hFile=0x37c, lpBuffer=0x27f3ca4*, nNumberOfBytesToWrite=0x10ce0, lpNumberOfBytesWritten=0x19ec6c, lpOverlapped=0x0 | out: lpBuffer=0x27f3ca4*, lpNumberOfBytesWritten=0x19ec6c*=0x10ce0, lpOverlapped=0x0) returned 1 [0110.439] CloseHandle (hObject=0x37c) returned 1 [0110.479] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\cKNpYvVFpawzB_mnB.pdf", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\cKNpYvVFpawzB_mnB.pdf", lpFilePart=0x0) returned 0x44 [0110.479] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\cKNpYvVFpawzB_mnB.pdf.spybuster", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\cKNpYvVFpawzB_mnB.pdf.spybuster", lpFilePart=0x0) returned 0x4e [0110.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec50) returned 1 [0110.480] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\cKNpYvVFpawzB_mnB.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\cknpyvvfpawzb_mnb.pdf"), fInfoLevelId=0x0, lpFileInformation=0x19eccc | out: lpFileInformation=0x19eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a1fda10, ftCreationTime.dwHighDateTime=0x1d5e2bf, ftLastAccessTime.dwLowDateTime=0x9195510, ftLastAccessTime.dwHighDateTime=0x1d5ede0, ftLastWriteTime.dwLowDateTime=0xb719f6b8, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x10ce0)) returned 1 [0110.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0110.482] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\cKNpYvVFpawzB_mnB.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\cknpyvvfpawzb_mnb.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\cKNpYvVFpawzB_mnB.pdf.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\cknpyvvfpawzb_mnb.pdf.spybuster")) returned 1 [0110.483] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\oxYk7ESnPUTbU.docx", nBufferLength=0x105, lpBuffer=0x19e68c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\oxYk7ESnPUTbU.docx", lpFilePart=0x0) returned 0x41 [0110.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0110.483] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\oxYk7ESnPUTbU.docx" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\oxyk7esnputbu.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0110.483] GetFileType (hFile=0x37c) returned 0x1 [0110.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0110.483] GetFileType (hFile=0x37c) returned 0x1 [0110.484] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19eccc | out: lpFileSizeHigh=0x19eccc*=0x0) returned 0x16a39 [0110.484] ReadFile (in: hFile=0x37c, lpBuffer=0x3945090, nNumberOfBytesToRead=0x16a39, lpNumberOfBytesRead=0x19ec78, lpOverlapped=0x0 | out: lpBuffer=0x3945090*, lpNumberOfBytesRead=0x19ec78*=0x16a39, lpOverlapped=0x0) returned 1 [0110.486] CloseHandle (hObject=0x37c) returned 1 [0110.638] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e790, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0110.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0110.638] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ecc0 | out: lpFileInformation=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0110.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0110.638] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\oxYk7ESnPUTbU.docx", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\oxYk7ESnPUTbU.docx", lpFilePart=0x0) returned 0x41 [0110.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0110.638] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\oxYk7ESnPUTbU.docx" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\oxyk7esnputbu.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0110.640] GetFileType (hFile=0x37c) returned 0x1 [0110.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0110.640] GetFileType (hFile=0x37c) returned 0x1 [0110.640] WriteFile (in: hFile=0x37c, lpBuffer=0x36c6358*, nNumberOfBytesToWrite=0x16a40, lpNumberOfBytesWritten=0x19ec6c, lpOverlapped=0x0 | out: lpBuffer=0x36c6358*, lpNumberOfBytesWritten=0x19ec6c*=0x16a40, lpOverlapped=0x0) returned 1 [0110.643] CloseHandle (hObject=0x37c) returned 1 [0110.649] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\oxYk7ESnPUTbU.docx", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\oxYk7ESnPUTbU.docx", lpFilePart=0x0) returned 0x41 [0110.649] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\oxYk7ESnPUTbU.docx.spybuster", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\oxYk7ESnPUTbU.docx.spybuster", lpFilePart=0x0) returned 0x4b [0110.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec50) returned 1 [0110.649] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\oxYk7ESnPUTbU.docx" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\oxyk7esnputbu.docx"), fInfoLevelId=0x0, lpFileInformation=0x19eccc | out: lpFileInformation=0x19eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x936960d0, ftCreationTime.dwHighDateTime=0x1d5e867, ftLastAccessTime.dwLowDateTime=0x35217270, ftLastAccessTime.dwHighDateTime=0x1d5ea2d, ftLastWriteTime.dwLowDateTime=0xb7369265, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x16a40)) returned 1 [0110.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0110.649] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\oxYk7ESnPUTbU.docx" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\oxyk7esnputbu.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\oxYk7ESnPUTbU.docx.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\oxyk7esnputbu.docx.spybuster")) returned 1 [0110.650] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\x4Pz6X-xTM2KRGJ.xlsx", nBufferLength=0x105, lpBuffer=0x19e68c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\x4Pz6X-xTM2KRGJ.xlsx", lpFilePart=0x0) returned 0x43 [0110.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0110.650] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\x4Pz6X-xTM2KRGJ.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\x4pz6x-xtm2krgj.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0110.651] GetFileType (hFile=0x37c) returned 0x1 [0110.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0110.651] GetFileType (hFile=0x37c) returned 0x1 [0110.651] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19eccc | out: lpFileSizeHigh=0x19eccc*=0x0) returned 0xeda9 [0110.651] ReadFile (in: hFile=0x37c, lpBuffer=0x265f790, nNumberOfBytesToRead=0xeda9, lpNumberOfBytesRead=0x19ec78, lpOverlapped=0x0 | out: lpBuffer=0x265f790*, lpNumberOfBytesRead=0x19ec78*=0xeda9, lpOverlapped=0x0) returned 1 [0110.652] CloseHandle (hObject=0x37c) returned 1 [0110.701] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e790, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0110.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0110.701] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ecc0 | out: lpFileInformation=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0110.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0110.701] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\x4Pz6X-xTM2KRGJ.xlsx", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\x4Pz6X-xTM2KRGJ.xlsx", lpFilePart=0x0) returned 0x43 [0110.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0110.701] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\x4Pz6X-xTM2KRGJ.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\x4pz6x-xtm2krgj.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0110.703] GetFileType (hFile=0x37c) returned 0x1 [0110.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0110.703] GetFileType (hFile=0x37c) returned 0x1 [0110.703] WriteFile (in: hFile=0x37c, lpBuffer=0x26d8ffc*, nNumberOfBytesToWrite=0xedb0, lpNumberOfBytesWritten=0x19ec6c, lpOverlapped=0x0 | out: lpBuffer=0x26d8ffc*, lpNumberOfBytesWritten=0x19ec6c*=0xedb0, lpOverlapped=0x0) returned 1 [0110.705] CloseHandle (hObject=0x37c) returned 1 [0110.711] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\x4Pz6X-xTM2KRGJ.xlsx", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\x4Pz6X-xTM2KRGJ.xlsx", lpFilePart=0x0) returned 0x43 [0110.711] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\x4Pz6X-xTM2KRGJ.xlsx.spybuster", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\x4Pz6X-xTM2KRGJ.xlsx.spybuster", lpFilePart=0x0) returned 0x4d [0110.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec50) returned 1 [0110.711] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\x4Pz6X-xTM2KRGJ.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\x4pz6x-xtm2krgj.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19eccc | out: lpFileInformation=0x19eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9dc7e80, ftCreationTime.dwHighDateTime=0x1d5ec05, ftLastAccessTime.dwLowDateTime=0xb4886580, ftLastAccessTime.dwHighDateTime=0x1d5e99e, ftLastWriteTime.dwLowDateTime=0xb740a983, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xedb0)) returned 1 [0110.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0110.712] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\x4Pz6X-xTM2KRGJ.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\x4pz6x-xtm2krgj.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\x4Pz6X-xTM2KRGJ.xlsx.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\x4pz6x-xtm2krgj.xlsx.spybuster")) returned 1 [0110.712] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\Zr4ou.doc", nBufferLength=0x105, lpBuffer=0x19e68c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\Zr4ou.doc", lpFilePart=0x0) returned 0x38 [0110.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0110.713] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\Zr4ou.doc" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\zr4ou.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0110.713] GetFileType (hFile=0x37c) returned 0x1 [0110.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0110.713] GetFileType (hFile=0x37c) returned 0x1 [0110.713] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19eccc | out: lpFileSizeHigh=0x19eccc*=0x0) returned 0xe463 [0110.713] ReadFile (in: hFile=0x37c, lpBuffer=0x26e82fc, nNumberOfBytesToRead=0xe463, lpNumberOfBytesRead=0x19ec78, lpOverlapped=0x0 | out: lpBuffer=0x26e82fc*, lpNumberOfBytesRead=0x19ec78*=0xe463, lpOverlapped=0x0) returned 1 [0110.714] CloseHandle (hObject=0x37c) returned 1 [0110.755] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e790, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0110.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0110.755] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ecc0 | out: lpFileInformation=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0110.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0110.756] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\Zr4ou.doc", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\Zr4ou.doc", lpFilePart=0x0) returned 0x38 [0110.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0110.756] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\Zr4ou.doc" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\zr4ou.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0110.758] GetFileType (hFile=0x37c) returned 0x1 [0110.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0110.758] GetFileType (hFile=0x37c) returned 0x1 [0110.758] WriteFile (in: hFile=0x37c, lpBuffer=0x275fe4c*, nNumberOfBytesToWrite=0xe470, lpNumberOfBytesWritten=0x19ec6c, lpOverlapped=0x0 | out: lpBuffer=0x275fe4c*, lpNumberOfBytesWritten=0x19ec6c*=0xe470, lpOverlapped=0x0) returned 1 [0110.760] CloseHandle (hObject=0x37c) returned 1 [0110.763] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\Zr4ou.doc", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\Zr4ou.doc", lpFilePart=0x0) returned 0x38 [0110.763] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\Zr4ou.doc.spybuster", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\Zr4ou.doc.spybuster", lpFilePart=0x0) returned 0x42 [0110.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec50) returned 1 [0110.763] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\Zr4ou.doc" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\zr4ou.doc"), fInfoLevelId=0x0, lpFileInformation=0x19eccc | out: lpFileInformation=0x19eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x216d8f40, ftCreationTime.dwHighDateTime=0x1d5e210, ftLastAccessTime.dwLowDateTime=0x86fca0e0, ftLastAccessTime.dwHighDateTime=0x1d5ef6b, ftLastWriteTime.dwLowDateTime=0xb74743e9, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xe470)) returned 1 [0110.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0110.763] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\Zr4ou.doc" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\zr4ou.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\Zr4ou.doc.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\zr4ou.doc.spybuster")) returned 1 [0110.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb0) returned 1 [0110.764] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh", nBufferLength=0x105, lpBuffer=0x19e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh", lpFilePart=0x0) returned 0x33 [0110.764] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\*", lpFindFileData=0x19e9d8 | out: lpFindFileData=0x19e9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23e89770, ftCreationTime.dwHighDateTime=0x1d5eb7e, ftLastAccessTime.dwLowDateTime=0x83cbc360, ftLastAccessTime.dwHighDateTime=0x1d5ece6, ftLastWriteTime.dwLowDateTime=0x83cbc360, ftLastWriteTime.dwHighDateTime=0x1d5ece6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b9b8 [0110.764] FindNextFileW (in: hFindFile=0x77b9b8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23e89770, ftCreationTime.dwHighDateTime=0x1d5eb7e, ftLastAccessTime.dwLowDateTime=0x83cbc360, ftLastAccessTime.dwHighDateTime=0x1d5ece6, ftLastWriteTime.dwLowDateTime=0x83cbc360, ftLastWriteTime.dwHighDateTime=0x1d5ece6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.765] FindNextFileW (in: hFindFile=0x77b9b8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5fff4f0, ftCreationTime.dwHighDateTime=0x1d5e950, ftLastAccessTime.dwLowDateTime=0x7d2fab20, ftLastAccessTime.dwHighDateTime=0x1d5e381, ftLastWriteTime.dwLowDateTime=0x7d2fab20, ftLastWriteTime.dwHighDateTime=0x1d5e381, nFileSizeHigh=0x0, nFileSizeLow=0x1886e, dwReserved0=0x0, dwReserved1=0x0, cFileName="0vQql94IYideak7.rtf", cAlternateFileName="0VQQL9~1.RTF")) returned 1 [0110.765] FindNextFileW (in: hFindFile=0x77b9b8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b5f3910, ftCreationTime.dwHighDateTime=0x1d5ef0e, ftLastAccessTime.dwLowDateTime=0x437ede50, ftLastAccessTime.dwHighDateTime=0x1d5e6d8, ftLastWriteTime.dwLowDateTime=0x437ede50, ftLastWriteTime.dwHighDateTime=0x1d5e6d8, nFileSizeHigh=0x0, nFileSizeLow=0x859, dwReserved0=0x0, dwReserved1=0x0, cFileName="76Ng72Ts1wA3.ppt", cAlternateFileName="76NG72~1.PPT")) returned 1 [0110.765] FindNextFileW (in: hFindFile=0x77b9b8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8392460, ftCreationTime.dwHighDateTime=0x1d5e54b, ftLastAccessTime.dwLowDateTime=0xc9dc44d0, ftLastAccessTime.dwHighDateTime=0x1d5e83e, ftLastWriteTime.dwLowDateTime=0xc9dc44d0, ftLastWriteTime.dwHighDateTime=0x1d5e83e, nFileSizeHigh=0x0, nFileSizeLow=0x131cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="InuQ3OwYVv_obJRd9Oy0.ots", cAlternateFileName="INUQ3O~1.OTS")) returned 1 [0110.765] FindNextFileW (in: hFindFile=0x77b9b8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdaeabff0, ftCreationTime.dwHighDateTime=0x1d5e2c5, ftLastAccessTime.dwLowDateTime=0x69ad4640, ftLastAccessTime.dwHighDateTime=0x1d5e159, ftLastWriteTime.dwLowDateTime=0x69ad4640, ftLastWriteTime.dwHighDateTime=0x1d5e159, nFileSizeHigh=0x0, nFileSizeLow=0xe407, dwReserved0=0x0, dwReserved1=0x0, cFileName="mjEJL.ods", cAlternateFileName="")) returned 1 [0110.765] FindNextFileW (in: hFindFile=0x77b9b8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93b502d0, ftCreationTime.dwHighDateTime=0x1d5edd8, ftLastAccessTime.dwLowDateTime=0x36a92560, ftLastAccessTime.dwHighDateTime=0x1d5e673, ftLastWriteTime.dwLowDateTime=0x36a92560, ftLastWriteTime.dwHighDateTime=0x1d5e673, nFileSizeHigh=0x0, nFileSizeLow=0xd4c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY3Nt.ods", cAlternateFileName="")) returned 1 [0110.765] FindNextFileW (in: hFindFile=0x77b9b8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c6b230, ftCreationTime.dwHighDateTime=0x1d5edfe, ftLastAccessTime.dwLowDateTime=0x1919a200, ftLastAccessTime.dwHighDateTime=0x1d5e90b, ftLastWriteTime.dwLowDateTime=0x1919a200, ftLastWriteTime.dwHighDateTime=0x1d5e90b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VWhsquURFxl8WGO-5", cAlternateFileName="VWHSQU~1")) returned 1 [0110.766] FindNextFileW (in: hFindFile=0x77b9b8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x794dff50, ftCreationTime.dwHighDateTime=0x1d5e16c, ftLastAccessTime.dwLowDateTime=0x75a6d90, ftLastAccessTime.dwHighDateTime=0x1d5e449, ftLastWriteTime.dwLowDateTime=0x75a6d90, ftLastWriteTime.dwHighDateTime=0x1d5e449, nFileSizeHigh=0x0, nFileSizeLow=0x1709b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xt2sZ-EfQMfW9-.pptx", cAlternateFileName="XT2SZ-~1.PPT")) returned 1 [0110.766] FindNextFileW (in: hFindFile=0x77b9b8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0110.766] FindClose (in: hFindFile=0x77b9b8 | out: hFindFile=0x77b9b8) returned 1 [0110.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec6c) returned 1 [0110.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec78) returned 1 [0110.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb0) returned 1 [0110.766] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh", nBufferLength=0x105, lpBuffer=0x19e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh", lpFilePart=0x0) returned 0x33 [0110.766] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\*", lpFindFileData=0x19e9d8 | out: lpFindFileData=0x19e9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23e89770, ftCreationTime.dwHighDateTime=0x1d5eb7e, ftLastAccessTime.dwLowDateTime=0x83cbc360, ftLastAccessTime.dwHighDateTime=0x1d5ece6, ftLastWriteTime.dwLowDateTime=0x83cbc360, ftLastWriteTime.dwHighDateTime=0x1d5ece6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b778 [0110.767] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23e89770, ftCreationTime.dwHighDateTime=0x1d5eb7e, ftLastAccessTime.dwLowDateTime=0x83cbc360, ftLastAccessTime.dwHighDateTime=0x1d5ece6, ftLastWriteTime.dwLowDateTime=0x83cbc360, ftLastWriteTime.dwHighDateTime=0x1d5ece6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.767] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5fff4f0, ftCreationTime.dwHighDateTime=0x1d5e950, ftLastAccessTime.dwLowDateTime=0x7d2fab20, ftLastAccessTime.dwHighDateTime=0x1d5e381, ftLastWriteTime.dwLowDateTime=0x7d2fab20, ftLastWriteTime.dwHighDateTime=0x1d5e381, nFileSizeHigh=0x0, nFileSizeLow=0x1886e, dwReserved0=0x0, dwReserved1=0x0, cFileName="0vQql94IYideak7.rtf", cAlternateFileName="0VQQL9~1.RTF")) returned 1 [0110.767] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b5f3910, ftCreationTime.dwHighDateTime=0x1d5ef0e, ftLastAccessTime.dwLowDateTime=0x437ede50, ftLastAccessTime.dwHighDateTime=0x1d5e6d8, ftLastWriteTime.dwLowDateTime=0x437ede50, ftLastWriteTime.dwHighDateTime=0x1d5e6d8, nFileSizeHigh=0x0, nFileSizeLow=0x859, dwReserved0=0x0, dwReserved1=0x0, cFileName="76Ng72Ts1wA3.ppt", cAlternateFileName="76NG72~1.PPT")) returned 1 [0110.767] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8392460, ftCreationTime.dwHighDateTime=0x1d5e54b, ftLastAccessTime.dwLowDateTime=0xc9dc44d0, ftLastAccessTime.dwHighDateTime=0x1d5e83e, ftLastWriteTime.dwLowDateTime=0xc9dc44d0, ftLastWriteTime.dwHighDateTime=0x1d5e83e, nFileSizeHigh=0x0, nFileSizeLow=0x131cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="InuQ3OwYVv_obJRd9Oy0.ots", cAlternateFileName="INUQ3O~1.OTS")) returned 1 [0110.768] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdaeabff0, ftCreationTime.dwHighDateTime=0x1d5e2c5, ftLastAccessTime.dwLowDateTime=0x69ad4640, ftLastAccessTime.dwHighDateTime=0x1d5e159, ftLastWriteTime.dwLowDateTime=0x69ad4640, ftLastWriteTime.dwHighDateTime=0x1d5e159, nFileSizeHigh=0x0, nFileSizeLow=0xe407, dwReserved0=0x0, dwReserved1=0x0, cFileName="mjEJL.ods", cAlternateFileName="")) returned 1 [0110.768] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93b502d0, ftCreationTime.dwHighDateTime=0x1d5edd8, ftLastAccessTime.dwLowDateTime=0x36a92560, ftLastAccessTime.dwHighDateTime=0x1d5e673, ftLastWriteTime.dwLowDateTime=0x36a92560, ftLastWriteTime.dwHighDateTime=0x1d5e673, nFileSizeHigh=0x0, nFileSizeLow=0xd4c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY3Nt.ods", cAlternateFileName="")) returned 1 [0110.768] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c6b230, ftCreationTime.dwHighDateTime=0x1d5edfe, ftLastAccessTime.dwLowDateTime=0x1919a200, ftLastAccessTime.dwHighDateTime=0x1d5e90b, ftLastWriteTime.dwLowDateTime=0x1919a200, ftLastWriteTime.dwHighDateTime=0x1d5e90b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VWhsquURFxl8WGO-5", cAlternateFileName="VWHSQU~1")) returned 1 [0110.768] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x794dff50, ftCreationTime.dwHighDateTime=0x1d5e16c, ftLastAccessTime.dwLowDateTime=0x75a6d90, ftLastAccessTime.dwHighDateTime=0x1d5e449, ftLastWriteTime.dwLowDateTime=0x75a6d90, ftLastWriteTime.dwHighDateTime=0x1d5e449, nFileSizeHigh=0x0, nFileSizeLow=0x1709b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xt2sZ-EfQMfW9-.pptx", cAlternateFileName="XT2SZ-~1.PPT")) returned 1 [0110.768] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x794dff50, ftCreationTime.dwHighDateTime=0x1d5e16c, ftLastAccessTime.dwLowDateTime=0x75a6d90, ftLastAccessTime.dwHighDateTime=0x1d5e449, ftLastWriteTime.dwLowDateTime=0x75a6d90, ftLastWriteTime.dwHighDateTime=0x1d5e449, nFileSizeHigh=0x0, nFileSizeLow=0x1709b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xt2sZ-EfQMfW9-.pptx", cAlternateFileName="XT2SZ-~1.PPT")) returned 0 [0110.769] FindClose (in: hFindFile=0x77b778 | out: hFindFile=0x77b778) returned 1 [0110.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec6c) returned 1 [0110.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec78) returned 1 [0110.769] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\0vQql94IYideak7.rtf", nBufferLength=0x105, lpBuffer=0x19e618, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\0vQql94IYideak7.rtf", lpFilePart=0x0) returned 0x47 [0110.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb5c) returned 1 [0110.769] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\0vQql94IYideak7.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\0vqql94iyideak7.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0110.769] GetFileType (hFile=0x37c) returned 0x1 [0110.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb58) returned 1 [0110.769] GetFileType (hFile=0x37c) returned 0x1 [0110.769] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ec58 | out: lpFileSizeHigh=0x19ec58*=0x0) returned 0x1886e [0110.769] ReadFile (in: hFile=0x37c, lpBuffer=0x37171f8, nNumberOfBytesToRead=0x1886e, lpNumberOfBytesRead=0x19ec04, lpOverlapped=0x0 | out: lpBuffer=0x37171f8*, lpNumberOfBytesRead=0x19ec04*=0x1886e, lpOverlapped=0x0) returned 1 [0110.771] CloseHandle (hObject=0x37c) returned 1 [0110.814] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e71c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0110.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0110.815] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ec4c | out: lpFileInformation=0x19ec4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0110.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0110.815] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\0vQql94IYideak7.rtf", nBufferLength=0x105, lpBuffer=0x19e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\0vQql94IYideak7.rtf", lpFilePart=0x0) returned 0x47 [0110.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb48) returned 1 [0110.815] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\0vQql94IYideak7.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\0vqql94iyideak7.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0110.818] GetFileType (hFile=0x37c) returned 0x1 [0110.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb44) returned 1 [0110.818] GetFileType (hFile=0x37c) returned 0x1 [0110.818] WriteFile (in: hFile=0x37c, lpBuffer=0x3791c68*, nNumberOfBytesToWrite=0x18870, lpNumberOfBytesWritten=0x19ebf8, lpOverlapped=0x0 | out: lpBuffer=0x3791c68*, lpNumberOfBytesWritten=0x19ebf8*=0x18870, lpOverlapped=0x0) returned 1 [0110.821] CloseHandle (hObject=0x37c) returned 1 [0110.830] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\0vQql94IYideak7.rtf", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\0vQql94IYideak7.rtf", lpFilePart=0x0) returned 0x47 [0110.830] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\0vQql94IYideak7.rtf.spybuster", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\0vQql94IYideak7.rtf.spybuster", lpFilePart=0x0) returned 0x51 [0110.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebdc) returned 1 [0110.830] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\0vQql94IYideak7.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\0vqql94iyideak7.rtf"), fInfoLevelId=0x0, lpFileInformation=0x19ec58 | out: lpFileInformation=0x19ec58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5fff4f0, ftCreationTime.dwHighDateTime=0x1d5e950, ftLastAccessTime.dwLowDateTime=0x7d2fab20, ftLastAccessTime.dwHighDateTime=0x1d5e381, ftLastWriteTime.dwLowDateTime=0xb750cd7e, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x18870)) returned 1 [0110.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebd8) returned 1 [0110.831] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\0vQql94IYideak7.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\0vqql94iyideak7.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\0vQql94IYideak7.rtf.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\0vqql94iyideak7.rtf.spybuster")) returned 1 [0110.831] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\76Ng72Ts1wA3.ppt", nBufferLength=0x105, lpBuffer=0x19e618, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\76Ng72Ts1wA3.ppt", lpFilePart=0x0) returned 0x44 [0110.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb5c) returned 1 [0110.832] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\76Ng72Ts1wA3.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\76ng72ts1wa3.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0110.832] GetFileType (hFile=0x37c) returned 0x1 [0110.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb58) returned 1 [0110.832] GetFileType (hFile=0x37c) returned 0x1 [0110.832] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ec58 | out: lpFileSizeHigh=0x19ec58*=0x0) returned 0x859 [0110.832] ReadFile (in: hFile=0x37c, lpBuffer=0x27beaa4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ec04, lpOverlapped=0x0 | out: lpBuffer=0x27beaa4*, lpNumberOfBytesRead=0x19ec04*=0x859, lpOverlapped=0x0) returned 1 [0110.833] CloseHandle (hObject=0x37c) returned 1 [0110.880] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e71c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0110.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0110.880] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ec4c | out: lpFileInformation=0x19ec4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0110.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0110.881] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\76Ng72Ts1wA3.ppt", nBufferLength=0x105, lpBuffer=0x19e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\76Ng72Ts1wA3.ppt", lpFilePart=0x0) returned 0x44 [0110.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb48) returned 1 [0110.881] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\76Ng72Ts1wA3.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\76ng72ts1wa3.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0110.882] GetFileType (hFile=0x37c) returned 0x1 [0110.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb44) returned 1 [0110.882] GetFileType (hFile=0x37c) returned 0x1 [0110.883] WriteFile (in: hFile=0x37c, lpBuffer=0x280f4c8*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x19ebcc, lpOverlapped=0x0 | out: lpBuffer=0x280f4c8*, lpNumberOfBytesWritten=0x19ebcc*=0x860, lpOverlapped=0x0) returned 1 [0110.884] CloseHandle (hObject=0x37c) returned 1 [0110.886] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\76Ng72Ts1wA3.ppt", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\76Ng72Ts1wA3.ppt", lpFilePart=0x0) returned 0x44 [0110.886] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\76Ng72Ts1wA3.ppt.spybuster", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\76Ng72Ts1wA3.ppt.spybuster", lpFilePart=0x0) returned 0x4e [0110.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebdc) returned 1 [0110.886] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\76Ng72Ts1wA3.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\76ng72ts1wa3.ppt"), fInfoLevelId=0x0, lpFileInformation=0x19ec58 | out: lpFileInformation=0x19ec58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b5f3910, ftCreationTime.dwHighDateTime=0x1d5ef0e, ftLastAccessTime.dwLowDateTime=0x437ede50, ftLastAccessTime.dwHighDateTime=0x1d5e6d8, ftLastWriteTime.dwLowDateTime=0xb75a573b, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x860)) returned 1 [0110.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebd8) returned 1 [0110.886] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\76Ng72Ts1wA3.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\76ng72ts1wa3.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\76Ng72Ts1wA3.ppt.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\76ng72ts1wa3.ppt.spybuster")) returned 1 [0110.887] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\Xt2sZ-EfQMfW9-.pptx", nBufferLength=0x105, lpBuffer=0x19e618, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\Xt2sZ-EfQMfW9-.pptx", lpFilePart=0x0) returned 0x47 [0110.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb5c) returned 1 [0110.887] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\Xt2sZ-EfQMfW9-.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\xt2sz-efqmfw9-.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0110.888] GetFileType (hFile=0x37c) returned 0x1 [0110.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb58) returned 1 [0110.888] GetFileType (hFile=0x37c) returned 0x1 [0110.888] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ec58 | out: lpFileSizeHigh=0x19ec58*=0x0) returned 0x1709b [0110.888] ReadFile (in: hFile=0x37c, lpBuffer=0x37aa4f8, nNumberOfBytesToRead=0x1709b, lpNumberOfBytesRead=0x19ec04, lpOverlapped=0x0 | out: lpBuffer=0x37aa4f8*, lpNumberOfBytesRead=0x19ec04*=0x1709b, lpOverlapped=0x0) returned 1 [0110.890] CloseHandle (hObject=0x37c) returned 1 [0110.967] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e71c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0110.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0110.968] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ec4c | out: lpFileInformation=0x19ec4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0110.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0110.968] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\Xt2sZ-EfQMfW9-.pptx", nBufferLength=0x105, lpBuffer=0x19e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\Xt2sZ-EfQMfW9-.pptx", lpFilePart=0x0) returned 0x47 [0110.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb48) returned 1 [0110.968] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\Xt2sZ-EfQMfW9-.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\xt2sz-efqmfw9-.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0110.970] GetFileType (hFile=0x37c) returned 0x1 [0110.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb44) returned 1 [0110.970] GetFileType (hFile=0x37c) returned 0x1 [0110.970] WriteFile (in: hFile=0x37c, lpBuffer=0x381d850*, nNumberOfBytesToWrite=0x170a0, lpNumberOfBytesWritten=0x19ebf8, lpOverlapped=0x0 | out: lpBuffer=0x381d850*, lpNumberOfBytesWritten=0x19ebf8*=0x170a0, lpOverlapped=0x0) returned 1 [0110.973] CloseHandle (hObject=0x37c) returned 1 [0110.977] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\Xt2sZ-EfQMfW9-.pptx", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\Xt2sZ-EfQMfW9-.pptx", lpFilePart=0x0) returned 0x47 [0110.977] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\Xt2sZ-EfQMfW9-.pptx.spybuster", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\Xt2sZ-EfQMfW9-.pptx.spybuster", lpFilePart=0x0) returned 0x51 [0110.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebdc) returned 1 [0110.977] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\Xt2sZ-EfQMfW9-.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\xt2sz-efqmfw9-.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19ec58 | out: lpFileInformation=0x19ec58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x794dff50, ftCreationTime.dwHighDateTime=0x1d5e16c, ftLastAccessTime.dwLowDateTime=0x75a6d90, ftLastAccessTime.dwHighDateTime=0x1d5e449, ftLastWriteTime.dwLowDateTime=0xb768a576, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x170a0)) returned 1 [0110.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebd8) returned 1 [0110.977] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\Xt2sZ-EfQMfW9-.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\xt2sz-efqmfw9-.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\Xt2sZ-EfQMfW9-.pptx.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\xt2sz-efqmfw9-.pptx.spybuster")) returned 1 [0110.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec3c) returned 1 [0110.978] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5", nBufferLength=0x105, lpBuffer=0x19e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5", lpFilePart=0x0) returned 0x45 [0110.978] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\*", lpFindFileData=0x19e964 | out: lpFindFileData=0x19e964*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c6b230, ftCreationTime.dwHighDateTime=0x1d5edfe, ftLastAccessTime.dwLowDateTime=0x1919a200, ftLastAccessTime.dwHighDateTime=0x1d5e90b, ftLastWriteTime.dwLowDateTime=0x1919a200, ftLastWriteTime.dwHighDateTime=0x1d5e90b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b778 [0110.979] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19e970 | out: lpFindFileData=0x19e970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c6b230, ftCreationTime.dwHighDateTime=0x1d5edfe, ftLastAccessTime.dwLowDateTime=0x1919a200, ftLastAccessTime.dwHighDateTime=0x1d5e90b, ftLastWriteTime.dwLowDateTime=0x1919a200, ftLastWriteTime.dwHighDateTime=0x1d5e90b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.979] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19e970 | out: lpFindFileData=0x19e970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe81b9020, ftCreationTime.dwHighDateTime=0x1d5e8db, ftLastAccessTime.dwLowDateTime=0x83f440d0, ftLastAccessTime.dwHighDateTime=0x1d5e8f2, ftLastWriteTime.dwLowDateTime=0x83f440d0, ftLastWriteTime.dwHighDateTime=0x1d5e8f2, nFileSizeHigh=0x0, nFileSizeLow=0x3896, dwReserved0=0x0, dwReserved1=0x0, cFileName="BoiBqzNTiQ5Zv9CoPBOH.docx", cAlternateFileName="BOIBQZ~1.DOC")) returned 1 [0110.979] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19e970 | out: lpFindFileData=0x19e970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42f2c7a0, ftCreationTime.dwHighDateTime=0x1d5ed3e, ftLastAccessTime.dwLowDateTime=0xe450cfc0, ftLastAccessTime.dwHighDateTime=0x1d5ef6e, ftLastWriteTime.dwLowDateTime=0xe450cfc0, ftLastWriteTime.dwHighDateTime=0x1d5ef6e, nFileSizeHigh=0x0, nFileSizeLow=0x14949, dwReserved0=0x0, dwReserved1=0x0, cFileName="hqHIO7tkxzM.docx", cAlternateFileName="HQHIO7~1.DOC")) returned 1 [0110.979] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19e970 | out: lpFindFileData=0x19e970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed523ef0, ftCreationTime.dwHighDateTime=0x1d5e75e, ftLastAccessTime.dwLowDateTime=0xd366b20, ftLastAccessTime.dwHighDateTime=0x1d5e3df, ftLastWriteTime.dwLowDateTime=0xd366b20, ftLastWriteTime.dwHighDateTime=0x1d5e3df, nFileSizeHigh=0x0, nFileSizeLow=0x6e6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="KScPR-l zU4XGZ0gIY.ods", cAlternateFileName="KSCPR-~1.ODS")) returned 1 [0110.979] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19e970 | out: lpFindFileData=0x19e970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3006180, ftCreationTime.dwHighDateTime=0x1d5e86f, ftLastAccessTime.dwLowDateTime=0x987733b0, ftLastAccessTime.dwHighDateTime=0x1d5e3f1, ftLastWriteTime.dwLowDateTime=0x987733b0, ftLastWriteTime.dwHighDateTime=0x1d5e3f1, nFileSizeHigh=0x0, nFileSizeLow=0xa957, dwReserved0=0x0, dwReserved1=0x0, cFileName="mLdJ4z-CFDHGH.xlsx", cAlternateFileName="MLDJ4Z~1.XLS")) returned 1 [0110.980] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19e970 | out: lpFindFileData=0x19e970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bf33d0, ftCreationTime.dwHighDateTime=0x1d5e5f5, ftLastAccessTime.dwLowDateTime=0xe2832050, ftLastAccessTime.dwHighDateTime=0x1d5f04d, ftLastWriteTime.dwLowDateTime=0xe2832050, ftLastWriteTime.dwHighDateTime=0x1d5f04d, nFileSizeHigh=0x0, nFileSizeLow=0x18cb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="wT0MNxDVsda-q.pdf", cAlternateFileName="WT0MNX~1.PDF")) returned 1 [0110.980] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19e970 | out: lpFindFileData=0x19e970*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0110.980] FindClose (in: hFindFile=0x77b778 | out: hFindFile=0x77b778) returned 1 [0110.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebf8) returned 1 [0110.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec04) returned 1 [0110.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec3c) returned 1 [0110.980] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5", nBufferLength=0x105, lpBuffer=0x19e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5", lpFilePart=0x0) returned 0x45 [0110.984] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\*", lpFindFileData=0x19e964 | out: lpFindFileData=0x19e964*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c6b230, ftCreationTime.dwHighDateTime=0x1d5edfe, ftLastAccessTime.dwLowDateTime=0x1919a200, ftLastAccessTime.dwHighDateTime=0x1d5e90b, ftLastWriteTime.dwLowDateTime=0x1919a200, ftLastWriteTime.dwHighDateTime=0x1d5e90b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b9f8 [0110.984] FindNextFileW (in: hFindFile=0x77b9f8, lpFindFileData=0x19e970 | out: lpFindFileData=0x19e970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c6b230, ftCreationTime.dwHighDateTime=0x1d5edfe, ftLastAccessTime.dwLowDateTime=0x1919a200, ftLastAccessTime.dwHighDateTime=0x1d5e90b, ftLastWriteTime.dwLowDateTime=0x1919a200, ftLastWriteTime.dwHighDateTime=0x1d5e90b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.985] FindNextFileW (in: hFindFile=0x77b9f8, lpFindFileData=0x19e970 | out: lpFindFileData=0x19e970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe81b9020, ftCreationTime.dwHighDateTime=0x1d5e8db, ftLastAccessTime.dwLowDateTime=0x83f440d0, ftLastAccessTime.dwHighDateTime=0x1d5e8f2, ftLastWriteTime.dwLowDateTime=0x83f440d0, ftLastWriteTime.dwHighDateTime=0x1d5e8f2, nFileSizeHigh=0x0, nFileSizeLow=0x3896, dwReserved0=0x0, dwReserved1=0x0, cFileName="BoiBqzNTiQ5Zv9CoPBOH.docx", cAlternateFileName="BOIBQZ~1.DOC")) returned 1 [0110.985] FindNextFileW (in: hFindFile=0x77b9f8, lpFindFileData=0x19e970 | out: lpFindFileData=0x19e970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42f2c7a0, ftCreationTime.dwHighDateTime=0x1d5ed3e, ftLastAccessTime.dwLowDateTime=0xe450cfc0, ftLastAccessTime.dwHighDateTime=0x1d5ef6e, ftLastWriteTime.dwLowDateTime=0xe450cfc0, ftLastWriteTime.dwHighDateTime=0x1d5ef6e, nFileSizeHigh=0x0, nFileSizeLow=0x14949, dwReserved0=0x0, dwReserved1=0x0, cFileName="hqHIO7tkxzM.docx", cAlternateFileName="HQHIO7~1.DOC")) returned 1 [0110.985] FindNextFileW (in: hFindFile=0x77b9f8, lpFindFileData=0x19e970 | out: lpFindFileData=0x19e970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed523ef0, ftCreationTime.dwHighDateTime=0x1d5e75e, ftLastAccessTime.dwLowDateTime=0xd366b20, ftLastAccessTime.dwHighDateTime=0x1d5e3df, ftLastWriteTime.dwLowDateTime=0xd366b20, ftLastWriteTime.dwHighDateTime=0x1d5e3df, nFileSizeHigh=0x0, nFileSizeLow=0x6e6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="KScPR-l zU4XGZ0gIY.ods", cAlternateFileName="KSCPR-~1.ODS")) returned 1 [0110.985] FindNextFileW (in: hFindFile=0x77b9f8, lpFindFileData=0x19e970 | out: lpFindFileData=0x19e970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3006180, ftCreationTime.dwHighDateTime=0x1d5e86f, ftLastAccessTime.dwLowDateTime=0x987733b0, ftLastAccessTime.dwHighDateTime=0x1d5e3f1, ftLastWriteTime.dwLowDateTime=0x987733b0, ftLastWriteTime.dwHighDateTime=0x1d5e3f1, nFileSizeHigh=0x0, nFileSizeLow=0xa957, dwReserved0=0x0, dwReserved1=0x0, cFileName="mLdJ4z-CFDHGH.xlsx", cAlternateFileName="MLDJ4Z~1.XLS")) returned 1 [0110.986] FindNextFileW (in: hFindFile=0x77b9f8, lpFindFileData=0x19e970 | out: lpFindFileData=0x19e970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bf33d0, ftCreationTime.dwHighDateTime=0x1d5e5f5, ftLastAccessTime.dwLowDateTime=0xe2832050, ftLastAccessTime.dwHighDateTime=0x1d5f04d, ftLastWriteTime.dwLowDateTime=0xe2832050, ftLastWriteTime.dwHighDateTime=0x1d5f04d, nFileSizeHigh=0x0, nFileSizeLow=0x18cb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="wT0MNxDVsda-q.pdf", cAlternateFileName="WT0MNX~1.PDF")) returned 1 [0110.986] FindNextFileW (in: hFindFile=0x77b9f8, lpFindFileData=0x19e970 | out: lpFindFileData=0x19e970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bf33d0, ftCreationTime.dwHighDateTime=0x1d5e5f5, ftLastAccessTime.dwLowDateTime=0xe2832050, ftLastAccessTime.dwHighDateTime=0x1d5f04d, ftLastWriteTime.dwLowDateTime=0xe2832050, ftLastWriteTime.dwHighDateTime=0x1d5f04d, nFileSizeHigh=0x0, nFileSizeLow=0x18cb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="wT0MNxDVsda-q.pdf", cAlternateFileName="WT0MNX~1.PDF")) returned 0 [0110.986] FindClose (in: hFindFile=0x77b9f8 | out: hFindFile=0x77b9f8) returned 1 [0110.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebf8) returned 1 [0110.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec04) returned 1 [0110.986] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\BoiBqzNTiQ5Zv9CoPBOH.docx", nBufferLength=0x105, lpBuffer=0x19e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\BoiBqzNTiQ5Zv9CoPBOH.docx", lpFilePart=0x0) returned 0x5f [0110.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eae8) returned 1 [0110.986] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\BoiBqzNTiQ5Zv9CoPBOH.docx" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\vwhsquurfxl8wgo-5\\boibqzntiq5zv9copboh.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0110.986] GetFileType (hFile=0x37c) returned 0x1 [0110.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eae4) returned 1 [0110.987] GetFileType (hFile=0x37c) returned 0x1 [0110.987] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ebe4 | out: lpFileSizeHigh=0x19ebe4*=0x0) returned 0x3896 [0110.987] ReadFile (in: hFile=0x37c, lpBuffer=0x2661078, nNumberOfBytesToRead=0x3896, lpNumberOfBytesRead=0x19eb90, lpOverlapped=0x0 | out: lpBuffer=0x2661078*, lpNumberOfBytesRead=0x19eb90*=0x3896, lpOverlapped=0x0) returned 1 [0110.988] CloseHandle (hObject=0x37c) returned 1 [0111.023] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e6a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0111.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb5c) returned 1 [0111.023] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ebd8 | out: lpFileInformation=0x19ebd8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0111.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb58) returned 1 [0111.023] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\BoiBqzNTiQ5Zv9CoPBOH.docx", nBufferLength=0x105, lpBuffer=0x19e590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\BoiBqzNTiQ5Zv9CoPBOH.docx", lpFilePart=0x0) returned 0x5f [0111.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ead4) returned 1 [0111.023] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\BoiBqzNTiQ5Zv9CoPBOH.docx" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\vwhsquurfxl8wgo-5\\boibqzntiq5zv9copboh.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0111.025] GetFileType (hFile=0x37c) returned 0x1 [0111.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ead0) returned 1 [0111.025] GetFileType (hFile=0x37c) returned 0x1 [0111.025] WriteFile (in: hFile=0x37c, lpBuffer=0x26bfae0*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x19eb84, lpOverlapped=0x0 | out: lpBuffer=0x26bfae0*, lpNumberOfBytesWritten=0x19eb84*=0x38a0, lpOverlapped=0x0) returned 1 [0111.026] CloseHandle (hObject=0x37c) returned 1 [0111.027] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\BoiBqzNTiQ5Zv9CoPBOH.docx", nBufferLength=0x105, lpBuffer=0x19e6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\BoiBqzNTiQ5Zv9CoPBOH.docx", lpFilePart=0x0) returned 0x5f [0111.028] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\BoiBqzNTiQ5Zv9CoPBOH.docx.spybuster", nBufferLength=0x105, lpBuffer=0x19e6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\BoiBqzNTiQ5Zv9CoPBOH.docx.spybuster", lpFilePart=0x0) returned 0x69 [0111.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb68) returned 1 [0111.028] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\BoiBqzNTiQ5Zv9CoPBOH.docx" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\vwhsquurfxl8wgo-5\\boibqzntiq5zv9copboh.docx"), fInfoLevelId=0x0, lpFileInformation=0x19ebe4 | out: lpFileInformation=0x19ebe4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe81b9020, ftCreationTime.dwHighDateTime=0x1d5e8db, ftLastAccessTime.dwLowDateTime=0x83f440d0, ftLastAccessTime.dwHighDateTime=0x1d5e8f2, ftLastWriteTime.dwLowDateTime=0xb76fcb1d, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x38a0)) returned 1 [0111.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb64) returned 1 [0111.028] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\BoiBqzNTiQ5Zv9CoPBOH.docx" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\vwhsquurfxl8wgo-5\\boibqzntiq5zv9copboh.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\BoiBqzNTiQ5Zv9CoPBOH.docx.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\vwhsquurfxl8wgo-5\\boibqzntiq5zv9copboh.docx.spybuster")) returned 1 [0111.029] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\hqHIO7tkxzM.docx", nBufferLength=0x105, lpBuffer=0x19e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\hqHIO7tkxzM.docx", lpFilePart=0x0) returned 0x56 [0111.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eae8) returned 1 [0111.029] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\hqHIO7tkxzM.docx" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\vwhsquurfxl8wgo-5\\hqhio7tkxzm.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0111.029] GetFileType (hFile=0x37c) returned 0x1 [0111.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eae4) returned 1 [0111.029] GetFileType (hFile=0x37c) returned 0x1 [0111.029] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ebe4 | out: lpFileSizeHigh=0x19ebe4*=0x0) returned 0x14949 [0111.029] ReadFile (in: hFile=0x37c, lpBuffer=0x26c3a04, nNumberOfBytesToRead=0x14949, lpNumberOfBytesRead=0x19eb90, lpOverlapped=0x0 | out: lpBuffer=0x26c3a04*, lpNumberOfBytesRead=0x19eb90*=0x14949, lpOverlapped=0x0) returned 1 [0111.031] CloseHandle (hObject=0x37c) returned 1 [0111.159] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e6a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0111.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb5c) returned 1 [0111.159] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ebd8 | out: lpFileInformation=0x19ebd8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0111.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb58) returned 1 [0111.159] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\hqHIO7tkxzM.docx", nBufferLength=0x105, lpBuffer=0x19e590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\hqHIO7tkxzM.docx", lpFilePart=0x0) returned 0x56 [0111.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ead4) returned 1 [0111.159] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\hqHIO7tkxzM.docx" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\vwhsquurfxl8wgo-5\\hqhio7tkxzm.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0111.162] GetFileType (hFile=0x37c) returned 0x1 [0111.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ead0) returned 1 [0111.162] GetFileType (hFile=0x37c) returned 0x1 [0111.162] WriteFile (in: hFile=0x37c, lpBuffer=0x274e3f4*, nNumberOfBytesToWrite=0x14950, lpNumberOfBytesWritten=0x19eb84, lpOverlapped=0x0 | out: lpBuffer=0x274e3f4*, lpNumberOfBytesWritten=0x19eb84*=0x14950, lpOverlapped=0x0) returned 1 [0111.164] CloseHandle (hObject=0x37c) returned 1 [0111.168] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\hqHIO7tkxzM.docx", nBufferLength=0x105, lpBuffer=0x19e6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\hqHIO7tkxzM.docx", lpFilePart=0x0) returned 0x56 [0111.168] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\hqHIO7tkxzM.docx.spybuster", nBufferLength=0x105, lpBuffer=0x19e6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\hqHIO7tkxzM.docx.spybuster", lpFilePart=0x0) returned 0x60 [0111.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb68) returned 1 [0111.168] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\hqHIO7tkxzM.docx" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\vwhsquurfxl8wgo-5\\hqhio7tkxzm.docx"), fInfoLevelId=0x0, lpFileInformation=0x19ebe4 | out: lpFileInformation=0x19ebe4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42f2c7a0, ftCreationTime.dwHighDateTime=0x1d5ed3e, ftLastAccessTime.dwLowDateTime=0xe450cfc0, ftLastAccessTime.dwHighDateTime=0x1d5ef6e, ftLastWriteTime.dwLowDateTime=0xb785418c, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x14950)) returned 1 [0111.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb64) returned 1 [0111.168] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\hqHIO7tkxzM.docx" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\vwhsquurfxl8wgo-5\\hqhio7tkxzm.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\hqHIO7tkxzM.docx.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\vwhsquurfxl8wgo-5\\hqhio7tkxzm.docx.spybuster")) returned 1 [0111.169] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\mLdJ4z-CFDHGH.xlsx", nBufferLength=0x105, lpBuffer=0x19e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\mLdJ4z-CFDHGH.xlsx", lpFilePart=0x0) returned 0x58 [0111.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eae8) returned 1 [0111.169] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\mLdJ4z-CFDHGH.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\vwhsquurfxl8wgo-5\\mldj4z-cfdhgh.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0111.169] GetFileType (hFile=0x37c) returned 0x1 [0111.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eae4) returned 1 [0111.169] GetFileType (hFile=0x37c) returned 0x1 [0111.170] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ebe4 | out: lpFileSizeHigh=0x19ebe4*=0x0) returned 0xa957 [0111.170] ReadFile (in: hFile=0x37c, lpBuffer=0x2763398, nNumberOfBytesToRead=0xa957, lpNumberOfBytesRead=0x19eb90, lpOverlapped=0x0 | out: lpBuffer=0x2763398*, lpNumberOfBytesRead=0x19eb90*=0xa957, lpOverlapped=0x0) returned 1 [0111.171] CloseHandle (hObject=0x37c) returned 1 [0111.231] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e6a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0111.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb5c) returned 1 [0111.231] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ebd8 | out: lpFileInformation=0x19ebd8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0111.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb58) returned 1 [0111.231] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\mLdJ4z-CFDHGH.xlsx", nBufferLength=0x105, lpBuffer=0x19e590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\mLdJ4z-CFDHGH.xlsx", lpFilePart=0x0) returned 0x58 [0111.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ead4) returned 1 [0111.231] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\mLdJ4z-CFDHGH.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\vwhsquurfxl8wgo-5\\mldj4z-cfdhgh.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0111.233] GetFileType (hFile=0x37c) returned 0x1 [0111.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ead0) returned 1 [0111.233] GetFileType (hFile=0x37c) returned 0x1 [0111.233] WriteFile (in: hFile=0x37c, lpBuffer=0x27cfdb8*, nNumberOfBytesToWrite=0xa960, lpNumberOfBytesWritten=0x19eb84, lpOverlapped=0x0 | out: lpBuffer=0x27cfdb8*, lpNumberOfBytesWritten=0x19eb84*=0xa960, lpOverlapped=0x0) returned 1 [0111.235] CloseHandle (hObject=0x37c) returned 1 [0111.238] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\mLdJ4z-CFDHGH.xlsx", nBufferLength=0x105, lpBuffer=0x19e6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\mLdJ4z-CFDHGH.xlsx", lpFilePart=0x0) returned 0x58 [0111.238] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\mLdJ4z-CFDHGH.xlsx.spybuster", nBufferLength=0x105, lpBuffer=0x19e6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\mLdJ4z-CFDHGH.xlsx.spybuster", lpFilePart=0x0) returned 0x62 [0111.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb68) returned 1 [0111.238] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\mLdJ4z-CFDHGH.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\vwhsquurfxl8wgo-5\\mldj4z-cfdhgh.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19ebe4 | out: lpFileInformation=0x19ebe4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3006180, ftCreationTime.dwHighDateTime=0x1d5e86f, ftLastAccessTime.dwLowDateTime=0x987733b0, ftLastAccessTime.dwHighDateTime=0x1d5e3f1, ftLastWriteTime.dwLowDateTime=0xb78eca09, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xa960)) returned 1 [0111.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb64) returned 1 [0111.238] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\mLdJ4z-CFDHGH.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\vwhsquurfxl8wgo-5\\mldj4z-cfdhgh.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\mLdJ4z-CFDHGH.xlsx.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\vwhsquurfxl8wgo-5\\mldj4z-cfdhgh.xlsx.spybuster")) returned 1 [0111.239] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\wT0MNxDVsda-q.pdf", nBufferLength=0x105, lpBuffer=0x19e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\wT0MNxDVsda-q.pdf", lpFilePart=0x0) returned 0x57 [0111.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eae8) returned 1 [0111.239] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\wT0MNxDVsda-q.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\vwhsquurfxl8wgo-5\\wt0mnxdvsda-q.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0111.239] GetFileType (hFile=0x37c) returned 0x1 [0111.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eae4) returned 1 [0111.239] GetFileType (hFile=0x37c) returned 0x1 [0111.239] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ebe4 | out: lpFileSizeHigh=0x19ebe4*=0x0) returned 0x18cb2 [0111.239] ReadFile (in: hFile=0x37c, lpBuffer=0x3872e70, nNumberOfBytesToRead=0x18cb2, lpNumberOfBytesRead=0x19eb90, lpOverlapped=0x0 | out: lpBuffer=0x3872e70*, lpNumberOfBytesRead=0x19eb90*=0x18cb2, lpOverlapped=0x0) returned 1 [0111.241] CloseHandle (hObject=0x37c) returned 1 [0111.310] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e6a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0111.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb5c) returned 1 [0111.310] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ebd8 | out: lpFileInformation=0x19ebd8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0111.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb58) returned 1 [0111.310] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\wT0MNxDVsda-q.pdf", nBufferLength=0x105, lpBuffer=0x19e590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\wT0MNxDVsda-q.pdf", lpFilePart=0x0) returned 0x57 [0111.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ead4) returned 1 [0111.311] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\wT0MNxDVsda-q.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\vwhsquurfxl8wgo-5\\wt0mnxdvsda-q.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0111.313] GetFileType (hFile=0x37c) returned 0x1 [0111.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ead0) returned 1 [0111.313] GetFileType (hFile=0x37c) returned 0x1 [0111.313] WriteFile (in: hFile=0x37c, lpBuffer=0x38eee60*, nNumberOfBytesToWrite=0x18cc0, lpNumberOfBytesWritten=0x19eb84, lpOverlapped=0x0 | out: lpBuffer=0x38eee60*, lpNumberOfBytesWritten=0x19eb84*=0x18cc0, lpOverlapped=0x0) returned 1 [0111.316] CloseHandle (hObject=0x37c) returned 1 [0111.325] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\wT0MNxDVsda-q.pdf", nBufferLength=0x105, lpBuffer=0x19e6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\wT0MNxDVsda-q.pdf", lpFilePart=0x0) returned 0x57 [0111.325] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\wT0MNxDVsda-q.pdf.spybuster", nBufferLength=0x105, lpBuffer=0x19e6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\wT0MNxDVsda-q.pdf.spybuster", lpFilePart=0x0) returned 0x61 [0111.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb68) returned 1 [0111.326] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\wT0MNxDVsda-q.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\vwhsquurfxl8wgo-5\\wt0mnxdvsda-q.pdf"), fInfoLevelId=0x0, lpFileInformation=0x19ebe4 | out: lpFileInformation=0x19ebe4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bf33d0, ftCreationTime.dwHighDateTime=0x1d5e5f5, ftLastAccessTime.dwLowDateTime=0xe2832050, ftLastAccessTime.dwHighDateTime=0x1d5f04d, ftLastWriteTime.dwLowDateTime=0xb79d1a64, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x18cc0)) returned 1 [0111.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb64) returned 1 [0111.326] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\wT0MNxDVsda-q.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\vwhsquurfxl8wgo-5\\wt0mnxdvsda-q.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\zEsXkxPFsoDWAZhIb1LP\\uHgh\\VWhsquURFxl8WGO-5\\wT0MNxDVsda-q.pdf.spybuster" (normalized: "c:\\users\\fd1hvy\\documents\\zesxkxpfsodwazhib1lp\\uhgh\\vwhsquurfxl8wgo-5\\wt0mnxdvsda-q.pdf.spybuster")) returned 1 [0111.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed98) returned 1 [0111.327] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads", nBufferLength=0x105, lpBuffer=0x19e84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads", lpFilePart=0x0) returned 0x19 [0111.327] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\*", lpFindFileData=0x19eac0 | out: lpFindFileData=0x19eac0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b5f8 [0111.327] FindNextFileW (in: hFindFile=0x77b5f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.327] FindNextFileW (in: hFindFile=0x77b5f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0111.328] FindNextFileW (in: hFindFile=0x77b5f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0111.328] FindClose (in: hFindFile=0x77b5f8 | out: hFindFile=0x77b5f8) returned 1 [0111.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed54) returned 1 [0111.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed60) returned 1 [0111.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed98) returned 1 [0111.328] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads", nBufferLength=0x105, lpBuffer=0x19e84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads", lpFilePart=0x0) returned 0x19 [0111.328] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\*", lpFindFileData=0x19eac0 | out: lpFindFileData=0x19eac0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b7b8 [0111.328] FindNextFileW (in: hFindFile=0x77b7b8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.329] FindNextFileW (in: hFindFile=0x77b7b8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0111.329] FindNextFileW (in: hFindFile=0x77b7b8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0111.329] FindClose (in: hFindFile=0x77b7b8 | out: hFindFile=0x77b7b8) returned 1 [0111.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed54) returned 1 [0111.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed60) returned 1 [0111.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed98) returned 1 [0111.329] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", nBufferLength=0x105, lpBuffer=0x19e84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures", lpFilePart=0x0) returned 0x18 [0111.329] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\*", lpFindFileData=0x19eac0 | out: lpFindFileData=0x19eac0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe6810cbf, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6810cbf, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77ba38 [0111.330] FindNextFileW (in: hFindFile=0x77ba38, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe6810cbf, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6810cbf, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.330] FindNextFileW (in: hFindFile=0x77ba38, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4977440, ftCreationTime.dwHighDateTime=0x1d5e14d, ftLastAccessTime.dwLowDateTime=0x9e0e21c0, ftLastAccessTime.dwHighDateTime=0x1d5ec76, ftLastWriteTime.dwLowDateTime=0x9e0e21c0, ftLastWriteTime.dwHighDateTime=0x1d5ec76, nFileSizeHigh=0x0, nFileSizeLow=0x9e31, dwReserved0=0x0, dwReserved1=0x0, cFileName="0ehOaE.jpg", cAlternateFileName="")) returned 1 [0111.330] FindNextFileW (in: hFindFile=0x77ba38, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1d0f0e0, ftCreationTime.dwHighDateTime=0x1d5e117, ftLastAccessTime.dwLowDateTime=0x8d59a050, ftLastAccessTime.dwHighDateTime=0x1d5efe8, ftLastWriteTime.dwLowDateTime=0x8d59a050, ftLastWriteTime.dwHighDateTime=0x1d5efe8, nFileSizeHigh=0x0, nFileSizeLow=0xcca2, dwReserved0=0x0, dwReserved1=0x0, cFileName="3MGKBPqc9-_MYecXCap.gif", cAlternateFileName="3MGKBP~1.GIF")) returned 1 [0111.330] FindNextFileW (in: hFindFile=0x77ba38, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x742093b0, ftCreationTime.dwHighDateTime=0x1d5eb0a, ftLastAccessTime.dwLowDateTime=0x983a5200, ftLastAccessTime.dwHighDateTime=0x1d5e5c3, ftLastWriteTime.dwLowDateTime=0x983a5200, ftLastWriteTime.dwHighDateTime=0x1d5e5c3, nFileSizeHigh=0x0, nFileSizeLow=0x3e80, dwReserved0=0x0, dwReserved1=0x0, cFileName="62Nxa.bmp", cAlternateFileName="")) returned 1 [0111.330] FindNextFileW (in: hFindFile=0x77ba38, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f6821e0, ftCreationTime.dwHighDateTime=0x1d5eb15, ftLastAccessTime.dwLowDateTime=0x59995560, ftLastAccessTime.dwHighDateTime=0x1d5e90f, ftLastWriteTime.dwLowDateTime=0x59995560, ftLastWriteTime.dwHighDateTime=0x1d5e90f, nFileSizeHigh=0x0, nFileSizeLow=0x11e6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ATGuP30pEWnchJJ.jpg", cAlternateFileName="ATGUP3~1.JPG")) returned 1 [0111.331] FindNextFileW (in: hFindFile=0x77ba38, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c30f990, ftCreationTime.dwHighDateTime=0x1d5e96b, ftLastAccessTime.dwLowDateTime=0x707fb1a0, ftLastAccessTime.dwHighDateTime=0x1d5e9ca, ftLastWriteTime.dwLowDateTime=0x707fb1a0, ftLastWriteTime.dwHighDateTime=0x1d5e9ca, nFileSizeHigh=0x0, nFileSizeLow=0x16f22, dwReserved0=0x0, dwReserved1=0x0, cFileName="BGq6.png", cAlternateFileName="")) returned 1 [0111.331] FindNextFileW (in: hFindFile=0x77ba38, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f822530, ftCreationTime.dwHighDateTime=0x1d5e406, ftLastAccessTime.dwLowDateTime=0xe958ca80, ftLastAccessTime.dwHighDateTime=0x1d5e86c, ftLastWriteTime.dwLowDateTime=0xe958ca80, ftLastWriteTime.dwHighDateTime=0x1d5e86c, nFileSizeHigh=0x0, nFileSizeLow=0x13ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BHTLU4kl.jpg", cAlternateFileName="")) returned 1 [0111.331] FindNextFileW (in: hFindFile=0x77ba38, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75aecc00, ftCreationTime.dwHighDateTime=0x1d5ee03, ftLastAccessTime.dwLowDateTime=0xb43f0750, ftLastAccessTime.dwHighDateTime=0x1d5ead9, ftLastWriteTime.dwLowDateTime=0xb43f0750, ftLastWriteTime.dwHighDateTime=0x1d5ead9, nFileSizeHigh=0x0, nFileSizeLow=0xc323, dwReserved0=0x0, dwReserved1=0x0, cFileName="bXAHv5c.jpg", cAlternateFileName="")) returned 1 [0111.331] FindNextFileW (in: hFindFile=0x77ba38, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0111.331] FindNextFileW (in: hFindFile=0x77ba38, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44053085, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44053085, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0111.331] FindNextFileW (in: hFindFile=0x77ba38, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6ec7a80, ftCreationTime.dwHighDateTime=0x1d5ef4d, ftLastAccessTime.dwLowDateTime=0x188264a0, ftLastAccessTime.dwHighDateTime=0x1d5e274, ftLastWriteTime.dwLowDateTime=0x188264a0, ftLastWriteTime.dwHighDateTime=0x1d5e274, nFileSizeHigh=0x0, nFileSizeLow=0x3c5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="IBucd.gif", cAlternateFileName="")) returned 1 [0111.333] FindNextFileW (in: hFindFile=0x77ba38, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8780a590, ftCreationTime.dwHighDateTime=0x1d5ec58, ftLastAccessTime.dwLowDateTime=0xcecb9890, ftLastAccessTime.dwHighDateTime=0x1d5e64c, ftLastWriteTime.dwLowDateTime=0xcecb9890, ftLastWriteTime.dwHighDateTime=0x1d5e64c, nFileSizeHigh=0x0, nFileSizeLow=0x530b, dwReserved0=0x0, dwReserved1=0x0, cFileName="icGdWx1uRk8YsM2.bmp", cAlternateFileName="ICGDWX~1.BMP")) returned 1 [0111.333] FindNextFileW (in: hFindFile=0x77ba38, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x202d94d0, ftCreationTime.dwHighDateTime=0x1d5e919, ftLastAccessTime.dwLowDateTime=0x7ea94d60, ftLastAccessTime.dwHighDateTime=0x1d5edf6, ftLastWriteTime.dwLowDateTime=0x7ea94d60, ftLastWriteTime.dwHighDateTime=0x1d5edf6, nFileSizeHigh=0x0, nFileSizeLow=0x12f3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="KNnK3mQlA9 02KNedah2.gif", cAlternateFileName="KNNK3M~1.GIF")) returned 1 [0111.333] FindNextFileW (in: hFindFile=0x77ba38, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dab7ef0, ftCreationTime.dwHighDateTime=0x1d5e9f7, ftLastAccessTime.dwLowDateTime=0x8a359590, ftLastAccessTime.dwHighDateTime=0x1d5e9a9, ftLastWriteTime.dwLowDateTime=0x8a359590, ftLastWriteTime.dwHighDateTime=0x1d5e9a9, nFileSizeHigh=0x0, nFileSizeLow=0x75a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ojBkzZF.png", cAlternateFileName="")) returned 1 [0111.333] FindNextFileW (in: hFindFile=0x77ba38, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x787ae0a0, ftCreationTime.dwHighDateTime=0x1d5e579, ftLastAccessTime.dwLowDateTime=0x2db10a00, ftLastAccessTime.dwHighDateTime=0x1d5e6f9, ftLastWriteTime.dwLowDateTime=0x2db10a00, ftLastWriteTime.dwHighDateTime=0x1d5e6f9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qi7 B4zT", cAlternateFileName="QI7B4Z~1")) returned 1 [0111.333] FindNextFileW (in: hFindFile=0x77ba38, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0111.334] FindNextFileW (in: hFindFile=0x77ba38, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x572fc840, ftCreationTime.dwHighDateTime=0x1d5f08a, ftLastAccessTime.dwLowDateTime=0xe0091e00, ftLastAccessTime.dwHighDateTime=0x1d5e478, ftLastWriteTime.dwLowDateTime=0xe0091e00, ftLastWriteTime.dwHighDateTime=0x1d5e478, nFileSizeHigh=0x0, nFileSizeLow=0x10cb5, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIRA.bmp", cAlternateFileName="")) returned 1 [0111.334] FindNextFileW (in: hFindFile=0x77ba38, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8752f00, ftCreationTime.dwHighDateTime=0x1d5e31a, ftLastAccessTime.dwLowDateTime=0xe8adcb50, ftLastAccessTime.dwHighDateTime=0x1d5f0ad, ftLastWriteTime.dwLowDateTime=0xe8adcb50, ftLastWriteTime.dwHighDateTime=0x1d5f0ad, nFileSizeHigh=0x0, nFileSizeLow=0x11441, dwReserved0=0x0, dwReserved1=0x0, cFileName="tciYhKunGDc.png", cAlternateFileName="TCIYHK~1.PNG")) returned 1 [0111.334] FindNextFileW (in: hFindFile=0x77ba38, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bf97050, ftCreationTime.dwHighDateTime=0x1d5e563, ftLastAccessTime.dwLowDateTime=0x36338820, ftLastAccessTime.dwHighDateTime=0x1d5ee32, ftLastWriteTime.dwLowDateTime=0x36338820, ftLastWriteTime.dwHighDateTime=0x1d5ee32, nFileSizeHigh=0x0, nFileSizeLow=0x1f4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="uE09.bmp", cAlternateFileName="")) returned 1 [0111.334] FindNextFileW (in: hFindFile=0x77ba38, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22459d30, ftCreationTime.dwHighDateTime=0x1d5e90a, ftLastAccessTime.dwLowDateTime=0x6b8a23f0, ftLastAccessTime.dwHighDateTime=0x1d5eb1a, ftLastWriteTime.dwLowDateTime=0x6b8a23f0, ftLastWriteTime.dwHighDateTime=0x1d5eb1a, nFileSizeHigh=0x0, nFileSizeLow=0x26d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="utrlInnQIT6YWq.png", cAlternateFileName="UTRLIN~1.PNG")) returned 1 [0111.334] FindNextFileW (in: hFindFile=0x77ba38, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x654d34a0, ftCreationTime.dwHighDateTime=0x1d5e584, ftLastAccessTime.dwLowDateTime=0x420a6200, ftLastAccessTime.dwHighDateTime=0x1d5edc3, ftLastWriteTime.dwLowDateTime=0x420a6200, ftLastWriteTime.dwHighDateTime=0x1d5edc3, nFileSizeHigh=0x0, nFileSizeLow=0x14eb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="x6g44LZkZF MNJz.png", cAlternateFileName="X6G44L~1.PNG")) returned 1 [0111.334] FindNextFileW (in: hFindFile=0x77ba38, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb86c2ce0, ftCreationTime.dwHighDateTime=0x1d5e12e, ftLastAccessTime.dwLowDateTime=0xd7bfea60, ftLastAccessTime.dwHighDateTime=0x1d5eccc, ftLastWriteTime.dwLowDateTime=0xd7bfea60, ftLastWriteTime.dwHighDateTime=0x1d5eccc, nFileSizeHigh=0x0, nFileSizeLow=0x1336a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZH82uCB7qM-yR7Km_Gf.jpg", cAlternateFileName="ZH82UC~1.JPG")) returned 1 [0111.335] FindNextFileW (in: hFindFile=0x77ba38, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0111.335] FindClose (in: hFindFile=0x77ba38 | out: hFindFile=0x77ba38) returned 1 [0111.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed54) returned 1 [0111.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed60) returned 1 [0111.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed98) returned 1 [0111.335] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", nBufferLength=0x105, lpBuffer=0x19e84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures", lpFilePart=0x0) returned 0x18 [0111.335] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\*", lpFindFileData=0x19eac0 | out: lpFindFileData=0x19eac0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe6810cbf, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6810cbf, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b778 [0111.336] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe6810cbf, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6810cbf, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.336] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4977440, ftCreationTime.dwHighDateTime=0x1d5e14d, ftLastAccessTime.dwLowDateTime=0x9e0e21c0, ftLastAccessTime.dwHighDateTime=0x1d5ec76, ftLastWriteTime.dwLowDateTime=0x9e0e21c0, ftLastWriteTime.dwHighDateTime=0x1d5ec76, nFileSizeHigh=0x0, nFileSizeLow=0x9e31, dwReserved0=0x0, dwReserved1=0x0, cFileName="0ehOaE.jpg", cAlternateFileName="")) returned 1 [0111.336] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1d0f0e0, ftCreationTime.dwHighDateTime=0x1d5e117, ftLastAccessTime.dwLowDateTime=0x8d59a050, ftLastAccessTime.dwHighDateTime=0x1d5efe8, ftLastWriteTime.dwLowDateTime=0x8d59a050, ftLastWriteTime.dwHighDateTime=0x1d5efe8, nFileSizeHigh=0x0, nFileSizeLow=0xcca2, dwReserved0=0x0, dwReserved1=0x0, cFileName="3MGKBPqc9-_MYecXCap.gif", cAlternateFileName="3MGKBP~1.GIF")) returned 1 [0111.336] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x742093b0, ftCreationTime.dwHighDateTime=0x1d5eb0a, ftLastAccessTime.dwLowDateTime=0x983a5200, ftLastAccessTime.dwHighDateTime=0x1d5e5c3, ftLastWriteTime.dwLowDateTime=0x983a5200, ftLastWriteTime.dwHighDateTime=0x1d5e5c3, nFileSizeHigh=0x0, nFileSizeLow=0x3e80, dwReserved0=0x0, dwReserved1=0x0, cFileName="62Nxa.bmp", cAlternateFileName="")) returned 1 [0111.336] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f6821e0, ftCreationTime.dwHighDateTime=0x1d5eb15, ftLastAccessTime.dwLowDateTime=0x59995560, ftLastAccessTime.dwHighDateTime=0x1d5e90f, ftLastWriteTime.dwLowDateTime=0x59995560, ftLastWriteTime.dwHighDateTime=0x1d5e90f, nFileSizeHigh=0x0, nFileSizeLow=0x11e6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ATGuP30pEWnchJJ.jpg", cAlternateFileName="ATGUP3~1.JPG")) returned 1 [0111.337] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c30f990, ftCreationTime.dwHighDateTime=0x1d5e96b, ftLastAccessTime.dwLowDateTime=0x707fb1a0, ftLastAccessTime.dwHighDateTime=0x1d5e9ca, ftLastWriteTime.dwLowDateTime=0x707fb1a0, ftLastWriteTime.dwHighDateTime=0x1d5e9ca, nFileSizeHigh=0x0, nFileSizeLow=0x16f22, dwReserved0=0x0, dwReserved1=0x0, cFileName="BGq6.png", cAlternateFileName="")) returned 1 [0111.337] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f822530, ftCreationTime.dwHighDateTime=0x1d5e406, ftLastAccessTime.dwLowDateTime=0xe958ca80, ftLastAccessTime.dwHighDateTime=0x1d5e86c, ftLastWriteTime.dwLowDateTime=0xe958ca80, ftLastWriteTime.dwHighDateTime=0x1d5e86c, nFileSizeHigh=0x0, nFileSizeLow=0x13ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BHTLU4kl.jpg", cAlternateFileName="")) returned 1 [0111.337] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75aecc00, ftCreationTime.dwHighDateTime=0x1d5ee03, ftLastAccessTime.dwLowDateTime=0xb43f0750, ftLastAccessTime.dwHighDateTime=0x1d5ead9, ftLastWriteTime.dwLowDateTime=0xb43f0750, ftLastWriteTime.dwHighDateTime=0x1d5ead9, nFileSizeHigh=0x0, nFileSizeLow=0xc323, dwReserved0=0x0, dwReserved1=0x0, cFileName="bXAHv5c.jpg", cAlternateFileName="")) returned 1 [0111.337] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0111.337] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44053085, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44053085, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0111.338] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6ec7a80, ftCreationTime.dwHighDateTime=0x1d5ef4d, ftLastAccessTime.dwLowDateTime=0x188264a0, ftLastAccessTime.dwHighDateTime=0x1d5e274, ftLastWriteTime.dwLowDateTime=0x188264a0, ftLastWriteTime.dwHighDateTime=0x1d5e274, nFileSizeHigh=0x0, nFileSizeLow=0x3c5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="IBucd.gif", cAlternateFileName="")) returned 1 [0111.338] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8780a590, ftCreationTime.dwHighDateTime=0x1d5ec58, ftLastAccessTime.dwLowDateTime=0xcecb9890, ftLastAccessTime.dwHighDateTime=0x1d5e64c, ftLastWriteTime.dwLowDateTime=0xcecb9890, ftLastWriteTime.dwHighDateTime=0x1d5e64c, nFileSizeHigh=0x0, nFileSizeLow=0x530b, dwReserved0=0x0, dwReserved1=0x0, cFileName="icGdWx1uRk8YsM2.bmp", cAlternateFileName="ICGDWX~1.BMP")) returned 1 [0111.338] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x202d94d0, ftCreationTime.dwHighDateTime=0x1d5e919, ftLastAccessTime.dwLowDateTime=0x7ea94d60, ftLastAccessTime.dwHighDateTime=0x1d5edf6, ftLastWriteTime.dwLowDateTime=0x7ea94d60, ftLastWriteTime.dwHighDateTime=0x1d5edf6, nFileSizeHigh=0x0, nFileSizeLow=0x12f3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="KNnK3mQlA9 02KNedah2.gif", cAlternateFileName="KNNK3M~1.GIF")) returned 1 [0111.338] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dab7ef0, ftCreationTime.dwHighDateTime=0x1d5e9f7, ftLastAccessTime.dwLowDateTime=0x8a359590, ftLastAccessTime.dwHighDateTime=0x1d5e9a9, ftLastWriteTime.dwLowDateTime=0x8a359590, ftLastWriteTime.dwHighDateTime=0x1d5e9a9, nFileSizeHigh=0x0, nFileSizeLow=0x75a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ojBkzZF.png", cAlternateFileName="")) returned 1 [0111.338] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x787ae0a0, ftCreationTime.dwHighDateTime=0x1d5e579, ftLastAccessTime.dwLowDateTime=0x2db10a00, ftLastAccessTime.dwHighDateTime=0x1d5e6f9, ftLastWriteTime.dwLowDateTime=0x2db10a00, ftLastWriteTime.dwHighDateTime=0x1d5e6f9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qi7 B4zT", cAlternateFileName="QI7B4Z~1")) returned 1 [0111.339] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0111.339] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x572fc840, ftCreationTime.dwHighDateTime=0x1d5f08a, ftLastAccessTime.dwLowDateTime=0xe0091e00, ftLastAccessTime.dwHighDateTime=0x1d5e478, ftLastWriteTime.dwLowDateTime=0xe0091e00, ftLastWriteTime.dwHighDateTime=0x1d5e478, nFileSizeHigh=0x0, nFileSizeLow=0x10cb5, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIRA.bmp", cAlternateFileName="")) returned 1 [0111.339] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8752f00, ftCreationTime.dwHighDateTime=0x1d5e31a, ftLastAccessTime.dwLowDateTime=0xe8adcb50, ftLastAccessTime.dwHighDateTime=0x1d5f0ad, ftLastWriteTime.dwLowDateTime=0xe8adcb50, ftLastWriteTime.dwHighDateTime=0x1d5f0ad, nFileSizeHigh=0x0, nFileSizeLow=0x11441, dwReserved0=0x0, dwReserved1=0x0, cFileName="tciYhKunGDc.png", cAlternateFileName="TCIYHK~1.PNG")) returned 1 [0111.339] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bf97050, ftCreationTime.dwHighDateTime=0x1d5e563, ftLastAccessTime.dwLowDateTime=0x36338820, ftLastAccessTime.dwHighDateTime=0x1d5ee32, ftLastWriteTime.dwLowDateTime=0x36338820, ftLastWriteTime.dwHighDateTime=0x1d5ee32, nFileSizeHigh=0x0, nFileSizeLow=0x1f4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="uE09.bmp", cAlternateFileName="")) returned 1 [0111.339] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22459d30, ftCreationTime.dwHighDateTime=0x1d5e90a, ftLastAccessTime.dwLowDateTime=0x6b8a23f0, ftLastAccessTime.dwHighDateTime=0x1d5eb1a, ftLastWriteTime.dwLowDateTime=0x6b8a23f0, ftLastWriteTime.dwHighDateTime=0x1d5eb1a, nFileSizeHigh=0x0, nFileSizeLow=0x26d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="utrlInnQIT6YWq.png", cAlternateFileName="UTRLIN~1.PNG")) returned 1 [0111.340] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x654d34a0, ftCreationTime.dwHighDateTime=0x1d5e584, ftLastAccessTime.dwLowDateTime=0x420a6200, ftLastAccessTime.dwHighDateTime=0x1d5edc3, ftLastWriteTime.dwLowDateTime=0x420a6200, ftLastWriteTime.dwHighDateTime=0x1d5edc3, nFileSizeHigh=0x0, nFileSizeLow=0x14eb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="x6g44LZkZF MNJz.png", cAlternateFileName="X6G44L~1.PNG")) returned 1 [0111.340] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb86c2ce0, ftCreationTime.dwHighDateTime=0x1d5e12e, ftLastAccessTime.dwLowDateTime=0xd7bfea60, ftLastAccessTime.dwHighDateTime=0x1d5eccc, ftLastWriteTime.dwLowDateTime=0xd7bfea60, ftLastWriteTime.dwHighDateTime=0x1d5eccc, nFileSizeHigh=0x0, nFileSizeLow=0x1336a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZH82uCB7qM-yR7Km_Gf.jpg", cAlternateFileName="ZH82UC~1.JPG")) returned 1 [0111.340] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb86c2ce0, ftCreationTime.dwHighDateTime=0x1d5e12e, ftLastAccessTime.dwLowDateTime=0xd7bfea60, ftLastAccessTime.dwHighDateTime=0x1d5eccc, ftLastWriteTime.dwLowDateTime=0xd7bfea60, ftLastWriteTime.dwHighDateTime=0x1d5eccc, nFileSizeHigh=0x0, nFileSizeLow=0x1336a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZH82uCB7qM-yR7Km_Gf.jpg", cAlternateFileName="ZH82UC~1.JPG")) returned 0 [0111.340] FindClose (in: hFindFile=0x77b778 | out: hFindFile=0x77b778) returned 1 [0111.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed54) returned 1 [0111.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed60) returned 1 [0111.341] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\0ehOaE.jpg", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\0ehOaE.jpg", lpFilePart=0x0) returned 0x23 [0111.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0111.341] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\0ehOaE.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\0ehoae.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0111.341] GetFileType (hFile=0x37c) returned 0x1 [0111.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0111.341] GetFileType (hFile=0x37c) returned 0x1 [0111.341] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x9e31 [0111.341] ReadFile (in: hFile=0x37c, lpBuffer=0x282cacc, nNumberOfBytesToRead=0x9e31, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x282cacc*, lpNumberOfBytesRead=0x19ecec*=0x9e31, lpOverlapped=0x0) returned 1 [0111.342] CloseHandle (hObject=0x37c) returned 1 [0111.385] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0111.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0111.385] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0111.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0111.385] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\0ehOaE.jpg", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\0ehOaE.jpg", lpFilePart=0x0) returned 0x23 [0111.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0111.386] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\0ehOaE.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\0ehoae.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0111.387] GetFileType (hFile=0x37c) returned 0x1 [0111.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0111.387] GetFileType (hFile=0x37c) returned 0x1 [0111.387] WriteFile (in: hFile=0x37c, lpBuffer=0x26b5ef4*, nNumberOfBytesToWrite=0x9e40, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x26b5ef4*, lpNumberOfBytesWritten=0x19ece0*=0x9e40, lpOverlapped=0x0) returned 1 [0111.389] CloseHandle (hObject=0x37c) returned 1 [0111.402] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\0ehOaE.jpg", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\0ehOaE.jpg", lpFilePart=0x0) returned 0x23 [0111.403] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\0ehOaE.jpg.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\0ehOaE.jpg.spybuster", lpFilePart=0x0) returned 0x2d [0111.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0111.403] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\0ehOaE.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\0ehoae.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4977440, ftCreationTime.dwHighDateTime=0x1d5e14d, ftLastAccessTime.dwLowDateTime=0x9e0e21c0, ftLastAccessTime.dwHighDateTime=0x1d5ec76, ftLastWriteTime.dwLowDateTime=0xb7a9dec2, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x9e40)) returned 1 [0111.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0111.403] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\0ehOaE.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\0ehoae.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\0ehOaE.jpg.spybuster" (normalized: "c:\\users\\fd1hvy\\pictures\\0ehoae.jpg.spybuster")) returned 1 [0111.404] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\62Nxa.bmp", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\62Nxa.bmp", lpFilePart=0x0) returned 0x22 [0111.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0111.404] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\62Nxa.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\62nxa.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0111.404] GetFileType (hFile=0x37c) returned 0x1 [0111.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0111.404] GetFileType (hFile=0x37c) returned 0x1 [0111.404] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x3e80 [0111.404] ReadFile (in: hFile=0x37c, lpBuffer=0x26c015c, nNumberOfBytesToRead=0x3e80, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x26c015c*, lpNumberOfBytesRead=0x19ecec*=0x3e80, lpOverlapped=0x0) returned 1 [0111.405] CloseHandle (hObject=0x37c) returned 1 [0111.431] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0111.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0111.431] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0111.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0111.431] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\62Nxa.bmp", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\62Nxa.bmp", lpFilePart=0x0) returned 0x22 [0111.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0111.431] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\62Nxa.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\62nxa.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0111.433] GetFileType (hFile=0x37c) returned 0x1 [0111.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0111.433] GetFileType (hFile=0x37c) returned 0x1 [0111.433] WriteFile (in: hFile=0x37c, lpBuffer=0x2720970*, nNumberOfBytesToWrite=0x3e90, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x2720970*, lpNumberOfBytesWritten=0x19ece0*=0x3e90, lpOverlapped=0x0) returned 1 [0111.435] CloseHandle (hObject=0x37c) returned 1 [0111.436] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\62Nxa.bmp", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\62Nxa.bmp", lpFilePart=0x0) returned 0x22 [0111.436] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\62Nxa.bmp.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\62Nxa.bmp.spybuster", lpFilePart=0x0) returned 0x2c [0111.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0111.437] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\62Nxa.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\62nxa.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x742093b0, ftCreationTime.dwHighDateTime=0x1d5eb0a, ftLastAccessTime.dwLowDateTime=0x983a5200, ftLastAccessTime.dwHighDateTime=0x1d5e5c3, ftLastWriteTime.dwLowDateTime=0xb7adc982, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x3e90)) returned 1 [0111.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0111.437] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\62Nxa.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\62nxa.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\62Nxa.bmp.spybuster" (normalized: "c:\\users\\fd1hvy\\pictures\\62nxa.bmp.spybuster")) returned 1 [0111.438] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ATGuP30pEWnchJJ.jpg", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ATGuP30pEWnchJJ.jpg", lpFilePart=0x0) returned 0x2c [0111.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0111.438] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ATGuP30pEWnchJJ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\atgup30pewnchjj.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0111.438] GetFileType (hFile=0x37c) returned 0x1 [0111.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0111.438] GetFileType (hFile=0x37c) returned 0x1 [0111.438] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x11e6b [0111.438] ReadFile (in: hFile=0x37c, lpBuffer=0x2724c34, nNumberOfBytesToRead=0x11e6b, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x2724c34*, lpNumberOfBytesRead=0x19ecec*=0x11e6b, lpOverlapped=0x0) returned 1 [0111.439] CloseHandle (hObject=0x37c) returned 1 [0111.469] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0111.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0111.469] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0111.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0111.470] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ATGuP30pEWnchJJ.jpg", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ATGuP30pEWnchJJ.jpg", lpFilePart=0x0) returned 0x2c [0111.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0111.470] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ATGuP30pEWnchJJ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\atgup30pewnchjj.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0111.471] GetFileType (hFile=0x37c) returned 0x1 [0111.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0111.472] GetFileType (hFile=0x37c) returned 0x1 [0111.472] WriteFile (in: hFile=0x37c, lpBuffer=0x27a7584*, nNumberOfBytesToWrite=0x11e70, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x27a7584*, lpNumberOfBytesWritten=0x19ece0*=0x11e70, lpOverlapped=0x0) returned 1 [0111.480] CloseHandle (hObject=0x37c) returned 1 [0111.483] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ATGuP30pEWnchJJ.jpg", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ATGuP30pEWnchJJ.jpg", lpFilePart=0x0) returned 0x2c [0111.483] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ATGuP30pEWnchJJ.jpg.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ATGuP30pEWnchJJ.jpg.spybuster", lpFilePart=0x0) returned 0x36 [0111.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0111.483] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ATGuP30pEWnchJJ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\atgup30pewnchjj.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f6821e0, ftCreationTime.dwHighDateTime=0x1d5eb15, ftLastAccessTime.dwLowDateTime=0x59995560, ftLastAccessTime.dwHighDateTime=0x1d5e90f, ftLastWriteTime.dwLowDateTime=0xb7b4f01f, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x11e70)) returned 1 [0111.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0111.484] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\ATGuP30pEWnchJJ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\atgup30pewnchjj.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\ATGuP30pEWnchJJ.jpg.spybuster" (normalized: "c:\\users\\fd1hvy\\pictures\\atgup30pewnchjj.jpg.spybuster")) returned 1 [0111.484] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\BGq6.png", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\BGq6.png", lpFilePart=0x0) returned 0x21 [0111.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0111.484] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\BGq6.png" (normalized: "c:\\users\\fd1hvy\\pictures\\bgq6.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0111.485] GetFileType (hFile=0x37c) returned 0x1 [0111.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0111.485] GetFileType (hFile=0x37c) returned 0x1 [0111.485] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x16f22 [0111.485] ReadFile (in: hFile=0x37c, lpBuffer=0x392b820, nNumberOfBytesToRead=0x16f22, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x392b820*, lpNumberOfBytesRead=0x19ecec*=0x16f22, lpOverlapped=0x0) returned 1 [0111.486] CloseHandle (hObject=0x37c) returned 1 [0111.548] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0111.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0111.548] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0111.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0111.548] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\BGq6.png", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\BGq6.png", lpFilePart=0x0) returned 0x21 [0111.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0111.548] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\BGq6.png" (normalized: "c:\\users\\fd1hvy\\pictures\\bgq6.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0111.551] GetFileType (hFile=0x37c) returned 0x1 [0111.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0111.551] GetFileType (hFile=0x37c) returned 0x1 [0111.551] WriteFile (in: hFile=0x37c, lpBuffer=0x3651a48*, nNumberOfBytesToWrite=0x16f30, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x3651a48*, lpNumberOfBytesWritten=0x19ece0*=0x16f30, lpOverlapped=0x0) returned 1 [0111.553] CloseHandle (hObject=0x37c) returned 1 [0111.557] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\BGq6.png", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\BGq6.png", lpFilePart=0x0) returned 0x21 [0111.557] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\BGq6.png.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\BGq6.png.spybuster", lpFilePart=0x0) returned 0x2b [0111.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0111.557] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\BGq6.png" (normalized: "c:\\users\\fd1hvy\\pictures\\bgq6.png"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c30f990, ftCreationTime.dwHighDateTime=0x1d5e96b, ftLastAccessTime.dwLowDateTime=0x707fb1a0, ftLastAccessTime.dwHighDateTime=0x1d5e9ca, ftLastWriteTime.dwLowDateTime=0xb7c0db45, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x16f30)) returned 1 [0111.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0111.557] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\BGq6.png" (normalized: "c:\\users\\fd1hvy\\pictures\\bgq6.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\BGq6.png.spybuster" (normalized: "c:\\users\\fd1hvy\\pictures\\bgq6.png.spybuster")) returned 1 [0111.558] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\BHTLU4kl.jpg", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\BHTLU4kl.jpg", lpFilePart=0x0) returned 0x25 [0111.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0111.558] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\BHTLU4kl.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\bhtlu4kl.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0111.558] GetFileType (hFile=0x37c) returned 0x1 [0111.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0111.559] GetFileType (hFile=0x37c) returned 0x1 [0111.559] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x13ec0 [0111.559] ReadFile (in: hFile=0x37c, lpBuffer=0x265e7fc, nNumberOfBytesToRead=0x13ec0, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x265e7fc*, lpNumberOfBytesRead=0x19ecec*=0x13ec0, lpOverlapped=0x0) returned 1 [0111.560] CloseHandle (hObject=0x37c) returned 1 [0111.616] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0111.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0111.616] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0111.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0111.616] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\BHTLU4kl.jpg", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\BHTLU4kl.jpg", lpFilePart=0x0) returned 0x25 [0111.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0111.616] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\BHTLU4kl.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\bhtlu4kl.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0111.618] GetFileType (hFile=0x37c) returned 0x1 [0111.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0111.618] GetFileType (hFile=0x37c) returned 0x1 [0111.618] WriteFile (in: hFile=0x37c, lpBuffer=0x26e73c4*, nNumberOfBytesToWrite=0x13ed0, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x26e73c4*, lpNumberOfBytesWritten=0x19ece0*=0x13ed0, lpOverlapped=0x0) returned 1 [0111.621] CloseHandle (hObject=0x37c) returned 1 [0111.624] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\BHTLU4kl.jpg", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\BHTLU4kl.jpg", lpFilePart=0x0) returned 0x25 [0111.624] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\BHTLU4kl.jpg.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\BHTLU4kl.jpg.spybuster", lpFilePart=0x0) returned 0x2f [0111.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0111.624] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\BHTLU4kl.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\bhtlu4kl.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f822530, ftCreationTime.dwHighDateTime=0x1d5e406, ftLastAccessTime.dwLowDateTime=0xe958ca80, ftLastAccessTime.dwHighDateTime=0x1d5e86c, ftLastWriteTime.dwLowDateTime=0xb7ca67f9, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x13ed0)) returned 1 [0111.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0111.625] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\BHTLU4kl.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\bhtlu4kl.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\BHTLU4kl.jpg.spybuster" (normalized: "c:\\users\\fd1hvy\\pictures\\bhtlu4kl.jpg.spybuster")) returned 1 [0111.629] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\bXAHv5c.jpg", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\bXAHv5c.jpg", lpFilePart=0x0) returned 0x24 [0111.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0111.630] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\bXAHv5c.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\bxahv5c.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0111.630] GetFileType (hFile=0x37c) returned 0x1 [0111.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0111.630] GetFileType (hFile=0x37c) returned 0x1 [0111.630] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0xc323 [0111.630] ReadFile (in: hFile=0x37c, lpBuffer=0x26fb6c0, nNumberOfBytesToRead=0xc323, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x26fb6c0*, lpNumberOfBytesRead=0x19ecec*=0xc323, lpOverlapped=0x0) returned 1 [0111.631] CloseHandle (hObject=0x37c) returned 1 [0111.674] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0111.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0111.674] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0111.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0111.674] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\bXAHv5c.jpg", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\bXAHv5c.jpg", lpFilePart=0x0) returned 0x24 [0111.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0111.674] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\bXAHv5c.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\bxahv5c.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0111.676] GetFileType (hFile=0x37c) returned 0x1 [0111.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0111.676] GetFileType (hFile=0x37c) returned 0x1 [0111.676] WriteFile (in: hFile=0x37c, lpBuffer=0x276ce50*, nNumberOfBytesToWrite=0xc330, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x276ce50*, lpNumberOfBytesWritten=0x19ece0*=0xc330, lpOverlapped=0x0) returned 1 [0111.679] CloseHandle (hObject=0x37c) returned 1 [0111.681] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\bXAHv5c.jpg", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\bXAHv5c.jpg", lpFilePart=0x0) returned 0x24 [0111.681] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\bXAHv5c.jpg.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\bXAHv5c.jpg.spybuster", lpFilePart=0x0) returned 0x2e [0111.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0111.681] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\bXAHv5c.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\bxahv5c.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75aecc00, ftCreationTime.dwHighDateTime=0x1d5ee03, ftLastAccessTime.dwLowDateTime=0xb43f0750, ftLastAccessTime.dwHighDateTime=0x1d5ead9, ftLastWriteTime.dwLowDateTime=0xb7d3efa5, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xc330)) returned 1 [0111.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0111.682] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\bXAHv5c.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\bxahv5c.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\bXAHv5c.jpg.spybuster" (normalized: "c:\\users\\fd1hvy\\pictures\\bxahv5c.jpg.spybuster")) returned 1 [0111.682] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\icGdWx1uRk8YsM2.bmp", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\icGdWx1uRk8YsM2.bmp", lpFilePart=0x0) returned 0x2c [0111.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0111.683] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\icGdWx1uRk8YsM2.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\icgdwx1urk8ysm2.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0111.683] GetFileType (hFile=0x37c) returned 0x1 [0111.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0111.683] GetFileType (hFile=0x37c) returned 0x1 [0111.683] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x530b [0111.683] ReadFile (in: hFile=0x37c, lpBuffer=0x27795f8, nNumberOfBytesToRead=0x530b, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x27795f8*, lpNumberOfBytesRead=0x19ecec*=0x530b, lpOverlapped=0x0) returned 1 [0111.686] CloseHandle (hObject=0x37c) returned 1 [0111.739] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0111.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0111.739] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0111.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0111.739] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\icGdWx1uRk8YsM2.bmp", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\icGdWx1uRk8YsM2.bmp", lpFilePart=0x0) returned 0x2c [0111.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0111.740] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\icGdWx1uRk8YsM2.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\icgdwx1urk8ysm2.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0111.741] GetFileType (hFile=0x37c) returned 0x1 [0111.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0111.741] GetFileType (hFile=0x37c) returned 0x1 [0111.741] WriteFile (in: hFile=0x37c, lpBuffer=0x27e0334*, nNumberOfBytesToWrite=0x5310, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x27e0334*, lpNumberOfBytesWritten=0x19ece0*=0x5310, lpOverlapped=0x0) returned 1 [0111.742] CloseHandle (hObject=0x37c) returned 1 [0111.744] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\icGdWx1uRk8YsM2.bmp", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\icGdWx1uRk8YsM2.bmp", lpFilePart=0x0) returned 0x2c [0111.744] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\icGdWx1uRk8YsM2.bmp.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\icGdWx1uRk8YsM2.bmp.spybuster", lpFilePart=0x0) returned 0x36 [0111.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0111.744] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\icGdWx1uRk8YsM2.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\icgdwx1urk8ysm2.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8780a590, ftCreationTime.dwHighDateTime=0x1d5ec58, ftLastAccessTime.dwLowDateTime=0xcecb9890, ftLastAccessTime.dwHighDateTime=0x1d5e64c, ftLastWriteTime.dwLowDateTime=0xb7dd76f1, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x5310)) returned 1 [0111.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0111.744] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\icGdWx1uRk8YsM2.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\icgdwx1urk8ysm2.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\icGdWx1uRk8YsM2.bmp.spybuster" (normalized: "c:\\users\\fd1hvy\\pictures\\icgdwx1urk8ysm2.bmp.spybuster")) returned 1 [0111.745] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ojBkzZF.png", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ojBkzZF.png", lpFilePart=0x0) returned 0x24 [0111.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0111.745] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ojBkzZF.png" (normalized: "c:\\users\\fd1hvy\\pictures\\ojbkzzf.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0111.746] GetFileType (hFile=0x37c) returned 0x1 [0111.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0111.746] GetFileType (hFile=0x37c) returned 0x1 [0111.746] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x75a [0111.746] ReadFile (in: hFile=0x37c, lpBuffer=0x27e623c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x27e623c*, lpNumberOfBytesRead=0x19ecec*=0x75a, lpOverlapped=0x0) returned 1 [0111.747] CloseHandle (hObject=0x37c) returned 1 [0111.780] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0111.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0111.780] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0111.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0111.781] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ojBkzZF.png", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ojBkzZF.png", lpFilePart=0x0) returned 0x24 [0111.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0111.781] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ojBkzZF.png" (normalized: "c:\\users\\fd1hvy\\pictures\\ojbkzzf.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0111.782] GetFileType (hFile=0x37c) returned 0x1 [0111.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0111.782] GetFileType (hFile=0x37c) returned 0x1 [0111.782] WriteFile (in: hFile=0x37c, lpBuffer=0x2836714*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x19ecb4, lpOverlapped=0x0 | out: lpBuffer=0x2836714*, lpNumberOfBytesWritten=0x19ecb4*=0x760, lpOverlapped=0x0) returned 1 [0111.783] CloseHandle (hObject=0x37c) returned 1 [0111.785] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ojBkzZF.png", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ojBkzZF.png", lpFilePart=0x0) returned 0x24 [0111.785] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ojBkzZF.png.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ojBkzZF.png.spybuster", lpFilePart=0x0) returned 0x2e [0111.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0111.785] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ojBkzZF.png" (normalized: "c:\\users\\fd1hvy\\pictures\\ojbkzzf.png"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dab7ef0, ftCreationTime.dwHighDateTime=0x1d5e9f7, ftLastAccessTime.dwLowDateTime=0x8a359590, ftLastAccessTime.dwHighDateTime=0x1d5e9a9, ftLastWriteTime.dwLowDateTime=0xb7e23d38, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x760)) returned 1 [0111.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0111.785] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\ojBkzZF.png" (normalized: "c:\\users\\fd1hvy\\pictures\\ojbkzzf.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\ojBkzZF.png.spybuster" (normalized: "c:\\users\\fd1hvy\\pictures\\ojbkzzf.png.spybuster")) returned 1 [0111.786] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\SIRA.bmp", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\SIRA.bmp", lpFilePart=0x0) returned 0x21 [0111.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0111.786] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\SIRA.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\sira.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0111.786] GetFileType (hFile=0x37c) returned 0x1 [0111.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0111.787] GetFileType (hFile=0x37c) returned 0x1 [0111.787] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x10cb5 [0111.787] ReadFile (in: hFile=0x37c, lpBuffer=0x2837934, nNumberOfBytesToRead=0x10cb5, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x2837934*, lpNumberOfBytesRead=0x19ecec*=0x10cb5, lpOverlapped=0x0) returned 1 [0111.788] CloseHandle (hObject=0x37c) returned 1 [0111.820] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0111.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0111.820] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0111.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0111.820] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\SIRA.bmp", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\SIRA.bmp", lpFilePart=0x0) returned 0x21 [0111.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0111.820] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\SIRA.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\sira.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0111.822] GetFileType (hFile=0x37c) returned 0x1 [0111.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0111.822] GetFileType (hFile=0x37c) returned 0x1 [0111.822] WriteFile (in: hFile=0x37c, lpBuffer=0x26c8030*, nNumberOfBytesToWrite=0x10cc0, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x26c8030*, lpNumberOfBytesWritten=0x19ece0*=0x10cc0, lpOverlapped=0x0) returned 1 [0111.825] CloseHandle (hObject=0x37c) returned 1 [0111.827] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\SIRA.bmp", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\SIRA.bmp", lpFilePart=0x0) returned 0x21 [0111.828] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\SIRA.bmp.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\SIRA.bmp.spybuster", lpFilePart=0x0) returned 0x2b [0111.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0111.828] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\SIRA.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\sira.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x572fc840, ftCreationTime.dwHighDateTime=0x1d5f08a, ftLastAccessTime.dwLowDateTime=0xe0091e00, ftLastAccessTime.dwHighDateTime=0x1d5e478, ftLastWriteTime.dwLowDateTime=0xb7e963d8, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x10cc0)) returned 1 [0111.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0111.828] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\SIRA.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\sira.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\SIRA.bmp.spybuster" (normalized: "c:\\users\\fd1hvy\\pictures\\sira.bmp.spybuster")) returned 1 [0111.829] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tciYhKunGDc.png", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tciYhKunGDc.png", lpFilePart=0x0) returned 0x28 [0111.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0111.829] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\tciYhKunGDc.png" (normalized: "c:\\users\\fd1hvy\\pictures\\tciyhkungdc.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0111.829] GetFileType (hFile=0x37c) returned 0x1 [0111.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0111.829] GetFileType (hFile=0x37c) returned 0x1 [0111.829] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x11441 [0111.829] ReadFile (in: hFile=0x37c, lpBuffer=0x26d9104, nNumberOfBytesToRead=0x11441, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x26d9104*, lpNumberOfBytesRead=0x19ecec*=0x11441, lpOverlapped=0x0) returned 1 [0111.831] CloseHandle (hObject=0x37c) returned 1 [0111.856] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0111.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0111.856] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0111.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0111.856] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tciYhKunGDc.png", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tciYhKunGDc.png", lpFilePart=0x0) returned 0x28 [0111.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0111.856] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\tciYhKunGDc.png" (normalized: "c:\\users\\fd1hvy\\pictures\\tciyhkungdc.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0111.858] GetFileType (hFile=0x37c) returned 0x1 [0111.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0111.858] GetFileType (hFile=0x37c) returned 0x1 [0111.858] WriteFile (in: hFile=0x37c, lpBuffer=0x2759d50*, nNumberOfBytesToWrite=0x11450, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x2759d50*, lpNumberOfBytesWritten=0x19ece0*=0x11450, lpOverlapped=0x0) returned 1 [0111.861] CloseHandle (hObject=0x37c) returned 1 [0111.954] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tciYhKunGDc.png", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tciYhKunGDc.png", lpFilePart=0x0) returned 0x28 [0111.954] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tciYhKunGDc.png.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tciYhKunGDc.png.spybuster", lpFilePart=0x0) returned 0x32 [0111.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0111.954] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tciYhKunGDc.png" (normalized: "c:\\users\\fd1hvy\\pictures\\tciyhkungdc.png"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8752f00, ftCreationTime.dwHighDateTime=0x1d5e31a, ftLastAccessTime.dwLowDateTime=0xe8adcb50, ftLastAccessTime.dwHighDateTime=0x1d5f0ad, ftLastWriteTime.dwLowDateTime=0xb7fe37e8, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x11450)) returned 1 [0111.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0111.954] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\tciYhKunGDc.png" (normalized: "c:\\users\\fd1hvy\\pictures\\tciyhkungdc.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\tciYhKunGDc.png.spybuster" (normalized: "c:\\users\\fd1hvy\\pictures\\tciyhkungdc.png.spybuster")) returned 1 [0111.955] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\uE09.bmp", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\uE09.bmp", lpFilePart=0x0) returned 0x21 [0111.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0111.955] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\uE09.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\ue09.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0111.956] GetFileType (hFile=0x37c) returned 0x1 [0111.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0111.956] GetFileType (hFile=0x37c) returned 0x1 [0111.956] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x1f4b [0111.956] ReadFile (in: hFile=0x37c, lpBuffer=0x276b5e4, nNumberOfBytesToRead=0x1f4b, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x276b5e4*, lpNumberOfBytesRead=0x19ecec*=0x1f4b, lpOverlapped=0x0) returned 1 [0111.957] CloseHandle (hObject=0x37c) returned 1 [0111.981] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0111.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0111.981] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0111.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0111.982] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\uE09.bmp", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\uE09.bmp", lpFilePart=0x0) returned 0x21 [0111.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0111.982] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\uE09.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\ue09.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0111.983] GetFileType (hFile=0x37c) returned 0x1 [0111.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0111.983] GetFileType (hFile=0x37c) returned 0x1 [0111.983] WriteFile (in: hFile=0x37c, lpBuffer=0x27c2060*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x27c2060*, lpNumberOfBytesWritten=0x19ece0*=0x1f50, lpOverlapped=0x0) returned 1 [0111.985] CloseHandle (hObject=0x37c) returned 1 [0111.986] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\uE09.bmp", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\uE09.bmp", lpFilePart=0x0) returned 0x21 [0111.986] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\uE09.bmp.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\uE09.bmp.spybuster", lpFilePart=0x0) returned 0x2b [0111.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0111.986] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\uE09.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\ue09.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bf97050, ftCreationTime.dwHighDateTime=0x1d5e563, ftLastAccessTime.dwLowDateTime=0x36338820, ftLastAccessTime.dwHighDateTime=0x1d5ee32, ftLastWriteTime.dwLowDateTime=0xb8013bb8, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x1f50)) returned 1 [0111.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0111.986] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\uE09.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\ue09.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\uE09.bmp.spybuster" (normalized: "c:\\users\\fd1hvy\\pictures\\ue09.bmp.spybuster")) returned 1 [0111.987] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\utrlInnQIT6YWq.png", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\utrlInnQIT6YWq.png", lpFilePart=0x0) returned 0x2b [0111.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0111.987] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\utrlInnQIT6YWq.png" (normalized: "c:\\users\\fd1hvy\\pictures\\utrlinnqit6ywq.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0111.987] GetFileType (hFile=0x37c) returned 0x1 [0111.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0111.987] GetFileType (hFile=0x37c) returned 0x1 [0111.988] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x26d1 [0111.988] ReadFile (in: hFile=0x37c, lpBuffer=0x27c43d0, nNumberOfBytesToRead=0x26d1, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x27c43d0*, lpNumberOfBytesRead=0x19ecec*=0x26d1, lpOverlapped=0x0) returned 1 [0112.012] CloseHandle (hObject=0x37c) returned 1 [0112.027] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0112.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0112.027] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0112.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0112.028] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\utrlInnQIT6YWq.png", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\utrlInnQIT6YWq.png", lpFilePart=0x0) returned 0x2b [0112.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0112.028] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\utrlInnQIT6YWq.png" (normalized: "c:\\users\\fd1hvy\\pictures\\utrlinnqit6ywq.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.029] GetFileType (hFile=0x37c) returned 0x1 [0112.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0112.029] GetFileType (hFile=0x37c) returned 0x1 [0112.029] WriteFile (in: hFile=0x37c, lpBuffer=0x281d41c*, nNumberOfBytesToWrite=0x26e0, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x281d41c*, lpNumberOfBytesWritten=0x19ece0*=0x26e0, lpOverlapped=0x0) returned 1 [0112.030] CloseHandle (hObject=0x37c) returned 1 [0112.031] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\utrlInnQIT6YWq.png", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\utrlInnQIT6YWq.png", lpFilePart=0x0) returned 0x2b [0112.031] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\utrlInnQIT6YWq.png.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\utrlInnQIT6YWq.png.spybuster", lpFilePart=0x0) returned 0x35 [0112.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0112.031] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\utrlInnQIT6YWq.png" (normalized: "c:\\users\\fd1hvy\\pictures\\utrlinnqit6ywq.png"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22459d30, ftCreationTime.dwHighDateTime=0x1d5e90a, ftLastAccessTime.dwLowDateTime=0x6b8a23f0, ftLastAccessTime.dwHighDateTime=0x1d5eb1a, ftLastWriteTime.dwLowDateTime=0xb80862bd, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x26e0)) returned 1 [0112.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0112.031] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\utrlInnQIT6YWq.png" (normalized: "c:\\users\\fd1hvy\\pictures\\utrlinnqit6ywq.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\utrlInnQIT6YWq.png.spybuster" (normalized: "c:\\users\\fd1hvy\\pictures\\utrlinnqit6ywq.png.spybuster")) returned 1 [0112.035] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\x6g44LZkZF MNJz.png", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\x6g44LZkZF MNJz.png", lpFilePart=0x0) returned 0x2c [0112.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0112.036] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\x6g44LZkZF MNJz.png" (normalized: "c:\\users\\fd1hvy\\pictures\\x6g44lzkzf mnjz.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.036] GetFileType (hFile=0x37c) returned 0x1 [0112.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0112.036] GetFileType (hFile=0x37c) returned 0x1 [0112.036] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x14eb3 [0112.036] ReadFile (in: hFile=0x37c, lpBuffer=0x3982b60, nNumberOfBytesToRead=0x14eb3, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x3982b60*, lpNumberOfBytesRead=0x19ecec*=0x14eb3, lpOverlapped=0x0) returned 1 [0112.037] CloseHandle (hObject=0x37c) returned 1 [0112.056] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0112.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0112.057] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0112.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0112.057] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\x6g44LZkZF MNJz.png", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\x6g44LZkZF MNJz.png", lpFilePart=0x0) returned 0x2c [0112.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0112.057] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\x6g44LZkZF MNJz.png" (normalized: "c:\\users\\fd1hvy\\pictures\\x6g44lzkzf mnjz.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.058] GetFileType (hFile=0x37c) returned 0x1 [0112.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0112.059] GetFileType (hFile=0x37c) returned 0x1 [0112.059] WriteFile (in: hFile=0x37c, lpBuffer=0x3730c18*, nNumberOfBytesToWrite=0x14ec0, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x3730c18*, lpNumberOfBytesWritten=0x19ece0*=0x14ec0, lpOverlapped=0x0) returned 1 [0112.061] CloseHandle (hObject=0x37c) returned 1 [0112.063] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\x6g44LZkZF MNJz.png", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\x6g44LZkZF MNJz.png", lpFilePart=0x0) returned 0x2c [0112.064] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\x6g44LZkZF MNJz.png.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\x6g44LZkZF MNJz.png.spybuster", lpFilePart=0x0) returned 0x36 [0112.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0112.064] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\x6g44LZkZF MNJz.png" (normalized: "c:\\users\\fd1hvy\\pictures\\x6g44lzkzf mnjz.png"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x654d34a0, ftCreationTime.dwHighDateTime=0x1d5e584, ftLastAccessTime.dwLowDateTime=0x420a6200, ftLastAccessTime.dwHighDateTime=0x1d5edc3, ftLastWriteTime.dwLowDateTime=0xb80d279a, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x14ec0)) returned 1 [0112.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0112.064] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\x6g44LZkZF MNJz.png" (normalized: "c:\\users\\fd1hvy\\pictures\\x6g44lzkzf mnjz.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\x6g44LZkZF MNJz.png.spybuster" (normalized: "c:\\users\\fd1hvy\\pictures\\x6g44lzkzf mnjz.png.spybuster")) returned 1 [0112.064] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ZH82uCB7qM-yR7Km_Gf.jpg", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ZH82uCB7qM-yR7Km_Gf.jpg", lpFilePart=0x0) returned 0x30 [0112.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0112.065] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ZH82uCB7qM-yR7Km_Gf.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\zh82ucb7qm-yr7km_gf.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.065] GetFileType (hFile=0x37c) returned 0x1 [0112.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0112.065] GetFileType (hFile=0x37c) returned 0x1 [0112.065] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x1336a [0112.065] ReadFile (in: hFile=0x37c, lpBuffer=0x286d228, nNumberOfBytesToRead=0x1336a, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x286d228*, lpNumberOfBytesRead=0x19ecec*=0x1336a, lpOverlapped=0x0) returned 1 [0112.066] CloseHandle (hObject=0x37c) returned 1 [0112.091] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0112.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0112.091] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0112.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0112.091] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ZH82uCB7qM-yR7Km_Gf.jpg", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ZH82uCB7qM-yR7Km_Gf.jpg", lpFilePart=0x0) returned 0x30 [0112.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0112.091] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ZH82uCB7qM-yR7Km_Gf.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\zh82ucb7qm-yr7km_gf.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.093] GetFileType (hFile=0x37c) returned 0x1 [0112.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0112.093] GetFileType (hFile=0x37c) returned 0x1 [0112.093] WriteFile (in: hFile=0x37c, lpBuffer=0x26f5f48*, nNumberOfBytesToWrite=0x13370, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x26f5f48*, lpNumberOfBytesWritten=0x19ece0*=0x13370, lpOverlapped=0x0) returned 1 [0112.095] CloseHandle (hObject=0x37c) returned 1 [0112.102] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ZH82uCB7qM-yR7Km_Gf.jpg", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ZH82uCB7qM-yR7Km_Gf.jpg", lpFilePart=0x0) returned 0x30 [0112.102] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ZH82uCB7qM-yR7Km_Gf.jpg.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ZH82uCB7qM-yR7Km_Gf.jpg.spybuster", lpFilePart=0x0) returned 0x3a [0112.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0112.103] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ZH82uCB7qM-yR7Km_Gf.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\zh82ucb7qm-yr7km_gf.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb86c2ce0, ftCreationTime.dwHighDateTime=0x1d5e12e, ftLastAccessTime.dwLowDateTime=0xd7bfea60, ftLastAccessTime.dwHighDateTime=0x1d5eccc, ftLastWriteTime.dwLowDateTime=0xb81458f8, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x13370)) returned 1 [0112.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0112.103] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\ZH82uCB7qM-yR7Km_Gf.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\zh82ucb7qm-yr7km_gf.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\ZH82uCB7qM-yR7Km_Gf.jpg.spybuster" (normalized: "c:\\users\\fd1hvy\\pictures\\zh82ucb7qm-yr7km_gf.jpg.spybuster")) returned 1 [0112.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed24) returned 1 [0112.103] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", nBufferLength=0x105, lpBuffer=0x19e7d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", lpFilePart=0x0) returned 0x24 [0112.103] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*", lpFindFileData=0x19ea4c | out: lpFindFileData=0x19ea4c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b978 [0112.104] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.104] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0112.105] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.105] FindClose (in: hFindFile=0x77b978 | out: hFindFile=0x77b978) returned 1 [0112.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ece0) returned 1 [0112.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecec) returned 1 [0112.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed24) returned 1 [0112.105] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", nBufferLength=0x105, lpBuffer=0x19e7d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", lpFilePart=0x0) returned 0x24 [0112.105] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*", lpFindFileData=0x19ea4c | out: lpFindFileData=0x19ea4c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b9f8 [0112.105] FindNextFileW (in: hFindFile=0x77b9f8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.105] FindNextFileW (in: hFindFile=0x77b9f8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0112.106] FindNextFileW (in: hFindFile=0x77b9f8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0112.106] FindClose (in: hFindFile=0x77b9f8 | out: hFindFile=0x77b9f8) returned 1 [0112.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ece0) returned 1 [0112.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecec) returned 1 [0112.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed24) returned 1 [0112.106] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT", nBufferLength=0x105, lpBuffer=0x19e7d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT", lpFilePart=0x0) returned 0x21 [0112.106] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\*", lpFindFileData=0x19ea4c | out: lpFindFileData=0x19ea4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x787ae0a0, ftCreationTime.dwHighDateTime=0x1d5e579, ftLastAccessTime.dwLowDateTime=0x2db10a00, ftLastAccessTime.dwHighDateTime=0x1d5e6f9, ftLastWriteTime.dwLowDateTime=0x2db10a00, ftLastWriteTime.dwHighDateTime=0x1d5e6f9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b538 [0112.106] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x787ae0a0, ftCreationTime.dwHighDateTime=0x1d5e579, ftLastAccessTime.dwLowDateTime=0x2db10a00, ftLastAccessTime.dwHighDateTime=0x1d5e6f9, ftLastWriteTime.dwLowDateTime=0x2db10a00, ftLastWriteTime.dwHighDateTime=0x1d5e6f9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.106] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c28e00, ftCreationTime.dwHighDateTime=0x1d5f121, ftLastAccessTime.dwLowDateTime=0x3919f2a0, ftLastAccessTime.dwHighDateTime=0x1d5ea76, ftLastWriteTime.dwLowDateTime=0x3919f2a0, ftLastWriteTime.dwHighDateTime=0x1d5ea76, nFileSizeHigh=0x0, nFileSizeLow=0xdcff, dwReserved0=0x0, dwReserved1=0x0, cFileName="-UJy7MJBZGtCnQl.jpg", cAlternateFileName="-UJY7M~1.JPG")) returned 1 [0112.107] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f1f3b0, ftCreationTime.dwHighDateTime=0x1d5e763, ftLastAccessTime.dwLowDateTime=0x75dc80b0, ftLastAccessTime.dwHighDateTime=0x1d5e83a, ftLastWriteTime.dwLowDateTime=0x75dc80b0, ftLastWriteTime.dwHighDateTime=0x1d5e83a, nFileSizeHigh=0x0, nFileSizeLow=0x6002, dwReserved0=0x0, dwReserved1=0x0, cFileName="1e_enKT IAy2.jpg", cAlternateFileName="1E_ENK~1.JPG")) returned 1 [0112.107] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x980ca10, ftCreationTime.dwHighDateTime=0x1d5e156, ftLastAccessTime.dwLowDateTime=0x8b095ba0, ftLastAccessTime.dwHighDateTime=0x1d5efd0, ftLastWriteTime.dwLowDateTime=0x8b095ba0, ftLastWriteTime.dwHighDateTime=0x1d5efd0, nFileSizeHigh=0x0, nFileSizeLow=0x9dbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="1P-qREW6.gif", cAlternateFileName="")) returned 1 [0112.107] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9821ecb0, ftCreationTime.dwHighDateTime=0x1d5ee42, ftLastAccessTime.dwLowDateTime=0x46fbce90, ftLastAccessTime.dwHighDateTime=0x1d5e33f, ftLastWriteTime.dwLowDateTime=0x46fbce90, ftLastWriteTime.dwHighDateTime=0x1d5e33f, nFileSizeHigh=0x0, nFileSizeLow=0x1e5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="3zSH.jpg", cAlternateFileName="")) returned 1 [0112.107] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea36d3a0, ftCreationTime.dwHighDateTime=0x1d5efad, ftLastAccessTime.dwLowDateTime=0x9e4da760, ftLastAccessTime.dwHighDateTime=0x1d5e6c6, ftLastWriteTime.dwLowDateTime=0x9e4da760, ftLastWriteTime.dwHighDateTime=0x1d5e6c6, nFileSizeHigh=0x0, nFileSizeLow=0x11507, dwReserved0=0x0, dwReserved1=0x0, cFileName="5h_Fw5CJjW.gif", cAlternateFileName="5H_FW5~1.GIF")) returned 1 [0112.107] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x739d0fa0, ftCreationTime.dwHighDateTime=0x1d5e0f5, ftLastAccessTime.dwLowDateTime=0x2cd0f830, ftLastAccessTime.dwHighDateTime=0x1d5e883, ftLastWriteTime.dwLowDateTime=0x2cd0f830, ftLastWriteTime.dwHighDateTime=0x1d5e883, nFileSizeHigh=0x0, nFileSizeLow=0x3f95, dwReserved0=0x0, dwReserved1=0x0, cFileName="BntE 0fjbg.png", cAlternateFileName="BNTE0F~1.PNG")) returned 1 [0112.107] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61f06d70, ftCreationTime.dwHighDateTime=0x1d5eb08, ftLastAccessTime.dwLowDateTime=0x3731ebd0, ftLastAccessTime.dwHighDateTime=0x1d5ea41, ftLastWriteTime.dwLowDateTime=0x3731ebd0, ftLastWriteTime.dwHighDateTime=0x1d5ea41, nFileSizeHigh=0x0, nFileSizeLow=0x980d, dwReserved0=0x0, dwReserved1=0x0, cFileName="cjy5yOqpzfy.jpg", cAlternateFileName="CJY5YO~1.JPG")) returned 1 [0112.107] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd924e00, ftCreationTime.dwHighDateTime=0x1d5e564, ftLastAccessTime.dwLowDateTime=0xa8305060, ftLastAccessTime.dwHighDateTime=0x1d5eb4f, ftLastWriteTime.dwLowDateTime=0xa8305060, ftLastWriteTime.dwHighDateTime=0x1d5eb4f, nFileSizeHigh=0x0, nFileSizeLow=0x1132, dwReserved0=0x0, dwReserved1=0x0, cFileName="crBLP3WmGf8pH9.png", cAlternateFileName="CRBLP3~1.PNG")) returned 1 [0112.107] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd19cf6e0, ftCreationTime.dwHighDateTime=0x1d5ee35, ftLastAccessTime.dwLowDateTime=0xe1a70020, ftLastAccessTime.dwHighDateTime=0x1d5e5e4, ftLastWriteTime.dwLowDateTime=0xe1a70020, ftLastWriteTime.dwHighDateTime=0x1d5e5e4, nFileSizeHigh=0x0, nFileSizeLow=0x1811c, dwReserved0=0x0, dwReserved1=0x0, cFileName="essUL5txxsQxH SCRUh.bmp", cAlternateFileName="ESSUL5~1.BMP")) returned 1 [0112.108] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe34bac90, ftCreationTime.dwHighDateTime=0x1d5ebd0, ftLastAccessTime.dwLowDateTime=0xb9ad7e0, ftLastAccessTime.dwHighDateTime=0x1d5ef35, ftLastWriteTime.dwLowDateTime=0xb9ad7e0, ftLastWriteTime.dwHighDateTime=0x1d5ef35, nFileSizeHigh=0x0, nFileSizeLow=0x27f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ON0kZc5-Em6.gif", cAlternateFileName="ON0KZC~1.GIF")) returned 1 [0112.108] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3336b5a0, ftCreationTime.dwHighDateTime=0x1d5ea7e, ftLastAccessTime.dwLowDateTime=0xb1c966c0, ftLastAccessTime.dwHighDateTime=0x1d5eee7, ftLastWriteTime.dwLowDateTime=0xb1c966c0, ftLastWriteTime.dwHighDateTime=0x1d5eee7, nFileSizeHigh=0x0, nFileSizeLow=0x18b91, dwReserved0=0x0, dwReserved1=0x0, cFileName="SX7SOdL26DN4v.gif", cAlternateFileName="SX7SOD~1.GIF")) returned 1 [0112.108] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436843a0, ftCreationTime.dwHighDateTime=0x1d5ec6b, ftLastAccessTime.dwLowDateTime=0xa79cc80, ftLastAccessTime.dwHighDateTime=0x1d5eacc, ftLastWriteTime.dwLowDateTime=0xa79cc80, ftLastWriteTime.dwHighDateTime=0x1d5eacc, nFileSizeHigh=0x0, nFileSizeLow=0x146fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="U_ICwLJ 4.gif", cAlternateFileName="U_ICWL~1.GIF")) returned 1 [0112.108] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x246fb640, ftCreationTime.dwHighDateTime=0x1d5e211, ftLastAccessTime.dwLowDateTime=0xf1fcad30, ftLastAccessTime.dwHighDateTime=0x1d5e7ab, ftLastWriteTime.dwLowDateTime=0xf1fcad30, ftLastWriteTime.dwHighDateTime=0x1d5e7ab, nFileSizeHigh=0x0, nFileSizeLow=0x16aed, dwReserved0=0x0, dwReserved1=0x0, cFileName="WYuGxfrkEC.bmp", cAlternateFileName="WYUGXF~1.BMP")) returned 1 [0112.108] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9b5acd0, ftCreationTime.dwHighDateTime=0x1d5eab7, ftLastAccessTime.dwLowDateTime=0x169998e0, ftLastAccessTime.dwHighDateTime=0x1d5e510, ftLastWriteTime.dwLowDateTime=0x169998e0, ftLastWriteTime.dwHighDateTime=0x1d5e510, nFileSizeHigh=0x0, nFileSizeLow=0x16034, dwReserved0=0x0, dwReserved1=0x0, cFileName="xX1isQ8ffBvePlH.gif", cAlternateFileName="XX1ISQ~1.GIF")) returned 1 [0112.108] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7766ae00, ftCreationTime.dwHighDateTime=0x1d5e1f6, ftLastAccessTime.dwLowDateTime=0x5b57a960, ftLastAccessTime.dwHighDateTime=0x1d5e1cb, ftLastWriteTime.dwLowDateTime=0x5b57a960, ftLastWriteTime.dwHighDateTime=0x1d5e1cb, nFileSizeHigh=0x0, nFileSizeLow=0x13695, dwReserved0=0x0, dwReserved1=0x0, cFileName="YTrSG1A.gif", cAlternateFileName="")) returned 1 [0112.108] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.108] FindClose (in: hFindFile=0x77b538 | out: hFindFile=0x77b538) returned 1 [0112.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ece0) returned 1 [0112.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecec) returned 1 [0112.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed24) returned 1 [0112.109] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT", nBufferLength=0x105, lpBuffer=0x19e7d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT", lpFilePart=0x0) returned 0x21 [0112.109] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\*", lpFindFileData=0x19ea4c | out: lpFindFileData=0x19ea4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x787ae0a0, ftCreationTime.dwHighDateTime=0x1d5e579, ftLastAccessTime.dwLowDateTime=0x2db10a00, ftLastAccessTime.dwHighDateTime=0x1d5e6f9, ftLastWriteTime.dwLowDateTime=0x2db10a00, ftLastWriteTime.dwHighDateTime=0x1d5e6f9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b6b8 [0112.109] FindNextFileW (in: hFindFile=0x77b6b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x787ae0a0, ftCreationTime.dwHighDateTime=0x1d5e579, ftLastAccessTime.dwLowDateTime=0x2db10a00, ftLastAccessTime.dwHighDateTime=0x1d5e6f9, ftLastWriteTime.dwLowDateTime=0x2db10a00, ftLastWriteTime.dwHighDateTime=0x1d5e6f9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.109] FindNextFileW (in: hFindFile=0x77b6b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c28e00, ftCreationTime.dwHighDateTime=0x1d5f121, ftLastAccessTime.dwLowDateTime=0x3919f2a0, ftLastAccessTime.dwHighDateTime=0x1d5ea76, ftLastWriteTime.dwLowDateTime=0x3919f2a0, ftLastWriteTime.dwHighDateTime=0x1d5ea76, nFileSizeHigh=0x0, nFileSizeLow=0xdcff, dwReserved0=0x0, dwReserved1=0x0, cFileName="-UJy7MJBZGtCnQl.jpg", cAlternateFileName="-UJY7M~1.JPG")) returned 1 [0112.109] FindNextFileW (in: hFindFile=0x77b6b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f1f3b0, ftCreationTime.dwHighDateTime=0x1d5e763, ftLastAccessTime.dwLowDateTime=0x75dc80b0, ftLastAccessTime.dwHighDateTime=0x1d5e83a, ftLastWriteTime.dwLowDateTime=0x75dc80b0, ftLastWriteTime.dwHighDateTime=0x1d5e83a, nFileSizeHigh=0x0, nFileSizeLow=0x6002, dwReserved0=0x0, dwReserved1=0x0, cFileName="1e_enKT IAy2.jpg", cAlternateFileName="1E_ENK~1.JPG")) returned 1 [0112.110] FindNextFileW (in: hFindFile=0x77b6b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x980ca10, ftCreationTime.dwHighDateTime=0x1d5e156, ftLastAccessTime.dwLowDateTime=0x8b095ba0, ftLastAccessTime.dwHighDateTime=0x1d5efd0, ftLastWriteTime.dwLowDateTime=0x8b095ba0, ftLastWriteTime.dwHighDateTime=0x1d5efd0, nFileSizeHigh=0x0, nFileSizeLow=0x9dbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="1P-qREW6.gif", cAlternateFileName="")) returned 1 [0112.110] FindNextFileW (in: hFindFile=0x77b6b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9821ecb0, ftCreationTime.dwHighDateTime=0x1d5ee42, ftLastAccessTime.dwLowDateTime=0x46fbce90, ftLastAccessTime.dwHighDateTime=0x1d5e33f, ftLastWriteTime.dwLowDateTime=0x46fbce90, ftLastWriteTime.dwHighDateTime=0x1d5e33f, nFileSizeHigh=0x0, nFileSizeLow=0x1e5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="3zSH.jpg", cAlternateFileName="")) returned 1 [0112.110] FindNextFileW (in: hFindFile=0x77b6b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea36d3a0, ftCreationTime.dwHighDateTime=0x1d5efad, ftLastAccessTime.dwLowDateTime=0x9e4da760, ftLastAccessTime.dwHighDateTime=0x1d5e6c6, ftLastWriteTime.dwLowDateTime=0x9e4da760, ftLastWriteTime.dwHighDateTime=0x1d5e6c6, nFileSizeHigh=0x0, nFileSizeLow=0x11507, dwReserved0=0x0, dwReserved1=0x0, cFileName="5h_Fw5CJjW.gif", cAlternateFileName="5H_FW5~1.GIF")) returned 1 [0112.110] FindNextFileW (in: hFindFile=0x77b6b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x739d0fa0, ftCreationTime.dwHighDateTime=0x1d5e0f5, ftLastAccessTime.dwLowDateTime=0x2cd0f830, ftLastAccessTime.dwHighDateTime=0x1d5e883, ftLastWriteTime.dwLowDateTime=0x2cd0f830, ftLastWriteTime.dwHighDateTime=0x1d5e883, nFileSizeHigh=0x0, nFileSizeLow=0x3f95, dwReserved0=0x0, dwReserved1=0x0, cFileName="BntE 0fjbg.png", cAlternateFileName="BNTE0F~1.PNG")) returned 1 [0112.110] FindNextFileW (in: hFindFile=0x77b6b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61f06d70, ftCreationTime.dwHighDateTime=0x1d5eb08, ftLastAccessTime.dwLowDateTime=0x3731ebd0, ftLastAccessTime.dwHighDateTime=0x1d5ea41, ftLastWriteTime.dwLowDateTime=0x3731ebd0, ftLastWriteTime.dwHighDateTime=0x1d5ea41, nFileSizeHigh=0x0, nFileSizeLow=0x980d, dwReserved0=0x0, dwReserved1=0x0, cFileName="cjy5yOqpzfy.jpg", cAlternateFileName="CJY5YO~1.JPG")) returned 1 [0112.110] FindNextFileW (in: hFindFile=0x77b6b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd924e00, ftCreationTime.dwHighDateTime=0x1d5e564, ftLastAccessTime.dwLowDateTime=0xa8305060, ftLastAccessTime.dwHighDateTime=0x1d5eb4f, ftLastWriteTime.dwLowDateTime=0xa8305060, ftLastWriteTime.dwHighDateTime=0x1d5eb4f, nFileSizeHigh=0x0, nFileSizeLow=0x1132, dwReserved0=0x0, dwReserved1=0x0, cFileName="crBLP3WmGf8pH9.png", cAlternateFileName="CRBLP3~1.PNG")) returned 1 [0112.111] FindNextFileW (in: hFindFile=0x77b6b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd19cf6e0, ftCreationTime.dwHighDateTime=0x1d5ee35, ftLastAccessTime.dwLowDateTime=0xe1a70020, ftLastAccessTime.dwHighDateTime=0x1d5e5e4, ftLastWriteTime.dwLowDateTime=0xe1a70020, ftLastWriteTime.dwHighDateTime=0x1d5e5e4, nFileSizeHigh=0x0, nFileSizeLow=0x1811c, dwReserved0=0x0, dwReserved1=0x0, cFileName="essUL5txxsQxH SCRUh.bmp", cAlternateFileName="ESSUL5~1.BMP")) returned 1 [0112.111] FindNextFileW (in: hFindFile=0x77b6b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe34bac90, ftCreationTime.dwHighDateTime=0x1d5ebd0, ftLastAccessTime.dwLowDateTime=0xb9ad7e0, ftLastAccessTime.dwHighDateTime=0x1d5ef35, ftLastWriteTime.dwLowDateTime=0xb9ad7e0, ftLastWriteTime.dwHighDateTime=0x1d5ef35, nFileSizeHigh=0x0, nFileSizeLow=0x27f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ON0kZc5-Em6.gif", cAlternateFileName="ON0KZC~1.GIF")) returned 1 [0112.111] FindNextFileW (in: hFindFile=0x77b6b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3336b5a0, ftCreationTime.dwHighDateTime=0x1d5ea7e, ftLastAccessTime.dwLowDateTime=0xb1c966c0, ftLastAccessTime.dwHighDateTime=0x1d5eee7, ftLastWriteTime.dwLowDateTime=0xb1c966c0, ftLastWriteTime.dwHighDateTime=0x1d5eee7, nFileSizeHigh=0x0, nFileSizeLow=0x18b91, dwReserved0=0x0, dwReserved1=0x0, cFileName="SX7SOdL26DN4v.gif", cAlternateFileName="SX7SOD~1.GIF")) returned 1 [0112.111] FindNextFileW (in: hFindFile=0x77b6b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436843a0, ftCreationTime.dwHighDateTime=0x1d5ec6b, ftLastAccessTime.dwLowDateTime=0xa79cc80, ftLastAccessTime.dwHighDateTime=0x1d5eacc, ftLastWriteTime.dwLowDateTime=0xa79cc80, ftLastWriteTime.dwHighDateTime=0x1d5eacc, nFileSizeHigh=0x0, nFileSizeLow=0x146fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="U_ICwLJ 4.gif", cAlternateFileName="U_ICWL~1.GIF")) returned 1 [0112.111] FindNextFileW (in: hFindFile=0x77b6b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x246fb640, ftCreationTime.dwHighDateTime=0x1d5e211, ftLastAccessTime.dwLowDateTime=0xf1fcad30, ftLastAccessTime.dwHighDateTime=0x1d5e7ab, ftLastWriteTime.dwLowDateTime=0xf1fcad30, ftLastWriteTime.dwHighDateTime=0x1d5e7ab, nFileSizeHigh=0x0, nFileSizeLow=0x16aed, dwReserved0=0x0, dwReserved1=0x0, cFileName="WYuGxfrkEC.bmp", cAlternateFileName="WYUGXF~1.BMP")) returned 1 [0112.111] FindNextFileW (in: hFindFile=0x77b6b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9b5acd0, ftCreationTime.dwHighDateTime=0x1d5eab7, ftLastAccessTime.dwLowDateTime=0x169998e0, ftLastAccessTime.dwHighDateTime=0x1d5e510, ftLastWriteTime.dwLowDateTime=0x169998e0, ftLastWriteTime.dwHighDateTime=0x1d5e510, nFileSizeHigh=0x0, nFileSizeLow=0x16034, dwReserved0=0x0, dwReserved1=0x0, cFileName="xX1isQ8ffBvePlH.gif", cAlternateFileName="XX1ISQ~1.GIF")) returned 1 [0112.112] FindNextFileW (in: hFindFile=0x77b6b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7766ae00, ftCreationTime.dwHighDateTime=0x1d5e1f6, ftLastAccessTime.dwLowDateTime=0x5b57a960, ftLastAccessTime.dwHighDateTime=0x1d5e1cb, ftLastWriteTime.dwLowDateTime=0x5b57a960, ftLastWriteTime.dwHighDateTime=0x1d5e1cb, nFileSizeHigh=0x0, nFileSizeLow=0x13695, dwReserved0=0x0, dwReserved1=0x0, cFileName="YTrSG1A.gif", cAlternateFileName="")) returned 1 [0112.112] FindNextFileW (in: hFindFile=0x77b6b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7766ae00, ftCreationTime.dwHighDateTime=0x1d5e1f6, ftLastAccessTime.dwLowDateTime=0x5b57a960, ftLastAccessTime.dwHighDateTime=0x1d5e1cb, ftLastWriteTime.dwLowDateTime=0x5b57a960, ftLastWriteTime.dwHighDateTime=0x1d5e1cb, nFileSizeHigh=0x0, nFileSizeLow=0x13695, dwReserved0=0x0, dwReserved1=0x0, cFileName="YTrSG1A.gif", cAlternateFileName="")) returned 0 [0112.112] FindClose (in: hFindFile=0x77b6b8 | out: hFindFile=0x77b6b8) returned 1 [0112.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ece0) returned 1 [0112.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecec) returned 1 [0112.112] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\-UJy7MJBZGtCnQl.jpg", nBufferLength=0x105, lpBuffer=0x19e68c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\-UJy7MJBZGtCnQl.jpg", lpFilePart=0x0) returned 0x35 [0112.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0112.112] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\-UJy7MJBZGtCnQl.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\-ujy7mjbzgtcnql.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.112] GetFileType (hFile=0x37c) returned 0x1 [0112.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0112.112] GetFileType (hFile=0x37c) returned 0x1 [0112.112] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19eccc | out: lpFileSizeHigh=0x19eccc*=0x0) returned 0xdcff [0112.113] ReadFile (in: hFile=0x37c, lpBuffer=0x270dca8, nNumberOfBytesToRead=0xdcff, lpNumberOfBytesRead=0x19ec78, lpOverlapped=0x0 | out: lpBuffer=0x270dca8*, lpNumberOfBytesRead=0x19ec78*=0xdcff, lpOverlapped=0x0) returned 1 [0112.114] CloseHandle (hObject=0x37c) returned 1 [0112.132] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e790, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0112.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0112.132] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ecc0 | out: lpFileInformation=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0112.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0112.132] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\-UJy7MJBZGtCnQl.jpg", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\-UJy7MJBZGtCnQl.jpg", lpFilePart=0x0) returned 0x35 [0112.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0112.132] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\-UJy7MJBZGtCnQl.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\-ujy7mjbzgtcnql.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.134] GetFileType (hFile=0x37c) returned 0x1 [0112.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0112.134] GetFileType (hFile=0x37c) returned 0x1 [0112.134] WriteFile (in: hFile=0x37c, lpBuffer=0x2784304*, nNumberOfBytesToWrite=0xdd00, lpNumberOfBytesWritten=0x19ec6c, lpOverlapped=0x0 | out: lpBuffer=0x2784304*, lpNumberOfBytesWritten=0x19ec6c*=0xdd00, lpOverlapped=0x0) returned 1 [0112.136] CloseHandle (hObject=0x37c) returned 1 [0112.138] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\-UJy7MJBZGtCnQl.jpg", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\-UJy7MJBZGtCnQl.jpg", lpFilePart=0x0) returned 0x35 [0112.138] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\-UJy7MJBZGtCnQl.jpg.spybuster", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\-UJy7MJBZGtCnQl.jpg.spybuster", lpFilePart=0x0) returned 0x3f [0112.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec50) returned 1 [0112.138] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\-UJy7MJBZGtCnQl.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\-ujy7mjbzgtcnql.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19eccc | out: lpFileInformation=0x19eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c28e00, ftCreationTime.dwHighDateTime=0x1d5f121, ftLastAccessTime.dwLowDateTime=0x3919f2a0, ftLastAccessTime.dwHighDateTime=0x1d5ea76, ftLastWriteTime.dwLowDateTime=0xb81911cb, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xdd00)) returned 1 [0112.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0112.138] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\-UJy7MJBZGtCnQl.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\-ujy7mjbzgtcnql.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\-UJy7MJBZGtCnQl.jpg.spybuster" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\-ujy7mjbzgtcnql.jpg.spybuster")) returned 1 [0112.139] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\1e_enKT IAy2.jpg", nBufferLength=0x105, lpBuffer=0x19e68c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\1e_enKT IAy2.jpg", lpFilePart=0x0) returned 0x32 [0112.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0112.139] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\1e_enKT IAy2.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\1e_enkt iay2.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.139] GetFileType (hFile=0x37c) returned 0x1 [0112.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0112.139] GetFileType (hFile=0x37c) returned 0x1 [0112.139] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19eccc | out: lpFileSizeHigh=0x19eccc*=0x0) returned 0x6002 [0112.139] ReadFile (in: hFile=0x37c, lpBuffer=0x27924e4, nNumberOfBytesToRead=0x6002, lpNumberOfBytesRead=0x19ec78, lpOverlapped=0x0 | out: lpBuffer=0x27924e4*, lpNumberOfBytesRead=0x19ec78*=0x6002, lpOverlapped=0x0) returned 1 [0112.140] CloseHandle (hObject=0x37c) returned 1 [0112.222] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e790, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0112.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0112.222] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ecc0 | out: lpFileInformation=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0112.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0112.223] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\1e_enKT IAy2.jpg", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\1e_enKT IAy2.jpg", lpFilePart=0x0) returned 0x32 [0112.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0112.223] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\1e_enKT IAy2.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\1e_enkt iay2.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.243] GetFileType (hFile=0x37c) returned 0x1 [0112.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0112.243] GetFileType (hFile=0x37c) returned 0x1 [0112.243] WriteFile (in: hFile=0x37c, lpBuffer=0x27fd320*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x19ec6c, lpOverlapped=0x0 | out: lpBuffer=0x27fd320*, lpNumberOfBytesWritten=0x19ec6c*=0x6010, lpOverlapped=0x0) returned 1 [0112.244] CloseHandle (hObject=0x37c) returned 1 [0112.246] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\1e_enKT IAy2.jpg", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\1e_enKT IAy2.jpg", lpFilePart=0x0) returned 0x32 [0112.246] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\1e_enKT IAy2.jpg.spybuster", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\1e_enKT IAy2.jpg.spybuster", lpFilePart=0x0) returned 0x3c [0112.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec50) returned 1 [0112.246] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\1e_enKT IAy2.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\1e_enkt iay2.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19eccc | out: lpFileInformation=0x19eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f1f3b0, ftCreationTime.dwHighDateTime=0x1d5e763, ftLastAccessTime.dwLowDateTime=0x75dc80b0, ftLastAccessTime.dwHighDateTime=0x1d5e83a, ftLastWriteTime.dwLowDateTime=0xb829ff3a, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x6010)) returned 1 [0112.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0112.246] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\1e_enKT IAy2.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\1e_enkt iay2.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\1e_enKT IAy2.jpg.spybuster" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\1e_enkt iay2.jpg.spybuster")) returned 1 [0112.247] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\3zSH.jpg", nBufferLength=0x105, lpBuffer=0x19e68c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\3zSH.jpg", lpFilePart=0x0) returned 0x2a [0112.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0112.247] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\3zSH.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\3zsh.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.247] GetFileType (hFile=0x37c) returned 0x1 [0112.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0112.247] GetFileType (hFile=0x37c) returned 0x1 [0112.248] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19eccc | out: lpFileSizeHigh=0x19eccc*=0x0) returned 0x1e5d [0112.248] ReadFile (in: hFile=0x37c, lpBuffer=0x28037f4, nNumberOfBytesToRead=0x1e5d, lpNumberOfBytesRead=0x19ec78, lpOverlapped=0x0 | out: lpBuffer=0x28037f4*, lpNumberOfBytesRead=0x19ec78*=0x1e5d, lpOverlapped=0x0) returned 1 [0112.249] CloseHandle (hObject=0x37c) returned 1 [0112.297] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e790, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0112.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0112.297] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ecc0 | out: lpFileInformation=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0112.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0112.298] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\3zSH.jpg", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\3zSH.jpg", lpFilePart=0x0) returned 0x2a [0112.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0112.298] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\3zSH.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\3zsh.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.299] GetFileType (hFile=0x37c) returned 0x1 [0112.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0112.299] GetFileType (hFile=0x37c) returned 0x1 [0112.299] WriteFile (in: hFile=0x37c, lpBuffer=0x2859dc0*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x19ec6c, lpOverlapped=0x0 | out: lpBuffer=0x2859dc0*, lpNumberOfBytesWritten=0x19ec6c*=0x1e60, lpOverlapped=0x0) returned 1 [0112.301] CloseHandle (hObject=0x37c) returned 1 [0112.302] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\3zSH.jpg", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\3zSH.jpg", lpFilePart=0x0) returned 0x2a [0112.302] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\3zSH.jpg.spybuster", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\3zSH.jpg.spybuster", lpFilePart=0x0) returned 0x34 [0112.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec50) returned 1 [0112.303] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\3zSH.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\3zsh.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19eccc | out: lpFileInformation=0x19eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9821ecb0, ftCreationTime.dwHighDateTime=0x1d5ee42, ftLastAccessTime.dwLowDateTime=0x46fbce90, ftLastAccessTime.dwHighDateTime=0x1d5e33f, ftLastWriteTime.dwLowDateTime=0xb833893c, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x1e60)) returned 1 [0112.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0112.303] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\3zSH.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\3zsh.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\3zSH.jpg.spybuster" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\3zsh.jpg.spybuster")) returned 1 [0112.304] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\BntE 0fjbg.png", nBufferLength=0x105, lpBuffer=0x19e68c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\BntE 0fjbg.png", lpFilePart=0x0) returned 0x30 [0112.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0112.304] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\BntE 0fjbg.png" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\bnte 0fjbg.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.304] GetFileType (hFile=0x37c) returned 0x1 [0112.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0112.304] GetFileType (hFile=0x37c) returned 0x1 [0112.304] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19eccc | out: lpFileSizeHigh=0x19eccc*=0x0) returned 0x3f95 [0112.304] ReadFile (in: hFile=0x37c, lpBuffer=0x285c0ac, nNumberOfBytesToRead=0x3f95, lpNumberOfBytesRead=0x19ec78, lpOverlapped=0x0 | out: lpBuffer=0x285c0ac*, lpNumberOfBytesRead=0x19ec78*=0x3f95, lpOverlapped=0x0) returned 1 [0112.305] CloseHandle (hObject=0x37c) returned 1 [0112.352] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e790, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0112.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0112.352] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ecc0 | out: lpFileInformation=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0112.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0112.352] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\BntE 0fjbg.png", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\BntE 0fjbg.png", lpFilePart=0x0) returned 0x30 [0112.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0112.352] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\BntE 0fjbg.png" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\bnte 0fjbg.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.354] GetFileType (hFile=0x37c) returned 0x1 [0112.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0112.354] GetFileType (hFile=0x37c) returned 0x1 [0112.354] WriteFile (in: hFile=0x37c, lpBuffer=0x26c1c10*, nNumberOfBytesToWrite=0x3fa0, lpNumberOfBytesWritten=0x19ec6c, lpOverlapped=0x0 | out: lpBuffer=0x26c1c10*, lpNumberOfBytesWritten=0x19ec6c*=0x3fa0, lpOverlapped=0x0) returned 1 [0112.355] CloseHandle (hObject=0x37c) returned 1 [0112.357] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\BntE 0fjbg.png", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\BntE 0fjbg.png", lpFilePart=0x0) returned 0x30 [0112.357] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\BntE 0fjbg.png.spybuster", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\BntE 0fjbg.png.spybuster", lpFilePart=0x0) returned 0x3a [0112.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec50) returned 1 [0112.357] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\BntE 0fjbg.png" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\bnte 0fjbg.png"), fInfoLevelId=0x0, lpFileInformation=0x19eccc | out: lpFileInformation=0x19eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x739d0fa0, ftCreationTime.dwHighDateTime=0x1d5e0f5, ftLastAccessTime.dwLowDateTime=0x2cd0f830, ftLastAccessTime.dwHighDateTime=0x1d5e883, ftLastWriteTime.dwLowDateTime=0xb83ab064, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x3fa0)) returned 1 [0112.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0112.357] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\BntE 0fjbg.png" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\bnte 0fjbg.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\BntE 0fjbg.png.spybuster" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\bnte 0fjbg.png.spybuster")) returned 1 [0112.358] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\cjy5yOqpzfy.jpg", nBufferLength=0x105, lpBuffer=0x19e68c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\cjy5yOqpzfy.jpg", lpFilePart=0x0) returned 0x31 [0112.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0112.358] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\cjy5yOqpzfy.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\cjy5yoqpzfy.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.358] GetFileType (hFile=0x37c) returned 0x1 [0112.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0112.358] GetFileType (hFile=0x37c) returned 0x1 [0112.358] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19eccc | out: lpFileSizeHigh=0x19eccc*=0x0) returned 0x980d [0112.358] ReadFile (in: hFile=0x37c, lpBuffer=0x26c6060, nNumberOfBytesToRead=0x980d, lpNumberOfBytesRead=0x19ec78, lpOverlapped=0x0 | out: lpBuffer=0x26c6060*, lpNumberOfBytesRead=0x19ec78*=0x980d, lpOverlapped=0x0) returned 1 [0112.360] CloseHandle (hObject=0x37c) returned 1 [0112.390] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e790, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0112.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0112.390] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ecc0 | out: lpFileInformation=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0112.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0112.391] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\cjy5yOqpzfy.jpg", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\cjy5yOqpzfy.jpg", lpFilePart=0x0) returned 0x31 [0112.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0112.391] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\cjy5yOqpzfy.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\cjy5yoqpzfy.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.392] GetFileType (hFile=0x37c) returned 0x1 [0112.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0112.392] GetFileType (hFile=0x37c) returned 0x1 [0112.392] WriteFile (in: hFile=0x37c, lpBuffer=0x27427f8*, nNumberOfBytesToWrite=0x9810, lpNumberOfBytesWritten=0x19ec6c, lpOverlapped=0x0 | out: lpBuffer=0x27427f8*, lpNumberOfBytesWritten=0x19ec6c*=0x9810, lpOverlapped=0x0) returned 1 [0112.394] CloseHandle (hObject=0x37c) returned 1 [0112.405] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\cjy5yOqpzfy.jpg", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\cjy5yOqpzfy.jpg", lpFilePart=0x0) returned 0x31 [0112.405] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\cjy5yOqpzfy.jpg.spybuster", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\cjy5yOqpzfy.jpg.spybuster", lpFilePart=0x0) returned 0x3b [0112.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec50) returned 1 [0112.405] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\cjy5yOqpzfy.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\cjy5yoqpzfy.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19eccc | out: lpFileInformation=0x19eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61f06d70, ftCreationTime.dwHighDateTime=0x1d5eb08, ftLastAccessTime.dwLowDateTime=0x3731ebd0, ftLastAccessTime.dwHighDateTime=0x1d5ea41, ftLastWriteTime.dwLowDateTime=0xb842f9ac, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x9810)) returned 1 [0112.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0112.405] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\cjy5yOqpzfy.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\cjy5yoqpzfy.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\cjy5yOqpzfy.jpg.spybuster" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\cjy5yoqpzfy.jpg.spybuster")) returned 1 [0112.406] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\crBLP3WmGf8pH9.png", nBufferLength=0x105, lpBuffer=0x19e68c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\crBLP3WmGf8pH9.png", lpFilePart=0x0) returned 0x34 [0112.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0112.406] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\crBLP3WmGf8pH9.png" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\crblp3wmgf8ph9.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.406] GetFileType (hFile=0x37c) returned 0x1 [0112.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0112.407] GetFileType (hFile=0x37c) returned 0x1 [0112.407] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19eccc | out: lpFileSizeHigh=0x19eccc*=0x0) returned 0x1132 [0112.407] ReadFile (in: hFile=0x37c, lpBuffer=0x274c4c8, nNumberOfBytesToRead=0x1132, lpNumberOfBytesRead=0x19ec78, lpOverlapped=0x0 | out: lpBuffer=0x274c4c8*, lpNumberOfBytesRead=0x19ec78*=0x1132, lpOverlapped=0x0) returned 1 [0112.408] CloseHandle (hObject=0x37c) returned 1 [0112.433] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e790, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0112.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0112.433] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ecc0 | out: lpFileInformation=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0112.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0112.433] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\crBLP3WmGf8pH9.png", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\crBLP3WmGf8pH9.png", lpFilePart=0x0) returned 0x34 [0112.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0112.434] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\crBLP3WmGf8pH9.png" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\crblp3wmgf8ph9.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.435] GetFileType (hFile=0x37c) returned 0x1 [0112.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0112.435] GetFileType (hFile=0x37c) returned 0x1 [0112.435] WriteFile (in: hFile=0x37c, lpBuffer=0x279e8f4*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x19ec6c, lpOverlapped=0x0 | out: lpBuffer=0x279e8f4*, lpNumberOfBytesWritten=0x19ec6c*=0x1140, lpOverlapped=0x0) returned 1 [0112.436] CloseHandle (hObject=0x37c) returned 1 [0112.438] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\crBLP3WmGf8pH9.png", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\crBLP3WmGf8pH9.png", lpFilePart=0x0) returned 0x34 [0112.438] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\crBLP3WmGf8pH9.png.spybuster", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\crBLP3WmGf8pH9.png.spybuster", lpFilePart=0x0) returned 0x3e [0112.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec50) returned 1 [0112.438] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\crBLP3WmGf8pH9.png" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\crblp3wmgf8ph9.png"), fInfoLevelId=0x0, lpFileInformation=0x19eccc | out: lpFileInformation=0x19eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd924e00, ftCreationTime.dwHighDateTime=0x1d5e564, ftLastAccessTime.dwLowDateTime=0xa8305060, ftLastAccessTime.dwHighDateTime=0x1d5eb4f, ftLastWriteTime.dwLowDateTime=0xb8469b85, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x1140)) returned 1 [0112.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0112.438] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\crBLP3WmGf8pH9.png" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\crblp3wmgf8ph9.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\crBLP3WmGf8pH9.png.spybuster" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\crblp3wmgf8ph9.png.spybuster")) returned 1 [0112.439] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\essUL5txxsQxH SCRUh.bmp", nBufferLength=0x105, lpBuffer=0x19e68c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\essUL5txxsQxH SCRUh.bmp", lpFilePart=0x0) returned 0x39 [0112.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0112.439] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\essUL5txxsQxH SCRUh.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\essul5txxsqxh scruh.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.439] GetFileType (hFile=0x37c) returned 0x1 [0112.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0112.440] GetFileType (hFile=0x37c) returned 0x1 [0112.440] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19eccc | out: lpFileSizeHigh=0x19eccc*=0x0) returned 0x1811c [0112.440] ReadFile (in: hFile=0x37c, lpBuffer=0x3787bd8, nNumberOfBytesToRead=0x1811c, lpNumberOfBytesRead=0x19ec78, lpOverlapped=0x0 | out: lpBuffer=0x3787bd8*, lpNumberOfBytesRead=0x19ec78*=0x1811c, lpOverlapped=0x0) returned 1 [0112.441] CloseHandle (hObject=0x37c) returned 1 [0112.468] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e790, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0112.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0112.468] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ecc0 | out: lpFileInformation=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0112.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0112.468] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\essUL5txxsQxH SCRUh.bmp", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\essUL5txxsQxH SCRUh.bmp", lpFilePart=0x0) returned 0x39 [0112.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0112.468] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\essUL5txxsQxH SCRUh.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\essul5txxsqxh scruh.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.470] GetFileType (hFile=0x37c) returned 0x1 [0112.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0112.471] GetFileType (hFile=0x37c) returned 0x1 [0112.471] WriteFile (in: hFile=0x37c, lpBuffer=0x38001b0*, nNumberOfBytesToWrite=0x18120, lpNumberOfBytesWritten=0x19ec6c, lpOverlapped=0x0 | out: lpBuffer=0x38001b0*, lpNumberOfBytesWritten=0x19ec6c*=0x18120, lpOverlapped=0x0) returned 1 [0112.473] CloseHandle (hObject=0x37c) returned 1 [0112.486] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\essUL5txxsQxH SCRUh.bmp", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\essUL5txxsQxH SCRUh.bmp", lpFilePart=0x0) returned 0x39 [0112.486] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\essUL5txxsQxH SCRUh.bmp.spybuster", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\essUL5txxsQxH SCRUh.bmp.spybuster", lpFilePart=0x0) returned 0x43 [0112.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec50) returned 1 [0112.486] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\essUL5txxsQxH SCRUh.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\essul5txxsqxh scruh.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19eccc | out: lpFileInformation=0x19eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd19cf6e0, ftCreationTime.dwHighDateTime=0x1d5ee35, ftLastAccessTime.dwLowDateTime=0xe1a70020, ftLastAccessTime.dwHighDateTime=0x1d5e5e4, ftLastWriteTime.dwLowDateTime=0xb84dc2d6, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x18120)) returned 1 [0112.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0112.486] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\essUL5txxsQxH SCRUh.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\essul5txxsqxh scruh.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\essUL5txxsQxH SCRUh.bmp.spybuster" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\essul5txxsqxh scruh.bmp.spybuster")) returned 1 [0112.487] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\WYuGxfrkEC.bmp", nBufferLength=0x105, lpBuffer=0x19e68c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\WYuGxfrkEC.bmp", lpFilePart=0x0) returned 0x30 [0112.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0112.487] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\WYuGxfrkEC.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\wyugxfrkec.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.487] GetFileType (hFile=0x37c) returned 0x1 [0112.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0112.487] GetFileType (hFile=0x37c) returned 0x1 [0112.488] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19eccc | out: lpFileSizeHigh=0x19eccc*=0x0) returned 0x16aed [0112.488] ReadFile (in: hFile=0x37c, lpBuffer=0x38182f0, nNumberOfBytesToRead=0x16aed, lpNumberOfBytesRead=0x19ec78, lpOverlapped=0x0 | out: lpBuffer=0x38182f0*, lpNumberOfBytesRead=0x19ec78*=0x16aed, lpOverlapped=0x0) returned 1 [0112.489] CloseHandle (hObject=0x37c) returned 1 [0112.515] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e790, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0112.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0112.515] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ecc0 | out: lpFileInformation=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0112.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0112.515] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\WYuGxfrkEC.bmp", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\WYuGxfrkEC.bmp", lpFilePart=0x0) returned 0x30 [0112.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0112.515] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\WYuGxfrkEC.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\wyugxfrkec.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.517] GetFileType (hFile=0x37c) returned 0x1 [0112.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0112.517] GetFileType (hFile=0x37c) returned 0x1 [0112.517] WriteFile (in: hFile=0x37c, lpBuffer=0x38899e0*, nNumberOfBytesToWrite=0x16af0, lpNumberOfBytesWritten=0x19ec6c, lpOverlapped=0x0 | out: lpBuffer=0x38899e0*, lpNumberOfBytesWritten=0x19ec6c*=0x16af0, lpOverlapped=0x0) returned 1 [0112.520] CloseHandle (hObject=0x37c) returned 1 [0112.532] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\WYuGxfrkEC.bmp", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\WYuGxfrkEC.bmp", lpFilePart=0x0) returned 0x30 [0112.532] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\WYuGxfrkEC.bmp.spybuster", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\WYuGxfrkEC.bmp.spybuster", lpFilePart=0x0) returned 0x3a [0112.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec50) returned 1 [0112.532] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\WYuGxfrkEC.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\wyugxfrkec.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19eccc | out: lpFileInformation=0x19eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x246fb640, ftCreationTime.dwHighDateTime=0x1d5e211, ftLastAccessTime.dwLowDateTime=0xf1fcad30, ftLastAccessTime.dwHighDateTime=0x1d5e7ab, ftLastWriteTime.dwLowDateTime=0xb854ea94, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x16af0)) returned 1 [0112.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0112.532] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\WYuGxfrkEC.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\wyugxfrkec.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Qi7 B4zT\\WYuGxfrkEC.bmp.spybuster" (normalized: "c:\\users\\fd1hvy\\pictures\\qi7 b4zt\\wyugxfrkec.bmp.spybuster")) returned 1 [0112.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed24) returned 1 [0112.533] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", nBufferLength=0x105, lpBuffer=0x19e7d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", lpFilePart=0x0) returned 0x27 [0112.533] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*", lpFindFileData=0x19ea4c | out: lpFindFileData=0x19ea4c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b9b8 [0112.534] FindNextFileW (in: hFindFile=0x77b9b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.534] FindNextFileW (in: hFindFile=0x77b9b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0112.534] FindNextFileW (in: hFindFile=0x77b9b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.534] FindClose (in: hFindFile=0x77b9b8 | out: hFindFile=0x77b9b8) returned 1 [0112.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ece0) returned 1 [0112.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecec) returned 1 [0112.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed24) returned 1 [0112.535] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", nBufferLength=0x105, lpBuffer=0x19e7d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", lpFilePart=0x0) returned 0x27 [0112.535] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*", lpFindFileData=0x19ea4c | out: lpFindFileData=0x19ea4c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77bb78 [0112.535] FindNextFileW (in: hFindFile=0x77bb78, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.535] FindNextFileW (in: hFindFile=0x77bb78, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0112.535] FindNextFileW (in: hFindFile=0x77bb78, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0112.535] FindClose (in: hFindFile=0x77bb78 | out: hFindFile=0x77bb78) returned 1 [0112.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ece0) returned 1 [0112.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecec) returned 1 [0112.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed98) returned 1 [0112.536] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music", nBufferLength=0x105, lpBuffer=0x19e84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music", lpFilePart=0x0) returned 0x15 [0112.536] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\*", lpFindFileData=0x19eac0 | out: lpFindFileData=0x19eac0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe65d49e1, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe65d49e1, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77bbf8 [0112.536] FindNextFileW (in: hFindFile=0x77bbf8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe65d49e1, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe65d49e1, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.536] FindNextFileW (in: hFindFile=0x77bbf8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x141aa440, ftCreationTime.dwHighDateTime=0x1d5e783, ftLastAccessTime.dwLowDateTime=0x17d046b0, ftLastAccessTime.dwHighDateTime=0x1d5e569, ftLastWriteTime.dwLowDateTime=0x17d046b0, ftLastWriteTime.dwHighDateTime=0x1d5e569, nFileSizeHigh=0x0, nFileSizeLow=0x1693f, dwReserved0=0x0, dwReserved1=0x0, cFileName="bWeUUE096Si.mp3", cAlternateFileName="BWEUUE~1.MP3")) returned 1 [0112.536] FindNextFileW (in: hFindFile=0x77bbf8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4409f518, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4409f518, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0112.537] FindNextFileW (in: hFindFile=0x77bbf8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8e60200, ftCreationTime.dwHighDateTime=0x1d5ee7a, ftLastAccessTime.dwLowDateTime=0x534e0cf0, ftLastAccessTime.dwHighDateTime=0x1d5e694, ftLastWriteTime.dwLowDateTime=0x534e0cf0, ftLastWriteTime.dwHighDateTime=0x1d5e694, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="K5yHR0Q9Y EL2_vro", cAlternateFileName="K5YHR0~1")) returned 1 [0112.537] FindNextFileW (in: hFindFile=0x77bbf8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35fc52e0, ftCreationTime.dwHighDateTime=0x1d5f0a0, ftLastAccessTime.dwLowDateTime=0x86057660, ftLastAccessTime.dwHighDateTime=0x1d5e117, ftLastWriteTime.dwLowDateTime=0x86057660, ftLastWriteTime.dwHighDateTime=0x1d5e117, nFileSizeHigh=0x0, nFileSizeLow=0x48a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="k9p8wKkT2-.wav", cAlternateFileName="K9P8WK~1.WAV")) returned 1 [0112.537] FindNextFileW (in: hFindFile=0x77bbf8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99abebf0, ftCreationTime.dwHighDateTime=0x1d5eabc, ftLastAccessTime.dwLowDateTime=0xb59d6b0, ftLastAccessTime.dwHighDateTime=0x1d5e291, ftLastWriteTime.dwLowDateTime=0xb59d6b0, ftLastWriteTime.dwHighDateTime=0x1d5e291, nFileSizeHigh=0x0, nFileSizeLow=0xb5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="kZwS4BzNNn8a_nS6ix.m4a", cAlternateFileName="KZWS4B~1.M4A")) returned 1 [0112.537] FindNextFileW (in: hFindFile=0x77bbf8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b7d99e0, ftCreationTime.dwHighDateTime=0x1d5ed89, ftLastAccessTime.dwLowDateTime=0x57c58720, ftLastAccessTime.dwHighDateTime=0x1d5e1b9, ftLastWriteTime.dwLowDateTime=0x57c58720, ftLastWriteTime.dwHighDateTime=0x1d5e1b9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q7qIPzWWSjw5RC5V", cAlternateFileName="Q7QIPZ~1")) returned 1 [0112.537] FindNextFileW (in: hFindFile=0x77bbf8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3638c320, ftCreationTime.dwHighDateTime=0x1d5e57d, ftLastAccessTime.dwLowDateTime=0x1b2320f0, ftLastAccessTime.dwHighDateTime=0x1d5e5c6, ftLastWriteTime.dwLowDateTime=0x1b2320f0, ftLastWriteTime.dwHighDateTime=0x1d5e5c6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SqWyO_nRxxI4LNX", cAlternateFileName="SQWYO_~1")) returned 1 [0112.537] FindNextFileW (in: hFindFile=0x77bbf8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3638c320, ftCreationTime.dwHighDateTime=0x1d5e57d, ftLastAccessTime.dwLowDateTime=0x1b2320f0, ftLastAccessTime.dwHighDateTime=0x1d5e5c6, ftLastWriteTime.dwLowDateTime=0x1b2320f0, ftLastWriteTime.dwHighDateTime=0x1d5e5c6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SqWyO_nRxxI4LNX", cAlternateFileName="SQWYO_~1")) returned 0 [0112.538] FindClose (in: hFindFile=0x77bbf8 | out: hFindFile=0x77bbf8) returned 1 [0112.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed54) returned 1 [0112.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed60) returned 1 [0112.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed98) returned 1 [0112.538] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music", nBufferLength=0x105, lpBuffer=0x19e84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music", lpFilePart=0x0) returned 0x15 [0112.538] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\*", lpFindFileData=0x19eac0 | out: lpFindFileData=0x19eac0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe65d49e1, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe65d49e1, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b778 [0112.538] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe65d49e1, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe65d49e1, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.538] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x141aa440, ftCreationTime.dwHighDateTime=0x1d5e783, ftLastAccessTime.dwLowDateTime=0x17d046b0, ftLastAccessTime.dwHighDateTime=0x1d5e569, ftLastWriteTime.dwLowDateTime=0x17d046b0, ftLastWriteTime.dwHighDateTime=0x1d5e569, nFileSizeHigh=0x0, nFileSizeLow=0x1693f, dwReserved0=0x0, dwReserved1=0x0, cFileName="bWeUUE096Si.mp3", cAlternateFileName="BWEUUE~1.MP3")) returned 1 [0112.538] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4409f518, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4409f518, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0112.539] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8e60200, ftCreationTime.dwHighDateTime=0x1d5ee7a, ftLastAccessTime.dwLowDateTime=0x534e0cf0, ftLastAccessTime.dwHighDateTime=0x1d5e694, ftLastWriteTime.dwLowDateTime=0x534e0cf0, ftLastWriteTime.dwHighDateTime=0x1d5e694, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="K5yHR0Q9Y EL2_vro", cAlternateFileName="K5YHR0~1")) returned 1 [0112.539] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35fc52e0, ftCreationTime.dwHighDateTime=0x1d5f0a0, ftLastAccessTime.dwLowDateTime=0x86057660, ftLastAccessTime.dwHighDateTime=0x1d5e117, ftLastWriteTime.dwLowDateTime=0x86057660, ftLastWriteTime.dwHighDateTime=0x1d5e117, nFileSizeHigh=0x0, nFileSizeLow=0x48a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="k9p8wKkT2-.wav", cAlternateFileName="K9P8WK~1.WAV")) returned 1 [0112.539] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99abebf0, ftCreationTime.dwHighDateTime=0x1d5eabc, ftLastAccessTime.dwLowDateTime=0xb59d6b0, ftLastAccessTime.dwHighDateTime=0x1d5e291, ftLastWriteTime.dwLowDateTime=0xb59d6b0, ftLastWriteTime.dwHighDateTime=0x1d5e291, nFileSizeHigh=0x0, nFileSizeLow=0xb5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="kZwS4BzNNn8a_nS6ix.m4a", cAlternateFileName="KZWS4B~1.M4A")) returned 1 [0112.539] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b7d99e0, ftCreationTime.dwHighDateTime=0x1d5ed89, ftLastAccessTime.dwLowDateTime=0x57c58720, ftLastAccessTime.dwHighDateTime=0x1d5e1b9, ftLastWriteTime.dwLowDateTime=0x57c58720, ftLastWriteTime.dwHighDateTime=0x1d5e1b9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q7qIPzWWSjw5RC5V", cAlternateFileName="Q7QIPZ~1")) returned 1 [0112.539] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3638c320, ftCreationTime.dwHighDateTime=0x1d5e57d, ftLastAccessTime.dwLowDateTime=0x1b2320f0, ftLastAccessTime.dwHighDateTime=0x1d5e5c6, ftLastWriteTime.dwLowDateTime=0x1b2320f0, ftLastWriteTime.dwHighDateTime=0x1d5e5c6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SqWyO_nRxxI4LNX", cAlternateFileName="SQWYO_~1")) returned 1 [0112.539] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.539] FindClose (in: hFindFile=0x77b778 | out: hFindFile=0x77b778) returned 1 [0112.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed54) returned 1 [0112.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed60) returned 1 [0112.540] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\bWeUUE096Si.mp3", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\bWeUUE096Si.mp3", lpFilePart=0x0) returned 0x25 [0112.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0112.540] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\bWeUUE096Si.mp3" (normalized: "c:\\users\\fd1hvy\\music\\bweuue096si.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.540] GetFileType (hFile=0x37c) returned 0x1 [0112.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0112.540] GetFileType (hFile=0x37c) returned 0x1 [0112.540] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x1693f [0112.540] ReadFile (in: hFile=0x37c, lpBuffer=0x38a04f0, nNumberOfBytesToRead=0x1693f, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x38a04f0*, lpNumberOfBytesRead=0x19ecec*=0x1693f, lpOverlapped=0x0) returned 1 [0112.541] CloseHandle (hObject=0x37c) returned 1 [0112.580] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0112.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0112.580] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0112.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0112.580] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\bWeUUE096Si.mp3", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\bWeUUE096Si.mp3", lpFilePart=0x0) returned 0x25 [0112.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0112.580] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\bWeUUE096Si.mp3" (normalized: "c:\\users\\fd1hvy\\music\\bweuue096si.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.582] GetFileType (hFile=0x37c) returned 0x1 [0112.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0112.582] GetFileType (hFile=0x37c) returned 0x1 [0112.582] WriteFile (in: hFile=0x37c, lpBuffer=0x3911370*, nNumberOfBytesToWrite=0x16940, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x3911370*, lpNumberOfBytesWritten=0x19ece0*=0x16940, lpOverlapped=0x0) returned 1 [0112.584] CloseHandle (hObject=0x37c) returned 1 [0112.594] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\bWeUUE096Si.mp3", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\bWeUUE096Si.mp3", lpFilePart=0x0) returned 0x25 [0112.594] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\bWeUUE096Si.mp3.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\bWeUUE096Si.mp3.spybuster", lpFilePart=0x0) returned 0x2f [0112.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0112.595] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\bWeUUE096Si.mp3" (normalized: "c:\\users\\fd1hvy\\music\\bweuue096si.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x141aa440, ftCreationTime.dwHighDateTime=0x1d5e783, ftLastAccessTime.dwLowDateTime=0x17d046b0, ftLastAccessTime.dwHighDateTime=0x1d5e569, ftLastWriteTime.dwLowDateTime=0xb85e8ecc, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x16940)) returned 1 [0112.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0112.595] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\bWeUUE096Si.mp3" (normalized: "c:\\users\\fd1hvy\\music\\bweuue096si.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\bWeUUE096Si.mp3.spybuster" (normalized: "c:\\users\\fd1hvy\\music\\bweuue096si.mp3.spybuster")) returned 1 [0112.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed24) returned 1 [0112.596] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro", nBufferLength=0x105, lpBuffer=0x19e7d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro", lpFilePart=0x0) returned 0x27 [0112.596] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\*", lpFindFileData=0x19ea4c | out: lpFindFileData=0x19ea4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8e60200, ftCreationTime.dwHighDateTime=0x1d5ee7a, ftLastAccessTime.dwLowDateTime=0x534e0cf0, ftLastAccessTime.dwHighDateTime=0x1d5e694, ftLastWriteTime.dwLowDateTime=0x534e0cf0, ftLastWriteTime.dwHighDateTime=0x1d5e694, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77bab8 [0112.596] FindNextFileW (in: hFindFile=0x77bab8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8e60200, ftCreationTime.dwHighDateTime=0x1d5ee7a, ftLastAccessTime.dwLowDateTime=0x534e0cf0, ftLastAccessTime.dwHighDateTime=0x1d5e694, ftLastWriteTime.dwLowDateTime=0x534e0cf0, ftLastWriteTime.dwHighDateTime=0x1d5e694, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.597] FindNextFileW (in: hFindFile=0x77bab8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb124d8a0, ftCreationTime.dwHighDateTime=0x1d5ea21, ftLastAccessTime.dwLowDateTime=0x746c1be0, ftLastAccessTime.dwHighDateTime=0x1d5e589, ftLastWriteTime.dwLowDateTime=0x746c1be0, ftLastWriteTime.dwHighDateTime=0x1d5e589, nFileSizeHigh=0x0, nFileSizeLow=0x499e, dwReserved0=0x0, dwReserved1=0x0, cFileName="1n6H 5.wav", cAlternateFileName="1N6H5~1.WAV")) returned 1 [0112.597] FindNextFileW (in: hFindFile=0x77bab8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x257b07b0, ftCreationTime.dwHighDateTime=0x1d5e301, ftLastAccessTime.dwLowDateTime=0x4e81bca0, ftLastAccessTime.dwHighDateTime=0x1d5eb1a, ftLastWriteTime.dwLowDateTime=0x4e81bca0, ftLastWriteTime.dwHighDateTime=0x1d5eb1a, nFileSizeHigh=0x0, nFileSizeLow=0x91f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="1wQWiq_Mzo.mp3", cAlternateFileName="1WQWIQ~1.MP3")) returned 1 [0112.597] FindNextFileW (in: hFindFile=0x77bab8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccdfa180, ftCreationTime.dwHighDateTime=0x1d5efd8, ftLastAccessTime.dwLowDateTime=0x6ba1ad90, ftLastAccessTime.dwHighDateTime=0x1d5eaac, ftLastWriteTime.dwLowDateTime=0x6ba1ad90, ftLastWriteTime.dwHighDateTime=0x1d5eaac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AudnE9qrl5c", cAlternateFileName="AUDNE9~1")) returned 1 [0112.597] FindNextFileW (in: hFindFile=0x77bab8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc349f60, ftCreationTime.dwHighDateTime=0x1d5ed8b, ftLastAccessTime.dwLowDateTime=0xc9181c30, ftLastAccessTime.dwHighDateTime=0x1d5ecf9, ftLastWriteTime.dwLowDateTime=0xc9181c30, ftLastWriteTime.dwHighDateTime=0x1d5ecf9, nFileSizeHigh=0x0, nFileSizeLow=0xee9, dwReserved0=0x0, dwReserved1=0x0, cFileName="cJtm.wav", cAlternateFileName="")) returned 1 [0112.597] FindNextFileW (in: hFindFile=0x77bab8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24d36010, ftCreationTime.dwHighDateTime=0x1d5f075, ftLastAccessTime.dwLowDateTime=0xfb097be0, ftLastAccessTime.dwHighDateTime=0x1d5ec71, ftLastWriteTime.dwLowDateTime=0xfb097be0, ftLastWriteTime.dwHighDateTime=0x1d5ec71, nFileSizeHigh=0x0, nFileSizeLow=0x2521, dwReserved0=0x0, dwReserved1=0x0, cFileName="ffJAjuViZ3I5RLW.wav", cAlternateFileName="FFJAJU~1.WAV")) returned 1 [0112.597] FindNextFileW (in: hFindFile=0x77bab8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82345590, ftCreationTime.dwHighDateTime=0x1d5e506, ftLastAccessTime.dwLowDateTime=0x66288830, ftLastAccessTime.dwHighDateTime=0x1d5ef42, ftLastWriteTime.dwLowDateTime=0x66288830, ftLastWriteTime.dwHighDateTime=0x1d5ef42, nFileSizeHigh=0x0, nFileSizeLow=0x69b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="rvaHv3w8EJL0.wav", cAlternateFileName="RVAHV3~1.WAV")) returned 1 [0112.598] FindNextFileW (in: hFindFile=0x77bab8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc5309b80, ftCreationTime.dwHighDateTime=0x1d5e527, ftLastAccessTime.dwLowDateTime=0xcb12c080, ftLastAccessTime.dwHighDateTime=0x1d5e763, ftLastWriteTime.dwLowDateTime=0xcb12c080, ftLastWriteTime.dwHighDateTime=0x1d5e763, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zlzFdg_dAeB37K", cAlternateFileName="ZLZFDG~1")) returned 1 [0112.598] FindNextFileW (in: hFindFile=0x77bab8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc5309b80, ftCreationTime.dwHighDateTime=0x1d5e527, ftLastAccessTime.dwLowDateTime=0xcb12c080, ftLastAccessTime.dwHighDateTime=0x1d5e763, ftLastWriteTime.dwLowDateTime=0xcb12c080, ftLastWriteTime.dwHighDateTime=0x1d5e763, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zlzFdg_dAeB37K", cAlternateFileName="ZLZFDG~1")) returned 0 [0112.598] FindClose (in: hFindFile=0x77bab8 | out: hFindFile=0x77bab8) returned 1 [0112.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ece0) returned 1 [0112.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecec) returned 1 [0112.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed24) returned 1 [0112.598] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro", nBufferLength=0x105, lpBuffer=0x19e7d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro", lpFilePart=0x0) returned 0x27 [0112.598] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\*", lpFindFileData=0x19ea4c | out: lpFindFileData=0x19ea4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8e60200, ftCreationTime.dwHighDateTime=0x1d5ee7a, ftLastAccessTime.dwLowDateTime=0x534e0cf0, ftLastAccessTime.dwHighDateTime=0x1d5e694, ftLastWriteTime.dwLowDateTime=0x534e0cf0, ftLastWriteTime.dwHighDateTime=0x1d5e694, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77bcb8 [0112.599] FindNextFileW (in: hFindFile=0x77bcb8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8e60200, ftCreationTime.dwHighDateTime=0x1d5ee7a, ftLastAccessTime.dwLowDateTime=0x534e0cf0, ftLastAccessTime.dwHighDateTime=0x1d5e694, ftLastWriteTime.dwLowDateTime=0x534e0cf0, ftLastWriteTime.dwHighDateTime=0x1d5e694, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.599] FindNextFileW (in: hFindFile=0x77bcb8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb124d8a0, ftCreationTime.dwHighDateTime=0x1d5ea21, ftLastAccessTime.dwLowDateTime=0x746c1be0, ftLastAccessTime.dwHighDateTime=0x1d5e589, ftLastWriteTime.dwLowDateTime=0x746c1be0, ftLastWriteTime.dwHighDateTime=0x1d5e589, nFileSizeHigh=0x0, nFileSizeLow=0x499e, dwReserved0=0x0, dwReserved1=0x0, cFileName="1n6H 5.wav", cAlternateFileName="1N6H5~1.WAV")) returned 1 [0112.599] FindNextFileW (in: hFindFile=0x77bcb8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x257b07b0, ftCreationTime.dwHighDateTime=0x1d5e301, ftLastAccessTime.dwLowDateTime=0x4e81bca0, ftLastAccessTime.dwHighDateTime=0x1d5eb1a, ftLastWriteTime.dwLowDateTime=0x4e81bca0, ftLastWriteTime.dwHighDateTime=0x1d5eb1a, nFileSizeHigh=0x0, nFileSizeLow=0x91f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="1wQWiq_Mzo.mp3", cAlternateFileName="1WQWIQ~1.MP3")) returned 1 [0112.600] FindNextFileW (in: hFindFile=0x77bcb8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccdfa180, ftCreationTime.dwHighDateTime=0x1d5efd8, ftLastAccessTime.dwLowDateTime=0x6ba1ad90, ftLastAccessTime.dwHighDateTime=0x1d5eaac, ftLastWriteTime.dwLowDateTime=0x6ba1ad90, ftLastWriteTime.dwHighDateTime=0x1d5eaac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AudnE9qrl5c", cAlternateFileName="AUDNE9~1")) returned 1 [0112.600] FindNextFileW (in: hFindFile=0x77bcb8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc349f60, ftCreationTime.dwHighDateTime=0x1d5ed8b, ftLastAccessTime.dwLowDateTime=0xc9181c30, ftLastAccessTime.dwHighDateTime=0x1d5ecf9, ftLastWriteTime.dwLowDateTime=0xc9181c30, ftLastWriteTime.dwHighDateTime=0x1d5ecf9, nFileSizeHigh=0x0, nFileSizeLow=0xee9, dwReserved0=0x0, dwReserved1=0x0, cFileName="cJtm.wav", cAlternateFileName="")) returned 1 [0112.600] FindNextFileW (in: hFindFile=0x77bcb8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24d36010, ftCreationTime.dwHighDateTime=0x1d5f075, ftLastAccessTime.dwLowDateTime=0xfb097be0, ftLastAccessTime.dwHighDateTime=0x1d5ec71, ftLastWriteTime.dwLowDateTime=0xfb097be0, ftLastWriteTime.dwHighDateTime=0x1d5ec71, nFileSizeHigh=0x0, nFileSizeLow=0x2521, dwReserved0=0x0, dwReserved1=0x0, cFileName="ffJAjuViZ3I5RLW.wav", cAlternateFileName="FFJAJU~1.WAV")) returned 1 [0112.600] FindNextFileW (in: hFindFile=0x77bcb8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82345590, ftCreationTime.dwHighDateTime=0x1d5e506, ftLastAccessTime.dwLowDateTime=0x66288830, ftLastAccessTime.dwHighDateTime=0x1d5ef42, ftLastWriteTime.dwLowDateTime=0x66288830, ftLastWriteTime.dwHighDateTime=0x1d5ef42, nFileSizeHigh=0x0, nFileSizeLow=0x69b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="rvaHv3w8EJL0.wav", cAlternateFileName="RVAHV3~1.WAV")) returned 1 [0112.600] FindNextFileW (in: hFindFile=0x77bcb8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc5309b80, ftCreationTime.dwHighDateTime=0x1d5e527, ftLastAccessTime.dwLowDateTime=0xcb12c080, ftLastAccessTime.dwHighDateTime=0x1d5e763, ftLastWriteTime.dwLowDateTime=0xcb12c080, ftLastWriteTime.dwHighDateTime=0x1d5e763, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zlzFdg_dAeB37K", cAlternateFileName="ZLZFDG~1")) returned 1 [0112.601] FindNextFileW (in: hFindFile=0x77bcb8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.601] FindClose (in: hFindFile=0x77bcb8 | out: hFindFile=0x77bcb8) returned 1 [0112.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ece0) returned 1 [0112.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecec) returned 1 [0112.601] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\1wQWiq_Mzo.mp3", nBufferLength=0x105, lpBuffer=0x19e68c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\1wQWiq_Mzo.mp3", lpFilePart=0x0) returned 0x36 [0112.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0112.601] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\1wQWiq_Mzo.mp3" (normalized: "c:\\users\\fd1hvy\\music\\k5yhr0q9y el2_vro\\1wqwiq_mzo.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.601] GetFileType (hFile=0x37c) returned 0x1 [0112.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0112.601] GetFileType (hFile=0x37c) returned 0x1 [0112.601] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19eccc | out: lpFileSizeHigh=0x19eccc*=0x0) returned 0x91f7 [0112.602] ReadFile (in: hFile=0x37c, lpBuffer=0x268805c, nNumberOfBytesToRead=0x91f7, lpNumberOfBytesRead=0x19ec78, lpOverlapped=0x0 | out: lpBuffer=0x268805c*, lpNumberOfBytesRead=0x19ec78*=0x91f7, lpOverlapped=0x0) returned 1 [0112.603] CloseHandle (hObject=0x37c) returned 1 [0112.648] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e790, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0112.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0112.648] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ecc0 | out: lpFileInformation=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0112.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0112.649] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\1wQWiq_Mzo.mp3", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\1wQWiq_Mzo.mp3", lpFilePart=0x0) returned 0x36 [0112.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0112.649] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\1wQWiq_Mzo.mp3" (normalized: "c:\\users\\fd1hvy\\music\\k5yhr0q9y el2_vro\\1wqwiq_mzo.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.650] GetFileType (hFile=0x37c) returned 0x1 [0112.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0112.651] GetFileType (hFile=0x37c) returned 0x1 [0112.651] WriteFile (in: hFile=0x37c, lpBuffer=0x27029a4*, nNumberOfBytesToWrite=0x9200, lpNumberOfBytesWritten=0x19ec6c, lpOverlapped=0x0 | out: lpBuffer=0x27029a4*, lpNumberOfBytesWritten=0x19ec6c*=0x9200, lpOverlapped=0x0) returned 1 [0112.652] CloseHandle (hObject=0x37c) returned 1 [0112.655] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\1wQWiq_Mzo.mp3", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\1wQWiq_Mzo.mp3", lpFilePart=0x0) returned 0x36 [0112.655] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\1wQWiq_Mzo.mp3.spybuster", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\1wQWiq_Mzo.mp3.spybuster", lpFilePart=0x0) returned 0x40 [0112.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec50) returned 1 [0112.655] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\1wQWiq_Mzo.mp3" (normalized: "c:\\users\\fd1hvy\\music\\k5yhr0q9y el2_vro\\1wqwiq_mzo.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19eccc | out: lpFileInformation=0x19eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x257b07b0, ftCreationTime.dwHighDateTime=0x1d5e301, ftLastAccessTime.dwLowDateTime=0x4e81bca0, ftLastAccessTime.dwHighDateTime=0x1d5eb1a, ftLastWriteTime.dwLowDateTime=0xb867fc83, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x9200)) returned 1 [0112.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0112.655] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\1wQWiq_Mzo.mp3" (normalized: "c:\\users\\fd1hvy\\music\\k5yhr0q9y el2_vro\\1wqwiq_mzo.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\1wQWiq_Mzo.mp3.spybuster" (normalized: "c:\\users\\fd1hvy\\music\\k5yhr0q9y el2_vro\\1wqwiq_mzo.mp3.spybuster")) returned 1 [0112.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb0) returned 1 [0112.656] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\AudnE9qrl5c", nBufferLength=0x105, lpBuffer=0x19e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\AudnE9qrl5c", lpFilePart=0x0) returned 0x33 [0112.656] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\AudnE9qrl5c\\*", lpFindFileData=0x19e9d8 | out: lpFindFileData=0x19e9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccdfa180, ftCreationTime.dwHighDateTime=0x1d5efd8, ftLastAccessTime.dwLowDateTime=0x6ba1ad90, ftLastAccessTime.dwHighDateTime=0x1d5eaac, ftLastWriteTime.dwLowDateTime=0x6ba1ad90, ftLastWriteTime.dwHighDateTime=0x1d5eaac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b578 [0112.656] FindNextFileW (in: hFindFile=0x77b578, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccdfa180, ftCreationTime.dwHighDateTime=0x1d5efd8, ftLastAccessTime.dwLowDateTime=0x6ba1ad90, ftLastAccessTime.dwHighDateTime=0x1d5eaac, ftLastWriteTime.dwLowDateTime=0x6ba1ad90, ftLastWriteTime.dwHighDateTime=0x1d5eaac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.657] FindNextFileW (in: hFindFile=0x77b578, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7022500, ftCreationTime.dwHighDateTime=0x1d5ec1d, ftLastAccessTime.dwLowDateTime=0x516787a0, ftLastAccessTime.dwHighDateTime=0x1d5e81e, ftLastWriteTime.dwLowDateTime=0x516787a0, ftLastWriteTime.dwHighDateTime=0x1d5e81e, nFileSizeHigh=0x0, nFileSizeLow=0x139ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="kJnA6b7jt.m4a", cAlternateFileName="KJNA6B~1.M4A")) returned 1 [0112.657] FindNextFileW (in: hFindFile=0x77b578, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4936e0, ftCreationTime.dwHighDateTime=0x1d5e788, ftLastAccessTime.dwLowDateTime=0xbd9a1270, ftLastAccessTime.dwHighDateTime=0x1d5e1bc, ftLastWriteTime.dwLowDateTime=0xbd9a1270, ftLastWriteTime.dwHighDateTime=0x1d5e1bc, nFileSizeHigh=0x0, nFileSizeLow=0x36f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="S7N4WQfp4.mp3", cAlternateFileName="S7N4WQ~1.MP3")) returned 1 [0112.657] FindNextFileW (in: hFindFile=0x77b578, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9648f130, ftCreationTime.dwHighDateTime=0x1d5e100, ftLastAccessTime.dwLowDateTime=0x5bbbedb0, ftLastAccessTime.dwHighDateTime=0x1d5eac4, ftLastWriteTime.dwLowDateTime=0x5bbbedb0, ftLastWriteTime.dwHighDateTime=0x1d5eac4, nFileSizeHigh=0x0, nFileSizeLow=0x129fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="sBqZ1XwX Pc64terJw-z.wav", cAlternateFileName="SBQZ1X~1.WAV")) returned 1 [0112.657] FindNextFileW (in: hFindFile=0x77b578, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39831950, ftCreationTime.dwHighDateTime=0x1d5e2a2, ftLastAccessTime.dwLowDateTime=0x7e28f1f0, ftLastAccessTime.dwHighDateTime=0x1d5ef37, ftLastWriteTime.dwLowDateTime=0x7e28f1f0, ftLastWriteTime.dwHighDateTime=0x1d5ef37, nFileSizeHigh=0x0, nFileSizeLow=0x5699, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHKhm.mp3", cAlternateFileName="")) returned 1 [0112.657] FindNextFileW (in: hFindFile=0x77b578, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.657] FindClose (in: hFindFile=0x77b578 | out: hFindFile=0x77b578) returned 1 [0112.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec6c) returned 1 [0112.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec78) returned 1 [0112.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb0) returned 1 [0112.658] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\AudnE9qrl5c", nBufferLength=0x105, lpBuffer=0x19e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\AudnE9qrl5c", lpFilePart=0x0) returned 0x33 [0112.658] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\AudnE9qrl5c\\*", lpFindFileData=0x19e9d8 | out: lpFindFileData=0x19e9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccdfa180, ftCreationTime.dwHighDateTime=0x1d5efd8, ftLastAccessTime.dwLowDateTime=0x6ba1ad90, ftLastAccessTime.dwHighDateTime=0x1d5eaac, ftLastWriteTime.dwLowDateTime=0x6ba1ad90, ftLastWriteTime.dwHighDateTime=0x1d5eaac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b6f8 [0112.658] FindNextFileW (in: hFindFile=0x77b6f8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccdfa180, ftCreationTime.dwHighDateTime=0x1d5efd8, ftLastAccessTime.dwLowDateTime=0x6ba1ad90, ftLastAccessTime.dwHighDateTime=0x1d5eaac, ftLastWriteTime.dwLowDateTime=0x6ba1ad90, ftLastWriteTime.dwHighDateTime=0x1d5eaac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.658] FindNextFileW (in: hFindFile=0x77b6f8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7022500, ftCreationTime.dwHighDateTime=0x1d5ec1d, ftLastAccessTime.dwLowDateTime=0x516787a0, ftLastAccessTime.dwHighDateTime=0x1d5e81e, ftLastWriteTime.dwLowDateTime=0x516787a0, ftLastWriteTime.dwHighDateTime=0x1d5e81e, nFileSizeHigh=0x0, nFileSizeLow=0x139ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="kJnA6b7jt.m4a", cAlternateFileName="KJNA6B~1.M4A")) returned 1 [0112.659] FindNextFileW (in: hFindFile=0x77b6f8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4936e0, ftCreationTime.dwHighDateTime=0x1d5e788, ftLastAccessTime.dwLowDateTime=0xbd9a1270, ftLastAccessTime.dwHighDateTime=0x1d5e1bc, ftLastWriteTime.dwLowDateTime=0xbd9a1270, ftLastWriteTime.dwHighDateTime=0x1d5e1bc, nFileSizeHigh=0x0, nFileSizeLow=0x36f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="S7N4WQfp4.mp3", cAlternateFileName="S7N4WQ~1.MP3")) returned 1 [0112.659] FindNextFileW (in: hFindFile=0x77b6f8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9648f130, ftCreationTime.dwHighDateTime=0x1d5e100, ftLastAccessTime.dwLowDateTime=0x5bbbedb0, ftLastAccessTime.dwHighDateTime=0x1d5eac4, ftLastWriteTime.dwLowDateTime=0x5bbbedb0, ftLastWriteTime.dwHighDateTime=0x1d5eac4, nFileSizeHigh=0x0, nFileSizeLow=0x129fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="sBqZ1XwX Pc64terJw-z.wav", cAlternateFileName="SBQZ1X~1.WAV")) returned 1 [0112.659] FindNextFileW (in: hFindFile=0x77b6f8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39831950, ftCreationTime.dwHighDateTime=0x1d5e2a2, ftLastAccessTime.dwLowDateTime=0x7e28f1f0, ftLastAccessTime.dwHighDateTime=0x1d5ef37, ftLastWriteTime.dwLowDateTime=0x7e28f1f0, ftLastWriteTime.dwHighDateTime=0x1d5ef37, nFileSizeHigh=0x0, nFileSizeLow=0x5699, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHKhm.mp3", cAlternateFileName="")) returned 1 [0112.659] FindNextFileW (in: hFindFile=0x77b6f8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39831950, ftCreationTime.dwHighDateTime=0x1d5e2a2, ftLastAccessTime.dwLowDateTime=0x7e28f1f0, ftLastAccessTime.dwHighDateTime=0x1d5ef37, ftLastWriteTime.dwLowDateTime=0x7e28f1f0, ftLastWriteTime.dwHighDateTime=0x1d5ef37, nFileSizeHigh=0x0, nFileSizeLow=0x5699, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHKhm.mp3", cAlternateFileName="")) returned 0 [0112.659] FindClose (in: hFindFile=0x77b6f8 | out: hFindFile=0x77b6f8) returned 1 [0112.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec6c) returned 1 [0112.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec78) returned 1 [0112.660] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\AudnE9qrl5c\\S7N4WQfp4.mp3", nBufferLength=0x105, lpBuffer=0x19e618, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\AudnE9qrl5c\\S7N4WQfp4.mp3", lpFilePart=0x0) returned 0x41 [0112.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb5c) returned 1 [0112.660] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\AudnE9qrl5c\\S7N4WQfp4.mp3" (normalized: "c:\\users\\fd1hvy\\music\\k5yhr0q9y el2_vro\\audne9qrl5c\\s7n4wqfp4.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.660] GetFileType (hFile=0x37c) returned 0x1 [0112.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb58) returned 1 [0112.660] GetFileType (hFile=0x37c) returned 0x1 [0112.660] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ec58 | out: lpFileSizeHigh=0x19ec58*=0x0) returned 0x36f5 [0112.660] ReadFile (in: hFile=0x37c, lpBuffer=0x270dd28, nNumberOfBytesToRead=0x36f5, lpNumberOfBytesRead=0x19ec04, lpOverlapped=0x0 | out: lpBuffer=0x270dd28*, lpNumberOfBytesRead=0x19ec04*=0x36f5, lpOverlapped=0x0) returned 1 [0112.662] CloseHandle (hObject=0x37c) returned 1 [0112.689] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e71c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0112.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0112.689] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ec4c | out: lpFileInformation=0x19ec4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0112.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0112.689] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\AudnE9qrl5c\\S7N4WQfp4.mp3", nBufferLength=0x105, lpBuffer=0x19e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\AudnE9qrl5c\\S7N4WQfp4.mp3", lpFilePart=0x0) returned 0x41 [0112.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb48) returned 1 [0112.690] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\AudnE9qrl5c\\S7N4WQfp4.mp3" (normalized: "c:\\users\\fd1hvy\\music\\k5yhr0q9y el2_vro\\audne9qrl5c\\s7n4wqfp4.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.691] GetFileType (hFile=0x37c) returned 0x1 [0112.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb44) returned 1 [0112.691] GetFileType (hFile=0x37c) returned 0x1 [0112.691] WriteFile (in: hFile=0x37c, lpBuffer=0x276be14*, nNumberOfBytesToWrite=0x3700, lpNumberOfBytesWritten=0x19ebf8, lpOverlapped=0x0 | out: lpBuffer=0x276be14*, lpNumberOfBytesWritten=0x19ebf8*=0x3700, lpOverlapped=0x0) returned 1 [0112.693] CloseHandle (hObject=0x37c) returned 1 [0112.695] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\AudnE9qrl5c\\S7N4WQfp4.mp3", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\AudnE9qrl5c\\S7N4WQfp4.mp3", lpFilePart=0x0) returned 0x41 [0112.695] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\AudnE9qrl5c\\S7N4WQfp4.mp3.spybuster", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\AudnE9qrl5c\\S7N4WQfp4.mp3.spybuster", lpFilePart=0x0) returned 0x4b [0112.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebdc) returned 1 [0112.695] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\AudnE9qrl5c\\S7N4WQfp4.mp3" (normalized: "c:\\users\\fd1hvy\\music\\k5yhr0q9y el2_vro\\audne9qrl5c\\s7n4wqfp4.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19ec58 | out: lpFileInformation=0x19ec58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4936e0, ftCreationTime.dwHighDateTime=0x1d5e788, ftLastAccessTime.dwLowDateTime=0xbd9a1270, ftLastAccessTime.dwHighDateTime=0x1d5e1bc, ftLastWriteTime.dwLowDateTime=0xb86f23f4, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x3700)) returned 1 [0112.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebd8) returned 1 [0112.695] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\AudnE9qrl5c\\S7N4WQfp4.mp3" (normalized: "c:\\users\\fd1hvy\\music\\k5yhr0q9y el2_vro\\audne9qrl5c\\s7n4wqfp4.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\AudnE9qrl5c\\S7N4WQfp4.mp3.spybuster" (normalized: "c:\\users\\fd1hvy\\music\\k5yhr0q9y el2_vro\\audne9qrl5c\\s7n4wqfp4.mp3.spybuster")) returned 1 [0112.696] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\AudnE9qrl5c\\SHKhm.mp3", nBufferLength=0x105, lpBuffer=0x19e618, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\AudnE9qrl5c\\SHKhm.mp3", lpFilePart=0x0) returned 0x3d [0112.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb5c) returned 1 [0112.696] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\AudnE9qrl5c\\SHKhm.mp3" (normalized: "c:\\users\\fd1hvy\\music\\k5yhr0q9y el2_vro\\audne9qrl5c\\shkhm.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.696] GetFileType (hFile=0x37c) returned 0x1 [0112.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb58) returned 1 [0112.696] GetFileType (hFile=0x37c) returned 0x1 [0112.696] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ec58 | out: lpFileSizeHigh=0x19ec58*=0x0) returned 0x5699 [0112.697] ReadFile (in: hFile=0x37c, lpBuffer=0x276fa64, nNumberOfBytesToRead=0x5699, lpNumberOfBytesRead=0x19ec04, lpOverlapped=0x0 | out: lpBuffer=0x276fa64*, lpNumberOfBytesRead=0x19ec04*=0x5699, lpOverlapped=0x0) returned 1 [0112.698] CloseHandle (hObject=0x37c) returned 1 [0112.750] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e71c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0112.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0112.750] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ec4c | out: lpFileInformation=0x19ec4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0112.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0112.751] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\AudnE9qrl5c\\SHKhm.mp3", nBufferLength=0x105, lpBuffer=0x19e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\AudnE9qrl5c\\SHKhm.mp3", lpFilePart=0x0) returned 0x3d [0112.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb48) returned 1 [0112.751] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\AudnE9qrl5c\\SHKhm.mp3" (normalized: "c:\\users\\fd1hvy\\music\\k5yhr0q9y el2_vro\\audne9qrl5c\\shkhm.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.753] GetFileType (hFile=0x37c) returned 0x1 [0112.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb44) returned 1 [0112.753] GetFileType (hFile=0x37c) returned 0x1 [0112.753] WriteFile (in: hFile=0x37c, lpBuffer=0x27d7970*, nNumberOfBytesToWrite=0x56a0, lpNumberOfBytesWritten=0x19ebf8, lpOverlapped=0x0 | out: lpBuffer=0x27d7970*, lpNumberOfBytesWritten=0x19ebf8*=0x56a0, lpOverlapped=0x0) returned 1 [0112.757] CloseHandle (hObject=0x37c) returned 1 [0112.759] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\AudnE9qrl5c\\SHKhm.mp3", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\AudnE9qrl5c\\SHKhm.mp3", lpFilePart=0x0) returned 0x3d [0112.759] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\AudnE9qrl5c\\SHKhm.mp3.spybuster", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\AudnE9qrl5c\\SHKhm.mp3.spybuster", lpFilePart=0x0) returned 0x47 [0112.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebdc) returned 1 [0112.759] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\AudnE9qrl5c\\SHKhm.mp3" (normalized: "c:\\users\\fd1hvy\\music\\k5yhr0q9y el2_vro\\audne9qrl5c\\shkhm.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19ec58 | out: lpFileInformation=0x19ec58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39831950, ftCreationTime.dwHighDateTime=0x1d5e2a2, ftLastAccessTime.dwLowDateTime=0x7e28f1f0, ftLastAccessTime.dwHighDateTime=0x1d5ef37, ftLastWriteTime.dwLowDateTime=0xb878adc7, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x56a0)) returned 1 [0112.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebd8) returned 1 [0112.759] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\AudnE9qrl5c\\SHKhm.mp3" (normalized: "c:\\users\\fd1hvy\\music\\k5yhr0q9y el2_vro\\audne9qrl5c\\shkhm.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\AudnE9qrl5c\\SHKhm.mp3.spybuster" (normalized: "c:\\users\\fd1hvy\\music\\k5yhr0q9y el2_vro\\audne9qrl5c\\shkhm.mp3.spybuster")) returned 1 [0112.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb0) returned 1 [0112.760] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K", nBufferLength=0x105, lpBuffer=0x19e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K", lpFilePart=0x0) returned 0x36 [0112.760] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K\\*", lpFindFileData=0x19e9d8 | out: lpFindFileData=0x19e9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc5309b80, ftCreationTime.dwHighDateTime=0x1d5e527, ftLastAccessTime.dwLowDateTime=0xcb12c080, ftLastAccessTime.dwHighDateTime=0x1d5e763, ftLastWriteTime.dwLowDateTime=0xcb12c080, ftLastWriteTime.dwHighDateTime=0x1d5e763, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b838 [0112.761] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc5309b80, ftCreationTime.dwHighDateTime=0x1d5e527, ftLastAccessTime.dwLowDateTime=0xcb12c080, ftLastAccessTime.dwHighDateTime=0x1d5e763, ftLastWriteTime.dwLowDateTime=0xcb12c080, ftLastWriteTime.dwHighDateTime=0x1d5e763, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.761] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x693dd80, ftCreationTime.dwHighDateTime=0x1d5edf2, ftLastAccessTime.dwLowDateTime=0x50203f0, ftLastAccessTime.dwHighDateTime=0x1d5e520, ftLastWriteTime.dwLowDateTime=0x50203f0, ftLastWriteTime.dwHighDateTime=0x1d5e520, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3uxgqON0", cAlternateFileName="")) returned 1 [0112.761] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77b320, ftCreationTime.dwHighDateTime=0x1d5ee60, ftLastAccessTime.dwLowDateTime=0x17f05da0, ftLastAccessTime.dwHighDateTime=0x1d5e4c0, ftLastWriteTime.dwLowDateTime=0x17f05da0, ftLastWriteTime.dwHighDateTime=0x1d5e4c0, nFileSizeHigh=0x0, nFileSizeLow=0x1768, dwReserved0=0x0, dwReserved1=0x0, cFileName="JY_1qbL6O3nw8FgWjccq.m4a", cAlternateFileName="JY_1QB~1.M4A")) returned 1 [0112.762] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0139370, ftCreationTime.dwHighDateTime=0x1d5e7fc, ftLastAccessTime.dwLowDateTime=0x9d041cc0, ftLastAccessTime.dwHighDateTime=0x1d5eddf, ftLastWriteTime.dwLowDateTime=0x9d041cc0, ftLastWriteTime.dwHighDateTime=0x1d5eddf, nFileSizeHigh=0x0, nFileSizeLow=0xcd2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="lVLRIcfhxCWD.wav", cAlternateFileName="LVLRIC~1.WAV")) returned 1 [0112.762] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x927fb220, ftCreationTime.dwHighDateTime=0x1d5f080, ftLastAccessTime.dwLowDateTime=0x8792e0e0, ftLastAccessTime.dwHighDateTime=0x1d5e34b, ftLastWriteTime.dwLowDateTime=0x8792e0e0, ftLastWriteTime.dwHighDateTime=0x1d5e34b, nFileSizeHigh=0x0, nFileSizeLow=0x1845a, dwReserved0=0x0, dwReserved1=0x0, cFileName="qyqgVOoOswEbMWAc.m4a", cAlternateFileName="QYQGVO~1.M4A")) returned 1 [0112.762] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8af46bc0, ftCreationTime.dwHighDateTime=0x1d5e2e5, ftLastAccessTime.dwLowDateTime=0x12b9a320, ftLastAccessTime.dwHighDateTime=0x1d5ecb1, ftLastWriteTime.dwLowDateTime=0x12b9a320, ftLastWriteTime.dwHighDateTime=0x1d5ecb1, nFileSizeHigh=0x0, nFileSizeLow=0x2cc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="TQ9imiFTg1-3Gy.mp3", cAlternateFileName="TQ9IMI~1.MP3")) returned 1 [0112.762] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.762] FindClose (in: hFindFile=0x77b838 | out: hFindFile=0x77b838) returned 1 [0112.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec6c) returned 1 [0112.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec78) returned 1 [0112.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb0) returned 1 [0112.763] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K", nBufferLength=0x105, lpBuffer=0x19e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K", lpFilePart=0x0) returned 0x36 [0112.763] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K\\*", lpFindFileData=0x19e9d8 | out: lpFindFileData=0x19e9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc5309b80, ftCreationTime.dwHighDateTime=0x1d5e527, ftLastAccessTime.dwLowDateTime=0xcb12c080, ftLastAccessTime.dwHighDateTime=0x1d5e763, ftLastWriteTime.dwLowDateTime=0xcb12c080, ftLastWriteTime.dwHighDateTime=0x1d5e763, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b978 [0112.763] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc5309b80, ftCreationTime.dwHighDateTime=0x1d5e527, ftLastAccessTime.dwLowDateTime=0xcb12c080, ftLastAccessTime.dwHighDateTime=0x1d5e763, ftLastWriteTime.dwLowDateTime=0xcb12c080, ftLastWriteTime.dwHighDateTime=0x1d5e763, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.763] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x693dd80, ftCreationTime.dwHighDateTime=0x1d5edf2, ftLastAccessTime.dwLowDateTime=0x50203f0, ftLastAccessTime.dwHighDateTime=0x1d5e520, ftLastWriteTime.dwLowDateTime=0x50203f0, ftLastWriteTime.dwHighDateTime=0x1d5e520, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3uxgqON0", cAlternateFileName="")) returned 1 [0112.763] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77b320, ftCreationTime.dwHighDateTime=0x1d5ee60, ftLastAccessTime.dwLowDateTime=0x17f05da0, ftLastAccessTime.dwHighDateTime=0x1d5e4c0, ftLastWriteTime.dwLowDateTime=0x17f05da0, ftLastWriteTime.dwHighDateTime=0x1d5e4c0, nFileSizeHigh=0x0, nFileSizeLow=0x1768, dwReserved0=0x0, dwReserved1=0x0, cFileName="JY_1qbL6O3nw8FgWjccq.m4a", cAlternateFileName="JY_1QB~1.M4A")) returned 1 [0112.764] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0139370, ftCreationTime.dwHighDateTime=0x1d5e7fc, ftLastAccessTime.dwLowDateTime=0x9d041cc0, ftLastAccessTime.dwHighDateTime=0x1d5eddf, ftLastWriteTime.dwLowDateTime=0x9d041cc0, ftLastWriteTime.dwHighDateTime=0x1d5eddf, nFileSizeHigh=0x0, nFileSizeLow=0xcd2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="lVLRIcfhxCWD.wav", cAlternateFileName="LVLRIC~1.WAV")) returned 1 [0112.764] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x927fb220, ftCreationTime.dwHighDateTime=0x1d5f080, ftLastAccessTime.dwLowDateTime=0x8792e0e0, ftLastAccessTime.dwHighDateTime=0x1d5e34b, ftLastWriteTime.dwLowDateTime=0x8792e0e0, ftLastWriteTime.dwHighDateTime=0x1d5e34b, nFileSizeHigh=0x0, nFileSizeLow=0x1845a, dwReserved0=0x0, dwReserved1=0x0, cFileName="qyqgVOoOswEbMWAc.m4a", cAlternateFileName="QYQGVO~1.M4A")) returned 1 [0112.764] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8af46bc0, ftCreationTime.dwHighDateTime=0x1d5e2e5, ftLastAccessTime.dwLowDateTime=0x12b9a320, ftLastAccessTime.dwHighDateTime=0x1d5ecb1, ftLastWriteTime.dwLowDateTime=0x12b9a320, ftLastWriteTime.dwHighDateTime=0x1d5ecb1, nFileSizeHigh=0x0, nFileSizeLow=0x2cc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="TQ9imiFTg1-3Gy.mp3", cAlternateFileName="TQ9IMI~1.MP3")) returned 1 [0112.764] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8af46bc0, ftCreationTime.dwHighDateTime=0x1d5e2e5, ftLastAccessTime.dwLowDateTime=0x12b9a320, ftLastAccessTime.dwHighDateTime=0x1d5ecb1, ftLastWriteTime.dwLowDateTime=0x12b9a320, ftLastWriteTime.dwHighDateTime=0x1d5ecb1, nFileSizeHigh=0x0, nFileSizeLow=0x2cc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="TQ9imiFTg1-3Gy.mp3", cAlternateFileName="TQ9IMI~1.MP3")) returned 0 [0112.764] FindClose (in: hFindFile=0x77b978 | out: hFindFile=0x77b978) returned 1 [0112.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec6c) returned 1 [0112.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec78) returned 1 [0112.765] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K\\TQ9imiFTg1-3Gy.mp3", nBufferLength=0x105, lpBuffer=0x19e618, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K\\TQ9imiFTg1-3Gy.mp3", lpFilePart=0x0) returned 0x49 [0112.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb5c) returned 1 [0112.765] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K\\TQ9imiFTg1-3Gy.mp3" (normalized: "c:\\users\\fd1hvy\\music\\k5yhr0q9y el2_vro\\zlzfdg_daeb37k\\tq9imiftg1-3gy.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.765] GetFileType (hFile=0x37c) returned 0x1 [0112.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb58) returned 1 [0112.765] GetFileType (hFile=0x37c) returned 0x1 [0112.765] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ec58 | out: lpFileSizeHigh=0x19ec58*=0x0) returned 0x2cc7 [0112.765] ReadFile (in: hFile=0x37c, lpBuffer=0x27df724, nNumberOfBytesToRead=0x2cc7, lpNumberOfBytesRead=0x19ec04, lpOverlapped=0x0 | out: lpBuffer=0x27df724*, lpNumberOfBytesRead=0x19ec04*=0x2cc7, lpOverlapped=0x0) returned 1 [0112.766] CloseHandle (hObject=0x37c) returned 1 [0112.813] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e71c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0112.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0112.813] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ec4c | out: lpFileInformation=0x19ec4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0112.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0112.813] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K\\TQ9imiFTg1-3Gy.mp3", nBufferLength=0x105, lpBuffer=0x19e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K\\TQ9imiFTg1-3Gy.mp3", lpFilePart=0x0) returned 0x49 [0112.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb48) returned 1 [0112.813] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K\\TQ9imiFTg1-3Gy.mp3" (normalized: "c:\\users\\fd1hvy\\music\\k5yhr0q9y el2_vro\\zlzfdg_daeb37k\\tq9imiftg1-3gy.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.815] GetFileType (hFile=0x37c) returned 0x1 [0112.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb44) returned 1 [0112.815] GetFileType (hFile=0x37c) returned 0x1 [0112.815] WriteFile (in: hFile=0x37c, lpBuffer=0x283a520*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x19ebf8, lpOverlapped=0x0 | out: lpBuffer=0x283a520*, lpNumberOfBytesWritten=0x19ebf8*=0x2cd0, lpOverlapped=0x0) returned 1 [0112.816] CloseHandle (hObject=0x37c) returned 1 [0112.818] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K\\TQ9imiFTg1-3Gy.mp3", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K\\TQ9imiFTg1-3Gy.mp3", lpFilePart=0x0) returned 0x49 [0112.818] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K\\TQ9imiFTg1-3Gy.mp3.spybuster", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K\\TQ9imiFTg1-3Gy.mp3.spybuster", lpFilePart=0x0) returned 0x53 [0112.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebdc) returned 1 [0112.818] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K\\TQ9imiFTg1-3Gy.mp3" (normalized: "c:\\users\\fd1hvy\\music\\k5yhr0q9y el2_vro\\zlzfdg_daeb37k\\tq9imiftg1-3gy.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19ec58 | out: lpFileInformation=0x19ec58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8af46bc0, ftCreationTime.dwHighDateTime=0x1d5e2e5, ftLastAccessTime.dwLowDateTime=0x12b9a320, ftLastAccessTime.dwHighDateTime=0x1d5ecb1, ftLastWriteTime.dwLowDateTime=0xb8823812, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x2cd0)) returned 1 [0112.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebd8) returned 1 [0112.819] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K\\TQ9imiFTg1-3Gy.mp3" (normalized: "c:\\users\\fd1hvy\\music\\k5yhr0q9y el2_vro\\zlzfdg_daeb37k\\tq9imiftg1-3gy.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K\\TQ9imiFTg1-3Gy.mp3.spybuster" (normalized: "c:\\users\\fd1hvy\\music\\k5yhr0q9y el2_vro\\zlzfdg_daeb37k\\tq9imiftg1-3gy.mp3.spybuster")) returned 1 [0112.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec3c) returned 1 [0112.820] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K\\3uxgqON0", nBufferLength=0x105, lpBuffer=0x19e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K\\3uxgqON0", lpFilePart=0x0) returned 0x3f [0112.820] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K\\3uxgqON0\\*", lpFindFileData=0x19e964 | out: lpFindFileData=0x19e964*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x693dd80, ftCreationTime.dwHighDateTime=0x1d5edf2, ftLastAccessTime.dwLowDateTime=0x50203f0, ftLastAccessTime.dwHighDateTime=0x1d5e520, ftLastWriteTime.dwLowDateTime=0x50203f0, ftLastWriteTime.dwHighDateTime=0x1d5e520, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b778 [0112.820] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19e970 | out: lpFindFileData=0x19e970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x693dd80, ftCreationTime.dwHighDateTime=0x1d5edf2, ftLastAccessTime.dwLowDateTime=0x50203f0, ftLastAccessTime.dwHighDateTime=0x1d5e520, ftLastWriteTime.dwLowDateTime=0x50203f0, ftLastWriteTime.dwHighDateTime=0x1d5e520, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.820] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19e970 | out: lpFindFileData=0x19e970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x340a360, ftCreationTime.dwHighDateTime=0x1d5eb4b, ftLastAccessTime.dwLowDateTime=0x6b7ed020, ftLastAccessTime.dwHighDateTime=0x1d5edc9, ftLastWriteTime.dwLowDateTime=0x6b7ed020, ftLastWriteTime.dwHighDateTime=0x1d5edc9, nFileSizeHigh=0x0, nFileSizeLow=0x41c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Npmut.m4a", cAlternateFileName="")) returned 1 [0112.820] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19e970 | out: lpFindFileData=0x19e970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba04b50, ftCreationTime.dwHighDateTime=0x1d5e880, ftLastAccessTime.dwLowDateTime=0x49eaa2f0, ftLastAccessTime.dwHighDateTime=0x1d5efe9, ftLastWriteTime.dwLowDateTime=0x49eaa2f0, ftLastWriteTime.dwHighDateTime=0x1d5efe9, nFileSizeHigh=0x0, nFileSizeLow=0x12b6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="zNN7vAC-k.mp3", cAlternateFileName="ZNN7VA~1.MP3")) returned 1 [0112.820] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19e970 | out: lpFindFileData=0x19e970*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.821] FindClose (in: hFindFile=0x77b778 | out: hFindFile=0x77b778) returned 1 [0112.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebf8) returned 1 [0112.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec04) returned 1 [0112.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec3c) returned 1 [0112.821] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K\\3uxgqON0", nBufferLength=0x105, lpBuffer=0x19e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K\\3uxgqON0", lpFilePart=0x0) returned 0x3f [0112.821] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K\\3uxgqON0\\*", lpFindFileData=0x19e964 | out: lpFindFileData=0x19e964*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x693dd80, ftCreationTime.dwHighDateTime=0x1d5edf2, ftLastAccessTime.dwLowDateTime=0x50203f0, ftLastAccessTime.dwHighDateTime=0x1d5e520, ftLastWriteTime.dwLowDateTime=0x50203f0, ftLastWriteTime.dwHighDateTime=0x1d5e520, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77bbf8 [0112.821] FindNextFileW (in: hFindFile=0x77bbf8, lpFindFileData=0x19e970 | out: lpFindFileData=0x19e970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x693dd80, ftCreationTime.dwHighDateTime=0x1d5edf2, ftLastAccessTime.dwLowDateTime=0x50203f0, ftLastAccessTime.dwHighDateTime=0x1d5e520, ftLastWriteTime.dwLowDateTime=0x50203f0, ftLastWriteTime.dwHighDateTime=0x1d5e520, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.821] FindNextFileW (in: hFindFile=0x77bbf8, lpFindFileData=0x19e970 | out: lpFindFileData=0x19e970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x340a360, ftCreationTime.dwHighDateTime=0x1d5eb4b, ftLastAccessTime.dwLowDateTime=0x6b7ed020, ftLastAccessTime.dwHighDateTime=0x1d5edc9, ftLastWriteTime.dwLowDateTime=0x6b7ed020, ftLastWriteTime.dwHighDateTime=0x1d5edc9, nFileSizeHigh=0x0, nFileSizeLow=0x41c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Npmut.m4a", cAlternateFileName="")) returned 1 [0112.821] FindNextFileW (in: hFindFile=0x77bbf8, lpFindFileData=0x19e970 | out: lpFindFileData=0x19e970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba04b50, ftCreationTime.dwHighDateTime=0x1d5e880, ftLastAccessTime.dwLowDateTime=0x49eaa2f0, ftLastAccessTime.dwHighDateTime=0x1d5efe9, ftLastWriteTime.dwLowDateTime=0x49eaa2f0, ftLastWriteTime.dwHighDateTime=0x1d5efe9, nFileSizeHigh=0x0, nFileSizeLow=0x12b6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="zNN7vAC-k.mp3", cAlternateFileName="ZNN7VA~1.MP3")) returned 1 [0112.821] FindNextFileW (in: hFindFile=0x77bbf8, lpFindFileData=0x19e970 | out: lpFindFileData=0x19e970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba04b50, ftCreationTime.dwHighDateTime=0x1d5e880, ftLastAccessTime.dwLowDateTime=0x49eaa2f0, ftLastAccessTime.dwHighDateTime=0x1d5efe9, ftLastWriteTime.dwLowDateTime=0x49eaa2f0, ftLastWriteTime.dwHighDateTime=0x1d5efe9, nFileSizeHigh=0x0, nFileSizeLow=0x12b6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="zNN7vAC-k.mp3", cAlternateFileName="ZNN7VA~1.MP3")) returned 0 [0112.821] FindClose (in: hFindFile=0x77bbf8 | out: hFindFile=0x77bbf8) returned 1 [0112.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebf8) returned 1 [0112.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec04) returned 1 [0112.822] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K\\3uxgqON0\\zNN7vAC-k.mp3", nBufferLength=0x105, lpBuffer=0x19e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K\\3uxgqON0\\zNN7vAC-k.mp3", lpFilePart=0x0) returned 0x4d [0112.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eae8) returned 1 [0112.822] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K\\3uxgqON0\\zNN7vAC-k.mp3" (normalized: "c:\\users\\fd1hvy\\music\\k5yhr0q9y el2_vro\\zlzfdg_daeb37k\\3uxgqon0\\znn7vac-k.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.822] GetFileType (hFile=0x37c) returned 0x1 [0112.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eae4) returned 1 [0112.822] GetFileType (hFile=0x37c) returned 0x1 [0112.822] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ebe4 | out: lpFileSizeHigh=0x19ebe4*=0x0) returned 0x12b6a [0112.822] ReadFile (in: hFile=0x37c, lpBuffer=0x283efbc, nNumberOfBytesToRead=0x12b6a, lpNumberOfBytesRead=0x19eb90, lpOverlapped=0x0 | out: lpBuffer=0x283efbc*, lpNumberOfBytesRead=0x19eb90*=0x12b6a, lpOverlapped=0x0) returned 1 [0112.824] CloseHandle (hObject=0x37c) returned 1 [0112.860] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e6a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0112.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb5c) returned 1 [0112.860] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ebd8 | out: lpFileInformation=0x19ebd8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0112.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb58) returned 1 [0112.860] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K\\3uxgqON0\\zNN7vAC-k.mp3", nBufferLength=0x105, lpBuffer=0x19e590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K\\3uxgqON0\\zNN7vAC-k.mp3", lpFilePart=0x0) returned 0x4d [0112.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ead4) returned 1 [0112.860] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K\\3uxgqON0\\zNN7vAC-k.mp3" (normalized: "c:\\users\\fd1hvy\\music\\k5yhr0q9y el2_vro\\zlzfdg_daeb37k\\3uxgqon0\\znn7vac-k.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.862] GetFileType (hFile=0x37c) returned 0x1 [0112.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ead0) returned 1 [0112.862] GetFileType (hFile=0x37c) returned 0x1 [0112.862] WriteFile (in: hFile=0x37c, lpBuffer=0x26d7744*, nNumberOfBytesToWrite=0x12b70, lpNumberOfBytesWritten=0x19eb84, lpOverlapped=0x0 | out: lpBuffer=0x26d7744*, lpNumberOfBytesWritten=0x19eb84*=0x12b70, lpOverlapped=0x0) returned 1 [0112.899] CloseHandle (hObject=0x37c) returned 1 [0112.903] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K\\3uxgqON0\\zNN7vAC-k.mp3", nBufferLength=0x105, lpBuffer=0x19e6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K\\3uxgqON0\\zNN7vAC-k.mp3", lpFilePart=0x0) returned 0x4d [0112.903] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K\\3uxgqON0\\zNN7vAC-k.mp3.spybuster", nBufferLength=0x105, lpBuffer=0x19e6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K\\3uxgqON0\\zNN7vAC-k.mp3.spybuster", lpFilePart=0x0) returned 0x57 [0112.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb68) returned 1 [0112.903] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K\\3uxgqON0\\zNN7vAC-k.mp3" (normalized: "c:\\users\\fd1hvy\\music\\k5yhr0q9y el2_vro\\zlzfdg_daeb37k\\3uxgqon0\\znn7vac-k.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19ebe4 | out: lpFileInformation=0x19ebe4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba04b50, ftCreationTime.dwHighDateTime=0x1d5e880, ftLastAccessTime.dwLowDateTime=0x49eaa2f0, ftLastAccessTime.dwHighDateTime=0x1d5efe9, ftLastWriteTime.dwLowDateTime=0xb88e2158, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x12b70)) returned 1 [0112.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb64) returned 1 [0112.903] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K\\3uxgqON0\\zNN7vAC-k.mp3" (normalized: "c:\\users\\fd1hvy\\music\\k5yhr0q9y el2_vro\\zlzfdg_daeb37k\\3uxgqon0\\znn7vac-k.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\K5yHR0Q9Y EL2_vro\\zlzFdg_dAeB37K\\3uxgqON0\\zNN7vAC-k.mp3.spybuster" (normalized: "c:\\users\\fd1hvy\\music\\k5yhr0q9y el2_vro\\zlzfdg_daeb37k\\3uxgqon0\\znn7vac-k.mp3.spybuster")) returned 1 [0112.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed24) returned 1 [0112.904] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q7qIPzWWSjw5RC5V", nBufferLength=0x105, lpBuffer=0x19e7d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q7qIPzWWSjw5RC5V", lpFilePart=0x0) returned 0x26 [0112.904] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q7qIPzWWSjw5RC5V\\*", lpFindFileData=0x19ea4c | out: lpFindFileData=0x19ea4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b7d99e0, ftCreationTime.dwHighDateTime=0x1d5ed89, ftLastAccessTime.dwLowDateTime=0x57c58720, ftLastAccessTime.dwHighDateTime=0x1d5e1b9, ftLastWriteTime.dwLowDateTime=0x57c58720, ftLastWriteTime.dwHighDateTime=0x1d5e1b9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b838 [0112.904] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b7d99e0, ftCreationTime.dwHighDateTime=0x1d5ed89, ftLastAccessTime.dwLowDateTime=0x57c58720, ftLastAccessTime.dwHighDateTime=0x1d5e1b9, ftLastWriteTime.dwLowDateTime=0x57c58720, ftLastWriteTime.dwHighDateTime=0x1d5e1b9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.904] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6e0b120, ftCreationTime.dwHighDateTime=0x1d5e0c2, ftLastAccessTime.dwLowDateTime=0xfb510400, ftLastAccessTime.dwHighDateTime=0x1d5e7c2, ftLastWriteTime.dwLowDateTime=0xfb510400, ftLastWriteTime.dwHighDateTime=0x1d5e7c2, nFileSizeHigh=0x0, nFileSizeLow=0x11ced, dwReserved0=0x0, dwReserved1=0x0, cFileName="2fTq5nVVMr6KXLqJrWF.m4a", cAlternateFileName="2FTQ5N~1.M4A")) returned 1 [0112.904] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13b50db0, ftCreationTime.dwHighDateTime=0x1d5e8cd, ftLastAccessTime.dwLowDateTime=0x7e506a30, ftLastAccessTime.dwHighDateTime=0x1d5e2cd, ftLastWriteTime.dwLowDateTime=0x7e506a30, ftLastWriteTime.dwHighDateTime=0x1d5e2cd, nFileSizeHigh=0x0, nFileSizeLow=0x15214, dwReserved0=0x0, dwReserved1=0x0, cFileName="dYyr 8p_MwuCU_W.m4a", cAlternateFileName="DYYR8P~1.M4A")) returned 1 [0112.905] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b3c10, ftCreationTime.dwHighDateTime=0x1d5e291, ftLastAccessTime.dwLowDateTime=0xefc2a9e0, ftLastAccessTime.dwHighDateTime=0x1d5e254, ftLastWriteTime.dwLowDateTime=0xefc2a9e0, ftLastWriteTime.dwHighDateTime=0x1d5e254, nFileSizeHigh=0x0, nFileSizeLow=0x7d45, dwReserved0=0x0, dwReserved1=0x0, cFileName="EuQZ035bN1mhfk.mp3", cAlternateFileName="EUQZ03~1.MP3")) returned 1 [0112.905] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x365b1e0, ftCreationTime.dwHighDateTime=0x1d5ec9b, ftLastAccessTime.dwLowDateTime=0x9c1276a0, ftLastAccessTime.dwHighDateTime=0x1d5e514, ftLastWriteTime.dwLowDateTime=0x9c1276a0, ftLastWriteTime.dwHighDateTime=0x1d5e514, nFileSizeHigh=0x0, nFileSizeLow=0x1402d, dwReserved0=0x0, dwReserved1=0x0, cFileName="FnDSS p.wav", cAlternateFileName="FNDSSP~1.WAV")) returned 1 [0112.905] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbce4bf0, ftCreationTime.dwHighDateTime=0x1d5ee40, ftLastAccessTime.dwLowDateTime=0x3244f0, ftLastAccessTime.dwHighDateTime=0x1d5f0bc, ftLastWriteTime.dwLowDateTime=0x3244f0, ftLastWriteTime.dwHighDateTime=0x1d5f0bc, nFileSizeHigh=0x0, nFileSizeLow=0x101a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="i0QS.mp3", cAlternateFileName="")) returned 1 [0112.905] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54848410, ftCreationTime.dwHighDateTime=0x1d5e305, ftLastAccessTime.dwLowDateTime=0x83326f60, ftLastAccessTime.dwHighDateTime=0x1d5ec7f, ftLastWriteTime.dwLowDateTime=0x83326f60, ftLastWriteTime.dwHighDateTime=0x1d5ec7f, nFileSizeHigh=0x0, nFileSizeLow=0x18257, dwReserved0=0x0, dwReserved1=0x0, cFileName="i3vPA3ijBW1ByzhML.wav", cAlternateFileName="I3VPA3~1.WAV")) returned 1 [0112.905] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2ba500, ftCreationTime.dwHighDateTime=0x1d5e1f9, ftLastAccessTime.dwLowDateTime=0x539f4070, ftLastAccessTime.dwHighDateTime=0x1d5e0d1, ftLastWriteTime.dwLowDateTime=0x539f4070, ftLastWriteTime.dwHighDateTime=0x1d5e0d1, nFileSizeHigh=0x0, nFileSizeLow=0x13396, dwReserved0=0x0, dwReserved1=0x0, cFileName="uGrj.m4a", cAlternateFileName="")) returned 1 [0112.905] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.905] FindClose (in: hFindFile=0x77b838 | out: hFindFile=0x77b838) returned 1 [0112.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ece0) returned 1 [0112.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecec) returned 1 [0112.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed24) returned 1 [0112.905] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q7qIPzWWSjw5RC5V", nBufferLength=0x105, lpBuffer=0x19e7d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q7qIPzWWSjw5RC5V", lpFilePart=0x0) returned 0x26 [0112.905] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q7qIPzWWSjw5RC5V\\*", lpFindFileData=0x19ea4c | out: lpFindFileData=0x19ea4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b7d99e0, ftCreationTime.dwHighDateTime=0x1d5ed89, ftLastAccessTime.dwLowDateTime=0x57c58720, ftLastAccessTime.dwHighDateTime=0x1d5e1b9, ftLastWriteTime.dwLowDateTime=0x57c58720, ftLastWriteTime.dwHighDateTime=0x1d5e1b9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b9b8 [0112.906] FindNextFileW (in: hFindFile=0x77b9b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b7d99e0, ftCreationTime.dwHighDateTime=0x1d5ed89, ftLastAccessTime.dwLowDateTime=0x57c58720, ftLastAccessTime.dwHighDateTime=0x1d5e1b9, ftLastWriteTime.dwLowDateTime=0x57c58720, ftLastWriteTime.dwHighDateTime=0x1d5e1b9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.906] FindNextFileW (in: hFindFile=0x77b9b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6e0b120, ftCreationTime.dwHighDateTime=0x1d5e0c2, ftLastAccessTime.dwLowDateTime=0xfb510400, ftLastAccessTime.dwHighDateTime=0x1d5e7c2, ftLastWriteTime.dwLowDateTime=0xfb510400, ftLastWriteTime.dwHighDateTime=0x1d5e7c2, nFileSizeHigh=0x0, nFileSizeLow=0x11ced, dwReserved0=0x0, dwReserved1=0x0, cFileName="2fTq5nVVMr6KXLqJrWF.m4a", cAlternateFileName="2FTQ5N~1.M4A")) returned 1 [0112.906] FindNextFileW (in: hFindFile=0x77b9b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13b50db0, ftCreationTime.dwHighDateTime=0x1d5e8cd, ftLastAccessTime.dwLowDateTime=0x7e506a30, ftLastAccessTime.dwHighDateTime=0x1d5e2cd, ftLastWriteTime.dwLowDateTime=0x7e506a30, ftLastWriteTime.dwHighDateTime=0x1d5e2cd, nFileSizeHigh=0x0, nFileSizeLow=0x15214, dwReserved0=0x0, dwReserved1=0x0, cFileName="dYyr 8p_MwuCU_W.m4a", cAlternateFileName="DYYR8P~1.M4A")) returned 1 [0112.906] FindNextFileW (in: hFindFile=0x77b9b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b3c10, ftCreationTime.dwHighDateTime=0x1d5e291, ftLastAccessTime.dwLowDateTime=0xefc2a9e0, ftLastAccessTime.dwHighDateTime=0x1d5e254, ftLastWriteTime.dwLowDateTime=0xefc2a9e0, ftLastWriteTime.dwHighDateTime=0x1d5e254, nFileSizeHigh=0x0, nFileSizeLow=0x7d45, dwReserved0=0x0, dwReserved1=0x0, cFileName="EuQZ035bN1mhfk.mp3", cAlternateFileName="EUQZ03~1.MP3")) returned 1 [0112.906] FindNextFileW (in: hFindFile=0x77b9b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x365b1e0, ftCreationTime.dwHighDateTime=0x1d5ec9b, ftLastAccessTime.dwLowDateTime=0x9c1276a0, ftLastAccessTime.dwHighDateTime=0x1d5e514, ftLastWriteTime.dwLowDateTime=0x9c1276a0, ftLastWriteTime.dwHighDateTime=0x1d5e514, nFileSizeHigh=0x0, nFileSizeLow=0x1402d, dwReserved0=0x0, dwReserved1=0x0, cFileName="FnDSS p.wav", cAlternateFileName="FNDSSP~1.WAV")) returned 1 [0112.906] FindNextFileW (in: hFindFile=0x77b9b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbce4bf0, ftCreationTime.dwHighDateTime=0x1d5ee40, ftLastAccessTime.dwLowDateTime=0x3244f0, ftLastAccessTime.dwHighDateTime=0x1d5f0bc, ftLastWriteTime.dwLowDateTime=0x3244f0, ftLastWriteTime.dwHighDateTime=0x1d5f0bc, nFileSizeHigh=0x0, nFileSizeLow=0x101a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="i0QS.mp3", cAlternateFileName="")) returned 1 [0112.906] FindNextFileW (in: hFindFile=0x77b9b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54848410, ftCreationTime.dwHighDateTime=0x1d5e305, ftLastAccessTime.dwLowDateTime=0x83326f60, ftLastAccessTime.dwHighDateTime=0x1d5ec7f, ftLastWriteTime.dwLowDateTime=0x83326f60, ftLastWriteTime.dwHighDateTime=0x1d5ec7f, nFileSizeHigh=0x0, nFileSizeLow=0x18257, dwReserved0=0x0, dwReserved1=0x0, cFileName="i3vPA3ijBW1ByzhML.wav", cAlternateFileName="I3VPA3~1.WAV")) returned 1 [0112.906] FindNextFileW (in: hFindFile=0x77b9b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2ba500, ftCreationTime.dwHighDateTime=0x1d5e1f9, ftLastAccessTime.dwLowDateTime=0x539f4070, ftLastAccessTime.dwHighDateTime=0x1d5e0d1, ftLastWriteTime.dwLowDateTime=0x539f4070, ftLastWriteTime.dwHighDateTime=0x1d5e0d1, nFileSizeHigh=0x0, nFileSizeLow=0x13396, dwReserved0=0x0, dwReserved1=0x0, cFileName="uGrj.m4a", cAlternateFileName="")) returned 1 [0112.906] FindNextFileW (in: hFindFile=0x77b9b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2ba500, ftCreationTime.dwHighDateTime=0x1d5e1f9, ftLastAccessTime.dwLowDateTime=0x539f4070, ftLastAccessTime.dwHighDateTime=0x1d5e0d1, ftLastWriteTime.dwLowDateTime=0x539f4070, ftLastWriteTime.dwHighDateTime=0x1d5e0d1, nFileSizeHigh=0x0, nFileSizeLow=0x13396, dwReserved0=0x0, dwReserved1=0x0, cFileName="uGrj.m4a", cAlternateFileName="")) returned 0 [0112.906] FindClose (in: hFindFile=0x77b9b8 | out: hFindFile=0x77b9b8) returned 1 [0112.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ece0) returned 1 [0112.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecec) returned 1 [0112.906] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q7qIPzWWSjw5RC5V\\EuQZ035bN1mhfk.mp3", nBufferLength=0x105, lpBuffer=0x19e68c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q7qIPzWWSjw5RC5V\\EuQZ035bN1mhfk.mp3", lpFilePart=0x0) returned 0x39 [0112.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0112.907] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Q7qIPzWWSjw5RC5V\\EuQZ035bN1mhfk.mp3" (normalized: "c:\\users\\fd1hvy\\music\\q7qipzwwsjw5rc5v\\euqz035bn1mhfk.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.907] GetFileType (hFile=0x37c) returned 0x1 [0112.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0112.907] GetFileType (hFile=0x37c) returned 0x1 [0112.907] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19eccc | out: lpFileSizeHigh=0x19eccc*=0x0) returned 0x7d45 [0112.907] ReadFile (in: hFile=0x37c, lpBuffer=0x26eca04, nNumberOfBytesToRead=0x7d45, lpNumberOfBytesRead=0x19ec78, lpOverlapped=0x0 | out: lpBuffer=0x26eca04*, lpNumberOfBytesRead=0x19ec78*=0x7d45, lpOverlapped=0x0) returned 1 [0112.908] CloseHandle (hObject=0x37c) returned 1 [0113.037] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e790, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0113.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0113.038] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ecc0 | out: lpFileInformation=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0113.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0113.038] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q7qIPzWWSjw5RC5V\\EuQZ035bN1mhfk.mp3", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q7qIPzWWSjw5RC5V\\EuQZ035bN1mhfk.mp3", lpFilePart=0x0) returned 0x39 [0113.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0113.038] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Q7qIPzWWSjw5RC5V\\EuQZ035bN1mhfk.mp3" (normalized: "c:\\users\\fd1hvy\\music\\q7qipzwwsjw5rc5v\\euqz035bn1mhfk.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0113.040] GetFileType (hFile=0x37c) returned 0x1 [0113.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0113.040] GetFileType (hFile=0x37c) returned 0x1 [0113.040] WriteFile (in: hFile=0x37c, lpBuffer=0x2760bdc*, nNumberOfBytesToWrite=0x7d50, lpNumberOfBytesWritten=0x19ec6c, lpOverlapped=0x0 | out: lpBuffer=0x2760bdc*, lpNumberOfBytesWritten=0x19ec6c*=0x7d50, lpOverlapped=0x0) returned 1 [0113.042] CloseHandle (hObject=0x37c) returned 1 [0113.043] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q7qIPzWWSjw5RC5V\\EuQZ035bN1mhfk.mp3", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q7qIPzWWSjw5RC5V\\EuQZ035bN1mhfk.mp3", lpFilePart=0x0) returned 0x39 [0113.044] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q7qIPzWWSjw5RC5V\\EuQZ035bN1mhfk.mp3.spybuster", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q7qIPzWWSjw5RC5V\\EuQZ035bN1mhfk.mp3.spybuster", lpFilePart=0x0) returned 0x43 [0113.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec50) returned 1 [0113.044] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q7qIPzWWSjw5RC5V\\EuQZ035bN1mhfk.mp3" (normalized: "c:\\users\\fd1hvy\\music\\q7qipzwwsjw5rc5v\\euqz035bn1mhfk.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19eccc | out: lpFileInformation=0x19eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b3c10, ftCreationTime.dwHighDateTime=0x1d5e291, ftLastAccessTime.dwLowDateTime=0xefc2a9e0, ftLastAccessTime.dwHighDateTime=0x1d5e254, ftLastWriteTime.dwLowDateTime=0xb8a39860, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x7d50)) returned 1 [0113.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0113.044] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Q7qIPzWWSjw5RC5V\\EuQZ035bN1mhfk.mp3" (normalized: "c:\\users\\fd1hvy\\music\\q7qipzwwsjw5rc5v\\euqz035bn1mhfk.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Q7qIPzWWSjw5RC5V\\EuQZ035bN1mhfk.mp3.spybuster" (normalized: "c:\\users\\fd1hvy\\music\\q7qipzwwsjw5rc5v\\euqz035bn1mhfk.mp3.spybuster")) returned 1 [0113.045] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q7qIPzWWSjw5RC5V\\i0QS.mp3", nBufferLength=0x105, lpBuffer=0x19e68c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q7qIPzWWSjw5RC5V\\i0QS.mp3", lpFilePart=0x0) returned 0x2f [0113.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0113.045] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Q7qIPzWWSjw5RC5V\\i0QS.mp3" (normalized: "c:\\users\\fd1hvy\\music\\q7qipzwwsjw5rc5v\\i0qs.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0113.045] GetFileType (hFile=0x37c) returned 0x1 [0113.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0113.045] GetFileType (hFile=0x37c) returned 0x1 [0113.045] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19eccc | out: lpFileSizeHigh=0x19eccc*=0x0) returned 0x101a0 [0113.045] ReadFile (in: hFile=0x37c, lpBuffer=0x2768e2c, nNumberOfBytesToRead=0x101a0, lpNumberOfBytesRead=0x19ec78, lpOverlapped=0x0 | out: lpBuffer=0x2768e2c*, lpNumberOfBytesRead=0x19ec78*=0x101a0, lpOverlapped=0x0) returned 1 [0113.047] CloseHandle (hObject=0x37c) returned 1 [0113.105] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e790, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0113.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0113.105] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ecc0 | out: lpFileInformation=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0113.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0113.105] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q7qIPzWWSjw5RC5V\\i0QS.mp3", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q7qIPzWWSjw5RC5V\\i0QS.mp3", lpFilePart=0x0) returned 0x2f [0113.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0113.106] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Q7qIPzWWSjw5RC5V\\i0QS.mp3" (normalized: "c:\\users\\fd1hvy\\music\\q7qipzwwsjw5rc5v\\i0qs.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0113.107] GetFileType (hFile=0x37c) returned 0x1 [0113.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0113.107] GetFileType (hFile=0x37c) returned 0x1 [0113.108] WriteFile (in: hFile=0x37c, lpBuffer=0x267e774*, nNumberOfBytesToWrite=0x101b0, lpNumberOfBytesWritten=0x19ec6c, lpOverlapped=0x0 | out: lpBuffer=0x267e774*, lpNumberOfBytesWritten=0x19ec6c*=0x101b0, lpOverlapped=0x0) returned 1 [0113.110] CloseHandle (hObject=0x37c) returned 1 [0113.133] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q7qIPzWWSjw5RC5V\\i0QS.mp3", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q7qIPzWWSjw5RC5V\\i0QS.mp3", lpFilePart=0x0) returned 0x2f [0113.133] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q7qIPzWWSjw5RC5V\\i0QS.mp3.spybuster", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Q7qIPzWWSjw5RC5V\\i0QS.mp3.spybuster", lpFilePart=0x0) returned 0x39 [0113.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec50) returned 1 [0113.133] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Q7qIPzWWSjw5RC5V\\i0QS.mp3" (normalized: "c:\\users\\fd1hvy\\music\\q7qipzwwsjw5rc5v\\i0qs.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19eccc | out: lpFileInformation=0x19eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbce4bf0, ftCreationTime.dwHighDateTime=0x1d5ee40, ftLastAccessTime.dwLowDateTime=0x3244f0, ftLastAccessTime.dwHighDateTime=0x1d5f0bc, ftLastWriteTime.dwLowDateTime=0xb8b1e4e7, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x101b0)) returned 1 [0113.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0113.134] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Q7qIPzWWSjw5RC5V\\i0QS.mp3" (normalized: "c:\\users\\fd1hvy\\music\\q7qipzwwsjw5rc5v\\i0qs.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Q7qIPzWWSjw5RC5V\\i0QS.mp3.spybuster" (normalized: "c:\\users\\fd1hvy\\music\\q7qipzwwsjw5rc5v\\i0qs.mp3.spybuster")) returned 1 [0113.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed24) returned 1 [0113.134] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\SqWyO_nRxxI4LNX", nBufferLength=0x105, lpBuffer=0x19e7d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\SqWyO_nRxxI4LNX", lpFilePart=0x0) returned 0x25 [0113.135] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\SqWyO_nRxxI4LNX\\*", lpFindFileData=0x19ea4c | out: lpFindFileData=0x19ea4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3638c320, ftCreationTime.dwHighDateTime=0x1d5e57d, ftLastAccessTime.dwLowDateTime=0x1b2320f0, ftLastAccessTime.dwHighDateTime=0x1d5e5c6, ftLastWriteTime.dwLowDateTime=0x1b2320f0, ftLastWriteTime.dwHighDateTime=0x1d5e5c6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b8b8 [0113.135] FindNextFileW (in: hFindFile=0x77b8b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3638c320, ftCreationTime.dwHighDateTime=0x1d5e57d, ftLastAccessTime.dwLowDateTime=0x1b2320f0, ftLastAccessTime.dwHighDateTime=0x1d5e5c6, ftLastWriteTime.dwLowDateTime=0x1b2320f0, ftLastWriteTime.dwHighDateTime=0x1d5e5c6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.135] FindNextFileW (in: hFindFile=0x77b8b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf27c480, ftCreationTime.dwHighDateTime=0x1d5e60d, ftLastAccessTime.dwLowDateTime=0xf7df350, ftLastAccessTime.dwHighDateTime=0x1d5eaf4, ftLastWriteTime.dwLowDateTime=0xf7df350, ftLastWriteTime.dwHighDateTime=0x1d5eaf4, nFileSizeHigh=0x0, nFileSizeLow=0x4b59, dwReserved0=0x0, dwReserved1=0x0, cFileName="d5AUW7TCi9LdRuKm83IK.wav", cAlternateFileName="D5AUW7~1.WAV")) returned 1 [0113.135] FindNextFileW (in: hFindFile=0x77b8b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10710a20, ftCreationTime.dwHighDateTime=0x1d5ec9a, ftLastAccessTime.dwLowDateTime=0x14317940, ftLastAccessTime.dwHighDateTime=0x1d5e562, ftLastWriteTime.dwLowDateTime=0x14317940, ftLastWriteTime.dwHighDateTime=0x1d5e562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="r554fiqIY9JSUU_bN", cAlternateFileName="R554FI~1")) returned 1 [0113.135] FindNextFileW (in: hFindFile=0x77b8b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebf8a1d0, ftCreationTime.dwHighDateTime=0x1d5f0b3, ftLastAccessTime.dwLowDateTime=0x12b1e030, ftLastAccessTime.dwHighDateTime=0x1d5e217, ftLastWriteTime.dwLowDateTime=0x12b1e030, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wd_m8px5Jj", cAlternateFileName="WD_M8P~1")) returned 1 [0113.135] FindNextFileW (in: hFindFile=0x77b8b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c28f390, ftCreationTime.dwHighDateTime=0x1d5e97b, ftLastAccessTime.dwLowDateTime=0xfb48ec90, ftLastAccessTime.dwHighDateTime=0x1d5e202, ftLastWriteTime.dwLowDateTime=0xfb48ec90, ftLastWriteTime.dwHighDateTime=0x1d5e202, nFileSizeHigh=0x0, nFileSizeLow=0xb502, dwReserved0=0x0, dwReserved1=0x0, cFileName="wj 24nPgoEbUo.m4a", cAlternateFileName="WJ24NP~1.M4A")) returned 1 [0113.135] FindNextFileW (in: hFindFile=0x77b8b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dfcc4a0, ftCreationTime.dwHighDateTime=0x1d5e6ee, ftLastAccessTime.dwLowDateTime=0x6f161510, ftLastAccessTime.dwHighDateTime=0x1d5e520, ftLastWriteTime.dwLowDateTime=0x6f161510, ftLastWriteTime.dwHighDateTime=0x1d5e520, nFileSizeHigh=0x0, nFileSizeLow=0x18e47, dwReserved0=0x0, dwReserved1=0x0, cFileName="yhoRSUzMn.m4a", cAlternateFileName="YHORSU~1.M4A")) returned 1 [0113.135] FindNextFileW (in: hFindFile=0x77b8b8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.135] FindClose (in: hFindFile=0x77b8b8 | out: hFindFile=0x77b8b8) returned 1 [0113.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ece0) returned 1 [0113.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecec) returned 1 [0113.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed24) returned 1 [0113.136] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\SqWyO_nRxxI4LNX", nBufferLength=0x105, lpBuffer=0x19e7d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\SqWyO_nRxxI4LNX", lpFilePart=0x0) returned 0x25 [0113.136] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\SqWyO_nRxxI4LNX\\*", lpFindFileData=0x19ea4c | out: lpFindFileData=0x19ea4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3638c320, ftCreationTime.dwHighDateTime=0x1d5e57d, ftLastAccessTime.dwLowDateTime=0x1b2320f0, ftLastAccessTime.dwHighDateTime=0x1d5e5c6, ftLastWriteTime.dwLowDateTime=0x1b2320f0, ftLastWriteTime.dwHighDateTime=0x1d5e5c6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b8f8 [0113.136] FindNextFileW (in: hFindFile=0x77b8f8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3638c320, ftCreationTime.dwHighDateTime=0x1d5e57d, ftLastAccessTime.dwLowDateTime=0x1b2320f0, ftLastAccessTime.dwHighDateTime=0x1d5e5c6, ftLastWriteTime.dwLowDateTime=0x1b2320f0, ftLastWriteTime.dwHighDateTime=0x1d5e5c6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.136] FindNextFileW (in: hFindFile=0x77b8f8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf27c480, ftCreationTime.dwHighDateTime=0x1d5e60d, ftLastAccessTime.dwLowDateTime=0xf7df350, ftLastAccessTime.dwHighDateTime=0x1d5eaf4, ftLastWriteTime.dwLowDateTime=0xf7df350, ftLastWriteTime.dwHighDateTime=0x1d5eaf4, nFileSizeHigh=0x0, nFileSizeLow=0x4b59, dwReserved0=0x0, dwReserved1=0x0, cFileName="d5AUW7TCi9LdRuKm83IK.wav", cAlternateFileName="D5AUW7~1.WAV")) returned 1 [0113.136] FindNextFileW (in: hFindFile=0x77b8f8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10710a20, ftCreationTime.dwHighDateTime=0x1d5ec9a, ftLastAccessTime.dwLowDateTime=0x14317940, ftLastAccessTime.dwHighDateTime=0x1d5e562, ftLastWriteTime.dwLowDateTime=0x14317940, ftLastWriteTime.dwHighDateTime=0x1d5e562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="r554fiqIY9JSUU_bN", cAlternateFileName="R554FI~1")) returned 1 [0113.136] FindNextFileW (in: hFindFile=0x77b8f8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebf8a1d0, ftCreationTime.dwHighDateTime=0x1d5f0b3, ftLastAccessTime.dwLowDateTime=0x12b1e030, ftLastAccessTime.dwHighDateTime=0x1d5e217, ftLastWriteTime.dwLowDateTime=0x12b1e030, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wd_m8px5Jj", cAlternateFileName="WD_M8P~1")) returned 1 [0113.136] FindNextFileW (in: hFindFile=0x77b8f8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c28f390, ftCreationTime.dwHighDateTime=0x1d5e97b, ftLastAccessTime.dwLowDateTime=0xfb48ec90, ftLastAccessTime.dwHighDateTime=0x1d5e202, ftLastWriteTime.dwLowDateTime=0xfb48ec90, ftLastWriteTime.dwHighDateTime=0x1d5e202, nFileSizeHigh=0x0, nFileSizeLow=0xb502, dwReserved0=0x0, dwReserved1=0x0, cFileName="wj 24nPgoEbUo.m4a", cAlternateFileName="WJ24NP~1.M4A")) returned 1 [0113.136] FindNextFileW (in: hFindFile=0x77b8f8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dfcc4a0, ftCreationTime.dwHighDateTime=0x1d5e6ee, ftLastAccessTime.dwLowDateTime=0x6f161510, ftLastAccessTime.dwHighDateTime=0x1d5e520, ftLastWriteTime.dwLowDateTime=0x6f161510, ftLastWriteTime.dwHighDateTime=0x1d5e520, nFileSizeHigh=0x0, nFileSizeLow=0x18e47, dwReserved0=0x0, dwReserved1=0x0, cFileName="yhoRSUzMn.m4a", cAlternateFileName="YHORSU~1.M4A")) returned 1 [0113.136] FindNextFileW (in: hFindFile=0x77b8f8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dfcc4a0, ftCreationTime.dwHighDateTime=0x1d5e6ee, ftLastAccessTime.dwLowDateTime=0x6f161510, ftLastAccessTime.dwHighDateTime=0x1d5e520, ftLastWriteTime.dwLowDateTime=0x6f161510, ftLastWriteTime.dwHighDateTime=0x1d5e520, nFileSizeHigh=0x0, nFileSizeLow=0x18e47, dwReserved0=0x0, dwReserved1=0x0, cFileName="yhoRSUzMn.m4a", cAlternateFileName="YHORSU~1.M4A")) returned 0 [0113.136] FindClose (in: hFindFile=0x77b8f8 | out: hFindFile=0x77b8f8) returned 1 [0113.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ece0) returned 1 [0113.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecec) returned 1 [0113.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb0) returned 1 [0113.137] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\SqWyO_nRxxI4LNX\\r554fiqIY9JSUU_bN", nBufferLength=0x105, lpBuffer=0x19e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\SqWyO_nRxxI4LNX\\r554fiqIY9JSUU_bN", lpFilePart=0x0) returned 0x37 [0113.137] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\SqWyO_nRxxI4LNX\\r554fiqIY9JSUU_bN\\*", lpFindFileData=0x19e9d8 | out: lpFindFileData=0x19e9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10710a20, ftCreationTime.dwHighDateTime=0x1d5ec9a, ftLastAccessTime.dwLowDateTime=0x14317940, ftLastAccessTime.dwHighDateTime=0x1d5e562, ftLastWriteTime.dwLowDateTime=0x14317940, ftLastWriteTime.dwHighDateTime=0x1d5e562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77bb78 [0113.137] FindNextFileW (in: hFindFile=0x77bb78, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10710a20, ftCreationTime.dwHighDateTime=0x1d5ec9a, ftLastAccessTime.dwLowDateTime=0x14317940, ftLastAccessTime.dwHighDateTime=0x1d5e562, ftLastWriteTime.dwLowDateTime=0x14317940, ftLastWriteTime.dwHighDateTime=0x1d5e562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.137] FindNextFileW (in: hFindFile=0x77bb78, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4de0780, ftCreationTime.dwHighDateTime=0x1d5e528, ftLastAccessTime.dwLowDateTime=0x1269590, ftLastAccessTime.dwHighDateTime=0x1d5f0f4, ftLastWriteTime.dwLowDateTime=0x1269590, ftLastWriteTime.dwHighDateTime=0x1d5f0f4, nFileSizeHigh=0x0, nFileSizeLow=0xa6e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="6rZJ7 hypgS.m4a", cAlternateFileName="6RZJ7H~1.M4A")) returned 1 [0113.137] FindNextFileW (in: hFindFile=0x77bb78, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67a413a0, ftCreationTime.dwHighDateTime=0x1d5e9bb, ftLastAccessTime.dwLowDateTime=0x33642650, ftLastAccessTime.dwHighDateTime=0x1d5e2bf, ftLastWriteTime.dwLowDateTime=0x33642650, ftLastWriteTime.dwHighDateTime=0x1d5e2bf, nFileSizeHigh=0x0, nFileSizeLow=0x10c1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="80_nJ15qPEV3NN2H.m4a", cAlternateFileName="80_NJ1~1.M4A")) returned 1 [0113.137] FindNextFileW (in: hFindFile=0x77bb78, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94fa1200, ftCreationTime.dwHighDateTime=0x1d5ea1f, ftLastAccessTime.dwLowDateTime=0xba10e1a0, ftLastAccessTime.dwHighDateTime=0x1d5ecb2, ftLastWriteTime.dwLowDateTime=0xba10e1a0, ftLastWriteTime.dwHighDateTime=0x1d5ecb2, nFileSizeHigh=0x0, nFileSizeLow=0x8fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="wGGN4Ksgq2_SW-.m4a", cAlternateFileName="WGGN4K~1.M4A")) returned 1 [0113.137] FindNextFileW (in: hFindFile=0x77bb78, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.137] FindClose (in: hFindFile=0x77bb78 | out: hFindFile=0x77bb78) returned 1 [0113.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec6c) returned 1 [0113.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec78) returned 1 [0113.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb0) returned 1 [0113.138] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\SqWyO_nRxxI4LNX\\r554fiqIY9JSUU_bN", nBufferLength=0x105, lpBuffer=0x19e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\SqWyO_nRxxI4LNX\\r554fiqIY9JSUU_bN", lpFilePart=0x0) returned 0x37 [0113.138] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\SqWyO_nRxxI4LNX\\r554fiqIY9JSUU_bN\\*", lpFindFileData=0x19e9d8 | out: lpFindFileData=0x19e9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10710a20, ftCreationTime.dwHighDateTime=0x1d5ec9a, ftLastAccessTime.dwLowDateTime=0x14317940, ftLastAccessTime.dwHighDateTime=0x1d5e562, ftLastWriteTime.dwLowDateTime=0x14317940, ftLastWriteTime.dwHighDateTime=0x1d5e562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b638 [0113.138] FindNextFileW (in: hFindFile=0x77b638, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10710a20, ftCreationTime.dwHighDateTime=0x1d5ec9a, ftLastAccessTime.dwLowDateTime=0x14317940, ftLastAccessTime.dwHighDateTime=0x1d5e562, ftLastWriteTime.dwLowDateTime=0x14317940, ftLastWriteTime.dwHighDateTime=0x1d5e562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.138] FindNextFileW (in: hFindFile=0x77b638, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4de0780, ftCreationTime.dwHighDateTime=0x1d5e528, ftLastAccessTime.dwLowDateTime=0x1269590, ftLastAccessTime.dwHighDateTime=0x1d5f0f4, ftLastWriteTime.dwLowDateTime=0x1269590, ftLastWriteTime.dwHighDateTime=0x1d5f0f4, nFileSizeHigh=0x0, nFileSizeLow=0xa6e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="6rZJ7 hypgS.m4a", cAlternateFileName="6RZJ7H~1.M4A")) returned 1 [0113.138] FindNextFileW (in: hFindFile=0x77b638, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67a413a0, ftCreationTime.dwHighDateTime=0x1d5e9bb, ftLastAccessTime.dwLowDateTime=0x33642650, ftLastAccessTime.dwHighDateTime=0x1d5e2bf, ftLastWriteTime.dwLowDateTime=0x33642650, ftLastWriteTime.dwHighDateTime=0x1d5e2bf, nFileSizeHigh=0x0, nFileSizeLow=0x10c1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="80_nJ15qPEV3NN2H.m4a", cAlternateFileName="80_NJ1~1.M4A")) returned 1 [0113.138] FindNextFileW (in: hFindFile=0x77b638, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94fa1200, ftCreationTime.dwHighDateTime=0x1d5ea1f, ftLastAccessTime.dwLowDateTime=0xba10e1a0, ftLastAccessTime.dwHighDateTime=0x1d5ecb2, ftLastWriteTime.dwLowDateTime=0xba10e1a0, ftLastWriteTime.dwHighDateTime=0x1d5ecb2, nFileSizeHigh=0x0, nFileSizeLow=0x8fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="wGGN4Ksgq2_SW-.m4a", cAlternateFileName="WGGN4K~1.M4A")) returned 1 [0113.138] FindNextFileW (in: hFindFile=0x77b638, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94fa1200, ftCreationTime.dwHighDateTime=0x1d5ea1f, ftLastAccessTime.dwLowDateTime=0xba10e1a0, ftLastAccessTime.dwHighDateTime=0x1d5ecb2, ftLastWriteTime.dwLowDateTime=0xba10e1a0, ftLastWriteTime.dwHighDateTime=0x1d5ecb2, nFileSizeHigh=0x0, nFileSizeLow=0x8fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="wGGN4Ksgq2_SW-.m4a", cAlternateFileName="WGGN4K~1.M4A")) returned 0 [0113.138] FindClose (in: hFindFile=0x77b638 | out: hFindFile=0x77b638) returned 1 [0113.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec6c) returned 1 [0113.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec78) returned 1 [0113.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb0) returned 1 [0113.139] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\SqWyO_nRxxI4LNX\\Wd_m8px5Jj", nBufferLength=0x105, lpBuffer=0x19e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\SqWyO_nRxxI4LNX\\Wd_m8px5Jj", lpFilePart=0x0) returned 0x30 [0113.139] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\SqWyO_nRxxI4LNX\\Wd_m8px5Jj\\*", lpFindFileData=0x19e9d8 | out: lpFindFileData=0x19e9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebf8a1d0, ftCreationTime.dwHighDateTime=0x1d5f0b3, ftLastAccessTime.dwLowDateTime=0x12b1e030, ftLastAccessTime.dwHighDateTime=0x1d5e217, ftLastWriteTime.dwLowDateTime=0x12b1e030, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b6f8 [0113.139] FindNextFileW (in: hFindFile=0x77b6f8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebf8a1d0, ftCreationTime.dwHighDateTime=0x1d5f0b3, ftLastAccessTime.dwLowDateTime=0x12b1e030, ftLastAccessTime.dwHighDateTime=0x1d5e217, ftLastWriteTime.dwLowDateTime=0x12b1e030, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.139] FindNextFileW (in: hFindFile=0x77b6f8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2f8e40, ftCreationTime.dwHighDateTime=0x1d5e2e5, ftLastAccessTime.dwLowDateTime=0x59792cb0, ftLastAccessTime.dwHighDateTime=0x1d5e4fd, ftLastWriteTime.dwLowDateTime=0x59792cb0, ftLastWriteTime.dwHighDateTime=0x1d5e4fd, nFileSizeHigh=0x0, nFileSizeLow=0x431b, dwReserved0=0x0, dwReserved1=0x0, cFileName="tm0S.wav", cAlternateFileName="")) returned 1 [0113.139] FindNextFileW (in: hFindFile=0x77b6f8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.139] FindClose (in: hFindFile=0x77b6f8 | out: hFindFile=0x77b6f8) returned 1 [0113.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec6c) returned 1 [0113.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec78) returned 1 [0113.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb0) returned 1 [0113.139] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\SqWyO_nRxxI4LNX\\Wd_m8px5Jj", nBufferLength=0x105, lpBuffer=0x19e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\SqWyO_nRxxI4LNX\\Wd_m8px5Jj", lpFilePart=0x0) returned 0x30 [0113.139] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\SqWyO_nRxxI4LNX\\Wd_m8px5Jj\\*", lpFindFileData=0x19e9d8 | out: lpFindFileData=0x19e9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebf8a1d0, ftCreationTime.dwHighDateTime=0x1d5f0b3, ftLastAccessTime.dwLowDateTime=0x12b1e030, ftLastAccessTime.dwHighDateTime=0x1d5e217, ftLastWriteTime.dwLowDateTime=0x12b1e030, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77bbb8 [0113.140] FindNextFileW (in: hFindFile=0x77bbb8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebf8a1d0, ftCreationTime.dwHighDateTime=0x1d5f0b3, ftLastAccessTime.dwLowDateTime=0x12b1e030, ftLastAccessTime.dwHighDateTime=0x1d5e217, ftLastWriteTime.dwLowDateTime=0x12b1e030, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.140] FindNextFileW (in: hFindFile=0x77bbb8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2f8e40, ftCreationTime.dwHighDateTime=0x1d5e2e5, ftLastAccessTime.dwLowDateTime=0x59792cb0, ftLastAccessTime.dwHighDateTime=0x1d5e4fd, ftLastWriteTime.dwLowDateTime=0x59792cb0, ftLastWriteTime.dwHighDateTime=0x1d5e4fd, nFileSizeHigh=0x0, nFileSizeLow=0x431b, dwReserved0=0x0, dwReserved1=0x0, cFileName="tm0S.wav", cAlternateFileName="")) returned 1 [0113.140] FindNextFileW (in: hFindFile=0x77bbb8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b2f8e40, ftCreationTime.dwHighDateTime=0x1d5e2e5, ftLastAccessTime.dwLowDateTime=0x59792cb0, ftLastAccessTime.dwHighDateTime=0x1d5e4fd, ftLastWriteTime.dwLowDateTime=0x59792cb0, ftLastWriteTime.dwHighDateTime=0x1d5e4fd, nFileSizeHigh=0x0, nFileSizeLow=0x431b, dwReserved0=0x0, dwReserved1=0x0, cFileName="tm0S.wav", cAlternateFileName="")) returned 0 [0113.140] FindClose (in: hFindFile=0x77bbb8 | out: hFindFile=0x77bbb8) returned 1 [0113.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec6c) returned 1 [0113.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec78) returned 1 [0113.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed98) returned 1 [0113.140] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive", nBufferLength=0x105, lpBuffer=0x19e84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\OneDrive", lpFilePart=0x0) returned 0x18 [0113.140] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive\\*", lpFindFileData=0x19eac0 | out: lpFindFileData=0x19eac0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b638 [0113.145] FindNextFileW (in: hFindFile=0x77b638, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.145] FindNextFileW (in: hFindFile=0x77b638, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.146] FindNextFileW (in: hFindFile=0x77b638, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.147] FindClose (in: hFindFile=0x77b638 | out: hFindFile=0x77b638) returned 1 [0113.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed54) returned 1 [0113.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed60) returned 1 [0113.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed98) returned 1 [0113.147] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive", nBufferLength=0x105, lpBuffer=0x19e84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\OneDrive", lpFilePart=0x0) returned 0x18 [0113.147] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive\\*", lpFindFileData=0x19eac0 | out: lpFindFileData=0x19eac0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b9f8 [0113.147] FindNextFileW (in: hFindFile=0x77b9f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.148] FindNextFileW (in: hFindFile=0x77b9f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.148] FindNextFileW (in: hFindFile=0x77b9f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0113.148] FindClose (in: hFindFile=0x77b9f8 | out: hFindFile=0x77b9f8) returned 1 [0113.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed54) returned 1 [0113.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed60) returned 1 [0113.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed98) returned 1 [0113.148] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games", nBufferLength=0x105, lpBuffer=0x19e84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Saved Games", lpFilePart=0x0) returned 0x1b [0113.148] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games\\*", lpFindFileData=0x19eac0 | out: lpFindFileData=0x19eac0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b578 [0113.148] FindNextFileW (in: hFindFile=0x77b578, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.148] FindNextFileW (in: hFindFile=0x77b578, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.148] FindNextFileW (in: hFindFile=0x77b578, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.149] FindClose (in: hFindFile=0x77b578 | out: hFindFile=0x77b578) returned 1 [0113.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed54) returned 1 [0113.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed60) returned 1 [0113.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed98) returned 1 [0113.149] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games", nBufferLength=0x105, lpBuffer=0x19e84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Saved Games", lpFilePart=0x0) returned 0x1b [0113.149] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games\\*", lpFindFileData=0x19eac0 | out: lpFindFileData=0x19eac0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b738 [0113.149] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.149] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.149] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0113.149] FindClose (in: hFindFile=0x77b738 | out: hFindFile=0x77b738) returned 1 [0113.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed54) returned 1 [0113.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed60) returned 1 [0113.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed98) returned 1 [0113.150] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites", nBufferLength=0x105, lpBuffer=0x19e84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites", lpFilePart=0x0) returned 0x19 [0113.150] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\*", lpFindFileData=0x19eac0 | out: lpFindFileData=0x19eac0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b5f8 [0113.150] FindNextFileW (in: hFindFile=0x77b5f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.150] FindNextFileW (in: hFindFile=0x77b5f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43598c8e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43b9f870, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x43b9f870, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bing.url", cAlternateFileName="")) returned 1 [0113.150] FindNextFileW (in: hFindFile=0x77b5f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.150] FindNextFileW (in: hFindFile=0x77b5f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0113.150] FindNextFileW (in: hFindFile=0x77b5f8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 0 [0113.150] FindClose (in: hFindFile=0x77b5f8 | out: hFindFile=0x77b5f8) returned 1 [0113.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed54) returned 1 [0113.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed60) returned 1 [0113.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed98) returned 1 [0113.151] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites", nBufferLength=0x105, lpBuffer=0x19e84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites", lpFilePart=0x0) returned 0x19 [0113.151] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\*", lpFindFileData=0x19eac0 | out: lpFindFileData=0x19eac0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77baf8 [0113.151] FindNextFileW (in: hFindFile=0x77baf8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.151] FindNextFileW (in: hFindFile=0x77baf8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43598c8e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43b9f870, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x43b9f870, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bing.url", cAlternateFileName="")) returned 1 [0113.151] FindNextFileW (in: hFindFile=0x77baf8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.151] FindNextFileW (in: hFindFile=0x77baf8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0113.151] FindNextFileW (in: hFindFile=0x77baf8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.151] FindClose (in: hFindFile=0x77baf8 | out: hFindFile=0x77baf8) returned 1 [0113.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed54) returned 1 [0113.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed60) returned 1 [0113.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed24) returned 1 [0113.151] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x19e7d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites\\Links", lpFilePart=0x0) returned 0x1f [0113.151] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\*", lpFindFileData=0x19ea4c | out: lpFindFileData=0x19ea4c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b678 [0113.152] FindNextFileW (in: hFindFile=0x77b678, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.152] FindNextFileW (in: hFindFile=0x77b678, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.152] FindNextFileW (in: hFindFile=0x77b678, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.152] FindClose (in: hFindFile=0x77b678 | out: hFindFile=0x77b678) returned 1 [0113.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ece0) returned 1 [0113.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecec) returned 1 [0113.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed24) returned 1 [0113.152] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x19e7d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites\\Links", lpFilePart=0x0) returned 0x1f [0113.152] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\*", lpFindFileData=0x19ea4c | out: lpFindFileData=0x19ea4c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b838 [0113.152] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.153] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.153] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0113.153] FindClose (in: hFindFile=0x77b838 | out: hFindFile=0x77b838) returned 1 [0113.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ece0) returned 1 [0113.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecec) returned 1 [0113.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed98) returned 1 [0113.153] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Searches", nBufferLength=0x105, lpBuffer=0x19e84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Searches", lpFilePart=0x0) returned 0x18 [0113.153] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\*", lpFindFileData=0x19eac0 | out: lpFindFileData=0x19eac0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b538 [0113.153] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.153] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.153] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44269063, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44269063, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44269063, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0113.154] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44242e24, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44242e24, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44242e24, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0113.154] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 1 [0113.154] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.154] FindClose (in: hFindFile=0x77b538 | out: hFindFile=0x77b538) returned 1 [0113.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed54) returned 1 [0113.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed60) returned 1 [0113.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed98) returned 1 [0113.154] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Searches", nBufferLength=0x105, lpBuffer=0x19e84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Searches", lpFilePart=0x0) returned 0x18 [0113.154] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\*", lpFindFileData=0x19eac0 | out: lpFindFileData=0x19eac0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b738 [0113.154] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.154] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.154] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44269063, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44269063, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44269063, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0113.155] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44242e24, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44242e24, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44242e24, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0113.155] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 1 [0113.155] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 0 [0113.155] FindClose (in: hFindFile=0x77b738 | out: hFindFile=0x77b738) returned 1 [0113.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed54) returned 1 [0113.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed60) returned 1 [0113.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed98) returned 1 [0113.155] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos", nBufferLength=0x105, lpBuffer=0x19e84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos", lpFilePart=0x0) returned 0x16 [0113.155] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\*", lpFindFileData=0x19eac0 | out: lpFindFileData=0x19eac0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe679e5e8, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe679e5e8, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b778 [0113.155] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe679e5e8, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe679e5e8, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.155] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc714900, ftCreationTime.dwHighDateTime=0x1d5ea9f, ftLastAccessTime.dwLowDateTime=0xb2afb4a0, ftLastAccessTime.dwHighDateTime=0x1d5e50e, ftLastWriteTime.dwLowDateTime=0xb2afb4a0, ftLastWriteTime.dwHighDateTime=0x1d5e50e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0w8t5", cAlternateFileName="")) returned 1 [0113.155] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1d7d2b0, ftCreationTime.dwHighDateTime=0x1d5e35c, ftLastAccessTime.dwLowDateTime=0xceba25a0, ftLastAccessTime.dwHighDateTime=0x1d5e70b, ftLastWriteTime.dwLowDateTime=0xceba25a0, ftLastWriteTime.dwHighDateTime=0x1d5e70b, nFileSizeHigh=0x0, nFileSizeLow=0x136d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="4aSqpWHLmh-gKsTa8c5h.flv", cAlternateFileName="4ASQPW~1.FLV")) returned 1 [0113.155] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43f94523, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43f94523, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.156] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34fc0500, ftCreationTime.dwHighDateTime=0x1d5ee9f, ftLastAccessTime.dwLowDateTime=0x6ead70d0, ftLastAccessTime.dwHighDateTime=0x1d5e202, ftLastWriteTime.dwLowDateTime=0x6ead70d0, ftLastWriteTime.dwHighDateTime=0x1d5e202, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gf9AWRpwu_3lT12g8", cAlternateFileName="GF9AWR~1")) returned 1 [0113.156] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc8b0020, ftCreationTime.dwHighDateTime=0x1d5f04c, ftLastAccessTime.dwLowDateTime=0xec4fd840, ftLastAccessTime.dwHighDateTime=0x1d5e1ba, ftLastWriteTime.dwLowDateTime=0xec4fd840, ftLastWriteTime.dwHighDateTime=0x1d5e1ba, nFileSizeHigh=0x0, nFileSizeLow=0x1427, dwReserved0=0x0, dwReserved1=0x0, cFileName="jR9NXTr2_5Ikd-IG 1W.mp4", cAlternateFileName="JR9NXT~1.MP4")) returned 1 [0113.156] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7411a8e0, ftCreationTime.dwHighDateTime=0x1d5f097, ftLastAccessTime.dwLowDateTime=0xa6797260, ftLastAccessTime.dwHighDateTime=0x1d5e4dd, ftLastWriteTime.dwLowDateTime=0xa6797260, ftLastWriteTime.dwHighDateTime=0x1d5e4dd, nFileSizeHigh=0x0, nFileSizeLow=0x15d19, dwReserved0=0x0, dwReserved1=0x0, cFileName="r-7y8-k7VC.flv", cAlternateFileName="R-7Y8-~1.FLV")) returned 1 [0113.156] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54af2cd0, ftCreationTime.dwHighDateTime=0x1d5e803, ftLastAccessTime.dwLowDateTime=0xe0c69430, ftLastAccessTime.dwHighDateTime=0x1d5e7f2, ftLastWriteTime.dwLowDateTime=0xe0c69430, ftLastWriteTime.dwHighDateTime=0x1d5e7f2, nFileSizeHigh=0x0, nFileSizeLow=0x11dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="RlUuHgH9CpkVKnxm1.mkv", cAlternateFileName="RLUUHG~1.MKV")) returned 1 [0113.156] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad81bed0, ftCreationTime.dwHighDateTime=0x1d5e5cf, ftLastAccessTime.dwLowDateTime=0xb615d110, ftLastAccessTime.dwHighDateTime=0x1d5eb03, ftLastWriteTime.dwLowDateTime=0xb615d110, ftLastWriteTime.dwHighDateTime=0x1d5eb03, nFileSizeHigh=0x0, nFileSizeLow=0x8269, dwReserved0=0x0, dwReserved1=0x0, cFileName="x3_AH.mkv", cAlternateFileName="")) returned 1 [0113.156] FindNextFileW (in: hFindFile=0x77b778, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.156] FindClose (in: hFindFile=0x77b778 | out: hFindFile=0x77b778) returned 1 [0113.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed54) returned 1 [0113.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed60) returned 1 [0113.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed98) returned 1 [0113.156] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos", nBufferLength=0x105, lpBuffer=0x19e84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos", lpFilePart=0x0) returned 0x16 [0113.156] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\*", lpFindFileData=0x19eac0 | out: lpFindFileData=0x19eac0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe679e5e8, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe679e5e8, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77baf8 [0113.156] FindNextFileW (in: hFindFile=0x77baf8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe679e5e8, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe679e5e8, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.157] FindNextFileW (in: hFindFile=0x77baf8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc714900, ftCreationTime.dwHighDateTime=0x1d5ea9f, ftLastAccessTime.dwLowDateTime=0xb2afb4a0, ftLastAccessTime.dwHighDateTime=0x1d5e50e, ftLastWriteTime.dwLowDateTime=0xb2afb4a0, ftLastWriteTime.dwHighDateTime=0x1d5e50e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0w8t5", cAlternateFileName="")) returned 1 [0113.157] FindNextFileW (in: hFindFile=0x77baf8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1d7d2b0, ftCreationTime.dwHighDateTime=0x1d5e35c, ftLastAccessTime.dwLowDateTime=0xceba25a0, ftLastAccessTime.dwHighDateTime=0x1d5e70b, ftLastWriteTime.dwLowDateTime=0xceba25a0, ftLastWriteTime.dwHighDateTime=0x1d5e70b, nFileSizeHigh=0x0, nFileSizeLow=0x136d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="4aSqpWHLmh-gKsTa8c5h.flv", cAlternateFileName="4ASQPW~1.FLV")) returned 1 [0113.157] FindNextFileW (in: hFindFile=0x77baf8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43f94523, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43f94523, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.157] FindNextFileW (in: hFindFile=0x77baf8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34fc0500, ftCreationTime.dwHighDateTime=0x1d5ee9f, ftLastAccessTime.dwLowDateTime=0x6ead70d0, ftLastAccessTime.dwHighDateTime=0x1d5e202, ftLastWriteTime.dwLowDateTime=0x6ead70d0, ftLastWriteTime.dwHighDateTime=0x1d5e202, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gf9AWRpwu_3lT12g8", cAlternateFileName="GF9AWR~1")) returned 1 [0113.157] FindNextFileW (in: hFindFile=0x77baf8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc8b0020, ftCreationTime.dwHighDateTime=0x1d5f04c, ftLastAccessTime.dwLowDateTime=0xec4fd840, ftLastAccessTime.dwHighDateTime=0x1d5e1ba, ftLastWriteTime.dwLowDateTime=0xec4fd840, ftLastWriteTime.dwHighDateTime=0x1d5e1ba, nFileSizeHigh=0x0, nFileSizeLow=0x1427, dwReserved0=0x0, dwReserved1=0x0, cFileName="jR9NXTr2_5Ikd-IG 1W.mp4", cAlternateFileName="JR9NXT~1.MP4")) returned 1 [0113.157] FindNextFileW (in: hFindFile=0x77baf8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7411a8e0, ftCreationTime.dwHighDateTime=0x1d5f097, ftLastAccessTime.dwLowDateTime=0xa6797260, ftLastAccessTime.dwHighDateTime=0x1d5e4dd, ftLastWriteTime.dwLowDateTime=0xa6797260, ftLastWriteTime.dwHighDateTime=0x1d5e4dd, nFileSizeHigh=0x0, nFileSizeLow=0x15d19, dwReserved0=0x0, dwReserved1=0x0, cFileName="r-7y8-k7VC.flv", cAlternateFileName="R-7Y8-~1.FLV")) returned 1 [0113.157] FindNextFileW (in: hFindFile=0x77baf8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54af2cd0, ftCreationTime.dwHighDateTime=0x1d5e803, ftLastAccessTime.dwLowDateTime=0xe0c69430, ftLastAccessTime.dwHighDateTime=0x1d5e7f2, ftLastWriteTime.dwLowDateTime=0xe0c69430, ftLastWriteTime.dwHighDateTime=0x1d5e7f2, nFileSizeHigh=0x0, nFileSizeLow=0x11dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="RlUuHgH9CpkVKnxm1.mkv", cAlternateFileName="RLUUHG~1.MKV")) returned 1 [0113.157] FindNextFileW (in: hFindFile=0x77baf8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad81bed0, ftCreationTime.dwHighDateTime=0x1d5e5cf, ftLastAccessTime.dwLowDateTime=0xb615d110, ftLastAccessTime.dwHighDateTime=0x1d5eb03, ftLastWriteTime.dwLowDateTime=0xb615d110, ftLastWriteTime.dwHighDateTime=0x1d5eb03, nFileSizeHigh=0x0, nFileSizeLow=0x8269, dwReserved0=0x0, dwReserved1=0x0, cFileName="x3_AH.mkv", cAlternateFileName="")) returned 1 [0113.157] FindNextFileW (in: hFindFile=0x77baf8, lpFindFileData=0x19eacc | out: lpFindFileData=0x19eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad81bed0, ftCreationTime.dwHighDateTime=0x1d5e5cf, ftLastAccessTime.dwLowDateTime=0xb615d110, ftLastAccessTime.dwHighDateTime=0x1d5eb03, ftLastWriteTime.dwLowDateTime=0xb615d110, ftLastWriteTime.dwHighDateTime=0x1d5eb03, nFileSizeHigh=0x0, nFileSizeLow=0x8269, dwReserved0=0x0, dwReserved1=0x0, cFileName="x3_AH.mkv", cAlternateFileName="")) returned 0 [0113.157] FindClose (in: hFindFile=0x77baf8 | out: hFindFile=0x77baf8) returned 1 [0113.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed54) returned 1 [0113.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed60) returned 1 [0113.157] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\jR9NXTr2_5Ikd-IG 1W.mp4", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\jR9NXTr2_5Ikd-IG 1W.mp4", lpFilePart=0x0) returned 0x2e [0113.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0113.157] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\jR9NXTr2_5Ikd-IG 1W.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\jr9nxtr2_5ikd-ig 1w.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0113.158] GetFileType (hFile=0x37c) returned 0x1 [0113.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0113.158] GetFileType (hFile=0x37c) returned 0x1 [0113.158] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x1427 [0113.158] ReadFile (in: hFile=0x37c, lpBuffer=0x269a554, nNumberOfBytesToRead=0x1427, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x269a554*, lpNumberOfBytesRead=0x19ecec*=0x1427, lpOverlapped=0x0) returned 1 [0113.159] CloseHandle (hObject=0x37c) returned 1 [0113.195] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0113.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0113.196] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0113.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0113.196] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\jR9NXTr2_5Ikd-IG 1W.mp4", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\jR9NXTr2_5Ikd-IG 1W.mp4", lpFilePart=0x0) returned 0x2e [0113.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0113.196] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\jR9NXTr2_5Ikd-IG 1W.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\jr9nxtr2_5ikd-ig 1w.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0113.197] GetFileType (hFile=0x37c) returned 0x1 [0113.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0113.198] GetFileType (hFile=0x37c) returned 0x1 [0113.198] WriteFile (in: hFile=0x37c, lpBuffer=0x26ed98c*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x26ed98c*, lpNumberOfBytesWritten=0x19ece0*=0x1430, lpOverlapped=0x0) returned 1 [0113.199] CloseHandle (hObject=0x37c) returned 1 [0113.200] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\jR9NXTr2_5Ikd-IG 1W.mp4", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\jR9NXTr2_5Ikd-IG 1W.mp4", lpFilePart=0x0) returned 0x2e [0113.200] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\jR9NXTr2_5Ikd-IG 1W.mp4.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\jR9NXTr2_5Ikd-IG 1W.mp4.spybuster", lpFilePart=0x0) returned 0x38 [0113.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0113.200] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\jR9NXTr2_5Ikd-IG 1W.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\jr9nxtr2_5ikd-ig 1w.mp4"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc8b0020, ftCreationTime.dwHighDateTime=0x1d5f04c, ftLastAccessTime.dwLowDateTime=0xec4fd840, ftLastAccessTime.dwHighDateTime=0x1d5e1ba, ftLastWriteTime.dwLowDateTime=0xb8bbaa98, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x1430)) returned 1 [0113.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0113.201] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\jR9NXTr2_5Ikd-IG 1W.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\jr9nxtr2_5ikd-ig 1w.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\jR9NXTr2_5Ikd-IG 1W.mp4.spybuster" (normalized: "c:\\users\\fd1hvy\\videos\\jr9nxtr2_5ikd-ig 1w.mp4.spybuster")) returned 1 [0113.201] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\RlUuHgH9CpkVKnxm1.mkv", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\RlUuHgH9CpkVKnxm1.mkv", lpFilePart=0x0) returned 0x2c [0113.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0113.201] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\RlUuHgH9CpkVKnxm1.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\rluuhgh9cpkvknxm1.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0113.202] GetFileType (hFile=0x37c) returned 0x1 [0113.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0113.202] GetFileType (hFile=0x37c) returned 0x1 [0113.202] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x11dd [0113.202] ReadFile (in: hFile=0x37c, lpBuffer=0x26ef288, nNumberOfBytesToRead=0x11dd, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x26ef288*, lpNumberOfBytesRead=0x19ecec*=0x11dd, lpOverlapped=0x0) returned 1 [0113.203] CloseHandle (hObject=0x37c) returned 1 [0113.237] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0113.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0113.237] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0113.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0113.237] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\RlUuHgH9CpkVKnxm1.mkv", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\RlUuHgH9CpkVKnxm1.mkv", lpFilePart=0x0) returned 0x2c [0113.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0113.238] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\RlUuHgH9CpkVKnxm1.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\rluuhgh9cpkvknxm1.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0113.239] GetFileType (hFile=0x37c) returned 0x1 [0113.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0113.239] GetFileType (hFile=0x37c) returned 0x1 [0113.239] WriteFile (in: hFile=0x37c, lpBuffer=0x27419d4*, nNumberOfBytesToWrite=0x11e0, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x27419d4*, lpNumberOfBytesWritten=0x19ece0*=0x11e0, lpOverlapped=0x0) returned 1 [0113.241] CloseHandle (hObject=0x37c) returned 1 [0113.242] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\RlUuHgH9CpkVKnxm1.mkv", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\RlUuHgH9CpkVKnxm1.mkv", lpFilePart=0x0) returned 0x2c [0113.242] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\RlUuHgH9CpkVKnxm1.mkv.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\RlUuHgH9CpkVKnxm1.mkv.spybuster", lpFilePart=0x0) returned 0x36 [0113.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0113.242] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\RlUuHgH9CpkVKnxm1.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\rluuhgh9cpkvknxm1.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54af2cd0, ftCreationTime.dwHighDateTime=0x1d5e803, ftLastAccessTime.dwLowDateTime=0xe0c69430, ftLastAccessTime.dwHighDateTime=0x1d5e7f2, ftLastWriteTime.dwLowDateTime=0xb8c294f2, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x11e0)) returned 1 [0113.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0113.242] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\RlUuHgH9CpkVKnxm1.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\rluuhgh9cpkvknxm1.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\RlUuHgH9CpkVKnxm1.mkv.spybuster" (normalized: "c:\\users\\fd1hvy\\videos\\rluuhgh9cpkvknxm1.mkv.spybuster")) returned 1 [0113.243] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\x3_AH.mkv", nBufferLength=0x105, lpBuffer=0x19e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\x3_AH.mkv", lpFilePart=0x0) returned 0x20 [0113.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0113.243] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\x3_AH.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\x3_ah.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0113.243] GetFileType (hFile=0x37c) returned 0x1 [0113.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0113.243] GetFileType (hFile=0x37c) returned 0x1 [0113.243] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed40 | out: lpFileSizeHigh=0x19ed40*=0x0) returned 0x8269 [0113.243] ReadFile (in: hFile=0x37c, lpBuffer=0x2743024, nNumberOfBytesToRead=0x8269, lpNumberOfBytesRead=0x19ecec, lpOverlapped=0x0 | out: lpBuffer=0x2743024*, lpNumberOfBytesRead=0x19ecec*=0x8269, lpOverlapped=0x0) returned 1 [0113.245] CloseHandle (hObject=0x37c) returned 1 [0113.269] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0113.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb8) returned 1 [0113.269] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed34 | out: lpFileInformation=0x19ed34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0113.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecb4) returned 1 [0113.281] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\x3_AH.mkv", nBufferLength=0x105, lpBuffer=0x19e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\x3_AH.mkv", lpFilePart=0x0) returned 0x20 [0113.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0113.282] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\x3_AH.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\x3_ah.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0113.284] GetFileType (hFile=0x37c) returned 0x1 [0113.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0113.284] GetFileType (hFile=0x37c) returned 0x1 [0113.284] WriteFile (in: hFile=0x37c, lpBuffer=0x27b8a40*, nNumberOfBytesToWrite=0x8270, lpNumberOfBytesWritten=0x19ece0, lpOverlapped=0x0 | out: lpBuffer=0x27b8a40*, lpNumberOfBytesWritten=0x19ece0*=0x8270, lpOverlapped=0x0) returned 1 [0113.286] CloseHandle (hObject=0x37c) returned 1 [0113.288] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\x3_AH.mkv", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\x3_AH.mkv", lpFilePart=0x0) returned 0x20 [0113.288] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\x3_AH.mkv.spybuster", nBufferLength=0x105, lpBuffer=0x19e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\x3_AH.mkv.spybuster", lpFilePart=0x0) returned 0x2a [0113.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecc4) returned 1 [0113.288] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\x3_AH.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\x3_ah.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19ed40 | out: lpFileInformation=0x19ed40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad81bed0, ftCreationTime.dwHighDateTime=0x1d5e5cf, ftLastAccessTime.dwLowDateTime=0xb615d110, ftLastAccessTime.dwHighDateTime=0x1d5eb03, ftLastWriteTime.dwLowDateTime=0xb8c9bdee, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x8270)) returned 1 [0113.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0113.289] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\x3_AH.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\x3_ah.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\x3_AH.mkv.spybuster" (normalized: "c:\\users\\fd1hvy\\videos\\x3_ah.mkv.spybuster")) returned 1 [0113.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed24) returned 1 [0113.320] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5", nBufferLength=0x105, lpBuffer=0x19e7d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5", lpFilePart=0x0) returned 0x1c [0113.320] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\*", lpFindFileData=0x19ea4c | out: lpFindFileData=0x19ea4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc714900, ftCreationTime.dwHighDateTime=0x1d5ea9f, ftLastAccessTime.dwLowDateTime=0xb2afb4a0, ftLastAccessTime.dwHighDateTime=0x1d5e50e, ftLastWriteTime.dwLowDateTime=0xb2afb4a0, ftLastWriteTime.dwHighDateTime=0x1d5e50e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b978 [0113.320] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc714900, ftCreationTime.dwHighDateTime=0x1d5ea9f, ftLastAccessTime.dwLowDateTime=0xb2afb4a0, ftLastAccessTime.dwHighDateTime=0x1d5e50e, ftLastWriteTime.dwLowDateTime=0xb2afb4a0, ftLastWriteTime.dwHighDateTime=0x1d5e50e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.320] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252014b0, ftCreationTime.dwHighDateTime=0x1d5e278, ftLastAccessTime.dwLowDateTime=0xd2d12540, ftLastAccessTime.dwHighDateTime=0x1d5e5de, ftLastWriteTime.dwLowDateTime=0xd2d12540, ftLastWriteTime.dwHighDateTime=0x1d5e5de, nFileSizeHigh=0x0, nFileSizeLow=0x111c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="G_6QGlYGgvlQ.flv", cAlternateFileName="G_6QGL~1.FLV")) returned 1 [0113.320] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25401c10, ftCreationTime.dwHighDateTime=0x1d5e6e7, ftLastAccessTime.dwLowDateTime=0x62f84090, ftLastAccessTime.dwHighDateTime=0x1d5e562, ftLastWriteTime.dwLowDateTime=0x62f84090, ftLastWriteTime.dwHighDateTime=0x1d5e562, nFileSizeHigh=0x0, nFileSizeLow=0x7bc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="I02qKcw8y.swf", cAlternateFileName="I02QKC~1.SWF")) returned 1 [0113.320] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5dbdf8d0, ftCreationTime.dwHighDateTime=0x1d5e42d, ftLastAccessTime.dwLowDateTime=0x2f723f90, ftLastAccessTime.dwHighDateTime=0x1d5ec6b, ftLastWriteTime.dwLowDateTime=0x2f723f90, ftLastWriteTime.dwHighDateTime=0x1d5ec6b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IdRynCfnNRP", cAlternateFileName="IDRYNC~1")) returned 1 [0113.320] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88923520, ftCreationTime.dwHighDateTime=0x1d5eb72, ftLastAccessTime.dwLowDateTime=0x37facd00, ftLastAccessTime.dwHighDateTime=0x1d5ef16, ftLastWriteTime.dwLowDateTime=0x37facd00, ftLastWriteTime.dwHighDateTime=0x1d5ef16, nFileSizeHigh=0x0, nFileSizeLow=0x135a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J60vjNHm.mp4", cAlternateFileName="")) returned 1 [0113.320] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9d4aa10, ftCreationTime.dwHighDateTime=0x1d5ea69, ftLastAccessTime.dwLowDateTime=0xb1256fc0, ftLastAccessTime.dwHighDateTime=0x1d5ee51, ftLastWriteTime.dwLowDateTime=0xb1256fc0, ftLastWriteTime.dwHighDateTime=0x1d5ee51, nFileSizeHigh=0x0, nFileSizeLow=0x10459, dwReserved0=0x0, dwReserved1=0x0, cFileName="la-7YGCqtlgmjKcxcDai.mkv", cAlternateFileName="LA-7YG~1.MKV")) returned 1 [0113.320] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58d0e830, ftCreationTime.dwHighDateTime=0x1d5e1af, ftLastAccessTime.dwLowDateTime=0x175bd8a0, ftLastAccessTime.dwHighDateTime=0x1d5ea0c, ftLastWriteTime.dwLowDateTime=0x175bd8a0, ftLastWriteTime.dwHighDateTime=0x1d5ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x11ac6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ni0d0MhAw4fjD.swf", cAlternateFileName="NI0D0M~1.SWF")) returned 1 [0113.320] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36d474f0, ftCreationTime.dwHighDateTime=0x1d5ede3, ftLastAccessTime.dwLowDateTime=0xf96f83e0, ftLastAccessTime.dwHighDateTime=0x1d5e7f0, ftLastWriteTime.dwLowDateTime=0xf96f83e0, ftLastWriteTime.dwHighDateTime=0x1d5e7f0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qNkSss06vEgW e7yXVm4", cAlternateFileName="QNKSSS~1")) returned 1 [0113.320] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85ee4710, ftCreationTime.dwHighDateTime=0x1d5eaea, ftLastAccessTime.dwLowDateTime=0x3cb701e0, ftLastAccessTime.dwHighDateTime=0x1d5e518, ftLastWriteTime.dwLowDateTime=0x3cb701e0, ftLastWriteTime.dwHighDateTime=0x1d5e518, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wnj7t2K0sr82w8ym", cAlternateFileName="WNJ7T2~1")) returned 1 [0113.320] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20ddac30, ftCreationTime.dwHighDateTime=0x1d5e86f, ftLastAccessTime.dwLowDateTime=0xb167b840, ftLastAccessTime.dwHighDateTime=0x1d5e6a3, ftLastWriteTime.dwLowDateTime=0xb167b840, ftLastWriteTime.dwHighDateTime=0x1d5e6a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wZpzNZ7EVrJ XYv", cAlternateFileName="WZPZNZ~1")) returned 1 [0113.320] FindNextFileW (in: hFindFile=0x77b978, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20ddac30, ftCreationTime.dwHighDateTime=0x1d5e86f, ftLastAccessTime.dwLowDateTime=0xb167b840, ftLastAccessTime.dwHighDateTime=0x1d5e6a3, ftLastWriteTime.dwLowDateTime=0xb167b840, ftLastWriteTime.dwHighDateTime=0x1d5e6a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wZpzNZ7EVrJ XYv", cAlternateFileName="WZPZNZ~1")) returned 0 [0113.321] FindClose (in: hFindFile=0x77b978 | out: hFindFile=0x77b978) returned 1 [0113.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ece0) returned 1 [0113.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecec) returned 1 [0113.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed24) returned 1 [0113.321] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5", nBufferLength=0x105, lpBuffer=0x19e7d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5", lpFilePart=0x0) returned 0x1c [0113.321] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\*", lpFindFileData=0x19ea4c | out: lpFindFileData=0x19ea4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc714900, ftCreationTime.dwHighDateTime=0x1d5ea9f, ftLastAccessTime.dwLowDateTime=0xb2afb4a0, ftLastAccessTime.dwHighDateTime=0x1d5e50e, ftLastWriteTime.dwLowDateTime=0xb2afb4a0, ftLastWriteTime.dwHighDateTime=0x1d5e50e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b7f8 [0113.321] FindNextFileW (in: hFindFile=0x77b7f8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc714900, ftCreationTime.dwHighDateTime=0x1d5ea9f, ftLastAccessTime.dwLowDateTime=0xb2afb4a0, ftLastAccessTime.dwHighDateTime=0x1d5e50e, ftLastWriteTime.dwLowDateTime=0xb2afb4a0, ftLastWriteTime.dwHighDateTime=0x1d5e50e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.321] FindNextFileW (in: hFindFile=0x77b7f8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252014b0, ftCreationTime.dwHighDateTime=0x1d5e278, ftLastAccessTime.dwLowDateTime=0xd2d12540, ftLastAccessTime.dwHighDateTime=0x1d5e5de, ftLastWriteTime.dwLowDateTime=0xd2d12540, ftLastWriteTime.dwHighDateTime=0x1d5e5de, nFileSizeHigh=0x0, nFileSizeLow=0x111c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="G_6QGlYGgvlQ.flv", cAlternateFileName="G_6QGL~1.FLV")) returned 1 [0113.321] FindNextFileW (in: hFindFile=0x77b7f8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25401c10, ftCreationTime.dwHighDateTime=0x1d5e6e7, ftLastAccessTime.dwLowDateTime=0x62f84090, ftLastAccessTime.dwHighDateTime=0x1d5e562, ftLastWriteTime.dwLowDateTime=0x62f84090, ftLastWriteTime.dwHighDateTime=0x1d5e562, nFileSizeHigh=0x0, nFileSizeLow=0x7bc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="I02qKcw8y.swf", cAlternateFileName="I02QKC~1.SWF")) returned 1 [0113.321] FindNextFileW (in: hFindFile=0x77b7f8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5dbdf8d0, ftCreationTime.dwHighDateTime=0x1d5e42d, ftLastAccessTime.dwLowDateTime=0x2f723f90, ftLastAccessTime.dwHighDateTime=0x1d5ec6b, ftLastWriteTime.dwLowDateTime=0x2f723f90, ftLastWriteTime.dwHighDateTime=0x1d5ec6b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IdRynCfnNRP", cAlternateFileName="IDRYNC~1")) returned 1 [0113.321] FindNextFileW (in: hFindFile=0x77b7f8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88923520, ftCreationTime.dwHighDateTime=0x1d5eb72, ftLastAccessTime.dwLowDateTime=0x37facd00, ftLastAccessTime.dwHighDateTime=0x1d5ef16, ftLastWriteTime.dwLowDateTime=0x37facd00, ftLastWriteTime.dwHighDateTime=0x1d5ef16, nFileSizeHigh=0x0, nFileSizeLow=0x135a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J60vjNHm.mp4", cAlternateFileName="")) returned 1 [0113.322] FindNextFileW (in: hFindFile=0x77b7f8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9d4aa10, ftCreationTime.dwHighDateTime=0x1d5ea69, ftLastAccessTime.dwLowDateTime=0xb1256fc0, ftLastAccessTime.dwHighDateTime=0x1d5ee51, ftLastWriteTime.dwLowDateTime=0xb1256fc0, ftLastWriteTime.dwHighDateTime=0x1d5ee51, nFileSizeHigh=0x0, nFileSizeLow=0x10459, dwReserved0=0x0, dwReserved1=0x0, cFileName="la-7YGCqtlgmjKcxcDai.mkv", cAlternateFileName="LA-7YG~1.MKV")) returned 1 [0113.322] FindNextFileW (in: hFindFile=0x77b7f8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58d0e830, ftCreationTime.dwHighDateTime=0x1d5e1af, ftLastAccessTime.dwLowDateTime=0x175bd8a0, ftLastAccessTime.dwHighDateTime=0x1d5ea0c, ftLastWriteTime.dwLowDateTime=0x175bd8a0, ftLastWriteTime.dwHighDateTime=0x1d5ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x11ac6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ni0d0MhAw4fjD.swf", cAlternateFileName="NI0D0M~1.SWF")) returned 1 [0113.322] FindNextFileW (in: hFindFile=0x77b7f8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36d474f0, ftCreationTime.dwHighDateTime=0x1d5ede3, ftLastAccessTime.dwLowDateTime=0xf96f83e0, ftLastAccessTime.dwHighDateTime=0x1d5e7f0, ftLastWriteTime.dwLowDateTime=0xf96f83e0, ftLastWriteTime.dwHighDateTime=0x1d5e7f0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qNkSss06vEgW e7yXVm4", cAlternateFileName="QNKSSS~1")) returned 1 [0113.322] FindNextFileW (in: hFindFile=0x77b7f8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85ee4710, ftCreationTime.dwHighDateTime=0x1d5eaea, ftLastAccessTime.dwLowDateTime=0x3cb701e0, ftLastAccessTime.dwHighDateTime=0x1d5e518, ftLastWriteTime.dwLowDateTime=0x3cb701e0, ftLastWriteTime.dwHighDateTime=0x1d5e518, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wnj7t2K0sr82w8ym", cAlternateFileName="WNJ7T2~1")) returned 1 [0113.322] FindNextFileW (in: hFindFile=0x77b7f8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20ddac30, ftCreationTime.dwHighDateTime=0x1d5e86f, ftLastAccessTime.dwLowDateTime=0xb167b840, ftLastAccessTime.dwHighDateTime=0x1d5e6a3, ftLastWriteTime.dwLowDateTime=0xb167b840, ftLastWriteTime.dwHighDateTime=0x1d5e6a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wZpzNZ7EVrJ XYv", cAlternateFileName="WZPZNZ~1")) returned 1 [0113.322] FindNextFileW (in: hFindFile=0x77b7f8, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.322] FindClose (in: hFindFile=0x77b7f8 | out: hFindFile=0x77b7f8) returned 1 [0113.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ece0) returned 1 [0113.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecec) returned 1 [0113.322] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\J60vjNHm.mp4", nBufferLength=0x105, lpBuffer=0x19e68c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\J60vjNHm.mp4", lpFilePart=0x0) returned 0x29 [0113.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0113.322] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\J60vjNHm.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\j60vjnhm.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0113.323] GetFileType (hFile=0x37c) returned 0x1 [0113.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0113.323] GetFileType (hFile=0x37c) returned 0x1 [0113.323] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19eccc | out: lpFileSizeHigh=0x19eccc*=0x0) returned 0x135a0 [0113.323] ReadFile (in: hFile=0x37c, lpBuffer=0x27c347c, nNumberOfBytesToRead=0x135a0, lpNumberOfBytesRead=0x19ec78, lpOverlapped=0x0 | out: lpBuffer=0x27c347c*, lpNumberOfBytesRead=0x19ec78*=0x135a0, lpOverlapped=0x0) returned 1 [0113.324] CloseHandle (hObject=0x37c) returned 1 [0113.359] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e790, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0113.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0113.359] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ecc0 | out: lpFileInformation=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0113.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0113.359] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\J60vjNHm.mp4", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\J60vjNHm.mp4", lpFilePart=0x0) returned 0x29 [0113.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0113.359] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\J60vjNHm.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\j60vjnhm.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0113.361] GetFileType (hFile=0x37c) returned 0x1 [0113.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0113.361] GetFileType (hFile=0x37c) returned 0x1 [0113.361] WriteFile (in: hFile=0x37c, lpBuffer=0x284a388*, nNumberOfBytesToWrite=0x135b0, lpNumberOfBytesWritten=0x19ec6c, lpOverlapped=0x0 | out: lpBuffer=0x284a388*, lpNumberOfBytesWritten=0x19ec6c*=0x135b0, lpOverlapped=0x0) returned 1 [0113.363] CloseHandle (hObject=0x37c) returned 1 [0113.366] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\J60vjNHm.mp4", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\J60vjNHm.mp4", lpFilePart=0x0) returned 0x29 [0113.366] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\J60vjNHm.mp4.spybuster", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\J60vjNHm.mp4.spybuster", lpFilePart=0x0) returned 0x33 [0113.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec50) returned 1 [0113.366] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\J60vjNHm.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\j60vjnhm.mp4"), fInfoLevelId=0x0, lpFileInformation=0x19eccc | out: lpFileInformation=0x19eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88923520, ftCreationTime.dwHighDateTime=0x1d5eb72, ftLastAccessTime.dwLowDateTime=0x37facd00, ftLastAccessTime.dwHighDateTime=0x1d5ef16, ftLastWriteTime.dwLowDateTime=0xb8d5d0ca, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x135b0)) returned 1 [0113.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0113.366] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\J60vjNHm.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\j60vjnhm.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\J60vjNHm.mp4.spybuster" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\j60vjnhm.mp4.spybuster")) returned 1 [0113.367] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\la-7YGCqtlgmjKcxcDai.mkv", nBufferLength=0x105, lpBuffer=0x19e68c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\la-7YGCqtlgmjKcxcDai.mkv", lpFilePart=0x0) returned 0x35 [0113.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0113.367] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\la-7YGCqtlgmjKcxcDai.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\la-7ygcqtlgmjkcxcdai.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0113.367] GetFileType (hFile=0x37c) returned 0x1 [0113.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0113.367] GetFileType (hFile=0x37c) returned 0x1 [0113.367] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19eccc | out: lpFileSizeHigh=0x19eccc*=0x0) returned 0x10459 [0113.367] ReadFile (in: hFile=0x37c, lpBuffer=0x285ddc0, nNumberOfBytesToRead=0x10459, lpNumberOfBytesRead=0x19ec78, lpOverlapped=0x0 | out: lpBuffer=0x285ddc0*, lpNumberOfBytesRead=0x19ec78*=0x10459, lpOverlapped=0x0) returned 1 [0113.368] CloseHandle (hObject=0x37c) returned 1 [0113.389] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e790, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0113.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0113.389] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ecc0 | out: lpFileInformation=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0113.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0113.389] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\la-7YGCqtlgmjKcxcDai.mkv", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\la-7YGCqtlgmjKcxcDai.mkv", lpFilePart=0x0) returned 0x35 [0113.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0113.389] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\la-7YGCqtlgmjKcxcDai.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\la-7ygcqtlgmjkcxcdai.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0113.391] GetFileType (hFile=0x37c) returned 0x1 [0113.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0113.391] GetFileType (hFile=0x37c) returned 0x1 [0113.391] WriteFile (in: hFile=0x37c, lpBuffer=0x28db8e0*, nNumberOfBytesToWrite=0x10460, lpNumberOfBytesWritten=0x19ec6c, lpOverlapped=0x0 | out: lpBuffer=0x28db8e0*, lpNumberOfBytesWritten=0x19ec6c*=0x10460, lpOverlapped=0x0) returned 1 [0113.393] CloseHandle (hObject=0x37c) returned 1 [0113.395] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\la-7YGCqtlgmjKcxcDai.mkv", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\la-7YGCqtlgmjKcxcDai.mkv", lpFilePart=0x0) returned 0x35 [0113.395] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\la-7YGCqtlgmjKcxcDai.mkv.spybuster", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\la-7YGCqtlgmjKcxcDai.mkv.spybuster", lpFilePart=0x0) returned 0x3f [0113.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec50) returned 1 [0113.395] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\la-7YGCqtlgmjKcxcDai.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\la-7ygcqtlgmjkcxcdai.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19eccc | out: lpFileInformation=0x19eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9d4aa10, ftCreationTime.dwHighDateTime=0x1d5ea69, ftLastAccessTime.dwLowDateTime=0xb1256fc0, ftLastAccessTime.dwHighDateTime=0x1d5ee51, ftLastWriteTime.dwLowDateTime=0xb8d80ec8, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x10460)) returned 1 [0113.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0113.396] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\la-7YGCqtlgmjKcxcDai.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\la-7ygcqtlgmjkcxcdai.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\la-7YGCqtlgmjKcxcDai.mkv.spybuster" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\la-7ygcqtlgmjkcxcdai.mkv.spybuster")) returned 1 [0113.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb0) returned 1 [0113.403] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP", nBufferLength=0x105, lpBuffer=0x19e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP", lpFilePart=0x0) returned 0x28 [0113.403] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\*", lpFindFileData=0x19e9d8 | out: lpFindFileData=0x19e9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5dbdf8d0, ftCreationTime.dwHighDateTime=0x1d5e42d, ftLastAccessTime.dwLowDateTime=0x2f723f90, ftLastAccessTime.dwHighDateTime=0x1d5ec6b, ftLastWriteTime.dwLowDateTime=0x2f723f90, ftLastWriteTime.dwHighDateTime=0x1d5ec6b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b678 [0113.403] FindNextFileW (in: hFindFile=0x77b678, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5dbdf8d0, ftCreationTime.dwHighDateTime=0x1d5e42d, ftLastAccessTime.dwLowDateTime=0x2f723f90, ftLastAccessTime.dwHighDateTime=0x1d5ec6b, ftLastWriteTime.dwLowDateTime=0x2f723f90, ftLastWriteTime.dwHighDateTime=0x1d5ec6b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.403] FindNextFileW (in: hFindFile=0x77b678, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9106d30, ftCreationTime.dwHighDateTime=0x1d5e729, ftLastAccessTime.dwLowDateTime=0x61bcc930, ftLastAccessTime.dwHighDateTime=0x1d5e116, ftLastWriteTime.dwLowDateTime=0x61bcc930, ftLastWriteTime.dwHighDateTime=0x1d5e116, nFileSizeHigh=0x0, nFileSizeLow=0x13f59, dwReserved0=0x0, dwReserved1=0x0, cFileName="Enyaw.avi", cAlternateFileName="")) returned 1 [0113.403] FindNextFileW (in: hFindFile=0x77b678, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12a33e40, ftCreationTime.dwHighDateTime=0x1d5e87a, ftLastAccessTime.dwLowDateTime=0xd5bc9bf0, ftLastAccessTime.dwHighDateTime=0x1d5ecae, ftLastWriteTime.dwLowDateTime=0xd5bc9bf0, ftLastWriteTime.dwHighDateTime=0x1d5ecae, nFileSizeHigh=0x0, nFileSizeLow=0x16cbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="fvQovREy.avi", cAlternateFileName="")) returned 1 [0113.403] FindNextFileW (in: hFindFile=0x77b678, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x779c4e50, ftCreationTime.dwHighDateTime=0x1d5e3f6, ftLastAccessTime.dwLowDateTime=0x6a864580, ftLastAccessTime.dwHighDateTime=0x1d5f01d, ftLastWriteTime.dwLowDateTime=0x6a864580, ftLastWriteTime.dwHighDateTime=0x1d5f01d, nFileSizeHigh=0x0, nFileSizeLow=0x16b32, dwReserved0=0x0, dwReserved1=0x0, cFileName="LCHVqKa90brlsfGf8f.mp4", cAlternateFileName="LCHVQK~1.MP4")) returned 1 [0113.407] FindNextFileW (in: hFindFile=0x77b678, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe206b4a0, ftCreationTime.dwHighDateTime=0x1d5e90b, ftLastAccessTime.dwLowDateTime=0x86f5e1b0, ftLastAccessTime.dwHighDateTime=0x1d5edcc, ftLastWriteTime.dwLowDateTime=0x86f5e1b0, ftLastWriteTime.dwHighDateTime=0x1d5edcc, nFileSizeHigh=0x0, nFileSizeLow=0xbdbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="N3vZhGHo7e0Fog-.avi", cAlternateFileName="N3VZHG~1.AVI")) returned 1 [0113.407] FindNextFileW (in: hFindFile=0x77b678, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7574b10, ftCreationTime.dwHighDateTime=0x1d5e840, ftLastAccessTime.dwLowDateTime=0x6e3d3d0, ftLastAccessTime.dwHighDateTime=0x1d5e703, ftLastWriteTime.dwLowDateTime=0x6e3d3d0, ftLastWriteTime.dwHighDateTime=0x1d5e703, nFileSizeHigh=0x0, nFileSizeLow=0x101c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="nXDr7JL.avi", cAlternateFileName="")) returned 1 [0113.407] FindNextFileW (in: hFindFile=0x77b678, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32acd60, ftCreationTime.dwHighDateTime=0x1d5e228, ftLastAccessTime.dwLowDateTime=0x40d31400, ftLastAccessTime.dwHighDateTime=0x1d5e30e, ftLastWriteTime.dwLowDateTime=0x40d31400, ftLastWriteTime.dwHighDateTime=0x1d5e30e, nFileSizeHigh=0x0, nFileSizeLow=0x137f, dwReserved0=0x0, dwReserved1=0x0, cFileName="qMSDX 8vxCnMdo.avi", cAlternateFileName="QMSDX8~1.AVI")) returned 1 [0113.408] FindNextFileW (in: hFindFile=0x77b678, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15dec950, ftCreationTime.dwHighDateTime=0x1d5eb2f, ftLastAccessTime.dwLowDateTime=0x93accf90, ftLastAccessTime.dwHighDateTime=0x1d5e21e, ftLastWriteTime.dwLowDateTime=0x93accf90, ftLastWriteTime.dwHighDateTime=0x1d5e21e, nFileSizeHigh=0x0, nFileSizeLow=0x55c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="vflb 7.mkv", cAlternateFileName="VFLB7~1.MKV")) returned 1 [0113.408] FindNextFileW (in: hFindFile=0x77b678, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45f5edd0, ftCreationTime.dwHighDateTime=0x1d5e26f, ftLastAccessTime.dwLowDateTime=0x40d4bb90, ftLastAccessTime.dwHighDateTime=0x1d5ee9c, ftLastWriteTime.dwLowDateTime=0x40d4bb90, ftLastWriteTime.dwHighDateTime=0x1d5ee9c, nFileSizeHigh=0x0, nFileSizeLow=0x2cca, dwReserved0=0x0, dwReserved1=0x0, cFileName="_BbgA4o_O.swf", cAlternateFileName="_BBGA4~1.SWF")) returned 1 [0113.408] FindNextFileW (in: hFindFile=0x77b678, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.408] FindClose (in: hFindFile=0x77b678 | out: hFindFile=0x77b678) returned 1 [0113.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec6c) returned 1 [0113.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec78) returned 1 [0113.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb0) returned 1 [0113.408] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP", nBufferLength=0x105, lpBuffer=0x19e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP", lpFilePart=0x0) returned 0x28 [0113.408] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\*", lpFindFileData=0x19e9d8 | out: lpFindFileData=0x19e9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5dbdf8d0, ftCreationTime.dwHighDateTime=0x1d5e42d, ftLastAccessTime.dwLowDateTime=0x2f723f90, ftLastAccessTime.dwHighDateTime=0x1d5ec6b, ftLastWriteTime.dwLowDateTime=0x2f723f90, ftLastWriteTime.dwHighDateTime=0x1d5ec6b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77bb38 [0113.409] FindNextFileW (in: hFindFile=0x77bb38, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5dbdf8d0, ftCreationTime.dwHighDateTime=0x1d5e42d, ftLastAccessTime.dwLowDateTime=0x2f723f90, ftLastAccessTime.dwHighDateTime=0x1d5ec6b, ftLastWriteTime.dwLowDateTime=0x2f723f90, ftLastWriteTime.dwHighDateTime=0x1d5ec6b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.409] FindNextFileW (in: hFindFile=0x77bb38, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9106d30, ftCreationTime.dwHighDateTime=0x1d5e729, ftLastAccessTime.dwLowDateTime=0x61bcc930, ftLastAccessTime.dwHighDateTime=0x1d5e116, ftLastWriteTime.dwLowDateTime=0x61bcc930, ftLastWriteTime.dwHighDateTime=0x1d5e116, nFileSizeHigh=0x0, nFileSizeLow=0x13f59, dwReserved0=0x0, dwReserved1=0x0, cFileName="Enyaw.avi", cAlternateFileName="")) returned 1 [0113.409] FindNextFileW (in: hFindFile=0x77bb38, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12a33e40, ftCreationTime.dwHighDateTime=0x1d5e87a, ftLastAccessTime.dwLowDateTime=0xd5bc9bf0, ftLastAccessTime.dwHighDateTime=0x1d5ecae, ftLastWriteTime.dwLowDateTime=0xd5bc9bf0, ftLastWriteTime.dwHighDateTime=0x1d5ecae, nFileSizeHigh=0x0, nFileSizeLow=0x16cbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="fvQovREy.avi", cAlternateFileName="")) returned 1 [0113.409] FindNextFileW (in: hFindFile=0x77bb38, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x779c4e50, ftCreationTime.dwHighDateTime=0x1d5e3f6, ftLastAccessTime.dwLowDateTime=0x6a864580, ftLastAccessTime.dwHighDateTime=0x1d5f01d, ftLastWriteTime.dwLowDateTime=0x6a864580, ftLastWriteTime.dwHighDateTime=0x1d5f01d, nFileSizeHigh=0x0, nFileSizeLow=0x16b32, dwReserved0=0x0, dwReserved1=0x0, cFileName="LCHVqKa90brlsfGf8f.mp4", cAlternateFileName="LCHVQK~1.MP4")) returned 1 [0113.409] FindNextFileW (in: hFindFile=0x77bb38, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe206b4a0, ftCreationTime.dwHighDateTime=0x1d5e90b, ftLastAccessTime.dwLowDateTime=0x86f5e1b0, ftLastAccessTime.dwHighDateTime=0x1d5edcc, ftLastWriteTime.dwLowDateTime=0x86f5e1b0, ftLastWriteTime.dwHighDateTime=0x1d5edcc, nFileSizeHigh=0x0, nFileSizeLow=0xbdbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="N3vZhGHo7e0Fog-.avi", cAlternateFileName="N3VZHG~1.AVI")) returned 1 [0113.409] FindNextFileW (in: hFindFile=0x77bb38, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7574b10, ftCreationTime.dwHighDateTime=0x1d5e840, ftLastAccessTime.dwLowDateTime=0x6e3d3d0, ftLastAccessTime.dwHighDateTime=0x1d5e703, ftLastWriteTime.dwLowDateTime=0x6e3d3d0, ftLastWriteTime.dwHighDateTime=0x1d5e703, nFileSizeHigh=0x0, nFileSizeLow=0x101c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="nXDr7JL.avi", cAlternateFileName="")) returned 1 [0113.409] FindNextFileW (in: hFindFile=0x77bb38, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32acd60, ftCreationTime.dwHighDateTime=0x1d5e228, ftLastAccessTime.dwLowDateTime=0x40d31400, ftLastAccessTime.dwHighDateTime=0x1d5e30e, ftLastWriteTime.dwLowDateTime=0x40d31400, ftLastWriteTime.dwHighDateTime=0x1d5e30e, nFileSizeHigh=0x0, nFileSizeLow=0x137f, dwReserved0=0x0, dwReserved1=0x0, cFileName="qMSDX 8vxCnMdo.avi", cAlternateFileName="QMSDX8~1.AVI")) returned 1 [0113.409] FindNextFileW (in: hFindFile=0x77bb38, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15dec950, ftCreationTime.dwHighDateTime=0x1d5eb2f, ftLastAccessTime.dwLowDateTime=0x93accf90, ftLastAccessTime.dwHighDateTime=0x1d5e21e, ftLastWriteTime.dwLowDateTime=0x93accf90, ftLastWriteTime.dwHighDateTime=0x1d5e21e, nFileSizeHigh=0x0, nFileSizeLow=0x55c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="vflb 7.mkv", cAlternateFileName="VFLB7~1.MKV")) returned 1 [0113.409] FindNextFileW (in: hFindFile=0x77bb38, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45f5edd0, ftCreationTime.dwHighDateTime=0x1d5e26f, ftLastAccessTime.dwLowDateTime=0x40d4bb90, ftLastAccessTime.dwHighDateTime=0x1d5ee9c, ftLastWriteTime.dwLowDateTime=0x40d4bb90, ftLastWriteTime.dwHighDateTime=0x1d5ee9c, nFileSizeHigh=0x0, nFileSizeLow=0x2cca, dwReserved0=0x0, dwReserved1=0x0, cFileName="_BbgA4o_O.swf", cAlternateFileName="_BBGA4~1.SWF")) returned 1 [0113.409] FindNextFileW (in: hFindFile=0x77bb38, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45f5edd0, ftCreationTime.dwHighDateTime=0x1d5e26f, ftLastAccessTime.dwLowDateTime=0x40d4bb90, ftLastAccessTime.dwHighDateTime=0x1d5ee9c, ftLastWriteTime.dwLowDateTime=0x40d4bb90, ftLastWriteTime.dwHighDateTime=0x1d5ee9c, nFileSizeHigh=0x0, nFileSizeLow=0x2cca, dwReserved0=0x0, dwReserved1=0x0, cFileName="_BbgA4o_O.swf", cAlternateFileName="_BBGA4~1.SWF")) returned 0 [0113.409] FindClose (in: hFindFile=0x77bb38 | out: hFindFile=0x77bb38) returned 1 [0113.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec6c) returned 1 [0113.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec78) returned 1 [0113.410] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\Enyaw.avi", nBufferLength=0x105, lpBuffer=0x19e618, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\Enyaw.avi", lpFilePart=0x0) returned 0x32 [0113.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb5c) returned 1 [0113.410] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\Enyaw.avi" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\enyaw.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0113.410] GetFileType (hFile=0x37c) returned 0x1 [0113.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb58) returned 1 [0113.410] GetFileType (hFile=0x37c) returned 0x1 [0113.410] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ec58 | out: lpFileSizeHigh=0x19ec58*=0x0) returned 0x13f59 [0113.410] ReadFile (in: hFile=0x37c, lpBuffer=0x2680ff0, nNumberOfBytesToRead=0x13f59, lpNumberOfBytesRead=0x19ec04, lpOverlapped=0x0 | out: lpBuffer=0x2680ff0*, lpNumberOfBytesRead=0x19ec04*=0x13f59, lpOverlapped=0x0) returned 1 [0113.412] CloseHandle (hObject=0x37c) returned 1 [0113.442] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e71c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0113.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0113.442] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ec4c | out: lpFileInformation=0x19ec4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0113.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0113.452] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\Enyaw.avi", nBufferLength=0x105, lpBuffer=0x19e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\Enyaw.avi", lpFilePart=0x0) returned 0x32 [0113.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb48) returned 1 [0113.452] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\Enyaw.avi" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\enyaw.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0113.455] GetFileType (hFile=0x37c) returned 0x1 [0113.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb44) returned 1 [0113.455] GetFileType (hFile=0x37c) returned 0x1 [0113.455] WriteFile (in: hFile=0x37c, lpBuffer=0x2709d6c*, nNumberOfBytesToWrite=0x13f60, lpNumberOfBytesWritten=0x19ebf8, lpOverlapped=0x0 | out: lpBuffer=0x2709d6c*, lpNumberOfBytesWritten=0x19ebf8*=0x13f60, lpOverlapped=0x0) returned 1 [0113.457] CloseHandle (hObject=0x37c) returned 1 [0113.460] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\Enyaw.avi", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\Enyaw.avi", lpFilePart=0x0) returned 0x32 [0113.460] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\Enyaw.avi.spybuster", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\Enyaw.avi.spybuster", lpFilePart=0x0) returned 0x3c [0113.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebdc) returned 1 [0113.460] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\Enyaw.avi" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\enyaw.avi"), fInfoLevelId=0x0, lpFileInformation=0x19ec58 | out: lpFileInformation=0x19ec58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9106d30, ftCreationTime.dwHighDateTime=0x1d5e729, ftLastAccessTime.dwLowDateTime=0x61bcc930, ftLastAccessTime.dwHighDateTime=0x1d5e116, ftLastWriteTime.dwLowDateTime=0xb8e3f6e9, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x13f60)) returned 1 [0113.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebd8) returned 1 [0113.461] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\Enyaw.avi" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\enyaw.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\Enyaw.avi.spybuster" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\enyaw.avi.spybuster")) returned 1 [0113.462] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\fvQovREy.avi", nBufferLength=0x105, lpBuffer=0x19e618, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\fvQovREy.avi", lpFilePart=0x0) returned 0x35 [0113.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb5c) returned 1 [0113.462] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\fvQovREy.avi" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\fvqovrey.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0113.462] GetFileType (hFile=0x37c) returned 0x1 [0113.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb58) returned 1 [0113.462] GetFileType (hFile=0x37c) returned 0x1 [0113.462] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ec58 | out: lpFileSizeHigh=0x19ec58*=0x0) returned 0x16cbd [0113.462] ReadFile (in: hFile=0x37c, lpBuffer=0x3651a48, nNumberOfBytesToRead=0x16cbd, lpNumberOfBytesRead=0x19ec04, lpOverlapped=0x0 | out: lpBuffer=0x3651a48*, lpNumberOfBytesRead=0x19ec04*=0x16cbd, lpOverlapped=0x0) returned 1 [0113.464] CloseHandle (hObject=0x37c) returned 1 [0113.508] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e71c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0113.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0113.508] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ec4c | out: lpFileInformation=0x19ec4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0113.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0113.509] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\fvQovREy.avi", nBufferLength=0x105, lpBuffer=0x19e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\fvQovREy.avi", lpFilePart=0x0) returned 0x35 [0113.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb48) returned 1 [0113.509] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\fvQovREy.avi" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\fvqovrey.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0113.511] GetFileType (hFile=0x37c) returned 0x1 [0113.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb44) returned 1 [0113.511] GetFileType (hFile=0x37c) returned 0x1 [0113.511] WriteFile (in: hFile=0x37c, lpBuffer=0x3783838*, nNumberOfBytesToWrite=0x16cc0, lpNumberOfBytesWritten=0x19ebf8, lpOverlapped=0x0 | out: lpBuffer=0x3783838*, lpNumberOfBytesWritten=0x19ebf8*=0x16cc0, lpOverlapped=0x0) returned 1 [0113.514] CloseHandle (hObject=0x37c) returned 1 [0113.518] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\fvQovREy.avi", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\fvQovREy.avi", lpFilePart=0x0) returned 0x35 [0113.518] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\fvQovREy.avi.spybuster", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\fvQovREy.avi.spybuster", lpFilePart=0x0) returned 0x3f [0113.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebdc) returned 1 [0113.518] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\fvQovREy.avi" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\fvqovrey.avi"), fInfoLevelId=0x0, lpFileInformation=0x19ec58 | out: lpFileInformation=0x19ec58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12a33e40, ftCreationTime.dwHighDateTime=0x1d5e87a, ftLastAccessTime.dwLowDateTime=0xd5bc9bf0, ftLastAccessTime.dwHighDateTime=0x1d5ecae, ftLastWriteTime.dwLowDateTime=0xb8eb1dbd, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x16cc0)) returned 1 [0113.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebd8) returned 1 [0113.518] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\fvQovREy.avi" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\fvqovrey.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\fvQovREy.avi.spybuster" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\fvqovrey.avi.spybuster")) returned 1 [0113.519] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\LCHVqKa90brlsfGf8f.mp4", nBufferLength=0x105, lpBuffer=0x19e618, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\LCHVqKa90brlsfGf8f.mp4", lpFilePart=0x0) returned 0x3f [0113.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb5c) returned 1 [0113.519] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\LCHVqKa90brlsfGf8f.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\lchvqka90brlsfgf8f.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0113.519] GetFileType (hFile=0x37c) returned 0x1 [0113.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb58) returned 1 [0113.519] GetFileType (hFile=0x37c) returned 0x1 [0113.520] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ec58 | out: lpFileSizeHigh=0x19ec58*=0x0) returned 0x16b32 [0113.520] ReadFile (in: hFile=0x37c, lpBuffer=0x379a518, nNumberOfBytesToRead=0x16b32, lpNumberOfBytesRead=0x19ec04, lpOverlapped=0x0 | out: lpBuffer=0x379a518*, lpNumberOfBytesRead=0x19ec04*=0x16b32, lpOverlapped=0x0) returned 1 [0113.525] CloseHandle (hObject=0x37c) returned 1 [0113.562] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e71c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0113.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0113.562] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ec4c | out: lpFileInformation=0x19ec4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0113.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0113.562] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\LCHVqKa90brlsfGf8f.mp4", nBufferLength=0x105, lpBuffer=0x19e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\LCHVqKa90brlsfGf8f.mp4", lpFilePart=0x0) returned 0x3f [0113.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb48) returned 1 [0113.562] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\LCHVqKa90brlsfGf8f.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\lchvqka90brlsfgf8f.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0113.564] GetFileType (hFile=0x37c) returned 0x1 [0113.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb44) returned 1 [0113.564] GetFileType (hFile=0x37c) returned 0x1 [0113.564] WriteFile (in: hFile=0x37c, lpBuffer=0x380bd88*, nNumberOfBytesToWrite=0x16b40, lpNumberOfBytesWritten=0x19ebf8, lpOverlapped=0x0 | out: lpBuffer=0x380bd88*, lpNumberOfBytesWritten=0x19ebf8*=0x16b40, lpOverlapped=0x0) returned 1 [0113.568] CloseHandle (hObject=0x37c) returned 1 [0113.574] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\LCHVqKa90brlsfGf8f.mp4", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\LCHVqKa90brlsfGf8f.mp4", lpFilePart=0x0) returned 0x3f [0113.574] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\LCHVqKa90brlsfGf8f.mp4.spybuster", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\LCHVqKa90brlsfGf8f.mp4.spybuster", lpFilePart=0x0) returned 0x49 [0113.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebdc) returned 1 [0113.574] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\LCHVqKa90brlsfGf8f.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\lchvqka90brlsfgf8f.mp4"), fInfoLevelId=0x0, lpFileInformation=0x19ec58 | out: lpFileInformation=0x19ec58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x779c4e50, ftCreationTime.dwHighDateTime=0x1d5e3f6, ftLastAccessTime.dwLowDateTime=0x6a864580, ftLastAccessTime.dwHighDateTime=0x1d5f01d, ftLastWriteTime.dwLowDateTime=0xb8f4a88a, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x16b40)) returned 1 [0113.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebd8) returned 1 [0113.575] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\LCHVqKa90brlsfGf8f.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\lchvqka90brlsfgf8f.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\LCHVqKa90brlsfGf8f.mp4.spybuster" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\lchvqka90brlsfgf8f.mp4.spybuster")) returned 1 [0113.575] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\N3vZhGHo7e0Fog-.avi", nBufferLength=0x105, lpBuffer=0x19e618, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\N3vZhGHo7e0Fog-.avi", lpFilePart=0x0) returned 0x3c [0113.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb5c) returned 1 [0113.576] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\N3vZhGHo7e0Fog-.avi" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\n3vzhgho7e0fog-.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0113.576] GetFileType (hFile=0x37c) returned 0x1 [0113.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb58) returned 1 [0113.576] GetFileType (hFile=0x37c) returned 0x1 [0113.576] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ec58 | out: lpFileSizeHigh=0x19ec58*=0x0) returned 0xbdbc [0113.576] ReadFile (in: hFile=0x37c, lpBuffer=0x27b87b8, nNumberOfBytesToRead=0xbdbc, lpNumberOfBytesRead=0x19ec04, lpOverlapped=0x0 | out: lpBuffer=0x27b87b8*, lpNumberOfBytesRead=0x19ec04*=0xbdbc, lpOverlapped=0x0) returned 1 [0113.577] CloseHandle (hObject=0x37c) returned 1 [0113.684] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e71c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0113.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0113.685] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ec4c | out: lpFileInformation=0x19ec4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0113.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0113.685] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\N3vZhGHo7e0Fog-.avi", nBufferLength=0x105, lpBuffer=0x19e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\N3vZhGHo7e0Fog-.avi", lpFilePart=0x0) returned 0x3c [0113.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb48) returned 1 [0113.685] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\N3vZhGHo7e0Fog-.avi" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\n3vzhgho7e0fog-.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0113.687] GetFileType (hFile=0x37c) returned 0x1 [0113.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb44) returned 1 [0113.687] GetFileType (hFile=0x37c) returned 0x1 [0113.687] WriteFile (in: hFile=0x37c, lpBuffer=0x2828ef4*, nNumberOfBytesToWrite=0xbdc0, lpNumberOfBytesWritten=0x19ebf8, lpOverlapped=0x0 | out: lpBuffer=0x2828ef4*, lpNumberOfBytesWritten=0x19ebf8*=0xbdc0, lpOverlapped=0x0) returned 1 [0113.689] CloseHandle (hObject=0x37c) returned 1 [0113.691] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\N3vZhGHo7e0Fog-.avi", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\N3vZhGHo7e0Fog-.avi", lpFilePart=0x0) returned 0x3c [0113.691] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\N3vZhGHo7e0Fog-.avi.spybuster", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\N3vZhGHo7e0Fog-.avi.spybuster", lpFilePart=0x0) returned 0x46 [0113.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebdc) returned 1 [0113.691] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\N3vZhGHo7e0Fog-.avi" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\n3vzhgho7e0fog-.avi"), fInfoLevelId=0x0, lpFileInformation=0x19ec58 | out: lpFileInformation=0x19ec58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe206b4a0, ftCreationTime.dwHighDateTime=0x1d5e90b, ftLastAccessTime.dwLowDateTime=0x86f5e1b0, ftLastAccessTime.dwHighDateTime=0x1d5edcc, ftLastWriteTime.dwLowDateTime=0xb9055de5, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xbdc0)) returned 1 [0113.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebd8) returned 1 [0113.691] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\N3vZhGHo7e0Fog-.avi" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\n3vzhgho7e0fog-.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\N3vZhGHo7e0Fog-.avi.spybuster" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\n3vzhgho7e0fog-.avi.spybuster")) returned 1 [0113.692] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\nXDr7JL.avi", nBufferLength=0x105, lpBuffer=0x19e618, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\nXDr7JL.avi", lpFilePart=0x0) returned 0x34 [0113.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb5c) returned 1 [0113.692] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\nXDr7JL.avi" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\nxdr7jl.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0113.693] GetFileType (hFile=0x37c) returned 0x1 [0113.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb58) returned 1 [0113.693] GetFileType (hFile=0x37c) returned 0x1 [0113.693] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ec58 | out: lpFileSizeHigh=0x19ec58*=0x0) returned 0x101c1 [0113.693] ReadFile (in: hFile=0x37c, lpBuffer=0x28351cc, nNumberOfBytesToRead=0x101c1, lpNumberOfBytesRead=0x19ec04, lpOverlapped=0x0 | out: lpBuffer=0x28351cc*, lpNumberOfBytesRead=0x19ec04*=0x101c1, lpOverlapped=0x0) returned 1 [0113.694] CloseHandle (hObject=0x37c) returned 1 [0113.730] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e71c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0113.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0113.730] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ec4c | out: lpFileInformation=0x19ec4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0113.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0113.731] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\nXDr7JL.avi", nBufferLength=0x105, lpBuffer=0x19e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\nXDr7JL.avi", lpFilePart=0x0) returned 0x34 [0113.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb48) returned 1 [0113.731] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\nXDr7JL.avi" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\nxdr7jl.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0113.750] GetFileType (hFile=0x37c) returned 0x1 [0113.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb44) returned 1 [0113.750] GetFileType (hFile=0x37c) returned 0x1 [0113.750] WriteFile (in: hFile=0x37c, lpBuffer=0x26c2e08*, nNumberOfBytesToWrite=0x101d0, lpNumberOfBytesWritten=0x19ebf8, lpOverlapped=0x0 | out: lpBuffer=0x26c2e08*, lpNumberOfBytesWritten=0x19ebf8*=0x101d0, lpOverlapped=0x0) returned 1 [0113.752] CloseHandle (hObject=0x37c) returned 1 [0113.766] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\nXDr7JL.avi", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\nXDr7JL.avi", lpFilePart=0x0) returned 0x34 [0113.766] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\nXDr7JL.avi.spybuster", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\nXDr7JL.avi.spybuster", lpFilePart=0x0) returned 0x3e [0113.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebdc) returned 1 [0113.766] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\nXDr7JL.avi" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\nxdr7jl.avi"), fInfoLevelId=0x0, lpFileInformation=0x19ec58 | out: lpFileInformation=0x19ec58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7574b10, ftCreationTime.dwHighDateTime=0x1d5e840, ftLastAccessTime.dwLowDateTime=0x6e3d3d0, ftLastAccessTime.dwHighDateTime=0x1d5e703, ftLastWriteTime.dwLowDateTime=0xb9114410, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x101d0)) returned 1 [0113.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebd8) returned 1 [0113.767] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\nXDr7JL.avi" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\nxdr7jl.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\nXDr7JL.avi.spybuster" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\nxdr7jl.avi.spybuster")) returned 1 [0113.768] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\qMSDX 8vxCnMdo.avi", nBufferLength=0x105, lpBuffer=0x19e618, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\qMSDX 8vxCnMdo.avi", lpFilePart=0x0) returned 0x3b [0113.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb5c) returned 1 [0113.768] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\qMSDX 8vxCnMdo.avi" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\qmsdx 8vxcnmdo.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0113.768] GetFileType (hFile=0x37c) returned 0x1 [0113.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb58) returned 1 [0113.768] GetFileType (hFile=0x37c) returned 0x1 [0113.768] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ec58 | out: lpFileSizeHigh=0x19ec58*=0x0) returned 0x137f [0113.768] ReadFile (in: hFile=0x37c, lpBuffer=0x26d34bc, nNumberOfBytesToRead=0x137f, lpNumberOfBytesRead=0x19ec04, lpOverlapped=0x0 | out: lpBuffer=0x26d34bc*, lpNumberOfBytesRead=0x19ec04*=0x137f, lpOverlapped=0x0) returned 1 [0113.769] CloseHandle (hObject=0x37c) returned 1 [0113.792] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e71c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0113.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0113.792] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ec4c | out: lpFileInformation=0x19ec4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0113.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0113.792] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\qMSDX 8vxCnMdo.avi", nBufferLength=0x105, lpBuffer=0x19e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\qMSDX 8vxCnMdo.avi", lpFilePart=0x0) returned 0x3b [0113.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb48) returned 1 [0113.792] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\qMSDX 8vxCnMdo.avi" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\qmsdx 8vxcnmdo.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0113.793] GetFileType (hFile=0x37c) returned 0x1 [0113.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb44) returned 1 [0113.794] GetFileType (hFile=0x37c) returned 0x1 [0113.794] WriteFile (in: hFile=0x37c, lpBuffer=0x2726584*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x19ebf8, lpOverlapped=0x0 | out: lpBuffer=0x2726584*, lpNumberOfBytesWritten=0x19ebf8*=0x1380, lpOverlapped=0x0) returned 1 [0113.795] CloseHandle (hObject=0x37c) returned 1 [0113.800] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\qMSDX 8vxCnMdo.avi", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\qMSDX 8vxCnMdo.avi", lpFilePart=0x0) returned 0x3b [0113.800] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\qMSDX 8vxCnMdo.avi.spybuster", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\qMSDX 8vxCnMdo.avi.spybuster", lpFilePart=0x0) returned 0x45 [0113.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebdc) returned 1 [0113.800] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\qMSDX 8vxCnMdo.avi" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\qmsdx 8vxcnmdo.avi"), fInfoLevelId=0x0, lpFileInformation=0x19ec58 | out: lpFileInformation=0x19ec58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32acd60, ftCreationTime.dwHighDateTime=0x1d5e228, ftLastAccessTime.dwLowDateTime=0x40d31400, ftLastAccessTime.dwHighDateTime=0x1d5e30e, ftLastWriteTime.dwLowDateTime=0xb916092f, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x1380)) returned 1 [0113.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebd8) returned 1 [0113.801] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\qMSDX 8vxCnMdo.avi" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\qmsdx 8vxcnmdo.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\qMSDX 8vxCnMdo.avi.spybuster" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\qmsdx 8vxcnmdo.avi.spybuster")) returned 1 [0113.801] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\vflb 7.mkv", nBufferLength=0x105, lpBuffer=0x19e618, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\vflb 7.mkv", lpFilePart=0x0) returned 0x33 [0113.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb5c) returned 1 [0113.802] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\vflb 7.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\vflb 7.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0113.802] GetFileType (hFile=0x37c) returned 0x1 [0113.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb58) returned 1 [0113.802] GetFileType (hFile=0x37c) returned 0x1 [0113.802] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ec58 | out: lpFileSizeHigh=0x19ec58*=0x0) returned 0x55c3 [0113.802] ReadFile (in: hFile=0x37c, lpBuffer=0x2727e08, nNumberOfBytesToRead=0x55c3, lpNumberOfBytesRead=0x19ec04, lpOverlapped=0x0 | out: lpBuffer=0x2727e08*, lpNumberOfBytesRead=0x19ec04*=0x55c3, lpOverlapped=0x0) returned 1 [0113.803] CloseHandle (hObject=0x37c) returned 1 [0113.839] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e71c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0113.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0113.839] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ec4c | out: lpFileInformation=0x19ec4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0113.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0113.839] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\vflb 7.mkv", nBufferLength=0x105, lpBuffer=0x19e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\vflb 7.mkv", lpFilePart=0x0) returned 0x33 [0113.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb48) returned 1 [0113.839] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\vflb 7.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\vflb 7.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0113.841] GetFileType (hFile=0x37c) returned 0x1 [0113.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb44) returned 1 [0113.841] GetFileType (hFile=0x37c) returned 0x1 [0113.841] WriteFile (in: hFile=0x37c, lpBuffer=0x278f904*, nNumberOfBytesToWrite=0x55d0, lpNumberOfBytesWritten=0x19ebf8, lpOverlapped=0x0 | out: lpBuffer=0x278f904*, lpNumberOfBytesWritten=0x19ebf8*=0x55d0, lpOverlapped=0x0) returned 1 [0113.842] CloseHandle (hObject=0x37c) returned 1 [0113.847] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\vflb 7.mkv", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\vflb 7.mkv", lpFilePart=0x0) returned 0x33 [0113.847] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\vflb 7.mkv.spybuster", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\vflb 7.mkv.spybuster", lpFilePart=0x0) returned 0x3d [0113.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebdc) returned 1 [0113.847] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\vflb 7.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\vflb 7.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19ec58 | out: lpFileInformation=0x19ec58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15dec950, ftCreationTime.dwHighDateTime=0x1d5eb2f, ftLastAccessTime.dwLowDateTime=0x93accf90, ftLastAccessTime.dwHighDateTime=0x1d5e21e, ftLastWriteTime.dwLowDateTime=0xb91d303d, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x55d0)) returned 1 [0113.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebd8) returned 1 [0113.847] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\vflb 7.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\vflb 7.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\IdRynCfnNRP\\vflb 7.mkv.spybuster" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\idryncfnnrp\\vflb 7.mkv.spybuster")) returned 1 [0113.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb0) returned 1 [0113.848] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\qNkSss06vEgW e7yXVm4", nBufferLength=0x105, lpBuffer=0x19e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\qNkSss06vEgW e7yXVm4", lpFilePart=0x0) returned 0x31 [0113.848] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\qNkSss06vEgW e7yXVm4\\*", lpFindFileData=0x19e9d8 | out: lpFindFileData=0x19e9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36d474f0, ftCreationTime.dwHighDateTime=0x1d5ede3, ftLastAccessTime.dwLowDateTime=0xf96f83e0, ftLastAccessTime.dwHighDateTime=0x1d5e7f0, ftLastWriteTime.dwLowDateTime=0xf96f83e0, ftLastWriteTime.dwHighDateTime=0x1d5e7f0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b9b8 [0113.848] FindNextFileW (in: hFindFile=0x77b9b8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36d474f0, ftCreationTime.dwHighDateTime=0x1d5ede3, ftLastAccessTime.dwLowDateTime=0xf96f83e0, ftLastAccessTime.dwHighDateTime=0x1d5e7f0, ftLastWriteTime.dwLowDateTime=0xf96f83e0, ftLastWriteTime.dwHighDateTime=0x1d5e7f0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.849] FindNextFileW (in: hFindFile=0x77b9b8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a5a0d0, ftCreationTime.dwHighDateTime=0x1d5eecf, ftLastAccessTime.dwLowDateTime=0x41516d10, ftLastAccessTime.dwHighDateTime=0x1d5e682, ftLastWriteTime.dwLowDateTime=0x41516d10, ftLastWriteTime.dwHighDateTime=0x1d5e682, nFileSizeHigh=0x0, nFileSizeLow=0xb5f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="3zXG.flv", cAlternateFileName="")) returned 1 [0113.849] FindNextFileW (in: hFindFile=0x77b9b8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb7cd4b0, ftCreationTime.dwHighDateTime=0x1d5e0cc, ftLastAccessTime.dwLowDateTime=0xf9c5a340, ftLastAccessTime.dwHighDateTime=0x1d5ef7c, ftLastWriteTime.dwLowDateTime=0xf9c5a340, ftLastWriteTime.dwHighDateTime=0x1d5ef7c, nFileSizeHigh=0x0, nFileSizeLow=0x9e9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BJ3wbV.flv", cAlternateFileName="")) returned 1 [0113.867] FindNextFileW (in: hFindFile=0x77b9b8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4da863d0, ftCreationTime.dwHighDateTime=0x1d5ee60, ftLastAccessTime.dwLowDateTime=0x9df6ce40, ftLastAccessTime.dwHighDateTime=0x1d5e90a, ftLastWriteTime.dwLowDateTime=0x9df6ce40, ftLastWriteTime.dwHighDateTime=0x1d5e90a, nFileSizeHigh=0x0, nFileSizeLow=0x145d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVTHQ5N29Ax2mpX3.avi", cAlternateFileName="DVTHQ5~1.AVI")) returned 1 [0113.867] FindNextFileW (in: hFindFile=0x77b9b8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.867] FindClose (in: hFindFile=0x77b9b8 | out: hFindFile=0x77b9b8) returned 1 [0113.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec6c) returned 1 [0113.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec78) returned 1 [0113.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb0) returned 1 [0113.868] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\qNkSss06vEgW e7yXVm4", nBufferLength=0x105, lpBuffer=0x19e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\qNkSss06vEgW e7yXVm4", lpFilePart=0x0) returned 0x31 [0113.868] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\qNkSss06vEgW e7yXVm4\\*", lpFindFileData=0x19e9d8 | out: lpFindFileData=0x19e9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36d474f0, ftCreationTime.dwHighDateTime=0x1d5ede3, ftLastAccessTime.dwLowDateTime=0xf96f83e0, ftLastAccessTime.dwHighDateTime=0x1d5e7f0, ftLastWriteTime.dwLowDateTime=0xf96f83e0, ftLastWriteTime.dwHighDateTime=0x1d5e7f0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b878 [0113.868] FindNextFileW (in: hFindFile=0x77b878, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36d474f0, ftCreationTime.dwHighDateTime=0x1d5ede3, ftLastAccessTime.dwLowDateTime=0xf96f83e0, ftLastAccessTime.dwHighDateTime=0x1d5e7f0, ftLastWriteTime.dwLowDateTime=0xf96f83e0, ftLastWriteTime.dwHighDateTime=0x1d5e7f0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.868] FindNextFileW (in: hFindFile=0x77b878, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a5a0d0, ftCreationTime.dwHighDateTime=0x1d5eecf, ftLastAccessTime.dwLowDateTime=0x41516d10, ftLastAccessTime.dwHighDateTime=0x1d5e682, ftLastWriteTime.dwLowDateTime=0x41516d10, ftLastWriteTime.dwHighDateTime=0x1d5e682, nFileSizeHigh=0x0, nFileSizeLow=0xb5f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="3zXG.flv", cAlternateFileName="")) returned 1 [0113.868] FindNextFileW (in: hFindFile=0x77b878, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb7cd4b0, ftCreationTime.dwHighDateTime=0x1d5e0cc, ftLastAccessTime.dwLowDateTime=0xf9c5a340, ftLastAccessTime.dwHighDateTime=0x1d5ef7c, ftLastWriteTime.dwLowDateTime=0xf9c5a340, ftLastWriteTime.dwHighDateTime=0x1d5ef7c, nFileSizeHigh=0x0, nFileSizeLow=0x9e9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BJ3wbV.flv", cAlternateFileName="")) returned 1 [0113.869] FindNextFileW (in: hFindFile=0x77b878, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4da863d0, ftCreationTime.dwHighDateTime=0x1d5ee60, ftLastAccessTime.dwLowDateTime=0x9df6ce40, ftLastAccessTime.dwHighDateTime=0x1d5e90a, ftLastWriteTime.dwLowDateTime=0x9df6ce40, ftLastWriteTime.dwHighDateTime=0x1d5e90a, nFileSizeHigh=0x0, nFileSizeLow=0x145d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVTHQ5N29Ax2mpX3.avi", cAlternateFileName="DVTHQ5~1.AVI")) returned 1 [0113.869] FindNextFileW (in: hFindFile=0x77b878, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4da863d0, ftCreationTime.dwHighDateTime=0x1d5ee60, ftLastAccessTime.dwLowDateTime=0x9df6ce40, ftLastAccessTime.dwHighDateTime=0x1d5e90a, ftLastWriteTime.dwLowDateTime=0x9df6ce40, ftLastWriteTime.dwHighDateTime=0x1d5e90a, nFileSizeHigh=0x0, nFileSizeLow=0x145d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVTHQ5N29Ax2mpX3.avi", cAlternateFileName="DVTHQ5~1.AVI")) returned 0 [0113.869] FindClose (in: hFindFile=0x77b878 | out: hFindFile=0x77b878) returned 1 [0113.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec6c) returned 1 [0113.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec78) returned 1 [0113.869] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\qNkSss06vEgW e7yXVm4\\DVTHQ5N29Ax2mpX3.avi", nBufferLength=0x105, lpBuffer=0x19e618, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\qNkSss06vEgW e7yXVm4\\DVTHQ5N29Ax2mpX3.avi", lpFilePart=0x0) returned 0x46 [0113.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb5c) returned 1 [0113.869] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\qNkSss06vEgW e7yXVm4\\DVTHQ5N29Ax2mpX3.avi" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\qnksss06vegw e7yxvm4\\dvthq5n29ax2mpx3.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0113.869] GetFileType (hFile=0x37c) returned 0x1 [0113.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb58) returned 1 [0113.869] GetFileType (hFile=0x37c) returned 0x1 [0113.869] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ec58 | out: lpFileSizeHigh=0x19ec58*=0x0) returned 0x145d2 [0113.870] ReadFile (in: hFile=0x37c, lpBuffer=0x2796c0c, nNumberOfBytesToRead=0x145d2, lpNumberOfBytesRead=0x19ec04, lpOverlapped=0x0 | out: lpBuffer=0x2796c0c*, lpNumberOfBytesRead=0x19ec04*=0x145d2, lpOverlapped=0x0) returned 1 [0113.871] CloseHandle (hObject=0x37c) returned 1 [0113.899] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e71c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0113.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0113.900] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ec4c | out: lpFileInformation=0x19ec4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0113.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0113.900] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\qNkSss06vEgW e7yXVm4\\DVTHQ5N29Ax2mpX3.avi", nBufferLength=0x105, lpBuffer=0x19e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\qNkSss06vEgW e7yXVm4\\DVTHQ5N29Ax2mpX3.avi", lpFilePart=0x0) returned 0x46 [0113.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb48) returned 1 [0113.900] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\qNkSss06vEgW e7yXVm4\\DVTHQ5N29Ax2mpX3.avi" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\qnksss06vegw e7yxvm4\\dvthq5n29ax2mpx3.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0113.902] GetFileType (hFile=0x37c) returned 0x1 [0113.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb44) returned 1 [0113.902] GetFileType (hFile=0x37c) returned 0x1 [0113.902] WriteFile (in: hFile=0x37c, lpBuffer=0x2820bac*, nNumberOfBytesToWrite=0x145e0, lpNumberOfBytesWritten=0x19ebf8, lpOverlapped=0x0 | out: lpBuffer=0x2820bac*, lpNumberOfBytesWritten=0x19ebf8*=0x145e0, lpOverlapped=0x0) returned 1 [0113.905] CloseHandle (hObject=0x37c) returned 1 [0113.924] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\qNkSss06vEgW e7yXVm4\\DVTHQ5N29Ax2mpX3.avi", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\qNkSss06vEgW e7yXVm4\\DVTHQ5N29Ax2mpX3.avi", lpFilePart=0x0) returned 0x46 [0113.924] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\qNkSss06vEgW e7yXVm4\\DVTHQ5N29Ax2mpX3.avi.spybuster", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\qNkSss06vEgW e7yXVm4\\DVTHQ5N29Ax2mpX3.avi.spybuster", lpFilePart=0x0) returned 0x50 [0113.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebdc) returned 1 [0113.924] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\qNkSss06vEgW e7yXVm4\\DVTHQ5N29Ax2mpX3.avi" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\qnksss06vegw e7yxvm4\\dvthq5n29ax2mpx3.avi"), fInfoLevelId=0x0, lpFileInformation=0x19ec58 | out: lpFileInformation=0x19ec58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4da863d0, ftCreationTime.dwHighDateTime=0x1d5ee60, ftLastAccessTime.dwLowDateTime=0x9df6ce40, ftLastAccessTime.dwHighDateTime=0x1d5e90a, ftLastWriteTime.dwLowDateTime=0xb929349e, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x145e0)) returned 1 [0113.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebd8) returned 1 [0113.924] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\qNkSss06vEgW e7yXVm4\\DVTHQ5N29Ax2mpX3.avi" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\qnksss06vegw e7yxvm4\\dvthq5n29ax2mpx3.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\qNkSss06vEgW e7yXVm4\\DVTHQ5N29Ax2mpX3.avi.spybuster" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\qnksss06vegw e7yxvm4\\dvthq5n29ax2mpx3.avi.spybuster")) returned 1 [0113.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb0) returned 1 [0113.925] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\Wnj7t2K0sr82w8ym", nBufferLength=0x105, lpBuffer=0x19e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\Wnj7t2K0sr82w8ym", lpFilePart=0x0) returned 0x2d [0113.925] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\Wnj7t2K0sr82w8ym\\*", lpFindFileData=0x19e9d8 | out: lpFindFileData=0x19e9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85ee4710, ftCreationTime.dwHighDateTime=0x1d5eaea, ftLastAccessTime.dwLowDateTime=0x3cb701e0, ftLastAccessTime.dwHighDateTime=0x1d5e518, ftLastWriteTime.dwLowDateTime=0x3cb701e0, ftLastWriteTime.dwHighDateTime=0x1d5e518, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b838 [0113.925] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85ee4710, ftCreationTime.dwHighDateTime=0x1d5eaea, ftLastAccessTime.dwLowDateTime=0x3cb701e0, ftLastAccessTime.dwHighDateTime=0x1d5e518, ftLastWriteTime.dwLowDateTime=0x3cb701e0, ftLastWriteTime.dwHighDateTime=0x1d5e518, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.926] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a61b4e0, ftCreationTime.dwHighDateTime=0x1d5ea4f, ftLastAccessTime.dwLowDateTime=0xf3660da0, ftLastAccessTime.dwHighDateTime=0x1d5e43c, ftLastWriteTime.dwLowDateTime=0xf3660da0, ftLastWriteTime.dwHighDateTime=0x1d5e43c, nFileSizeHigh=0x0, nFileSizeLow=0x149a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CKFU4r2Ry7OuQfYzEu7M.mp4", cAlternateFileName="CKFU4R~1.MP4")) returned 1 [0113.926] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4871720, ftCreationTime.dwHighDateTime=0x1d5e92f, ftLastAccessTime.dwLowDateTime=0x50956d70, ftLastAccessTime.dwHighDateTime=0x1d5e4a3, ftLastWriteTime.dwLowDateTime=0x50956d70, ftLastWriteTime.dwHighDateTime=0x1d5e4a3, nFileSizeHigh=0x0, nFileSizeLow=0x14b3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="w2LFl7qnN.avi", cAlternateFileName="W2LFL7~1.AVI")) returned 1 [0113.926] FindNextFileW (in: hFindFile=0x77b838, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0113.926] FindClose (in: hFindFile=0x77b838 | out: hFindFile=0x77b838) returned 1 [0113.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec6c) returned 1 [0113.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec78) returned 1 [0113.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb0) returned 1 [0113.926] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\Wnj7t2K0sr82w8ym", nBufferLength=0x105, lpBuffer=0x19e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\Wnj7t2K0sr82w8ym", lpFilePart=0x0) returned 0x2d [0113.926] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\Wnj7t2K0sr82w8ym\\*", lpFindFileData=0x19e9d8 | out: lpFindFileData=0x19e9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85ee4710, ftCreationTime.dwHighDateTime=0x1d5eaea, ftLastAccessTime.dwLowDateTime=0x3cb701e0, ftLastAccessTime.dwHighDateTime=0x1d5e518, ftLastWriteTime.dwLowDateTime=0x3cb701e0, ftLastWriteTime.dwHighDateTime=0x1d5e518, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77baf8 [0113.926] FindNextFileW (in: hFindFile=0x77baf8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85ee4710, ftCreationTime.dwHighDateTime=0x1d5eaea, ftLastAccessTime.dwLowDateTime=0x3cb701e0, ftLastAccessTime.dwHighDateTime=0x1d5e518, ftLastWriteTime.dwLowDateTime=0x3cb701e0, ftLastWriteTime.dwHighDateTime=0x1d5e518, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.926] FindNextFileW (in: hFindFile=0x77baf8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a61b4e0, ftCreationTime.dwHighDateTime=0x1d5ea4f, ftLastAccessTime.dwLowDateTime=0xf3660da0, ftLastAccessTime.dwHighDateTime=0x1d5e43c, ftLastWriteTime.dwLowDateTime=0xf3660da0, ftLastWriteTime.dwHighDateTime=0x1d5e43c, nFileSizeHigh=0x0, nFileSizeLow=0x149a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CKFU4r2Ry7OuQfYzEu7M.mp4", cAlternateFileName="CKFU4R~1.MP4")) returned 1 [0113.926] FindNextFileW (in: hFindFile=0x77baf8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4871720, ftCreationTime.dwHighDateTime=0x1d5e92f, ftLastAccessTime.dwLowDateTime=0x50956d70, ftLastAccessTime.dwHighDateTime=0x1d5e4a3, ftLastWriteTime.dwLowDateTime=0x50956d70, ftLastWriteTime.dwHighDateTime=0x1d5e4a3, nFileSizeHigh=0x0, nFileSizeLow=0x14b3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="w2LFl7qnN.avi", cAlternateFileName="W2LFL7~1.AVI")) returned 1 [0113.927] FindNextFileW (in: hFindFile=0x77baf8, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4871720, ftCreationTime.dwHighDateTime=0x1d5e92f, ftLastAccessTime.dwLowDateTime=0x50956d70, ftLastAccessTime.dwHighDateTime=0x1d5e4a3, ftLastWriteTime.dwLowDateTime=0x50956d70, ftLastWriteTime.dwHighDateTime=0x1d5e4a3, nFileSizeHigh=0x0, nFileSizeLow=0x14b3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="w2LFl7qnN.avi", cAlternateFileName="W2LFL7~1.AVI")) returned 0 [0113.927] FindClose (in: hFindFile=0x77baf8 | out: hFindFile=0x77baf8) returned 1 [0113.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec6c) returned 1 [0113.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec78) returned 1 [0113.927] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\Wnj7t2K0sr82w8ym\\CKFU4r2Ry7OuQfYzEu7M.mp4", nBufferLength=0x105, lpBuffer=0x19e618, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\Wnj7t2K0sr82w8ym\\CKFU4r2Ry7OuQfYzEu7M.mp4", lpFilePart=0x0) returned 0x46 [0113.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb5c) returned 1 [0113.927] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\Wnj7t2K0sr82w8ym\\CKFU4r2Ry7OuQfYzEu7M.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\wnj7t2k0sr82w8ym\\ckfu4r2ry7ouqfyzeu7m.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0113.927] GetFileType (hFile=0x37c) returned 0x1 [0113.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb58) returned 1 [0113.927] GetFileType (hFile=0x37c) returned 0x1 [0113.927] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ec58 | out: lpFileSizeHigh=0x19ec58*=0x0) returned 0x149a0 [0113.928] ReadFile (in: hFile=0x37c, lpBuffer=0x2836c18, nNumberOfBytesToRead=0x149a0, lpNumberOfBytesRead=0x19ec04, lpOverlapped=0x0 | out: lpBuffer=0x2836c18*, lpNumberOfBytesRead=0x19ec04*=0x149a0, lpOverlapped=0x0) returned 1 [0113.929] CloseHandle (hObject=0x37c) returned 1 [0113.974] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e71c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0113.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0113.974] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ec4c | out: lpFileInformation=0x19ec4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0113.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0113.976] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\Wnj7t2K0sr82w8ym\\CKFU4r2Ry7OuQfYzEu7M.mp4", nBufferLength=0x105, lpBuffer=0x19e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\Wnj7t2K0sr82w8ym\\CKFU4r2Ry7OuQfYzEu7M.mp4", lpFilePart=0x0) returned 0x46 [0113.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb48) returned 1 [0113.976] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\Wnj7t2K0sr82w8ym\\CKFU4r2Ry7OuQfYzEu7M.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\wnj7t2k0sr82w8ym\\ckfu4r2ry7ouqfyzeu7m.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0113.978] GetFileType (hFile=0x37c) returned 0x1 [0113.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb44) returned 1 [0113.978] GetFileType (hFile=0x37c) returned 0x1 [0113.978] WriteFile (in: hFile=0x37c, lpBuffer=0x26c5c04*, nNumberOfBytesToWrite=0x149b0, lpNumberOfBytesWritten=0x19ebf8, lpOverlapped=0x0 | out: lpBuffer=0x26c5c04*, lpNumberOfBytesWritten=0x19ebf8*=0x149b0, lpOverlapped=0x0) returned 1 [0113.981] CloseHandle (hObject=0x37c) returned 1 [0114.024] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\Wnj7t2K0sr82w8ym\\CKFU4r2Ry7OuQfYzEu7M.mp4", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\Wnj7t2K0sr82w8ym\\CKFU4r2Ry7OuQfYzEu7M.mp4", lpFilePart=0x0) returned 0x46 [0114.024] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\Wnj7t2K0sr82w8ym\\CKFU4r2Ry7OuQfYzEu7M.mp4.spybuster", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\Wnj7t2K0sr82w8ym\\CKFU4r2Ry7OuQfYzEu7M.mp4.spybuster", lpFilePart=0x0) returned 0x50 [0114.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebdc) returned 1 [0114.024] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\Wnj7t2K0sr82w8ym\\CKFU4r2Ry7OuQfYzEu7M.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\wnj7t2k0sr82w8ym\\ckfu4r2ry7ouqfyzeu7m.mp4"), fInfoLevelId=0x0, lpFileInformation=0x19ec58 | out: lpFileInformation=0x19ec58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a61b4e0, ftCreationTime.dwHighDateTime=0x1d5ea4f, ftLastAccessTime.dwLowDateTime=0xf3660da0, ftLastAccessTime.dwHighDateTime=0x1d5e43c, ftLastWriteTime.dwLowDateTime=0xb939ccaa, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x149b0)) returned 1 [0114.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebd8) returned 1 [0114.024] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\Wnj7t2K0sr82w8ym\\CKFU4r2Ry7OuQfYzEu7M.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\wnj7t2k0sr82w8ym\\ckfu4r2ry7ouqfyzeu7m.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\Wnj7t2K0sr82w8ym\\CKFU4r2Ry7OuQfYzEu7M.mp4.spybuster" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\wnj7t2k0sr82w8ym\\ckfu4r2ry7ouqfyzeu7m.mp4.spybuster")) returned 1 [0114.025] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\Wnj7t2K0sr82w8ym\\w2LFl7qnN.avi", nBufferLength=0x105, lpBuffer=0x19e618, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\Wnj7t2K0sr82w8ym\\w2LFl7qnN.avi", lpFilePart=0x0) returned 0x3b [0114.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb5c) returned 1 [0114.026] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\Wnj7t2K0sr82w8ym\\w2LFl7qnN.avi" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\wnj7t2k0sr82w8ym\\w2lfl7qnn.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0114.026] GetFileType (hFile=0x37c) returned 0x1 [0114.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb58) returned 1 [0114.026] GetFileType (hFile=0x37c) returned 0x1 [0114.026] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ec58 | out: lpFileSizeHigh=0x19ec58*=0x0) returned 0x14b3f [0114.026] ReadFile (in: hFile=0x37c, lpBuffer=0x26dab38, nNumberOfBytesToRead=0x14b3f, lpNumberOfBytesRead=0x19ec04, lpOverlapped=0x0 | out: lpBuffer=0x26dab38*, lpNumberOfBytesRead=0x19ec04*=0x14b3f, lpOverlapped=0x0) returned 1 [0114.027] CloseHandle (hObject=0x37c) returned 1 [0114.127] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e71c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0114.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0114.127] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ec4c | out: lpFileInformation=0x19ec4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0114.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0114.128] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\Wnj7t2K0sr82w8ym\\w2LFl7qnN.avi", nBufferLength=0x105, lpBuffer=0x19e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\Wnj7t2K0sr82w8ym\\w2LFl7qnN.avi", lpFilePart=0x0) returned 0x3b [0114.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb48) returned 1 [0114.128] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\Wnj7t2K0sr82w8ym\\w2LFl7qnN.avi" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\wnj7t2k0sr82w8ym\\w2lfl7qnn.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0114.130] GetFileType (hFile=0x37c) returned 0x1 [0114.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb44) returned 1 [0114.130] GetFileType (hFile=0x37c) returned 0x1 [0114.130] WriteFile (in: hFile=0x37c, lpBuffer=0x2765c54*, nNumberOfBytesToWrite=0x14b40, lpNumberOfBytesWritten=0x19ebf8, lpOverlapped=0x0 | out: lpBuffer=0x2765c54*, lpNumberOfBytesWritten=0x19ebf8*=0x14b40, lpOverlapped=0x0) returned 1 [0114.133] CloseHandle (hObject=0x37c) returned 1 [0114.136] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\Wnj7t2K0sr82w8ym\\w2LFl7qnN.avi", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\Wnj7t2K0sr82w8ym\\w2LFl7qnN.avi", lpFilePart=0x0) returned 0x3b [0114.137] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\Wnj7t2K0sr82w8ym\\w2LFl7qnN.avi.spybuster", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\Wnj7t2K0sr82w8ym\\w2LFl7qnN.avi.spybuster", lpFilePart=0x0) returned 0x45 [0114.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebdc) returned 1 [0114.137] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\Wnj7t2K0sr82w8ym\\w2LFl7qnN.avi" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\wnj7t2k0sr82w8ym\\w2lfl7qnn.avi"), fInfoLevelId=0x0, lpFileInformation=0x19ec58 | out: lpFileInformation=0x19ec58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4871720, ftCreationTime.dwHighDateTime=0x1d5e92f, ftLastAccessTime.dwLowDateTime=0x50956d70, ftLastAccessTime.dwHighDateTime=0x1d5e4a3, ftLastWriteTime.dwLowDateTime=0xb94a7c9f, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x14b40)) returned 1 [0114.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebd8) returned 1 [0114.137] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\Wnj7t2K0sr82w8ym\\w2LFl7qnN.avi" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\wnj7t2k0sr82w8ym\\w2lfl7qnn.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\Wnj7t2K0sr82w8ym\\w2LFl7qnN.avi.spybuster" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\wnj7t2k0sr82w8ym\\w2lfl7qnn.avi.spybuster")) returned 1 [0114.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb0) returned 1 [0114.138] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\wZpzNZ7EVrJ XYv", nBufferLength=0x105, lpBuffer=0x19e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\wZpzNZ7EVrJ XYv", lpFilePart=0x0) returned 0x2c [0114.138] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\wZpzNZ7EVrJ XYv\\*", lpFindFileData=0x19e9d8 | out: lpFindFileData=0x19e9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20ddac30, ftCreationTime.dwHighDateTime=0x1d5e86f, ftLastAccessTime.dwLowDateTime=0xb167b840, ftLastAccessTime.dwHighDateTime=0x1d5e6a3, ftLastWriteTime.dwLowDateTime=0xb167b840, ftLastWriteTime.dwHighDateTime=0x1d5e6a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b738 [0114.138] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20ddac30, ftCreationTime.dwHighDateTime=0x1d5e86f, ftLastAccessTime.dwLowDateTime=0xb167b840, ftLastAccessTime.dwHighDateTime=0x1d5e6a3, ftLastWriteTime.dwLowDateTime=0xb167b840, ftLastWriteTime.dwHighDateTime=0x1d5e6a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.138] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36686ee0, ftCreationTime.dwHighDateTime=0x1d5e42e, ftLastAccessTime.dwLowDateTime=0xa9034b60, ftLastAccessTime.dwHighDateTime=0x1d5eebe, ftLastWriteTime.dwLowDateTime=0xa9034b60, ftLastWriteTime.dwHighDateTime=0x1d5eebe, nFileSizeHigh=0x0, nFileSizeLow=0x1673b, dwReserved0=0x0, dwReserved1=0x0, cFileName="-4xRGwDeIULvJHpI6w82.mkv", cAlternateFileName="-4XRGW~1.MKV")) returned 1 [0114.138] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cb36160, ftCreationTime.dwHighDateTime=0x1d5e4dc, ftLastAccessTime.dwLowDateTime=0xf4d4e140, ftLastAccessTime.dwHighDateTime=0x1d5e95d, ftLastWriteTime.dwLowDateTime=0xf4d4e140, ftLastWriteTime.dwHighDateTime=0x1d5e95d, nFileSizeHigh=0x0, nFileSizeLow=0x101d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="jQE2Yyj1V7O4.flv", cAlternateFileName="JQE2YY~1.FLV")) returned 1 [0114.138] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cc1180, ftCreationTime.dwHighDateTime=0x1d5e62d, ftLastAccessTime.dwLowDateTime=0xe446cc10, ftLastAccessTime.dwHighDateTime=0x1d5e225, ftLastWriteTime.dwLowDateTime=0xe446cc10, ftLastWriteTime.dwHighDateTime=0x1d5e225, nFileSizeHigh=0x0, nFileSizeLow=0x682d, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIzxwjrmuV.mp4", cAlternateFileName="TIZXWJ~1.MP4")) returned 1 [0114.138] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.138] FindClose (in: hFindFile=0x77b738 | out: hFindFile=0x77b738) returned 1 [0114.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec6c) returned 1 [0114.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec78) returned 1 [0114.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb0) returned 1 [0114.139] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\wZpzNZ7EVrJ XYv", nBufferLength=0x105, lpBuffer=0x19e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\wZpzNZ7EVrJ XYv", lpFilePart=0x0) returned 0x2c [0114.139] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\wZpzNZ7EVrJ XYv\\*", lpFindFileData=0x19e9d8 | out: lpFindFileData=0x19e9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20ddac30, ftCreationTime.dwHighDateTime=0x1d5e86f, ftLastAccessTime.dwLowDateTime=0xb167b840, ftLastAccessTime.dwHighDateTime=0x1d5e6a3, ftLastWriteTime.dwLowDateTime=0xb167b840, ftLastWriteTime.dwHighDateTime=0x1d5e6a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77bb38 [0114.139] FindNextFileW (in: hFindFile=0x77bb38, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20ddac30, ftCreationTime.dwHighDateTime=0x1d5e86f, ftLastAccessTime.dwLowDateTime=0xb167b840, ftLastAccessTime.dwHighDateTime=0x1d5e6a3, ftLastWriteTime.dwLowDateTime=0xb167b840, ftLastWriteTime.dwHighDateTime=0x1d5e6a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.139] FindNextFileW (in: hFindFile=0x77bb38, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36686ee0, ftCreationTime.dwHighDateTime=0x1d5e42e, ftLastAccessTime.dwLowDateTime=0xa9034b60, ftLastAccessTime.dwHighDateTime=0x1d5eebe, ftLastWriteTime.dwLowDateTime=0xa9034b60, ftLastWriteTime.dwHighDateTime=0x1d5eebe, nFileSizeHigh=0x0, nFileSizeLow=0x1673b, dwReserved0=0x0, dwReserved1=0x0, cFileName="-4xRGwDeIULvJHpI6w82.mkv", cAlternateFileName="-4XRGW~1.MKV")) returned 1 [0114.139] FindNextFileW (in: hFindFile=0x77bb38, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cb36160, ftCreationTime.dwHighDateTime=0x1d5e4dc, ftLastAccessTime.dwLowDateTime=0xf4d4e140, ftLastAccessTime.dwHighDateTime=0x1d5e95d, ftLastWriteTime.dwLowDateTime=0xf4d4e140, ftLastWriteTime.dwHighDateTime=0x1d5e95d, nFileSizeHigh=0x0, nFileSizeLow=0x101d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="jQE2Yyj1V7O4.flv", cAlternateFileName="JQE2YY~1.FLV")) returned 1 [0114.139] FindNextFileW (in: hFindFile=0x77bb38, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cc1180, ftCreationTime.dwHighDateTime=0x1d5e62d, ftLastAccessTime.dwLowDateTime=0xe446cc10, ftLastAccessTime.dwHighDateTime=0x1d5e225, ftLastWriteTime.dwLowDateTime=0xe446cc10, ftLastWriteTime.dwHighDateTime=0x1d5e225, nFileSizeHigh=0x0, nFileSizeLow=0x682d, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIzxwjrmuV.mp4", cAlternateFileName="TIZXWJ~1.MP4")) returned 1 [0114.139] FindNextFileW (in: hFindFile=0x77bb38, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cc1180, ftCreationTime.dwHighDateTime=0x1d5e62d, ftLastAccessTime.dwLowDateTime=0xe446cc10, ftLastAccessTime.dwHighDateTime=0x1d5e225, ftLastWriteTime.dwLowDateTime=0xe446cc10, ftLastWriteTime.dwHighDateTime=0x1d5e225, nFileSizeHigh=0x0, nFileSizeLow=0x682d, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIzxwjrmuV.mp4", cAlternateFileName="TIZXWJ~1.MP4")) returned 0 [0114.139] FindClose (in: hFindFile=0x77bb38 | out: hFindFile=0x77bb38) returned 1 [0114.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec6c) returned 1 [0114.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec78) returned 1 [0114.140] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\wZpzNZ7EVrJ XYv\\-4xRGwDeIULvJHpI6w82.mkv", nBufferLength=0x105, lpBuffer=0x19e618, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\wZpzNZ7EVrJ XYv\\-4xRGwDeIULvJHpI6w82.mkv", lpFilePart=0x0) returned 0x45 [0114.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb5c) returned 1 [0114.140] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\wZpzNZ7EVrJ XYv\\-4xRGwDeIULvJHpI6w82.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\wzpznz7evrj xyv\\-4xrgwdeiulvjhpi6w82.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0114.140] GetFileType (hFile=0x37c) returned 0x1 [0114.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb58) returned 1 [0114.140] GetFileType (hFile=0x37c) returned 0x1 [0114.140] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ec58 | out: lpFileSizeHigh=0x19ec58*=0x0) returned 0x1673b [0114.141] ReadFile (in: hFile=0x37c, lpBuffer=0x38d5da8, nNumberOfBytesToRead=0x1673b, lpNumberOfBytesRead=0x19ec04, lpOverlapped=0x0 | out: lpBuffer=0x38d5da8*, lpNumberOfBytesRead=0x19ec04*=0x1673b, lpOverlapped=0x0) returned 1 [0114.144] CloseHandle (hObject=0x37c) returned 1 [0114.186] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e71c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0114.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0114.186] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ec4c | out: lpFileInformation=0x19ec4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0114.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0114.186] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\wZpzNZ7EVrJ XYv\\-4xRGwDeIULvJHpI6w82.mkv", nBufferLength=0x105, lpBuffer=0x19e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\wZpzNZ7EVrJ XYv\\-4xRGwDeIULvJHpI6w82.mkv", lpFilePart=0x0) returned 0x45 [0114.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb48) returned 1 [0114.186] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\wZpzNZ7EVrJ XYv\\-4xRGwDeIULvJHpI6w82.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\wzpznz7evrj xyv\\-4xrgwdeiulvjhpi6w82.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0114.188] GetFileType (hFile=0x37c) returned 0x1 [0114.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb44) returned 1 [0114.188] GetFileType (hFile=0x37c) returned 0x1 [0114.188] WriteFile (in: hFile=0x37c, lpBuffer=0x3946220*, nNumberOfBytesToWrite=0x16740, lpNumberOfBytesWritten=0x19ebf8, lpOverlapped=0x0 | out: lpBuffer=0x3946220*, lpNumberOfBytesWritten=0x19ebf8*=0x16740, lpOverlapped=0x0) returned 1 [0114.191] CloseHandle (hObject=0x37c) returned 1 [0114.197] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\wZpzNZ7EVrJ XYv\\-4xRGwDeIULvJHpI6w82.mkv", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\wZpzNZ7EVrJ XYv\\-4xRGwDeIULvJHpI6w82.mkv", lpFilePart=0x0) returned 0x45 [0114.197] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\wZpzNZ7EVrJ XYv\\-4xRGwDeIULvJHpI6w82.mkv.spybuster", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\wZpzNZ7EVrJ XYv\\-4xRGwDeIULvJHpI6w82.mkv.spybuster", lpFilePart=0x0) returned 0x4f [0114.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebdc) returned 1 [0114.197] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\wZpzNZ7EVrJ XYv\\-4xRGwDeIULvJHpI6w82.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\wzpznz7evrj xyv\\-4xrgwdeiulvjhpi6w82.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19ec58 | out: lpFileInformation=0x19ec58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36686ee0, ftCreationTime.dwHighDateTime=0x1d5e42e, ftLastAccessTime.dwLowDateTime=0xa9034b60, ftLastAccessTime.dwHighDateTime=0x1d5eebe, ftLastWriteTime.dwLowDateTime=0xb95405d0, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x16740)) returned 1 [0114.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebd8) returned 1 [0114.197] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\wZpzNZ7EVrJ XYv\\-4xRGwDeIULvJHpI6w82.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\wzpznz7evrj xyv\\-4xrgwdeiulvjhpi6w82.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\wZpzNZ7EVrJ XYv\\-4xRGwDeIULvJHpI6w82.mkv.spybuster" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\wzpznz7evrj xyv\\-4xrgwdeiulvjhpi6w82.mkv.spybuster")) returned 1 [0114.198] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\wZpzNZ7EVrJ XYv\\TIzxwjrmuV.mp4", nBufferLength=0x105, lpBuffer=0x19e618, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\wZpzNZ7EVrJ XYv\\TIzxwjrmuV.mp4", lpFilePart=0x0) returned 0x3b [0114.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb5c) returned 1 [0114.198] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\wZpzNZ7EVrJ XYv\\TIzxwjrmuV.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\wzpznz7evrj xyv\\tizxwjrmuv.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0114.199] GetFileType (hFile=0x37c) returned 0x1 [0114.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb58) returned 1 [0114.199] GetFileType (hFile=0x37c) returned 0x1 [0114.199] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ec58 | out: lpFileSizeHigh=0x19ec58*=0x0) returned 0x682d [0114.199] ReadFile (in: hFile=0x37c, lpBuffer=0x27c9854, nNumberOfBytesToRead=0x682d, lpNumberOfBytesRead=0x19ec04, lpOverlapped=0x0 | out: lpBuffer=0x27c9854*, lpNumberOfBytesRead=0x19ec04*=0x682d, lpOverlapped=0x0) returned 1 [0114.200] CloseHandle (hObject=0x37c) returned 1 [0114.230] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e71c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0114.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0114.230] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ec4c | out: lpFileInformation=0x19ec4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0114.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0114.230] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\wZpzNZ7EVrJ XYv\\TIzxwjrmuV.mp4", nBufferLength=0x105, lpBuffer=0x19e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\wZpzNZ7EVrJ XYv\\TIzxwjrmuV.mp4", lpFilePart=0x0) returned 0x3b [0114.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb48) returned 1 [0114.230] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\wZpzNZ7EVrJ XYv\\TIzxwjrmuV.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\wzpznz7evrj xyv\\tizxwjrmuv.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0114.232] GetFileType (hFile=0x37c) returned 0x1 [0114.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb44) returned 1 [0114.232] GetFileType (hFile=0x37c) returned 0x1 [0114.232] WriteFile (in: hFile=0x37c, lpBuffer=0x2836f30*, nNumberOfBytesToWrite=0x6830, lpNumberOfBytesWritten=0x19ebf8, lpOverlapped=0x0 | out: lpBuffer=0x2836f30*, lpNumberOfBytesWritten=0x19ebf8*=0x6830, lpOverlapped=0x0) returned 1 [0114.233] CloseHandle (hObject=0x37c) returned 1 [0114.235] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\wZpzNZ7EVrJ XYv\\TIzxwjrmuV.mp4", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\wZpzNZ7EVrJ XYv\\TIzxwjrmuV.mp4", lpFilePart=0x0) returned 0x3b [0114.235] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\wZpzNZ7EVrJ XYv\\TIzxwjrmuV.mp4.spybuster", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0w8t5\\wZpzNZ7EVrJ XYv\\TIzxwjrmuV.mp4.spybuster", lpFilePart=0x0) returned 0x45 [0114.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebdc) returned 1 [0114.235] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\wZpzNZ7EVrJ XYv\\TIzxwjrmuV.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\wzpznz7evrj xyv\\tizxwjrmuv.mp4"), fInfoLevelId=0x0, lpFileInformation=0x19ec58 | out: lpFileInformation=0x19ec58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cc1180, ftCreationTime.dwHighDateTime=0x1d5e62d, ftLastAccessTime.dwLowDateTime=0xe446cc10, ftLastAccessTime.dwHighDateTime=0x1d5e225, ftLastWriteTime.dwLowDateTime=0xb958ca89, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x6830)) returned 1 [0114.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebd8) returned 1 [0114.235] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\wZpzNZ7EVrJ XYv\\TIzxwjrmuV.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\wzpznz7evrj xyv\\tizxwjrmuv.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\0w8t5\\wZpzNZ7EVrJ XYv\\TIzxwjrmuV.mp4.spybuster" (normalized: "c:\\users\\fd1hvy\\videos\\0w8t5\\wzpznz7evrj xyv\\tizxwjrmuv.mp4.spybuster")) returned 1 [0114.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed24) returned 1 [0114.236] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8", nBufferLength=0x105, lpBuffer=0x19e7d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8", lpFilePart=0x0) returned 0x28 [0114.236] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\*", lpFindFileData=0x19ea4c | out: lpFindFileData=0x19ea4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34fc0500, ftCreationTime.dwHighDateTime=0x1d5ee9f, ftLastAccessTime.dwLowDateTime=0x6ead70d0, ftLastAccessTime.dwHighDateTime=0x1d5e202, ftLastWriteTime.dwLowDateTime=0x6ead70d0, ftLastWriteTime.dwHighDateTime=0x1d5e202, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77ba38 [0114.236] FindNextFileW (in: hFindFile=0x77ba38, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34fc0500, ftCreationTime.dwHighDateTime=0x1d5ee9f, ftLastAccessTime.dwLowDateTime=0x6ead70d0, ftLastAccessTime.dwHighDateTime=0x1d5e202, ftLastWriteTime.dwLowDateTime=0x6ead70d0, ftLastWriteTime.dwHighDateTime=0x1d5e202, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.236] FindNextFileW (in: hFindFile=0x77ba38, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d56660, ftCreationTime.dwHighDateTime=0x1d5e33a, ftLastAccessTime.dwLowDateTime=0x57cc91a0, ftLastAccessTime.dwHighDateTime=0x1d5e60f, ftLastWriteTime.dwLowDateTime=0x57cc91a0, ftLastWriteTime.dwHighDateTime=0x1d5e60f, nFileSizeHigh=0x0, nFileSizeLow=0xd92c, dwReserved0=0x0, dwReserved1=0x0, cFileName="61g_QjO.flv", cAlternateFileName="")) returned 1 [0114.236] FindNextFileW (in: hFindFile=0x77ba38, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ec3730, ftCreationTime.dwHighDateTime=0x1d5e4bb, ftLastAccessTime.dwLowDateTime=0x3b11d0, ftLastAccessTime.dwHighDateTime=0x1d5e477, ftLastWriteTime.dwLowDateTime=0x3b11d0, ftLastWriteTime.dwHighDateTime=0x1d5e477, nFileSizeHigh=0x0, nFileSizeLow=0xf5d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="94gp-fbdQLAMLhZn.mkv", cAlternateFileName="94GP-F~1.MKV")) returned 1 [0114.237] FindNextFileW (in: hFindFile=0x77ba38, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdb41a90, ftCreationTime.dwHighDateTime=0x1d5e6fb, ftLastAccessTime.dwLowDateTime=0x9f1ffe0, ftLastAccessTime.dwHighDateTime=0x1d5e5df, ftLastWriteTime.dwLowDateTime=0x9f1ffe0, ftLastWriteTime.dwHighDateTime=0x1d5e5df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KxER", cAlternateFileName="")) returned 1 [0114.237] FindNextFileW (in: hFindFile=0x77ba38, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaeef0640, ftCreationTime.dwHighDateTime=0x1d5e847, ftLastAccessTime.dwLowDateTime=0x5cbc2960, ftLastAccessTime.dwHighDateTime=0x1d5e3a2, ftLastWriteTime.dwLowDateTime=0x5cbc2960, ftLastWriteTime.dwHighDateTime=0x1d5e3a2, nFileSizeHigh=0x0, nFileSizeLow=0x7f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="P _VzpiYzLOQ.mp4", cAlternateFileName="P_VZPI~1.MP4")) returned 1 [0114.237] FindNextFileW (in: hFindFile=0x77ba38, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b3b3680, ftCreationTime.dwHighDateTime=0x1d5e129, ftLastAccessTime.dwLowDateTime=0x93eb6e50, ftLastAccessTime.dwHighDateTime=0x1d5e262, ftLastWriteTime.dwLowDateTime=0x93eb6e50, ftLastWriteTime.dwHighDateTime=0x1d5e262, nFileSizeHigh=0x0, nFileSizeLow=0x13a8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="pu9T2VV_YhRq.mkv", cAlternateFileName="PU9T2V~1.MKV")) returned 1 [0114.237] FindNextFileW (in: hFindFile=0x77ba38, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c2e300, ftCreationTime.dwHighDateTime=0x1d5e5bb, ftLastAccessTime.dwLowDateTime=0xd0886200, ftLastAccessTime.dwHighDateTime=0x1d5e352, ftLastWriteTime.dwLowDateTime=0xd0886200, ftLastWriteTime.dwHighDateTime=0x1d5e352, nFileSizeHigh=0x0, nFileSizeLow=0x325f, dwReserved0=0x0, dwReserved1=0x0, cFileName="WEAU oNjlE4iZ6d.mp4", cAlternateFileName="WEAUON~1.MP4")) returned 1 [0114.237] FindNextFileW (in: hFindFile=0x77ba38, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfec964d0, ftCreationTime.dwHighDateTime=0x1d5e112, ftLastAccessTime.dwLowDateTime=0x1f15be00, ftLastAccessTime.dwHighDateTime=0x1d5edc0, ftLastWriteTime.dwLowDateTime=0x1f15be00, ftLastWriteTime.dwHighDateTime=0x1d5edc0, nFileSizeHigh=0x0, nFileSizeLow=0x131b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPptyG7FnWSWscrotuzO.flv", cAlternateFileName="XPPTYG~1.FLV")) returned 1 [0114.237] FindNextFileW (in: hFindFile=0x77ba38, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7d21b50, ftCreationTime.dwHighDateTime=0x1d5e172, ftLastAccessTime.dwLowDateTime=0x660878d0, ftLastAccessTime.dwHighDateTime=0x1d5ed9c, ftLastWriteTime.dwLowDateTime=0x660878d0, ftLastWriteTime.dwHighDateTime=0x1d5ed9c, nFileSizeHigh=0x0, nFileSizeLow=0x14265, dwReserved0=0x0, dwReserved1=0x0, cFileName="_XJPK-lyI86Kg.swf", cAlternateFileName="_XJPK-~1.SWF")) returned 1 [0114.237] FindNextFileW (in: hFindFile=0x77ba38, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.237] FindClose (in: hFindFile=0x77ba38 | out: hFindFile=0x77ba38) returned 1 [0114.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ece0) returned 1 [0114.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecec) returned 1 [0114.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed24) returned 1 [0114.237] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8", nBufferLength=0x105, lpBuffer=0x19e7d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8", lpFilePart=0x0) returned 0x28 [0114.237] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\*", lpFindFileData=0x19ea4c | out: lpFindFileData=0x19ea4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34fc0500, ftCreationTime.dwHighDateTime=0x1d5ee9f, ftLastAccessTime.dwLowDateTime=0x6ead70d0, ftLastAccessTime.dwHighDateTime=0x1d5e202, ftLastWriteTime.dwLowDateTime=0x6ead70d0, ftLastWriteTime.dwHighDateTime=0x1d5e202, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b738 [0114.238] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34fc0500, ftCreationTime.dwHighDateTime=0x1d5ee9f, ftLastAccessTime.dwLowDateTime=0x6ead70d0, ftLastAccessTime.dwHighDateTime=0x1d5e202, ftLastWriteTime.dwLowDateTime=0x6ead70d0, ftLastWriteTime.dwHighDateTime=0x1d5e202, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.238] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d56660, ftCreationTime.dwHighDateTime=0x1d5e33a, ftLastAccessTime.dwLowDateTime=0x57cc91a0, ftLastAccessTime.dwHighDateTime=0x1d5e60f, ftLastWriteTime.dwLowDateTime=0x57cc91a0, ftLastWriteTime.dwHighDateTime=0x1d5e60f, nFileSizeHigh=0x0, nFileSizeLow=0xd92c, dwReserved0=0x0, dwReserved1=0x0, cFileName="61g_QjO.flv", cAlternateFileName="")) returned 1 [0114.238] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ec3730, ftCreationTime.dwHighDateTime=0x1d5e4bb, ftLastAccessTime.dwLowDateTime=0x3b11d0, ftLastAccessTime.dwHighDateTime=0x1d5e477, ftLastWriteTime.dwLowDateTime=0x3b11d0, ftLastWriteTime.dwHighDateTime=0x1d5e477, nFileSizeHigh=0x0, nFileSizeLow=0xf5d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="94gp-fbdQLAMLhZn.mkv", cAlternateFileName="94GP-F~1.MKV")) returned 1 [0114.238] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdb41a90, ftCreationTime.dwHighDateTime=0x1d5e6fb, ftLastAccessTime.dwLowDateTime=0x9f1ffe0, ftLastAccessTime.dwHighDateTime=0x1d5e5df, ftLastWriteTime.dwLowDateTime=0x9f1ffe0, ftLastWriteTime.dwHighDateTime=0x1d5e5df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KxER", cAlternateFileName="")) returned 1 [0114.238] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaeef0640, ftCreationTime.dwHighDateTime=0x1d5e847, ftLastAccessTime.dwLowDateTime=0x5cbc2960, ftLastAccessTime.dwHighDateTime=0x1d5e3a2, ftLastWriteTime.dwLowDateTime=0x5cbc2960, ftLastWriteTime.dwHighDateTime=0x1d5e3a2, nFileSizeHigh=0x0, nFileSizeLow=0x7f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="P _VzpiYzLOQ.mp4", cAlternateFileName="P_VZPI~1.MP4")) returned 1 [0114.238] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b3b3680, ftCreationTime.dwHighDateTime=0x1d5e129, ftLastAccessTime.dwLowDateTime=0x93eb6e50, ftLastAccessTime.dwHighDateTime=0x1d5e262, ftLastWriteTime.dwLowDateTime=0x93eb6e50, ftLastWriteTime.dwHighDateTime=0x1d5e262, nFileSizeHigh=0x0, nFileSizeLow=0x13a8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="pu9T2VV_YhRq.mkv", cAlternateFileName="PU9T2V~1.MKV")) returned 1 [0114.238] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c2e300, ftCreationTime.dwHighDateTime=0x1d5e5bb, ftLastAccessTime.dwLowDateTime=0xd0886200, ftLastAccessTime.dwHighDateTime=0x1d5e352, ftLastWriteTime.dwLowDateTime=0xd0886200, ftLastWriteTime.dwHighDateTime=0x1d5e352, nFileSizeHigh=0x0, nFileSizeLow=0x325f, dwReserved0=0x0, dwReserved1=0x0, cFileName="WEAU oNjlE4iZ6d.mp4", cAlternateFileName="WEAUON~1.MP4")) returned 1 [0114.238] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfec964d0, ftCreationTime.dwHighDateTime=0x1d5e112, ftLastAccessTime.dwLowDateTime=0x1f15be00, ftLastAccessTime.dwHighDateTime=0x1d5edc0, ftLastWriteTime.dwLowDateTime=0x1f15be00, ftLastWriteTime.dwHighDateTime=0x1d5edc0, nFileSizeHigh=0x0, nFileSizeLow=0x131b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="xPptyG7FnWSWscrotuzO.flv", cAlternateFileName="XPPTYG~1.FLV")) returned 1 [0114.238] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7d21b50, ftCreationTime.dwHighDateTime=0x1d5e172, ftLastAccessTime.dwLowDateTime=0x660878d0, ftLastAccessTime.dwHighDateTime=0x1d5ed9c, ftLastWriteTime.dwLowDateTime=0x660878d0, ftLastWriteTime.dwHighDateTime=0x1d5ed9c, nFileSizeHigh=0x0, nFileSizeLow=0x14265, dwReserved0=0x0, dwReserved1=0x0, cFileName="_XJPK-lyI86Kg.swf", cAlternateFileName="_XJPK-~1.SWF")) returned 1 [0114.238] FindNextFileW (in: hFindFile=0x77b738, lpFindFileData=0x19ea58 | out: lpFindFileData=0x19ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7d21b50, ftCreationTime.dwHighDateTime=0x1d5e172, ftLastAccessTime.dwLowDateTime=0x660878d0, ftLastAccessTime.dwHighDateTime=0x1d5ed9c, ftLastWriteTime.dwLowDateTime=0x660878d0, ftLastWriteTime.dwHighDateTime=0x1d5ed9c, nFileSizeHigh=0x0, nFileSizeLow=0x14265, dwReserved0=0x0, dwReserved1=0x0, cFileName="_XJPK-lyI86Kg.swf", cAlternateFileName="_XJPK-~1.SWF")) returned 0 [0114.238] FindClose (in: hFindFile=0x77b738 | out: hFindFile=0x77b738) returned 1 [0114.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ece0) returned 1 [0114.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecec) returned 1 [0114.239] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\94gp-fbdQLAMLhZn.mkv", nBufferLength=0x105, lpBuffer=0x19e68c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\94gp-fbdQLAMLhZn.mkv", lpFilePart=0x0) returned 0x3d [0114.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0114.239] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\94gp-fbdQLAMLhZn.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\gf9awrpwu_3lt12g8\\94gp-fbdqlamlhzn.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0114.239] GetFileType (hFile=0x37c) returned 0x1 [0114.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0114.239] GetFileType (hFile=0x37c) returned 0x1 [0114.239] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19eccc | out: lpFileSizeHigh=0x19eccc*=0x0) returned 0xf5d9 [0114.239] ReadFile (in: hFile=0x37c, lpBuffer=0x284026c, nNumberOfBytesToRead=0xf5d9, lpNumberOfBytesRead=0x19ec78, lpOverlapped=0x0 | out: lpBuffer=0x284026c*, lpNumberOfBytesRead=0x19ec78*=0xf5d9, lpOverlapped=0x0) returned 1 [0114.241] CloseHandle (hObject=0x37c) returned 1 [0114.292] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e790, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0114.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0114.292] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ecc0 | out: lpFileInformation=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0114.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0114.292] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\94gp-fbdQLAMLhZn.mkv", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\94gp-fbdQLAMLhZn.mkv", lpFilePart=0x0) returned 0x3d [0114.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0114.293] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\94gp-fbdQLAMLhZn.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\gf9awrpwu_3lt12g8\\94gp-fbdqlamlhzn.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0114.295] GetFileType (hFile=0x37c) returned 0x1 [0114.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0114.295] GetFileType (hFile=0x37c) returned 0x1 [0114.295] WriteFile (in: hFile=0x37c, lpBuffer=0x26b5c24*, nNumberOfBytesToWrite=0xf5e0, lpNumberOfBytesWritten=0x19ec6c, lpOverlapped=0x0 | out: lpBuffer=0x26b5c24*, lpNumberOfBytesWritten=0x19ec6c*=0xf5e0, lpOverlapped=0x0) returned 1 [0114.297] CloseHandle (hObject=0x37c) returned 1 [0114.317] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\94gp-fbdQLAMLhZn.mkv", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\94gp-fbdQLAMLhZn.mkv", lpFilePart=0x0) returned 0x3d [0114.317] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\94gp-fbdQLAMLhZn.mkv.spybuster", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\94gp-fbdQLAMLhZn.mkv.spybuster", lpFilePart=0x0) returned 0x47 [0114.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec50) returned 1 [0114.317] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\94gp-fbdQLAMLhZn.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\gf9awrpwu_3lt12g8\\94gp-fbdqlamlhzn.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19eccc | out: lpFileInformation=0x19eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ec3730, ftCreationTime.dwHighDateTime=0x1d5e4bb, ftLastAccessTime.dwLowDateTime=0x3b11d0, ftLastAccessTime.dwHighDateTime=0x1d5e477, ftLastWriteTime.dwLowDateTime=0xb965f2a1, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0xf5e0)) returned 1 [0114.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0114.317] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\94gp-fbdQLAMLhZn.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\gf9awrpwu_3lt12g8\\94gp-fbdqlamlhzn.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\94gp-fbdQLAMLhZn.mkv.spybuster" (normalized: "c:\\users\\fd1hvy\\videos\\gf9awrpwu_3lt12g8\\94gp-fbdqlamlhzn.mkv.spybuster")) returned 1 [0114.318] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\P _VzpiYzLOQ.mp4", nBufferLength=0x105, lpBuffer=0x19e68c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\P _VzpiYzLOQ.mp4", lpFilePart=0x0) returned 0x39 [0114.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0114.318] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\P _VzpiYzLOQ.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\gf9awrpwu_3lt12g8\\p _vzpiyzloq.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0114.318] GetFileType (hFile=0x37c) returned 0x1 [0114.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0114.318] GetFileType (hFile=0x37c) returned 0x1 [0114.319] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19eccc | out: lpFileSizeHigh=0x19eccc*=0x0) returned 0x7f6e [0114.319] ReadFile (in: hFile=0x37c, lpBuffer=0x26c5734, nNumberOfBytesToRead=0x7f6e, lpNumberOfBytesRead=0x19ec78, lpOverlapped=0x0 | out: lpBuffer=0x26c5734*, lpNumberOfBytesRead=0x19ec78*=0x7f6e, lpOverlapped=0x0) returned 1 [0114.320] CloseHandle (hObject=0x37c) returned 1 [0114.345] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e790, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0114.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0114.345] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ecc0 | out: lpFileInformation=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0114.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0114.345] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\P _VzpiYzLOQ.mp4", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\P _VzpiYzLOQ.mp4", lpFilePart=0x0) returned 0x39 [0114.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0114.345] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\P _VzpiYzLOQ.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\gf9awrpwu_3lt12g8\\p _vzpiyzloq.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0114.347] GetFileType (hFile=0x37c) returned 0x1 [0114.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0114.347] GetFileType (hFile=0x37c) returned 0x1 [0114.347] WriteFile (in: hFile=0x37c, lpBuffer=0x273a3ac*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x19ec6c, lpOverlapped=0x0 | out: lpBuffer=0x273a3ac*, lpNumberOfBytesWritten=0x19ec6c*=0x7f70, lpOverlapped=0x0) returned 1 [0114.354] CloseHandle (hObject=0x37c) returned 1 [0114.358] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\P _VzpiYzLOQ.mp4", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\P _VzpiYzLOQ.mp4", lpFilePart=0x0) returned 0x39 [0114.358] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\P _VzpiYzLOQ.mp4.spybuster", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\P _VzpiYzLOQ.mp4.spybuster", lpFilePart=0x0) returned 0x43 [0114.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec50) returned 1 [0114.358] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\P _VzpiYzLOQ.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\gf9awrpwu_3lt12g8\\p _vzpiyzloq.mp4"), fInfoLevelId=0x0, lpFileInformation=0x19eccc | out: lpFileInformation=0x19eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaeef0640, ftCreationTime.dwHighDateTime=0x1d5e847, ftLastAccessTime.dwLowDateTime=0x5cbc2960, ftLastAccessTime.dwHighDateTime=0x1d5e3a2, ftLastWriteTime.dwLowDateTime=0xb96bdd46, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x7f70)) returned 1 [0114.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0114.358] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\P _VzpiYzLOQ.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\gf9awrpwu_3lt12g8\\p _vzpiyzloq.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\P _VzpiYzLOQ.mp4.spybuster" (normalized: "c:\\users\\fd1hvy\\videos\\gf9awrpwu_3lt12g8\\p _vzpiyzloq.mp4.spybuster")) returned 1 [0114.360] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\pu9T2VV_YhRq.mkv", nBufferLength=0x105, lpBuffer=0x19e68c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\pu9T2VV_YhRq.mkv", lpFilePart=0x0) returned 0x39 [0114.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0114.360] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\pu9T2VV_YhRq.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\gf9awrpwu_3lt12g8\\pu9t2vv_yhrq.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0114.360] GetFileType (hFile=0x37c) returned 0x1 [0114.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0114.360] GetFileType (hFile=0x37c) returned 0x1 [0114.360] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19eccc | out: lpFileSizeHigh=0x19eccc*=0x0) returned 0x13a8d [0114.360] ReadFile (in: hFile=0x37c, lpBuffer=0x2742824, nNumberOfBytesToRead=0x13a8d, lpNumberOfBytesRead=0x19ec78, lpOverlapped=0x0 | out: lpBuffer=0x2742824*, lpNumberOfBytesRead=0x19ec78*=0x13a8d, lpOverlapped=0x0) returned 1 [0114.362] CloseHandle (hObject=0x37c) returned 1 [0114.392] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e790, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0114.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0114.392] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ecc0 | out: lpFileInformation=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0114.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0114.393] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\pu9T2VV_YhRq.mkv", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\pu9T2VV_YhRq.mkv", lpFilePart=0x0) returned 0x39 [0114.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0114.393] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\pu9T2VV_YhRq.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\gf9awrpwu_3lt12g8\\pu9t2vv_yhrq.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0114.395] GetFileType (hFile=0x37c) returned 0x1 [0114.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0114.395] GetFileType (hFile=0x37c) returned 0x1 [0114.395] WriteFile (in: hFile=0x37c, lpBuffer=0x27ca5d4*, nNumberOfBytesToWrite=0x13a90, lpNumberOfBytesWritten=0x19ec6c, lpOverlapped=0x0 | out: lpBuffer=0x27ca5d4*, lpNumberOfBytesWritten=0x19ec6c*=0x13a90, lpOverlapped=0x0) returned 1 [0114.406] CloseHandle (hObject=0x37c) returned 1 [0114.416] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\pu9T2VV_YhRq.mkv", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\pu9T2VV_YhRq.mkv", lpFilePart=0x0) returned 0x39 [0114.416] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\pu9T2VV_YhRq.mkv.spybuster", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\pu9T2VV_YhRq.mkv.spybuster", lpFilePart=0x0) returned 0x43 [0114.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec50) returned 1 [0114.416] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\pu9T2VV_YhRq.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\gf9awrpwu_3lt12g8\\pu9t2vv_yhrq.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19eccc | out: lpFileInformation=0x19eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b3b3680, ftCreationTime.dwHighDateTime=0x1d5e129, ftLastAccessTime.dwLowDateTime=0x93eb6e50, ftLastAccessTime.dwHighDateTime=0x1d5e262, ftLastWriteTime.dwLowDateTime=0xb97606dc, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x13a90)) returned 1 [0114.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0114.416] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\pu9T2VV_YhRq.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\gf9awrpwu_3lt12g8\\pu9t2vv_yhrq.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\pu9T2VV_YhRq.mkv.spybuster" (normalized: "c:\\users\\fd1hvy\\videos\\gf9awrpwu_3lt12g8\\pu9t2vv_yhrq.mkv.spybuster")) returned 1 [0114.417] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\WEAU oNjlE4iZ6d.mp4", nBufferLength=0x105, lpBuffer=0x19e68c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\WEAU oNjlE4iZ6d.mp4", lpFilePart=0x0) returned 0x3c [0114.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0114.417] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\WEAU oNjlE4iZ6d.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\gf9awrpwu_3lt12g8\\weau onjle4iz6d.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0114.418] GetFileType (hFile=0x37c) returned 0x1 [0114.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0114.418] GetFileType (hFile=0x37c) returned 0x1 [0114.418] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19eccc | out: lpFileSizeHigh=0x19eccc*=0x0) returned 0x325f [0114.418] ReadFile (in: hFile=0x37c, lpBuffer=0x27de578, nNumberOfBytesToRead=0x325f, lpNumberOfBytesRead=0x19ec78, lpOverlapped=0x0 | out: lpBuffer=0x27de578*, lpNumberOfBytesRead=0x19ec78*=0x325f, lpOverlapped=0x0) returned 1 [0114.419] CloseHandle (hObject=0x37c) returned 1 [0114.495] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e790, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0114.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec44) returned 1 [0114.496] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ecc0 | out: lpFileInformation=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0114.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec40) returned 1 [0114.496] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\WEAU oNjlE4iZ6d.mp4", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\WEAU oNjlE4iZ6d.mp4", lpFilePart=0x0) returned 0x3c [0114.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0114.496] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\WEAU oNjlE4iZ6d.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\gf9awrpwu_3lt12g8\\weau onjle4iz6d.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0114.498] GetFileType (hFile=0x37c) returned 0x1 [0114.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0114.498] GetFileType (hFile=0x37c) returned 0x1 [0114.498] WriteFile (in: hFile=0x37c, lpBuffer=0x283af44*, nNumberOfBytesToWrite=0x3260, lpNumberOfBytesWritten=0x19ec6c, lpOverlapped=0x0 | out: lpBuffer=0x283af44*, lpNumberOfBytesWritten=0x19ec6c*=0x3260, lpOverlapped=0x0) returned 1 [0114.499] CloseHandle (hObject=0x37c) returned 1 [0114.501] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\WEAU oNjlE4iZ6d.mp4", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\WEAU oNjlE4iZ6d.mp4", lpFilePart=0x0) returned 0x3c [0114.501] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\WEAU oNjlE4iZ6d.mp4.spybuster", nBufferLength=0x105, lpBuffer=0x19e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\WEAU oNjlE4iZ6d.mp4.spybuster", lpFilePart=0x0) returned 0x46 [0114.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec50) returned 1 [0114.501] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\WEAU oNjlE4iZ6d.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\gf9awrpwu_3lt12g8\\weau onjle4iz6d.mp4"), fInfoLevelId=0x0, lpFileInformation=0x19eccc | out: lpFileInformation=0x19eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c2e300, ftCreationTime.dwHighDateTime=0x1d5e5bb, ftLastAccessTime.dwLowDateTime=0xd0886200, ftLastAccessTime.dwHighDateTime=0x1d5e352, ftLastWriteTime.dwLowDateTime=0xb981b0ee, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x3260)) returned 1 [0114.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0114.501] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\WEAU oNjlE4iZ6d.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\gf9awrpwu_3lt12g8\\weau onjle4iz6d.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\WEAU oNjlE4iZ6d.mp4.spybuster" (normalized: "c:\\users\\fd1hvy\\videos\\gf9awrpwu_3lt12g8\\weau onjle4iz6d.mp4.spybuster")) returned 1 [0114.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb0) returned 1 [0114.502] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\KxER", nBufferLength=0x105, lpBuffer=0x19e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\KxER", lpFilePart=0x0) returned 0x2d [0114.502] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\KxER\\*", lpFindFileData=0x19e9d8 | out: lpFindFileData=0x19e9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdb41a90, ftCreationTime.dwHighDateTime=0x1d5e6fb, ftLastAccessTime.dwLowDateTime=0x9f1ffe0, ftLastAccessTime.dwHighDateTime=0x1d5e5df, ftLastWriteTime.dwLowDateTime=0x9f1ffe0, ftLastWriteTime.dwHighDateTime=0x1d5e5df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77b538 [0114.502] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdb41a90, ftCreationTime.dwHighDateTime=0x1d5e6fb, ftLastAccessTime.dwLowDateTime=0x9f1ffe0, ftLastAccessTime.dwHighDateTime=0x1d5e5df, ftLastWriteTime.dwLowDateTime=0x9f1ffe0, ftLastWriteTime.dwHighDateTime=0x1d5e5df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.502] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfb420c0, ftCreationTime.dwHighDateTime=0x1d5e9a2, ftLastAccessTime.dwLowDateTime=0xb8b26a10, ftLastAccessTime.dwHighDateTime=0x1d5e783, ftLastWriteTime.dwLowDateTime=0xb8b26a10, ftLastWriteTime.dwHighDateTime=0x1d5e783, nFileSizeHigh=0x0, nFileSizeLow=0x110d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="jKlhZJ1cXm TL1p.flv", cAlternateFileName="JKLHZJ~1.FLV")) returned 1 [0114.502] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8eb27cf0, ftCreationTime.dwHighDateTime=0x1d5e16b, ftLastAccessTime.dwLowDateTime=0xbaac7810, ftLastAccessTime.dwHighDateTime=0x1d5e26f, ftLastWriteTime.dwLowDateTime=0xbaac7810, ftLastWriteTime.dwHighDateTime=0x1d5e26f, nFileSizeHigh=0x0, nFileSizeLow=0x14190, dwReserved0=0x0, dwReserved1=0x0, cFileName="tqpt5bJJmOZb.mp4", cAlternateFileName="TQPT5B~1.MP4")) returned 1 [0114.502] FindNextFileW (in: hFindFile=0x77b538, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0114.503] FindClose (in: hFindFile=0x77b538 | out: hFindFile=0x77b538) returned 1 [0114.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec6c) returned 1 [0114.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec78) returned 1 [0114.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ecb0) returned 1 [0114.503] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\KxER", nBufferLength=0x105, lpBuffer=0x19e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\KxER", lpFilePart=0x0) returned 0x2d [0114.503] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\KxER\\*", lpFindFileData=0x19e9d8 | out: lpFindFileData=0x19e9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdb41a90, ftCreationTime.dwHighDateTime=0x1d5e6fb, ftLastAccessTime.dwLowDateTime=0x9f1ffe0, ftLastAccessTime.dwHighDateTime=0x1d5e5df, ftLastWriteTime.dwLowDateTime=0x9f1ffe0, ftLastWriteTime.dwHighDateTime=0x1d5e5df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x77bc78 [0114.503] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdb41a90, ftCreationTime.dwHighDateTime=0x1d5e6fb, ftLastAccessTime.dwLowDateTime=0x9f1ffe0, ftLastAccessTime.dwHighDateTime=0x1d5e5df, ftLastWriteTime.dwLowDateTime=0x9f1ffe0, ftLastWriteTime.dwHighDateTime=0x1d5e5df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.503] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfb420c0, ftCreationTime.dwHighDateTime=0x1d5e9a2, ftLastAccessTime.dwLowDateTime=0xb8b26a10, ftLastAccessTime.dwHighDateTime=0x1d5e783, ftLastWriteTime.dwLowDateTime=0xb8b26a10, ftLastWriteTime.dwHighDateTime=0x1d5e783, nFileSizeHigh=0x0, nFileSizeLow=0x110d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="jKlhZJ1cXm TL1p.flv", cAlternateFileName="JKLHZJ~1.FLV")) returned 1 [0114.503] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8eb27cf0, ftCreationTime.dwHighDateTime=0x1d5e16b, ftLastAccessTime.dwLowDateTime=0xbaac7810, ftLastAccessTime.dwHighDateTime=0x1d5e26f, ftLastWriteTime.dwLowDateTime=0xbaac7810, ftLastWriteTime.dwHighDateTime=0x1d5e26f, nFileSizeHigh=0x0, nFileSizeLow=0x14190, dwReserved0=0x0, dwReserved1=0x0, cFileName="tqpt5bJJmOZb.mp4", cAlternateFileName="TQPT5B~1.MP4")) returned 1 [0114.503] FindNextFileW (in: hFindFile=0x77bc78, lpFindFileData=0x19e9e4 | out: lpFindFileData=0x19e9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8eb27cf0, ftCreationTime.dwHighDateTime=0x1d5e16b, ftLastAccessTime.dwLowDateTime=0xbaac7810, ftLastAccessTime.dwHighDateTime=0x1d5e26f, ftLastWriteTime.dwLowDateTime=0xbaac7810, ftLastWriteTime.dwHighDateTime=0x1d5e26f, nFileSizeHigh=0x0, nFileSizeLow=0x14190, dwReserved0=0x0, dwReserved1=0x0, cFileName="tqpt5bJJmOZb.mp4", cAlternateFileName="TQPT5B~1.MP4")) returned 0 [0114.503] FindClose (in: hFindFile=0x77bc78 | out: hFindFile=0x77bc78) returned 1 [0114.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec6c) returned 1 [0114.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec78) returned 1 [0114.504] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\KxER\\tqpt5bJJmOZb.mp4", nBufferLength=0x105, lpBuffer=0x19e618, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\KxER\\tqpt5bJJmOZb.mp4", lpFilePart=0x0) returned 0x3e [0114.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb5c) returned 1 [0114.504] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\KxER\\tqpt5bJJmOZb.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\gf9awrpwu_3lt12g8\\kxer\\tqpt5bjjmozb.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0114.504] GetFileType (hFile=0x37c) returned 0x1 [0114.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb58) returned 1 [0114.504] GetFileType (hFile=0x37c) returned 0x1 [0114.504] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ec58 | out: lpFileSizeHigh=0x19ec58*=0x0) returned 0x14190 [0114.504] ReadFile (in: hFile=0x37c, lpBuffer=0x283fbf4, nNumberOfBytesToRead=0x14190, lpNumberOfBytesRead=0x19ec04, lpOverlapped=0x0 | out: lpBuffer=0x283fbf4*, lpNumberOfBytesRead=0x19ec04*=0x14190, lpOverlapped=0x0) returned 1 [0114.506] CloseHandle (hObject=0x37c) returned 1 [0114.564] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x105, lpBuffer=0x19e71c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0114.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebd0) returned 1 [0114.564] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ec4c | out: lpFileInformation=0x19ec4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0114.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebcc) returned 1 [0114.564] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\KxER\\tqpt5bJJmOZb.mp4", nBufferLength=0x105, lpBuffer=0x19e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\KxER\\tqpt5bJJmOZb.mp4", lpFilePart=0x0) returned 0x3e [0114.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb48) returned 1 [0114.565] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\KxER\\tqpt5bJJmOZb.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\gf9awrpwu_3lt12g8\\kxer\\tqpt5bjjmozb.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0114.567] GetFileType (hFile=0x37c) returned 0x1 [0114.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb44) returned 1 [0114.567] GetFileType (hFile=0x37c) returned 0x1 [0114.567] WriteFile (in: hFile=0x37c, lpBuffer=0x26ac6fc*, nNumberOfBytesToWrite=0x141a0, lpNumberOfBytesWritten=0x19ebf8, lpOverlapped=0x0 | out: lpBuffer=0x26ac6fc*, lpNumberOfBytesWritten=0x19ebf8*=0x141a0, lpOverlapped=0x0) returned 1 [0114.569] CloseHandle (hObject=0x37c) returned 1 [0114.577] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\KxER\\tqpt5bJJmOZb.mp4", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\KxER\\tqpt5bJJmOZb.mp4", lpFilePart=0x0) returned 0x3e [0114.577] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\KxER\\tqpt5bJJmOZb.mp4.spybuster", nBufferLength=0x105, lpBuffer=0x19e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\KxER\\tqpt5bJJmOZb.mp4.spybuster", lpFilePart=0x0) returned 0x48 [0114.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebdc) returned 1 [0114.577] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\KxER\\tqpt5bJJmOZb.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\gf9awrpwu_3lt12g8\\kxer\\tqpt5bjjmozb.mp4"), fInfoLevelId=0x0, lpFileInformation=0x19ec58 | out: lpFileInformation=0x19ec58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8eb27cf0, ftCreationTime.dwHighDateTime=0x1d5e16b, ftLastAccessTime.dwLowDateTime=0xbaac7810, ftLastAccessTime.dwHighDateTime=0x1d5e26f, ftLastWriteTime.dwLowDateTime=0xb98d3e32, ftLastWriteTime.dwHighDateTime=0x1d675cf, nFileSizeHigh=0x0, nFileSizeLow=0x141a0)) returned 1 [0114.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebd8) returned 1 [0114.577] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\KxER\\tqpt5bJJmOZb.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\gf9awrpwu_3lt12g8\\kxer\\tqpt5bjjmozb.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\Gf9AWRpwu_3lT12g8\\KxER\\tqpt5bJJmOZb.mp4.spybuster" (normalized: "c:\\users\\fd1hvy\\videos\\gf9awrpwu_3lt12g8\\kxer\\tqpt5bjjmozb.mp4.spybuster")) returned 1 [0114.594] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt", nBufferLength=0x105, lpBuffer=0x19e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt", lpFilePart=0x0) returned 0x23 [0114.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed74) returned 1 [0114.594] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x37c [0114.595] GetFileType (hFile=0x37c) returned 0x1 [0114.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed70) returned 1 [0114.595] GetFileType (hFile=0x37c) returned 0x1 [0114.597] WriteFile (in: hFile=0x37c, lpBuffer=0x26c2b5c*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x19edd4, lpOverlapped=0x0 | out: lpBuffer=0x26c2b5c*, lpNumberOfBytesWritten=0x19edd4*=0x10b, lpOverlapped=0x0) returned 1 [0114.599] CloseHandle (hObject=0x37c) returned 1 [0114.696] GetCurrentProcess () returned 0xffffffff [0114.696] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ea8c | out: TokenHandle=0x19ea8c*=0xf0) returned 1 [0114.714] GetCurrentProcess () returned 0xffffffff [0114.714] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ea9c | out: TokenHandle=0x19ea9c*=0x368) returned 1 [0114.724] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x36c [0114.724] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x370 [0114.731] GetCurrentProcess () returned 0xffffffff [0114.731] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eaac | out: TokenHandle=0x19eaac*=0x374) returned 1 [0114.735] GetCurrentProcess () returned 0xffffffff [0114.735] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eabc | out: TokenHandle=0x19eabc*=0x364) returned 1 [0114.743] QueryPerformanceFrequency (in: lpFrequency=0x5e5a98 | out: lpFrequency=0x5e5a98*=100000000) returned 1 [0114.743] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee30 | out: lpPerformanceCount=0x19ee30*=20973722101) returned 1 [0114.748] GetCurrentProcess () returned 0xffffffff [0114.748] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ea78 | out: TokenHandle=0x19ea78*=0x378) returned 1 [0114.753] GetCurrentProcess () returned 0xffffffff [0114.753] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ea88 | out: TokenHandle=0x19ea88*=0x410) returned 1 [0114.839] GetCurrentProcess () returned 0xffffffff [0114.839] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ea8c | out: TokenHandle=0x19ea8c*=0x420) returned 1 [0114.841] GetCurrentProcess () returned 0xffffffff [0114.841] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ea9c | out: TokenHandle=0x19ea9c*=0x424) returned 1 [0114.844] GetCurrentProcess () returned 0xffffffff [0114.844] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ed14 | out: TokenHandle=0x19ed14*=0x428) returned 1 [0114.847] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x19de4c | out: phkResult=0x19de4c*=0x42c) returned 0x0 [0114.848] RegQueryValueExW (in: hKey=0x42c, lpValueName="InstallationType", lpReserved=0x0, lpType=0x19de6c, lpData=0x0, lpcbData=0x19de68*=0x0 | out: lpType=0x19de6c*=0x1, lpData=0x0, lpcbData=0x19de68*=0xe) returned 0x0 [0114.849] RegQueryValueExW (in: hKey=0x42c, lpValueName="InstallationType", lpReserved=0x0, lpType=0x19de6c, lpData=0x26cdc9c, lpcbData=0x19de68*=0xe | out: lpType=0x19de6c*=0x1, lpData="Client", lpcbData=0x19de68*=0xe) returned 0x0 [0114.849] RegCloseKey (hKey=0x42c) returned 0x0 [0114.850] lstrlenW (lpString="obsidium.dll") returned 12 [0114.850] lstrlenW (lpString="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\rasapi32.dll") returned 93 [0114.855] lstrlenW (lpString="obsidium.dll") returned 12 [0114.855] lstrlenW (lpString="rasapi32.dll") returned 12 [0116.233] GetModuleHandleA (lpModuleName="msvcrt.dll") returned 0x77640000 [0116.233] GetModuleHandleA (lpModuleName="api-ms-win-core-registry-l1-1-0.dll") returned 0x74bc0000 [0116.234] GetModuleHandleA (lpModuleName="api-ms-win-core-synch-l1-2-0.dll") returned 0x74bc0000 [0116.234] GetModuleHandleA (lpModuleName="api-ms-win-core-processthreads-l1-1-2.dll") returned 0x772d0000 [0116.234] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77970000 [0116.235] GetModuleHandleA (lpModuleName="api-ms-win-core-heap-l2-1-0.dll") returned 0x74bc0000 [0116.235] GetModuleHandleA (lpModuleName="api-ms-win-security-base-l1-2-0.dll") returned 0x74bc0000 [0116.235] GetModuleHandleA (lpModuleName="api-ms-win-core-localization-l1-2-1.dll") returned 0x74bc0000 [0116.236] GetModuleHandleA (lpModuleName="api-ms-win-core-errorhandling-l1-1-1.dll") returned 0x74bc0000 [0116.236] GetModuleHandleA (lpModuleName="api-ms-win-core-handle-l1-1-0.dll") returned 0x74bc0000 [0116.236] GetModuleHandleA (lpModuleName="api-ms-win-core-libraryloader-l1-2-0.dll") returned 0x74bc0000 [0116.237] GetModuleHandleA (lpModuleName="api-ms-win-core-registry-l2-2-0.dll") returned 0x756e0000 [0116.237] GetModuleHandleA (lpModuleName="api-ms-win-core-sysinfo-l1-2-1.dll") returned 0x74bc0000 [0116.238] GetModuleHandleA (lpModuleName="api-ms-win-core-synch-l1-2-1.dll") returned 0x74bc0000 [0116.238] GetModuleHandleA (lpModuleName="api-ms-win-eventlog-legacy-l1-1-0.dll") returned 0x756e0000 [0116.238] GetModuleHandleA (lpModuleName="api-ms-win-eventing-provider-l1-1-0.dll") returned 0x74bc0000 [0116.239] GetModuleHandleA (lpModuleName="api-ms-win-core-string-obsolete-l1-1-0.dll") returned 0x772d0000 [0116.239] GetModuleHandleA (lpModuleName="api-ms-win-core-file-l1-2-1.dll") returned 0x74bc0000 [0116.239] GetModuleHandleA (lpModuleName="api-ms-win-core-string-l1-1-0.dll") returned 0x74bc0000 [0116.240] GetModuleHandleA (lpModuleName="api-ms-win-core-heap-l1-2-0.dll") returned 0x74bc0000 [0116.241] GetModuleHandleA (lpModuleName="api-ms-win-core-processenvironment-l1-2-0.dll") returned 0x74bc0000 [0116.241] GetModuleHandleA (lpModuleName="api-ms-win-core-threadpool-l1-2-0.dll") returned 0x74bc0000 [0116.241] GetModuleHandleA (lpModuleName="api-ms-win-core-timezone-l1-1-0.dll") returned 0x74bc0000 [0116.242] GetModuleHandleA (lpModuleName="api-ms-win-core-profile-l1-1-0.dll") returned 0x74bc0000 [0116.242] GetModuleHandleA (lpModuleName="rasman.dll") returned 0x6f620000 [0116.244] GetModuleHandleA (lpModuleName="api-ms-win-core-apiquery-l1-1-0.dll") returned 0x77970000 [0116.244] GetModuleHandleA (lpModuleName="api-ms-win-eventing-classicprovider-l1-1-0.dll") returned 0x74bc0000 [0116.245] GetModuleHandleA (lpModuleName="api-ms-win-eventing-controller-l1-1-0.dll") returned 0x77700000 [0116.245] GetModuleHandleA (lpModuleName="api-ms-win-eventing-legacy-l1-1-0.dll") returned 0x756e0000 [0116.245] GetModuleHandleA (lpModuleName="api-ms-win-core-psapi-ansi-l1-1-0.dll") returned 0x74bc0000 [0116.246] GetModuleHandleA (lpModuleName="api-ms-win-core-winrt-string-l1-1-0.dll") returned 0x74940000 [0116.246] GetModuleHandleA (lpModuleName="api-ms-win-core-winrt-l1-1-0.dll") returned 0x74940000 [0116.247] GetModuleHandleA (lpModuleName="api-ms-win-core-string-l2-1-0.dll") returned 0x74bc0000 [0116.247] GetModuleHandleA (lpModuleName="api-ms-win-core-heap-obsolete-l1-1-0.dll") returned 0x772d0000 [0116.247] GetModuleHandleA (lpModuleName="api-ms-win-core-localization-obsolete-l1-3-0.dll") returned 0x74bc0000 [0116.248] GetModuleHandleA (lpModuleName="api-ms-win-core-kernel32-legacy-l1-1-1.dll") returned 0x772d0000 [0116.248] GetModuleHandleA (lpModuleName="api-ms-win-core-file-l2-1-2.dll") returned 0x74bc0000 [0116.248] GetModuleHandleA (lpModuleName="api-ms-win-core-delayload-l1-1-1.dll") returned 0x74bc0000 [0116.250] CoTaskMemAlloc (cb=0xcc0) returned 0x77d0048 [0116.253] RasEnumConnectionsW (in: param_1=0x77d0048, param_2=0x19ed24, param_3=0x19ed28 | out: param_1=0x77d0048, param_2=0x19ed24, param_3=0x19ed28) returned 0x0 [0116.617] CoTaskMemFree (pv=0x77d0048) [0116.618] lstrlenW (lpString="obsidium.dll") returned 12 [0116.618] lstrlenW (lpString="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ws2_32.dll") returned 91 [0116.623] lstrlenW (lpString="obsidium.dll") returned 12 [0116.623] lstrlenW (lpString="ws2_32.dll") returned 10 [0117.370] GetModuleHandleA (lpModuleName="api-ms-win-core-crt-l1-1-0.dll") returned 0x77970000 [0117.370] GetModuleHandleA (lpModuleName="api-ms-win-core-crt-l2-1-0.dll") returned 0x74bc0000 [0117.373] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77970000 [0117.373] GetModuleHandleA (lpModuleName="api-ms-win-core-errorhandling-l1-1-1.dll") returned 0x74bc0000 [0117.374] GetModuleHandleA (lpModuleName="api-ms-win-core-processthreads-l1-1-2.dll") returned 0x772d0000 [0117.374] GetModuleHandleA (lpModuleName="api-ms-win-eventing-classicprovider-l1-1-0.dll") returned 0x74bc0000 [0117.374] GetModuleHandleA (lpModuleName="api-ms-win-core-string-l1-1-0.dll") returned 0x74bc0000 [0117.375] GetModuleHandleA (lpModuleName="api-ms-win-core-handle-l1-1-0.dll") returned 0x74bc0000 [0117.375] GetModuleHandleA (lpModuleName="api-ms-win-core-synch-l1-2-0.dll") returned 0x74bc0000 [0117.375] GetModuleHandleA (lpModuleName="api-ms-win-core-libraryloader-l1-2-0.dll") returned 0x74bc0000 [0117.376] GetModuleHandleA (lpModuleName="api-ms-win-core-threadpool-l1-2-0.dll") returned 0x74bc0000 [0117.376] GetModuleHandleA (lpModuleName="api-ms-win-security-base-l1-2-0.dll") returned 0x74bc0000 [0117.376] GetModuleHandleA (lpModuleName="api-ms-win-eventing-provider-l1-1-0.dll") returned 0x74bc0000 [0117.377] GetModuleHandleA (lpModuleName="api-ms-win-core-heap-l1-2-0.dll") returned 0x74bc0000 [0117.377] GetModuleHandleA (lpModuleName="api-ms-win-core-registry-l1-1-0.dll") returned 0x74bc0000 [0117.377] GetModuleHandleA (lpModuleName="api-ms-win-core-processenvironment-l1-2-0.dll") returned 0x74bc0000 [0117.378] GetModuleHandleA (lpModuleName="api-ms-win-core-heap-l2-1-0.dll") returned 0x74bc0000 [0117.378] GetModuleHandleA (lpModuleName="api-ms-win-core-sysinfo-l1-2-1.dll") returned 0x74bc0000 [0117.378] GetModuleHandleA (lpModuleName="api-ms-win-core-file-l1-2-1.dll") returned 0x74bc0000 [0117.379] GetModuleHandleA (lpModuleName="api-ms-win-core-wow64-l1-1-0.dll") returned 0x74bc0000 [0117.379] GetModuleHandleA (lpModuleName="api-ms-win-core-io-l1-1-1.dll") returned 0x772d0000 [0117.379] GetModuleHandleA (lpModuleName="api-ms-win-core-profile-l1-1-0.dll") returned 0x74bc0000 [0117.380] GetModuleHandleA (lpModuleName="api-ms-win-core-util-l1-1-0.dll") returned 0x772d0000 [0117.380] GetModuleHandleA (lpModuleName="api-ms-win-eventing-obsolete-l1-1-0.dll") returned 0x77700000 [0117.380] GetModuleHandleA (lpModuleName="api-ms-win-core-string-obsolete-l1-1-0.dll") returned 0x772d0000 [0117.381] GetModuleHandleA (lpModuleName="api-ms-win-core-kernel32-legacy-l1-1-1.dll") returned 0x772d0000 [0117.381] GetModuleHandleA (lpModuleName="RPCRT4.dll") returned 0x76bf0000 [0117.381] GetModuleHandleA (lpModuleName="api-ms-win-core-debug-l1-1-1.dll") returned 0x74bc0000 [0117.382] GetModuleHandleA (lpModuleName="api-ms-win-core-delayload-l1-1-1.dll") returned 0x74bc0000 [0117.382] GetModuleHandleA (lpModuleName="api-ms-win-core-apiquery-l1-1-0.dll") returned 0x77970000 [0117.383] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19eb10 | out: lpWSAData=0x19eb10) returned 0 [0117.392] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x490 [0118.004] setsockopt (s=0x490, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0118.004] closesocket (s=0x490) returned 0 [0118.005] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x490 [0118.012] setsockopt (s=0x490, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0118.012] closesocket (s=0x490) returned 0 [0118.012] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x490 [0118.013] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x494 [0118.014] ioctlsocket (in: s=0x490, cmd=-2147195266, argp=0x19ed2c | out: argp=0x19ed2c) returned 0 [0118.014] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x498 [0118.015] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x49c [0118.015] ioctlsocket (in: s=0x498, cmd=-2147195266, argp=0x19ed2c | out: argp=0x19ed2c) returned 0 [0118.016] WSAIoctl (in: s=0x490, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x19ed14, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x19ed14, lpOverlapped=0x0) returned -1 [0118.018] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x19ea44, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0118.025] WSAEventSelect (s=0x490, hEventObject=0x494, lNetworkEvents=512) returned 0 [0118.026] WSAIoctl (in: s=0x498, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x19ed14, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x19ed14, lpOverlapped=0x0) returned -1 [0118.026] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x19ea44, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0118.026] WSAEventSelect (s=0x498, hEventObject=0x49c, lNetworkEvents=512) returned 0 [0118.026] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4a4 [0118.026] RasConnectionNotificationW (param_1=0xffffffff, param_2=0x4a4, param_3=0x3) returned 0x0 [0118.037] RegOpenCurrentUser (in: samDesired=0x20019, phkResult=0x19ed40 | out: phkResult=0x19ed40*=0x4bc) returned 0x0 [0118.038] RegOpenKeyExW (in: hKey=0x4bc, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ecf4 | out: phkResult=0x19ecf4*=0x4c0) returned 0x0 [0118.039] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4c4 [0118.039] RegNotifyChangeKeyValue (hKey=0x4c0, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x4c4, fAsynchronous=1) returned 0x0 [0118.040] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ecf8 | out: phkResult=0x19ecf8*=0x4c8) returned 0x0 [0118.040] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4cc [0118.040] RegNotifyChangeKeyValue (hKey=0x4c8, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x4cc, fAsynchronous=1) returned 0x0 [0118.041] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ecf8 | out: phkResult=0x19ecf8*=0x4d0) returned 0x0 [0118.041] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4d4 [0118.041] RegNotifyChangeKeyValue (hKey=0x4d0, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x4d4, fAsynchronous=1) returned 0x0 [0118.041] GetCurrentProcess () returned 0xffffffff [0118.041] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ece4 | out: TokenHandle=0x19ece4*=0x4d8) returned 1 [0118.045] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e5f0 | out: phkResult=0x19e5f0*=0x4dc) returned 0x0 [0118.046] RegQueryValueExW (in: hKey=0x4dc, lpValueName="LegacyWPADSupport", lpReserved=0x0, lpType=0x19e60c, lpData=0x0, lpcbData=0x19e608*=0x0 | out: lpType=0x19e60c*=0x0, lpData=0x0, lpcbData=0x19e608*=0x0) returned 0x2 [0118.046] RegCloseKey (hKey=0x4dc) returned 0x0 [0118.739] WinHttpOpen (pszAgentW=0x0, dwAccessType=0x1, pszProxyW=0x0, pszProxyBypassW=0x0, dwFlags=0x0) returned 0x77d5ab8 [0119.448] WinHttpSetTimeouts (hInternet=0x77d5ab8, nResolveTimeout=60000, nConnectTimeout=60000, nSendTimeout=60000, nReceiveTimeout=60000) returned 1 [0119.448] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x19ecf4 | out: pProxyConfig=0x19ecf4) returned 1 [0120.170] CoTaskMemAlloc (cb=0x20e) returned 0x77e6650 [0120.170] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_Disabled", lpBuffer=0x77e6650, nSize=0x105 | out: lpBuffer="ﷰݽ귰uណ潊᝾潊\x03") returned 0x0 [0120.170] CoTaskMemFree (pv=0x77e6650) [0120.171] CoTaskMemAlloc (cb=0x20e) returned 0x77e6650 [0120.171] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_MinCount", lpBuffer=0x77e6650, nSize=0x105 | out: lpBuffer="ﷰݽ귰uណ潊᝾潊\x03") returned 0x0 [0120.171] CoTaskMemFree (pv=0x77e6650) [0120.177] EtwEventRegister (in: ProviderId=0x26d0a34, EnableCallback=0x4ba0636, CallbackContext=0x0, RegHandle=0x26d0a10 | out: RegHandle=0x26d0a10) returned 0x0 [0120.177] EtwEventSetInformation (RegHandle=0x73b2e8, InformationClass=0x65, EventInformation=0x2, InformationLength=0x26d09d0) returned 0x0 [0120.179] GetCurrentProcess () returned 0xffffffff [0120.179] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ea54 | out: TokenHandle=0x19ea54*=0x520) returned 1 [0120.181] GetCurrentProcess () returned 0xffffffff [0120.181] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ea64 | out: TokenHandle=0x19ea64*=0x524) returned 1 [0120.185] SetEvent (hEvent=0x36c) returned 1 [0120.211] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ec5c*=0x4a4, lpdwindex=0x19ea7c | out: lpdwindex=0x19ea7c) returned 0x80010115 [0120.820] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ec3c*=0x494, lpdwindex=0x19ea5c | out: lpdwindex=0x19ea5c) returned 0x80010115 [0120.821] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ec3c*=0x49c, lpdwindex=0x19ea5c | out: lpdwindex=0x19ea5c) returned 0x80010115 [0120.821] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ec90*=0x4c4, lpdwindex=0x19eaac | out: lpdwindex=0x19eaac) returned 0x80010115 [0120.822] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ec90*=0x4cc, lpdwindex=0x19eaac | out: lpdwindex=0x19eaac) returned 0x80010115 [0120.822] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ec90*=0x4d4, lpdwindex=0x19eaac | out: lpdwindex=0x19eaac) returned 0x80010115 [0120.828] GetCurrentProcess () returned 0xffffffff [0120.828] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e9cc | out: TokenHandle=0x19e9cc*=0x560) returned 1 [0120.829] GetCurrentProcess () returned 0xffffffff [0120.829] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e9dc | out: TokenHandle=0x19e9dc*=0x564) returned 1 [0120.830] GetTimeZoneInformation (in: lpTimeZoneInformation=0x19eb4c | out: lpTimeZoneInformation=0x19eb4c) returned 0x2 [0120.836] GetDynamicTimeZoneInformation (in: pTimeZoneInformation=0x19e9a8 | out: pTimeZoneInformation=0x19e9a8) returned 0x2 [0120.837] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ea8c | out: phkResult=0x19ea8c*=0x568) returned 0x0 [0120.838] RegQueryValueExW (in: hKey=0x568, lpValueName="TZI", lpReserved=0x0, lpType=0x19eaa8, lpData=0x0, lpcbData=0x19eaa4*=0x0 | out: lpType=0x19eaa8*=0x3, lpData=0x0, lpcbData=0x19eaa4*=0x2c) returned 0x0 [0120.838] RegQueryValueExW (in: hKey=0x568, lpValueName="TZI", lpReserved=0x0, lpType=0x19eaa8, lpData=0x26d3a4c, lpcbData=0x19eaa4*=0x2c | out: lpType=0x19eaa8*=0x3, lpData=0x26d3a4c*, lpcbData=0x19eaa4*=0x2c) returned 0x0 [0120.838] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time\\Dynamic DST", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e8e0 | out: phkResult=0x19e8e0*=0x0) returned 0x2 [0120.839] RegQueryValueExW (in: hKey=0x568, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x19ea80, lpData=0x0, lpcbData=0x19ea7c*=0x0 | out: lpType=0x19ea80*=0x1, lpData=0x0, lpcbData=0x19ea7c*=0x20) returned 0x0 [0120.839] RegQueryValueExW (in: hKey=0x568, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x19ea80, lpData=0x26d3e70, lpcbData=0x19ea7c*=0x20 | out: lpType=0x19ea80*=0x1, lpData="@tzres.dll,-320", lpcbData=0x19ea7c*=0x20) returned 0x0 [0120.839] RegQueryValueExW (in: hKey=0x568, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x19ea80, lpData=0x0, lpcbData=0x19ea7c*=0x0 | out: lpType=0x19ea80*=0x1, lpData=0x0, lpcbData=0x19ea7c*=0x20) returned 0x0 [0120.839] RegQueryValueExW (in: hKey=0x568, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x19ea80, lpData=0x26d3ec8, lpcbData=0x19ea7c*=0x20 | out: lpType=0x19ea80*=0x1, lpData="@tzres.dll,-322", lpcbData=0x19ea7c*=0x20) returned 0x0 [0120.839] RegQueryValueExW (in: hKey=0x568, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x19ea80, lpData=0x0, lpcbData=0x19ea7c*=0x0 | out: lpType=0x19ea80*=0x1, lpData=0x0, lpcbData=0x19ea7c*=0x20) returned 0x0 [0120.839] RegQueryValueExW (in: hKey=0x568, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x19ea80, lpData=0x26d3f20, lpcbData=0x19ea7c*=0x20 | out: lpType=0x19ea80*=0x1, lpData="@tzres.dll,-321", lpcbData=0x19ea7c*=0x20) returned 0x0 [0120.847] CoTaskMemAlloc (cb=0x20c) returned 0x77e4378 [0120.847] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x77e4378 | out: pszPath="C:\\WINDOWS\\system32") returned 0x0 [0120.864] CoTaskMemFree (pv=0x77e4378) [0120.865] CoTaskMemAlloc (cb=0x20e) returned 0x77e4378 [0120.865] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\WINDOWS\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x19ea9c, pwszFileMUIPath=0x77e4378, pcchFileMUIPath=0x19eaa0, pululEnumerator=0x19ea94 | out: pwszLanguage=0x0, pcchLanguage=0x19ea9c, pwszFileMUIPath="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x19eaa0, pululEnumerator=0x19ea94) returned 1 [0120.909] CoTaskMemFree (pv=0x0) [0120.909] CoTaskMemFree (pv=0x77e4378) [0120.910] LoadLibraryExW (lpLibFileName="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x7ef0001 [0120.916] CoTaskMemAlloc (cb=0x3ec) returned 0x77dabe0 [0120.916] LoadStringW (in: hInstance=0x7ef0001, uID=0x140, lpBuffer=0x77dabe0, cchBufferMax=500 | out: lpBuffer="(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna") returned 0x3c [0120.916] CoTaskMemFree (pv=0x77dabe0) [0120.916] FreeLibrary (hLibModule=0x7ef0001) returned 1 [0120.917] CoTaskMemAlloc (cb=0x20c) returned 0x77d9f88 [0120.917] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x77d9f88 | out: pszPath="C:\\WINDOWS\\system32") returned 0x0 [0120.917] CoTaskMemFree (pv=0x77d9f88) [0120.917] CoTaskMemAlloc (cb=0x20e) returned 0x77d9f88 [0120.917] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\WINDOWS\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x19ea9c, pwszFileMUIPath=0x77d9f88, pcchFileMUIPath=0x19eaa0, pululEnumerator=0x19ea94 | out: pwszLanguage=0x0, pcchLanguage=0x19ea9c, pwszFileMUIPath="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x19eaa0, pululEnumerator=0x19ea94) returned 1 [0120.918] CoTaskMemFree (pv=0x0) [0120.918] CoTaskMemFree (pv=0x77d9f88) [0120.918] LoadLibraryExW (lpLibFileName="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x7ef0001 [0120.919] CoTaskMemAlloc (cb=0x3ec) returned 0x77dabe0 [0120.919] LoadStringW (in: hInstance=0x7ef0001, uID=0x142, lpBuffer=0x77dabe0, cchBufferMax=500 | out: lpBuffer="W. Europe Standard Time") returned 0x17 [0120.920] CoTaskMemFree (pv=0x77dabe0) [0120.920] FreeLibrary (hLibModule=0x7ef0001) returned 1 [0120.920] CoTaskMemAlloc (cb=0x20c) returned 0x77d9f88 [0120.920] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x77d9f88 | out: pszPath="C:\\WINDOWS\\system32") returned 0x0 [0120.920] CoTaskMemFree (pv=0x77d9f88) [0120.921] CoTaskMemAlloc (cb=0x20e) returned 0x77d9f88 [0120.921] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\WINDOWS\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x19ea9c, pwszFileMUIPath=0x77d9f88, pcchFileMUIPath=0x19eaa0, pululEnumerator=0x19ea94 | out: pwszLanguage=0x0, pcchLanguage=0x19ea9c, pwszFileMUIPath="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x19eaa0, pululEnumerator=0x19ea94) returned 1 [0120.921] CoTaskMemFree (pv=0x0) [0120.921] CoTaskMemFree (pv=0x77d9f88) [0120.921] LoadLibraryExW (lpLibFileName="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x7ef0001 [0120.922] CoTaskMemAlloc (cb=0x3ec) returned 0x77dabe0 [0120.922] LoadStringW (in: hInstance=0x7ef0001, uID=0x141, lpBuffer=0x77dabe0, cchBufferMax=500 | out: lpBuffer="W. Europe Daylight Time") returned 0x17 [0120.922] CoTaskMemFree (pv=0x77dabe0) [0120.922] FreeLibrary (hLibModule=0x7ef0001) returned 1 [0120.923] RegCloseKey (hKey=0x568) returned 0x0 [0120.924] SetEvent (hEvent=0x36c) returned 1 [0120.941] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x19eca8 | out: pFixedInfo=0x0, pOutBufLen=0x19eca8) returned 0x6f [0122.464] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x77e4378 [0122.464] GetNetworkParams (in: pFixedInfo=0x77e4378, pOutBufLen=0x19eca8 | out: pFixedInfo=0x77e4378, pOutBufLen=0x19eca8) returned 0x0 [0122.500] LocalFree (hMem=0x77e4378) returned 0x0 [0122.501] CoTaskMemAlloc (cb=0x20e) returned 0x77d9f88 [0122.501] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_Disabled", lpBuffer=0x77d9f88, nSize=0x105 | out: lpBuffer="ꢸݾ쯨ݽ") returned 0x0 [0122.501] CoTaskMemFree (pv=0x77d9f88) [0122.501] CoTaskMemAlloc (cb=0x20e) returned 0x77d9f88 [0122.501] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_MinCount", lpBuffer=0x77d9f88, nSize=0x105 | out: lpBuffer="ꢸݾ쯨ݽ") returned 0x0 [0122.501] CoTaskMemFree (pv=0x77d9f88) [0122.504] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x5ac [0122.507] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x584 [0122.508] GetAddrInfoW (in: pNodeName="www.google.com", pServiceName=0x0, pHints=0x19eb90*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x19eb38 | out: ppResult=0x19eb38*=0x775b18*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="www.google.com", ai_addr=0x77edc18*(sa_family=2, sin_port=0x0, sin_addr="172.217.23.132"), ai_next=0x0)) returned 0 [0123.345] FreeAddrInfoW (pAddrInfo=0x775b18*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="www.google.com", ai_addr=0x77edc18*(sa_family=2, sin_port=0x0, sin_addr="172.217.23.132"), ai_next=0x0)) [0123.354] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x5b4 [0123.354] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x5bc [0123.354] ioctlsocket (in: s=0x5b4, cmd=-2147195266, argp=0x19eb64 | out: argp=0x19eb64) returned 0 [0123.354] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x5c0 [0123.355] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x5c4 [0123.355] ioctlsocket (in: s=0x5c0, cmd=-2147195266, argp=0x19eb64 | out: argp=0x19eb64) returned 0 [0123.355] WSAIoctl (in: s=0x5b4, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x19eb4c, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x19eb4c, lpOverlapped=0x0) returned -1 [0123.355] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x19e87c, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0123.355] WSAEventSelect (s=0x5b4, hEventObject=0x5bc, lNetworkEvents=512) returned 0 [0123.355] WSAIoctl (in: s=0x5c0, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x19eb4c, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x19eb4c, lpOverlapped=0x0) returned -1 [0123.355] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x19e87c, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0123.355] WSAEventSelect (s=0x5c0, hEventObject=0x5c4, lNetworkEvents=512) returned 0 [0123.356] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x19eb48*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x19eb48*=0x818) returned 0x6f [0123.375] LocalAlloc (uFlags=0x0, uBytes=0x818) returned 0x77eea48 [0123.375] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x77eea48, SizePointer=0x19eb48*=0x818 | out: AdapterAddresses=0x77eea48*(Alignment=0x300000178, Length=0x178, IfIndex=0x3, Next=0x77eecf8, AdapterName="{9E48833B-70C6-43EE-85DC-893C1782D802}", FirstUnicastAddress=0x77eec6c, FirstAnycastAddress=0x0, FirstMulticastAddress=0x0, FirstDnsServerAddress=0x0, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection #2", FriendlyName="Ethernet 2", PhysicalAddress=([0]=0xc4, [1]=0x6d, [2]=0xf1, [3]=0x4, [4]=0xaf, [5]=0xf5, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x1c5, DdnsEnabled=0x1c5, RegisterAdapterSuffix=0x1c5, Dhcpv4Enabled=0x1c5, ReceiveOnly=0x1c5, NoMulticast=0x1c5, Ipv6OtherStatefulConfig=0x1c5, NetbiosOverTcpipEnabled=0x1c5, Ipv4Enabled=0x1c5, Ipv6Enabled=0x1c5, Ipv6ManagedAddressConfigurationSupported=0x1c5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x3, ZoneIndices=([0]=0x3, [1]=0x3, [2]=0x3, [3]=0x3, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0x19, Ipv6Metric=0x19, Luid=0x6008002000000, Dhcpv4Server.lpSockaddr=0x77eebc0*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11e7933cfae992b0, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x23, [5]=0x7d, [6]=0xeb, [7]=0x9, [8]=0x7c, [9]=0x4a, [10]=0x82, [11]=0x56, [12]=0xb9, [13]=0x2b, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x57c4a82, FirstDnsSuffix=0x0), SizePointer=0x19eb48*=0x818) returned 0x0 [0123.417] LocalFree (hMem=0x77eea48) returned 0x0 [0123.421] WSAConnect (in: s=0x5ac, name=0x26df8e8*(sa_family=2, sin_port=0x1bb, sin_addr="172.217.23.132"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0123.446] closesocket (s=0x584) returned 0 [0123.460] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ea98 | out: phkResult=0x19ea98*=0x584) returned 0x0 [0123.461] RegQueryValueExW (in: hKey=0x584, lpValueName="HWRPortReuseOnSocketBind", lpReserved=0x0, lpType=0x19eab4, lpData=0x0, lpcbData=0x19eab0*=0x0 | out: lpType=0x19eab4*=0x0, lpData=0x0, lpcbData=0x19eab0*=0x0) returned 0x2 [0123.461] RegCloseKey (hKey=0x584) returned 0x0 [0123.470] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ea9c | out: phkResult=0x19ea9c*=0x584) returned 0x0 [0123.471] RegQueryValueExW (in: hKey=0x584, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x19eab8, lpData=0x0, lpcbData=0x19eab4*=0x0 | out: lpType=0x19eab8*=0x0, lpData=0x0, lpcbData=0x19eab4*=0x0) returned 0x2 [0123.471] RegCloseKey (hKey=0x584) returned 0x0 [0123.473] GetCurrentProcessId () returned 0xef8 [0123.477] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xef8) returned 0x584 [0123.478] lstrlenW (lpString="obsidium.dll") returned 12 [0123.478] lstrlenW (lpString="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\psapi.dll") returned 90 [0123.483] lstrlenW (lpString="obsidium.dll") returned 12 [0123.483] lstrlenW (lpString="psapi.dll") returned 9 [0123.488] GetModuleHandleA (lpModuleName="api-ms-win-core-psapi-l1-1-0.dll") returned 0x74bc0000 [0123.488] GetModuleHandleA (lpModuleName="api-ms-win-core-libraryloader-l1-2-0.dll") returned 0x74bc0000 [0123.488] GetModuleHandleA (lpModuleName="api-ms-win-core-profile-l1-1-0.dll") returned 0x74bc0000 [0123.489] GetModuleHandleA (lpModuleName="api-ms-win-core-processthreads-l1-1-2.dll") returned 0x772d0000 [0123.489] GetModuleHandleA (lpModuleName="api-ms-win-core-sysinfo-l1-2-1.dll") returned 0x74bc0000 [0123.489] GetModuleHandleA (lpModuleName="api-ms-win-core-psapi-obsolete-l1-1-0.dll") returned 0x74bc0000 [0123.490] GetModuleHandleA (lpModuleName="api-ms-win-core-psapi-ansi-l1-1-0.dll") returned 0x74bc0000 [0123.491] EnumProcessModules (in: hProcess=0x584, lphModule=0x26e2014, cb=0x100, lpcbNeeded=0x19eaa4 | out: lphModule=0x26e2014, lpcbNeeded=0x19eaa4) returned 1 [0123.491] EnumProcessModules (in: hProcess=0x584, lphModule=0x26e2120, cb=0x200, lpcbNeeded=0x19eaa4 | out: lphModule=0x26e2120, lpcbNeeded=0x19eaa4) returned 1 [0123.491] GetModuleInformation (in: hProcess=0x584, hModule=0x400000, lpmodinfo=0x26e2360, cb=0xc | out: lpmodinfo=0x26e2360*(lpBaseOfDll=0x400000, SizeOfImage=0x6f000, EntryPoint=0x457000)) returned 1 [0123.492] CoTaskMemAlloc (cb=0x804) returned 0x77eea48 [0123.492] GetModuleBaseNameW (in: hProcess=0x584, hModule=0x400000, lpBaseName=0x77eea48, nSize=0x800 | out: lpBaseName="hidden-tear.exe") returned 0xf [0123.492] CoTaskMemFree (pv=0x77eea48) [0123.492] CoTaskMemAlloc (cb=0x804) returned 0x77eea48 [0123.492] GetModuleFileNameExW (in: hProcess=0x584, hModule=0x400000, lpFilename=0x77eea48, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\hidden-tear.exe")) returned 0x27 [0123.492] CoTaskMemFree (pv=0x77eea48) [0123.492] CloseHandle (hObject=0x584) returned 1 [0123.496] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe", nBufferLength=0x105, lpBuffer=0x19e5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe", lpFilePart=0x0) returned 0x27 [0123.496] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.SchSendAuxRecord", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ea9c | out: phkResult=0x19ea9c*=0x0) returned 0x2 [0123.497] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ea9c | out: phkResult=0x19ea9c*=0x584) returned 0x0 [0123.498] RegQueryValueExW (in: hKey=0x584, lpValueName="SchSendAuxRecord", lpReserved=0x0, lpType=0x19eab8, lpData=0x0, lpcbData=0x19eab4*=0x0 | out: lpType=0x19eab8*=0x0, lpData=0x0, lpcbData=0x19eab4*=0x0) returned 0x2 [0123.498] RegCloseKey (hKey=0x584) returned 0x0 [0123.498] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ea9c | out: phkResult=0x19ea9c*=0x584) returned 0x0 [0123.499] RegQueryValueExW (in: hKey=0x584, lpValueName="SystemDefaultTlsVersions", lpReserved=0x0, lpType=0x19eab8, lpData=0x0, lpcbData=0x19eab4*=0x0 | out: lpType=0x19eab8*=0x0, lpData=0x0, lpcbData=0x19eab4*=0x0) returned 0x2 [0123.499] RegCloseKey (hKey=0x584) returned 0x0 [0123.504] GetCurrentProcessId () returned 0xef8 [0123.504] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xef8) returned 0x584 [0123.504] EnumProcessModules (in: hProcess=0x584, lphModule=0x26e4fe4, cb=0x100, lpcbNeeded=0x19ea9c | out: lphModule=0x26e4fe4, lpcbNeeded=0x19ea9c) returned 1 [0123.504] EnumProcessModules (in: hProcess=0x584, lphModule=0x26e50f0, cb=0x200, lpcbNeeded=0x19ea9c | out: lphModule=0x26e50f0, lpcbNeeded=0x19ea9c) returned 1 [0123.505] GetModuleInformation (in: hProcess=0x584, hModule=0x400000, lpmodinfo=0x26e5330, cb=0xc | out: lpmodinfo=0x26e5330*(lpBaseOfDll=0x400000, SizeOfImage=0x6f000, EntryPoint=0x457000)) returned 1 [0123.505] CoTaskMemAlloc (cb=0x804) returned 0x77eea48 [0123.505] GetModuleBaseNameW (in: hProcess=0x584, hModule=0x400000, lpBaseName=0x77eea48, nSize=0x800 | out: lpBaseName="hidden-tear.exe") returned 0xf [0123.505] CoTaskMemFree (pv=0x77eea48) [0123.505] CoTaskMemAlloc (cb=0x804) returned 0x77eea48 [0123.505] GetModuleFileNameExW (in: hProcess=0x584, hModule=0x400000, lpFilename=0x77eea48, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\hidden-tear.exe")) returned 0x27 [0123.505] CoTaskMemFree (pv=0x77eea48) [0123.505] CloseHandle (hObject=0x584) returned 1 [0123.505] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe", nBufferLength=0x105, lpBuffer=0x19e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe", lpFilePart=0x0) returned 0x27 [0123.505] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.RequireCertificateEKUs", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ea94 | out: phkResult=0x19ea94*=0x0) returned 0x2 [0123.506] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ea94 | out: phkResult=0x19ea94*=0x584) returned 0x0 [0123.507] RegQueryValueExW (in: hKey=0x584, lpValueName="RequireCertificateEKUs", lpReserved=0x0, lpType=0x19eab0, lpData=0x0, lpcbData=0x19eaac*=0x0 | out: lpType=0x19eab0*=0x0, lpData=0x0, lpcbData=0x19eaac*=0x0) returned 0x2 [0123.507] RegCloseKey (hKey=0x584) returned 0x0 [0123.514] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x748890 [0123.574] lstrlenW (lpString="obsidium.dll") returned 12 [0123.574] lstrlenW (lpString="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.dll") returned 92 [0123.579] lstrlenW (lpString="obsidium.dll") returned 12 [0123.579] lstrlenW (lpString="crypt32.dll") returned 11 [0124.773] GetModuleHandleA (lpModuleName="api-ms-win-crt-runtime-l1-1-0.dll") returned 0x777e0000 [0124.774] GetModuleHandleA (lpModuleName="api-ms-win-crt-private-l1-1-0.dll") returned 0x777e0000 [0124.774] GetModuleHandleA (lpModuleName="api-ms-win-core-registry-l1-1-0.dll") returned 0x74bc0000 [0124.774] GetModuleHandleA (lpModuleName="api-ms-win-core-errorhandling-l1-1-1.dll") returned 0x74bc0000 [0124.775] GetModuleHandleA (lpModuleName="api-ms-win-core-synch-l1-2-0.dll") returned 0x74bc0000 [0124.775] GetModuleHandleA (lpModuleName="api-ms-win-core-processenvironment-l1-2-0.dll") returned 0x74bc0000 [0124.775] GetModuleHandleA (lpModuleName="api-ms-win-core-heap-l2-1-0.dll") returned 0x74bc0000 [0124.776] GetModuleHandleA (lpModuleName="api-ms-win-core-version-l1-1-0.dll") returned 0x74bc0000 [0124.776] GetModuleHandleA (lpModuleName="api-ms-win-core-debug-l1-1-1.dll") returned 0x74bc0000 [0124.776] GetModuleHandleA (lpModuleName="api-ms-win-core-processthreads-l1-1-2.dll") returned 0x772d0000 [0124.777] GetModuleHandleA (lpModuleName="api-ms-win-core-profile-l1-1-0.dll") returned 0x74bc0000 [0124.777] GetModuleHandleA (lpModuleName="api-ms-win-core-sysinfo-l1-2-1.dll") returned 0x74bc0000 [0124.777] GetModuleHandleA (lpModuleName="api-ms-win-core-interlocked-l1-2-0.dll") returned 0x74bc0000 [0124.778] GetModuleHandleA (lpModuleName="api-ms-win-core-libraryloader-l1-2-0.dll") returned 0x74bc0000 [0124.778] GetModuleHandleA (lpModuleName="api-ms-win-core-file-l1-2-1.dll") returned 0x74bc0000 [0124.778] GetModuleHandleA (lpModuleName="api-ms-win-eventing-provider-l1-1-0.dll") returned 0x74bc0000 [0124.779] GetModuleHandleA (lpModuleName="api-ms-win-core-localization-l1-2-1.dll") returned 0x74bc0000 [0124.779] GetModuleHandleA (lpModuleName="api-ms-win-core-string-l1-1-0.dll") returned 0x74bc0000 [0124.779] GetModuleHandleA (lpModuleName="api-ms-win-security-base-l1-2-0.dll") returned 0x74bc0000 [0124.780] GetModuleHandleA (lpModuleName="api-ms-win-core-handle-l1-1-0.dll") returned 0x74bc0000 [0124.780] GetModuleHandleA (lpModuleName="api-ms-win-core-psapi-l1-1-0.dll") returned 0x74bc0000 [0124.781] GetModuleHandleA (lpModuleName="api-ms-win-core-timezone-l1-1-0.dll") returned 0x74bc0000 [0124.781] GetModuleHandleA (lpModuleName="api-ms-win-core-libraryloader-l1-2-2.dll") returned 0x74bc0000 [0124.781] GetModuleHandleA (lpModuleName="api-ms-win-core-wow64-l1-1-0.dll") returned 0x74bc0000 [0124.782] GetModuleHandleA (lpModuleName="api-ms-win-core-datetime-l1-1-1.dll") returned 0x74bc0000 [0124.782] GetModuleHandleA (lpModuleName="api-ms-win-core-memory-l1-1-2.dll") returned 0x74bc0000 [0124.782] GetModuleHandleA (lpModuleName="api-ms-win-core-threadpool-l1-2-0.dll") returned 0x74bc0000 [0124.783] GetModuleHandleA (lpModuleName="api-ms-win-core-threadpool-private-l1-1-0.dll") returned 0x74bc0000 [0124.783] GetModuleHandleA (lpModuleName="api-ms-win-security-grouppolicy-l1-1-0.dll") returned 0x74bc0000 [0124.783] GetModuleHandleA (lpModuleName="MSASN1.dll") returned 0x77410000 [0124.785] GetModuleHandleA (lpModuleName="api-ms-win-core-threadpool-legacy-l1-1-0.dll") returned 0x74bc0000 [0124.786] GetModuleHandleA (lpModuleName="api-ms-win-core-kernel32-legacy-l1-1-1.dll") returned 0x772d0000 [0124.786] GetModuleHandleA (lpModuleName="api-ms-win-core-heap-obsolete-l1-1-0.dll") returned 0x772d0000 [0124.787] GetModuleHandleA (lpModuleName="api-ms-win-core-localization-obsolete-l1-3-0.dll") returned 0x74bc0000 [0124.787] GetModuleHandleA (lpModuleName="api-ms-win-core-string-obsolete-l1-1-0.dll") returned 0x772d0000 [0124.787] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77970000 [0124.788] GetModuleHandleA (lpModuleName="api-ms-win-core-delayload-l1-1-1.dll") returned 0x74bc0000 [0124.793] CryptFindOIDInfo (dwKeyType=0x2, pvKey=0x748890, dwGroupId=0x0) returned 0x0 [0124.828] LocalFree (hMem=0x748890) returned 0x0 [0124.828] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x77d7c78 [0124.828] CryptFindOIDInfo (dwKeyType=0x2, pvKey=0x77d7c78, dwGroupId=0x0) returned 0x0 [0124.828] LocalFree (hMem=0x77d7c78) returned 0x0 [0124.831] lstrlenW (lpString="obsidium.dll") returned 12 [0124.832] lstrlenW (lpString="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\secur32.dll") returned 92 [0124.837] lstrlenW (lpString="obsidium.dll") returned 12 [0124.837] lstrlenW (lpString="secur32.dll") returned 11 [0124.968] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77970000 [0124.968] GetModuleHandleA (lpModuleName="api-ms-win-core-libraryloader-l1-2-0.dll") returned 0x74bc0000 [0124.968] GetModuleHandleA (lpModuleName="api-ms-win-core-heap-l2-1-0.dll") returned 0x74bc0000 [0124.969] GetModuleHandleA (lpModuleName="api-ms-win-core-errorhandling-l1-1-1.dll") returned 0x74bc0000 [0124.969] GetModuleHandleA (lpModuleName="api-ms-win-core-sysinfo-l1-2-1.dll") returned 0x74bc0000 [0124.969] GetModuleHandleA (lpModuleName="api-ms-win-core-processthreads-l1-1-2.dll") returned 0x772d0000 [0124.970] GetModuleHandleA (lpModuleName="api-ms-win-core-profile-l1-1-0.dll") returned 0x74bc0000 [0124.970] GetModuleHandleA (lpModuleName="api-ms-win-core-string-obsolete-l1-1-0.dll") returned 0x772d0000 [0124.970] GetModuleHandleA (lpModuleName="api-ms-win-security-activedirectoryclient-l1-1-0.dll") returned 0x74bc0000 [0124.970] GetModuleHandleA (lpModuleName="api-ms-win-core-delayload-l1-1-1.dll") returned 0x74bc0000 [0124.971] EnumerateSecurityPackagesW (in: pcPackages=0x19ead8, ppPackageInfo=0x19ea6c | out: pcPackages=0x19ead8, ppPackageInfo=0x19ea6c) returned 0x0 [0125.050] FreeContextBuffer (in: pvContextBuffer=0x77d9500 | out: pvContextBuffer=0x77d9500) returned 0x0 [0125.056] GetCurrentProcess () returned 0xffffffff [0125.056] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e89c | out: TokenHandle=0x19e89c*=0x5d0) returned 1 [0125.057] AcquireCredentialsHandleW (in: pPrincipal=0x0, pPackage=0x26e79f0, fCredentialUse=0x2, pvLogonId=0x0, pAuthData=0x19e8f0, pGetKeyFn=0x0, pvGetKeyArgument=0x0, phCredential=0x26e919c, ptsExpiry=0x19e874 | out: phCredential=0x26e919c, ptsExpiry=0x19e874) returned 0x0 [0125.654] InitializeSecurityContextW (in: phCredential=0x19e8b0, phContext=0x0, pTargetName=0x26df9dc, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x0, Reserved2=0x0, phNewContext=0x26e93a0, pOutput=0x26e9338, pfContextAttr=0x26e79c4, ptsExpiry=0x19e8a8 | out: phNewContext=0x26e93a0, pOutput=0x26e9338, pfContextAttr=0x26e79c4, ptsExpiry=0x19e8a8) returned 0x90312 [0125.655] FreeContextBuffer (in: pvContextBuffer=0x77e4aa0 | out: pvContextBuffer=0x77e4aa0) returned 0x0 [0125.658] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0125.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="AppPolicyGetClrCompat", cchWideChar=21, lpMultiByteStr=0x19e8f0, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AppPolicyGetClrCompatãÙqö¥l\x12ðù§s8ð\x19", lpUsedDefaultChar=0x0) returned 21 [0125.659] GetProcAddress (hModule=0x772d0000, lpProcName="AppPolicyGetClrCompat") returned 0x74c968b0 [0125.661] AppPolicyGetClrCompat () returned 0x0 [0125.663] send (s=0x5ac, buf=0x26e93b4*, len=122, flags=0) returned 122 [0125.666] recv (in: s=0x5ac, buf=0x26e93b4, len=5, flags=0 | out: buf=0x26e93b4*) returned 5 [0125.693] recv (in: s=0x5ac, buf=0x26e93b9, len=63, flags=0 | out: buf=0x26e93b9*) returned 63 [0125.694] InitializeSecurityContextW (in: phCredential=0x19e808, phContext=0x19e898, pTargetName=0x26df9dc, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x26e978c, Reserved2=0x0, phNewContext=0x26e93a0, pOutput=0x26e97a0, pfContextAttr=0x26e79c4, ptsExpiry=0x19e800 | out: phNewContext=0x26e93a0, pOutput=0x26e97a0, pfContextAttr=0x26e79c4, ptsExpiry=0x19e800) returned 0x90312 [0125.695] recv (in: s=0x5ac, buf=0x26e9830, len=5, flags=0 | out: buf=0x26e9830*) returned 5 [0125.695] recv (in: s=0x5ac, buf=0x26e9849, len=2340, flags=0 | out: buf=0x26e9849*) returned 2340 [0125.695] InitializeSecurityContextW (in: phCredential=0x19e764, phContext=0x19e7f4, pTargetName=0x26df9dc, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x26ea1e0, Reserved2=0x0, phNewContext=0x26e93a0, pOutput=0x26ea1f4, pfContextAttr=0x26e79c4, ptsExpiry=0x19e75c | out: phNewContext=0x26e93a0, pOutput=0x26ea1f4, pfContextAttr=0x26e79c4, ptsExpiry=0x19e75c) returned 0x90312 [0125.698] recv (in: s=0x5ac, buf=0x26ea284, len=5, flags=0 | out: buf=0x26ea284*) returned 5 [0125.698] recv (in: s=0x5ac, buf=0x26ea29d, len=113, flags=0 | out: buf=0x26ea29d*) returned 113 [0125.698] InitializeSecurityContextW (in: phCredential=0x19e6c0, phContext=0x19e750, pTargetName=0x26df9dc, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x26ea380, Reserved2=0x0, phNewContext=0x26e93a0, pOutput=0x26ea394, pfContextAttr=0x26e79c4, ptsExpiry=0x19e6b8 | out: phNewContext=0x26e93a0, pOutput=0x26ea394, pfContextAttr=0x26e79c4, ptsExpiry=0x19e6b8) returned 0x90312 [0125.698] recv (in: s=0x5ac, buf=0x26ea424, len=5, flags=0 | out: buf=0x26ea424*) returned 5 [0125.699] recv (in: s=0x5ac, buf=0x26ea43d, len=4, flags=0 | out: buf=0x26ea43d*) returned 4 [0125.699] InitializeSecurityContextW (in: phCredential=0x19e61c, phContext=0x19e6ac, pTargetName=0x26df9dc, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x26ea4b4, Reserved2=0x0, phNewContext=0x26e93a0, pOutput=0x26ea4c8, pfContextAttr=0x26e79c4, ptsExpiry=0x19e614 | out: phNewContext=0x26e93a0, pOutput=0x26ea4c8, pfContextAttr=0x26e79c4, ptsExpiry=0x19e614) returned 0x90312 [0125.729] FreeContextBuffer (in: pvContextBuffer=0x77d5c0 | out: pvContextBuffer=0x77d5c0) returned 0x0 [0125.729] send (s=0x5ac, buf=0x26ea544*, len=101, flags=0) returned 101 [0125.730] recv (in: s=0x5ac, buf=0x26ea544, len=5, flags=0 | out: buf=0x26ea544*) returned 5 [0125.746] recv (in: s=0x5ac, buf=0x26ea5d1, len=236, flags=0 | out: buf=0x26ea5d1*) returned 236 [0125.746] InitializeSecurityContextW (in: phCredential=0x19e578, phContext=0x19e608, pTargetName=0x26df9dc, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x26ea730, Reserved2=0x0, phNewContext=0x26e93a0, pOutput=0x26ea744, pfContextAttr=0x26e79c4, ptsExpiry=0x19e570 | out: phNewContext=0x26e93a0, pOutput=0x26ea744, pfContextAttr=0x26e79c4, ptsExpiry=0x19e570) returned 0x90312 [0125.746] recv (in: s=0x5ac, buf=0x26ea7d4, len=5, flags=0 | out: buf=0x26ea7d4*) returned 5 [0125.746] recv (in: s=0x5ac, buf=0x26ea7ed, len=1, flags=0 | out: buf=0x26ea7ed*) returned 1 [0125.746] InitializeSecurityContextW (in: phCredential=0x19e4d4, phContext=0x19e564, pTargetName=0x26df9dc, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x26ea860, Reserved2=0x0, phNewContext=0x26e93a0, pOutput=0x26ea874, pfContextAttr=0x26e79c4, ptsExpiry=0x19e4cc | out: phNewContext=0x26e93a0, pOutput=0x26ea874, pfContextAttr=0x26e79c4, ptsExpiry=0x19e4cc) returned 0x90312 [0125.747] recv (in: s=0x5ac, buf=0x26ea904, len=5, flags=0 | out: buf=0x26ea904*) returned 5 [0125.747] recv (in: s=0x5ac, buf=0x26ea91d, len=48, flags=0 | out: buf=0x26ea91d*) returned 48 [0125.747] InitializeSecurityContextW (in: phCredential=0x19e430, phContext=0x19e4c0, pTargetName=0x26df9dc, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x26ea9c0, Reserved2=0x0, phNewContext=0x26e93a0, pOutput=0x26ea9d4, pfContextAttr=0x26e79c4, ptsExpiry=0x19e428 | out: phNewContext=0x26e93a0, pOutput=0x26ea9d4, pfContextAttr=0x26e79c4, ptsExpiry=0x19e428) returned 0x0 [0126.728] QueryContextAttributesW (in: phContext=0x26e93a0, ulAttribute=0x4, pBuffer=0x26eaa80 | out: pBuffer=0x26eaa80) returned 0x0 [0126.728] QueryContextAttributesW (in: phContext=0x26e93a0, ulAttribute=0x5a, pBuffer=0x26eaad8 | out: pBuffer=0x26eaad8) returned 0x0 [0126.729] QueryContextAttributesW (in: phContext=0x26e93a0, ulAttribute=0x53, pBuffer=0x26eab84 | out: pBuffer=0x26eab84) returned 0x0 [0126.737] lstrlenW (lpString="obsidium.dll") returned 12 [0126.737] lstrlenW (lpString="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\CRYPT32.dll") returned 57 [0126.757] CertDuplicateCertificateContext (pCertContext=0x77f4de8) returned 0x77f4de8 [0126.758] CertDuplicateStore (hCertStore=0x77e4228) returned 0x77e4228 [0126.758] CertEnumCertificatesInStore (hCertStore=0x77e4228, pPrevCertContext=0x0) returned 0x77f4fc8 [0126.758] CertDuplicateCertificateContext (pCertContext=0x77f4fc8) returned 0x77f4fc8 [0126.758] CertEnumCertificatesInStore (hCertStore=0x77e4228, pPrevCertContext=0x77f4fc8) returned 0x77f4de8 [0126.759] CertDuplicateCertificateContext (pCertContext=0x77f4de8) returned 0x77f4de8 [0126.759] CertEnumCertificatesInStore (hCertStore=0x77e4228, pPrevCertContext=0x77f4de8) returned 0x0 [0126.759] CertCloseStore (hCertStore=0x77e4228, dwFlags=0x0) returned 1 [0126.759] CertFreeCertificateContext (pCertContext=0x77f4de8) returned 1 [0126.777] CertOpenStore (lpszStoreProvider=0x2, dwEncodingType=0x10001, hCryptProv=0x0, dwFlags=0x2204, pvPara=0x0) returned 0x77e42a0 [0126.779] CertAddCRLLinkToStore (in: hCertStore=0x77e42a0, pCrlContext=0x77f4fc8, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0126.783] CertAddCRLLinkToStore (in: hCertStore=0x77e42a0, pCrlContext=0x77f4de8, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0126.784] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x786780 [0126.791] CertGetCertificateChain (in: hChainEngine=0x0, pCertContext=0x77f4de8, pTime=0x19e440, hAdditionalStore=0x77e42a0, pChainPara=0x19e380, dwFlags=0x0, pvReserved=0x0, ppChainContext=0x19e374 | out: ppChainContext=0x19e374) returned 1 [0126.816] LocalFree (hMem=0x786780) returned 0x0 [0126.816] CertDuplicateCertificateChain (pChainContext=0x7888b8) returned 0x7888b8 [0126.817] CertDuplicateCertificateContext (pCertContext=0x77f4de8) returned 0x77f4de8 [0126.817] CertDuplicateCertificateContext (pCertContext=0x77f5068) returned 0x77f5068 [0126.817] CertDuplicateCertificateContext (pCertContext=0x77f50b8) returned 0x77f50b8 [0126.817] CertFreeCertificateChain (pChainContext=0x7888b8) [0126.818] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x1, pChainContext=0x7888b8, pPolicyPara=0x19e520, pPolicyStatus=0x19e50c | out: pPolicyStatus=0x19e50c) returned 1 [0126.819] SetLastError (dwErrCode=0x0) [0126.821] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x4, pChainContext=0x7888b8, pPolicyPara=0x19e580, pPolicyStatus=0x19e534 | out: pPolicyStatus=0x19e534) returned 1 [0126.827] CertFreeCertificateChain (pChainContext=0x7888b8) [0126.828] CertFreeCertificateContext (pCertContext=0x77f4de8) returned 1 [0126.830] CoTaskMemAlloc (cb=0x20e) returned 0x7888b8 [0126.830] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_Disabled", lpBuffer=0x7888b8, nSize=0x105 | out: lpBuffer="﫰x?xĀ") returned 0x0 [0126.830] CoTaskMemFree (pv=0x7888b8) [0126.830] CoTaskMemAlloc (cb=0x20e) returned 0x7888b8 [0126.831] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_MinCount", lpBuffer=0x7888b8, nSize=0x105 | out: lpBuffer="﫰x?xĀ") returned 0x0 [0126.831] CoTaskMemFree (pv=0x7888b8) [0126.831] CoTaskMemAlloc (cb=0x20e) returned 0x7888b8 [0126.831] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_Disabled", lpBuffer=0x7888b8, nSize=0x105 | out: lpBuffer="﫰x?xĀ") returned 0x0 [0126.831] CoTaskMemFree (pv=0x7888b8) [0126.831] CoTaskMemAlloc (cb=0x20e) returned 0x7888b8 [0126.831] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_MinCount", lpBuffer=0x7888b8, nSize=0x105 | out: lpBuffer="﫰x?xĀ") returned 0x0 [0126.831] CoTaskMemFree (pv=0x7888b8) [0126.832] EncryptMessage (in: phContext=0x26e93a0, fQOP=0x0, pMessage=0x26f2cc8, MessageSeqNo=0x0 | out: pMessage=0x26f2cc8) returned 0x0 [0126.833] send (s=0x5ac, buf=0x26f17a0*, len=138, flags=0) returned 138 [0126.835] setsockopt (s=0x5ac, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0126.835] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.887] recv (in: s=0x5ac, buf=0x26fefdd, len=1424, flags=0 | out: buf=0x26fefdd*) returned 1424 [0126.888] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x2703098, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2703098, pfQOP=0x0) returned 0x0 [0126.899] setsockopt (s=0x5ac, level=65535, optname=4102, optval="ô\x01", optlen=4) returned 0 [0126.900] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee20 | out: lpPerformanceCount=0x19ee20*=22189349596) returned 1 [0126.900] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22189357984) returned 1 [0126.921] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.921] recv (in: s=0x5ac, buf=0x26fefdd, len=1424, flags=0 | out: buf=0x26fefdd*) returned 1424 [0126.921] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x2706c90, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2706c90, pfQOP=0x0) returned 0x0 [0126.921] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22191476491) returned 1 [0126.921] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.921] recv (in: s=0x5ac, buf=0x26fefdd, len=1424, flags=0 | out: buf=0x26fefdd*) returned 1424 [0126.921] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x2706db0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2706db0, pfQOP=0x0) returned 0x0 [0126.921] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22191505812) returned 1 [0126.921] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.921] recv (in: s=0x5ac, buf=0x26fefdd, len=1424, flags=0 | out: buf=0x26fefdd*) returned 1424 [0126.921] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x2706ed0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2706ed0, pfQOP=0x0) returned 0x0 [0126.921] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22191530443) returned 1 [0126.921] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.922] recv (in: s=0x5ac, buf=0x26fefdd, len=1424, flags=0 | out: buf=0x26fefdd*) returned 1424 [0126.922] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x2706ff0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2706ff0, pfQOP=0x0) returned 0x0 [0126.922] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22191555223) returned 1 [0126.922] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.922] recv (in: s=0x5ac, buf=0x26fefdd, len=1424, flags=0 | out: buf=0x26fefdd*) returned 1424 [0126.922] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x2707110, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2707110, pfQOP=0x0) returned 0x0 [0126.922] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22191580274) returned 1 [0126.922] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.922] recv (in: s=0x5ac, buf=0x26fefdd, len=1424, flags=0 | out: buf=0x26fefdd*) returned 1424 [0126.922] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x2707230, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2707230, pfQOP=0x0) returned 0x0 [0126.922] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22191605381) returned 1 [0126.922] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.922] recv (in: s=0x5ac, buf=0x26fefdd, len=1424, flags=0 | out: buf=0x26fefdd*) returned 1424 [0126.922] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x2707350, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2707350, pfQOP=0x0) returned 0x0 [0126.922] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22191630716) returned 1 [0126.922] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.923] recv (in: s=0x5ac, buf=0x26fefdd, len=1424, flags=0 | out: buf=0x26fefdd*) returned 1424 [0126.923] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x2707470, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2707470, pfQOP=0x0) returned 0x0 [0126.923] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22191656077) returned 1 [0126.923] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.923] recv (in: s=0x5ac, buf=0x26fefdd, len=1424, flags=0 | out: buf=0x26fefdd*) returned 1424 [0126.923] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x2707590, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2707590, pfQOP=0x0) returned 0x0 [0126.923] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22191681159) returned 1 [0126.923] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.923] recv (in: s=0x5ac, buf=0x26fefdd, len=1424, flags=0 | out: buf=0x26fefdd*) returned 1424 [0126.923] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x27076b0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x27076b0, pfQOP=0x0) returned 0x0 [0126.923] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22191705839) returned 1 [0126.923] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.923] recv (in: s=0x5ac, buf=0x26fefdd, len=1424, flags=0 | out: buf=0x26fefdd*) returned 1424 [0126.923] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x27077d0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x27077d0, pfQOP=0x0) returned 0x0 [0126.923] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22191731730) returned 1 [0126.923] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.924] recv (in: s=0x5ac, buf=0x26fefdd, len=1424, flags=0 | out: buf=0x26fefdd*) returned 1424 [0126.924] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x27078f0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x27078f0, pfQOP=0x0) returned 0x0 [0126.924] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22191756284) returned 1 [0126.924] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.924] recv (in: s=0x5ac, buf=0x26fefdd, len=1424, flags=0 | out: buf=0x26fefdd*) returned 1424 [0126.924] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x2707a10, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2707a10, pfQOP=0x0) returned 0x0 [0126.924] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22191781968) returned 1 [0126.924] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.924] recv (in: s=0x5ac, buf=0x26fefdd, len=1424, flags=0 | out: buf=0x26fefdd*) returned 1424 [0126.924] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x2707b30, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2707b30, pfQOP=0x0) returned 0x0 [0126.924] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22191806296) returned 1 [0126.924] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.924] recv (in: s=0x5ac, buf=0x26fefdd, len=1424, flags=0 | out: buf=0x26fefdd*) returned 1424 [0126.924] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x2707c50, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2707c50, pfQOP=0x0) returned 0x0 [0126.924] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22191831357) returned 1 [0126.924] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.925] recv (in: s=0x5ac, buf=0x26fefdd, len=928, flags=0 | out: buf=0x26fefdd*) returned 928 [0126.925] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x2707d70, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2707d70, pfQOP=0x0) returned 0x0 [0126.925] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22191862511) returned 1 [0126.925] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.925] recv (in: s=0x5ac, buf=0x26fefdd, len=208, flags=0 | out: buf=0x26fefdd*) returned 208 [0126.925] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x2707e90, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2707e90, pfQOP=0x0) returned 0x0 [0126.925] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22191909070) returned 1 [0126.925] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.925] recv (in: s=0x5ac, buf=0x26fefdd, len=1424, flags=0 | out: buf=0x26fefdd*) returned 1424 [0126.925] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x2707fb0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2707fb0, pfQOP=0x0) returned 0x0 [0126.926] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22191939193) returned 1 [0126.926] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.926] recv (in: s=0x5ac, buf=0x26fefdd, len=1424, flags=0 | out: buf=0x26fefdd*) returned 1424 [0126.926] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x27080d0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x27080d0, pfQOP=0x0) returned 0x0 [0126.926] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22191964216) returned 1 [0126.926] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.926] recv (in: s=0x5ac, buf=0x26fefdd, len=1424, flags=0 | out: buf=0x26fefdd*) returned 1424 [0126.926] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x27081f0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x27081f0, pfQOP=0x0) returned 0x0 [0126.926] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22191989938) returned 1 [0126.926] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.926] recv (in: s=0x5ac, buf=0x26fefdd, len=1424, flags=0 | out: buf=0x26fefdd*) returned 1424 [0126.926] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x2708310, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2708310, pfQOP=0x0) returned 0x0 [0126.926] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22192015770) returned 1 [0126.926] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.926] recv (in: s=0x5ac, buf=0x26fefdd, len=1424, flags=0 | out: buf=0x26fefdd*) returned 1424 [0126.926] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x2708430, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2708430, pfQOP=0x0) returned 0x0 [0126.927] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22192041310) returned 1 [0126.927] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.927] recv (in: s=0x5ac, buf=0x26fefdd, len=1424, flags=0 | out: buf=0x26fefdd*) returned 1424 [0126.927] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x2708550, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2708550, pfQOP=0x0) returned 0x0 [0126.927] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22192065733) returned 1 [0126.927] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.927] recv (in: s=0x5ac, buf=0x26fefdd, len=1424, flags=0 | out: buf=0x26fefdd*) returned 1424 [0126.927] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x2708670, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2708670, pfQOP=0x0) returned 0x0 [0126.927] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22192090076) returned 1 [0126.927] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.927] recv (in: s=0x5ac, buf=0x26fefdd, len=1424, flags=0 | out: buf=0x26fefdd*) returned 1424 [0126.927] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x2708790, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2708790, pfQOP=0x0) returned 0x0 [0126.927] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22192114519) returned 1 [0126.927] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.927] recv (in: s=0x5ac, buf=0x26fefdd, len=1424, flags=0 | out: buf=0x26fefdd*) returned 1424 [0126.927] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x27088b0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x27088b0, pfQOP=0x0) returned 0x0 [0126.928] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22192139079) returned 1 [0126.928] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.928] recv (in: s=0x5ac, buf=0x26fefdd, len=1424, flags=0 | out: buf=0x26fefdd*) returned 1424 [0126.928] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x27089d0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x27089d0, pfQOP=0x0) returned 0x0 [0126.928] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22192163754) returned 1 [0126.928] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.928] recv (in: s=0x5ac, buf=0x26fefdd, len=1424, flags=0 | out: buf=0x26fefdd*) returned 1424 [0126.928] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x2708af0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2708af0, pfQOP=0x0) returned 0x0 [0126.928] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22192188856) returned 1 [0126.928] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.928] recv (in: s=0x5ac, buf=0x26fefdd, len=1424, flags=0 | out: buf=0x26fefdd*) returned 1424 [0126.928] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x2708c10, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2708c10, pfQOP=0x0) returned 0x0 [0126.928] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22192215654) returned 1 [0126.928] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.928] recv (in: s=0x5ac, buf=0x26fefdd, len=1424, flags=0 | out: buf=0x26fefdd*) returned 1424 [0126.928] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x2708d30, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2708d30, pfQOP=0x0) returned 0x0 [0126.929] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22192240383) returned 1 [0126.929] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.929] recv (in: s=0x5ac, buf=0x26fefdd, len=1424, flags=0 | out: buf=0x26fefdd*) returned 1424 [0126.929] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x2708e50, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2708e50, pfQOP=0x0) returned 0x0 [0126.929] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22192265052) returned 1 [0126.929] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.929] recv (in: s=0x5ac, buf=0x26fefdd, len=1424, flags=0 | out: buf=0x26fefdd*) returned 1424 [0126.929] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x2708f70, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2708f70, pfQOP=0x0) returned 0x0 [0126.929] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22192290154) returned 1 [0126.929] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.929] recv (in: s=0x5ac, buf=0x26fefdd, len=1424, flags=0 | out: buf=0x26fefdd*) returned 1424 [0126.929] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x2709090, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2709090, pfQOP=0x0) returned 0x0 [0126.929] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22192316279) returned 1 [0126.929] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.929] recv (in: s=0x5ac, buf=0x26fefdd, len=1424, flags=0 | out: buf=0x26fefdd*) returned 1424 [0126.929] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x27091b0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x27091b0, pfQOP=0x0) returned 0x0 [0126.930] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22192341277) returned 1 [0126.930] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.930] recv (in: s=0x5ac, buf=0x26fefdd, len=1392, flags=0 | out: buf=0x26fefdd*) returned 1392 [0126.930] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x27092d0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x27092d0, pfQOP=0x0) returned 0x0 [0126.930] QueryPerformanceCounter (in: lpPerformanceCount=0x19ede8 | out: lpPerformanceCount=0x19ede8*=22192365844) returned 1 [0126.930] recv (in: s=0x5ac, buf=0x26fefd8, len=5, flags=0 | out: buf=0x26fefd8*) returned 5 [0126.930] recv (in: s=0x5ac, buf=0x26fefdd, len=32, flags=0 | out: buf=0x26fefdd*) returned 32 [0126.930] DecryptMessage (in: phContext=0x26e93a0, pMessage=0x27093f0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x27093f0, pfQOP=0x0) returned 0x0 [0126.930] SetEvent (hEvent=0x36c) returned 1 [0126.930] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee0c | out: lpPerformanceCount=0x19ee0c*=22192406558) returned 1 [0126.949] GetFullPathNameW (in: lpFileName="C:\\FD1HVy\\ransom.jpg", nBufferLength=0x105, lpBuffer=0x19e86c, lpFilePart=0x0 | out: lpBuffer="C:\\FD1HVy\\ransom.jpg", lpFilePart=0x0) returned 0x14 [0126.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edb0) returned 1 [0126.949] CreateFileW (lpFileName="C:\\FD1HVy\\ransom.jpg" (normalized: "c:\\fd1hvy\\ransom.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x6ac [0126.951] GetFileType (hFile=0x6ac) returned 0x1 [0126.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edac) returned 1 [0126.951] GetFileType (hFile=0x6ac) returned 0x1 [0127.381] CloseHandle (hObject=0x6ac) returned 1 [0127.382] GetFullPathNameW (in: lpFileName="C:\\FD1HVy\\ransom.jpg", nBufferLength=0x105, lpBuffer=0x19cbf4, lpFilePart=0x0 | out: lpBuffer="C:\\FD1HVy\\ransom.jpg", lpFilePart=0x0) returned 0x14 [0127.382] DeleteFileW (lpFileName="C:\\FD1HVy\\ransom.jpg" (normalized: "c:\\fd1hvy\\ransom.jpg")) returned 1 [0127.390] QueryPerformanceCounter (in: lpPerformanceCount=0x19edf8 | out: lpPerformanceCount=0x19edf8*=22238430854) returned 1 [0127.391] SetEvent (hEvent=0x36c) returned 1 [0127.391] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ec00*=0x4a4, lpdwindex=0x19ea1c | out: lpdwindex=0x19ea1c) returned 0x80010115 [0127.391] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ebe0*=0x494, lpdwindex=0x19e9fc | out: lpdwindex=0x19e9fc) returned 0x80010115 [0127.392] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ebe0*=0x49c, lpdwindex=0x19e9fc | out: lpdwindex=0x19e9fc) returned 0x80010115 [0127.392] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ec34*=0x4c4, lpdwindex=0x19ea54 | out: lpdwindex=0x19ea54) returned 0x80010115 [0127.393] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ec34*=0x4cc, lpdwindex=0x19ea54 | out: lpdwindex=0x19ea54) returned 0x80010115 [0127.393] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ec34*=0x4d4, lpdwindex=0x19ea54 | out: lpdwindex=0x19ea54) returned 0x80010115 [0127.394] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x6ac [0127.395] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x6b4 [0127.395] GetAddrInfoW (in: pNodeName="en7brhxplmzjhqd.m.pipedream.net", pServiceName=0x0, pHints=0x19eb34*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x19eadc | out: ppResult=0x19eadc*=0x77e7810*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="en7brhxplmzjhqd.m.pipedream.net", ai_addr=0x77ed0c0*(sa_family=2, sin_port=0x0, sin_addr="52.1.216.242"), ai_next=0x77e7d88*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x77ed120*(sa_family=2, sin_port=0x0, sin_addr="54.210.116.43"), ai_next=0x77e7db0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x77ed138*(sa_family=2, sin_port=0x0, sin_addr="54.146.242.158"), ai_next=0x77e7d10*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x77ecf58*(sa_family=2, sin_port=0x0, sin_addr="35.168.136.85"), ai_next=0x77e7d38*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x77ed168*(sa_family=2, sin_port=0x0, sin_addr="54.210.137.220"), ai_next=0x77e7d60*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x77ecf88*(sa_family=2, sin_port=0x0, sin_addr="52.20.135.248"), ai_next=0x0))))))) returned 0 [0127.400] FreeAddrInfoW (pAddrInfo=0x77e7810*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="en7brhxplmzjhqd.m.pipedream.net", ai_addr=0x77ed0c0*(sa_family=2, sin_port=0x0, sin_addr="52.1.216.242"), ai_next=0x77e7d88*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x77ed120*(sa_family=2, sin_port=0x0, sin_addr="54.210.116.43"), ai_next=0x77e7db0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x77ed138*(sa_family=2, sin_port=0x0, sin_addr="54.146.242.158"), ai_next=0x77e7d10*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x77ecf58*(sa_family=2, sin_port=0x0, sin_addr="35.168.136.85"), ai_next=0x77e7d38*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x77ed168*(sa_family=2, sin_port=0x0, sin_addr="54.210.137.220"), ai_next=0x77e7d60*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x77ecf88*(sa_family=2, sin_port=0x0, sin_addr="52.20.135.248"), ai_next=0x0))))))) [0127.401] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ea78*=0x5bc, lpdwindex=0x19e894 | out: lpdwindex=0x19e894) returned 0x80010115 [0127.401] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ea78*=0x5c4, lpdwindex=0x19e894 | out: lpdwindex=0x19e894) returned 0x80010115 [0127.402] WSAConnect (in: s=0x6ac, name=0x271f9a4*(sa_family=2, sin_port=0x1bb, sin_addr="52.1.216.242"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0127.568] closesocket (s=0x6b4) returned 0 [0127.569] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x77f770 [0127.569] CryptFindOIDInfo (dwKeyType=0x2, pvKey=0x77f770, dwGroupId=0x0) returned 0x0 [0127.569] LocalFree (hMem=0x77f770) returned 0x0 [0127.569] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x77f710 [0127.569] CryptFindOIDInfo (dwKeyType=0x2, pvKey=0x77f710, dwGroupId=0x0) returned 0x0 [0127.569] LocalFree (hMem=0x77f710) returned 0x0 [0127.570] InitializeSecurityContextW (in: phCredential=0x19e854, phContext=0x0, pTargetName=0x271fa28, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x0, Reserved2=0x0, phNewContext=0x2720c0c, pOutput=0x2720ba4, pfContextAttr=0x27209ec, ptsExpiry=0x19e84c | out: phNewContext=0x2720c0c, pOutput=0x2720ba4, pfContextAttr=0x27209ec, ptsExpiry=0x19e84c) returned 0x90312 [0127.570] FreeContextBuffer (in: pvContextBuffer=0x753db0 | out: pvContextBuffer=0x753db0) returned 0x0 [0127.570] send (s=0x6ac, buf=0x2720c20*, len=139, flags=0) returned 139 [0127.571] recv (in: s=0x6ac, buf=0x2720c20, len=5, flags=0 | out: buf=0x2720c20*) returned 5 [0127.739] recv (in: s=0x6ac, buf=0x2720c25, len=61, flags=0 | out: buf=0x2720c25*) returned 61 [0127.739] InitializeSecurityContextW (in: phCredential=0x19e7ac, phContext=0x19e83c, pTargetName=0x271fa28, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2720d30, Reserved2=0x0, phNewContext=0x2720c0c, pOutput=0x2720d44, pfContextAttr=0x27209ec, ptsExpiry=0x19e7a4 | out: phNewContext=0x2720c0c, pOutput=0x2720d44, pfContextAttr=0x27209ec, ptsExpiry=0x19e7a4) returned 0x90312 [0127.739] recv (in: s=0x6ac, buf=0x2720dd4, len=5, flags=0 | out: buf=0x2720dd4*) returned 5 [0127.739] recv (in: s=0x6ac, buf=0x2720ded, len=4830, flags=0 | out: buf=0x2720ded*) returned 4830 [0127.740] InitializeSecurityContextW (in: phCredential=0x19e708, phContext=0x19e798, pTargetName=0x271fa28, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x272213c, Reserved2=0x0, phNewContext=0x2720c0c, pOutput=0x2722150, pfContextAttr=0x27209ec, ptsExpiry=0x19e700 | out: phNewContext=0x2720c0c, pOutput=0x2722150, pfContextAttr=0x27209ec, ptsExpiry=0x19e700) returned 0x90312 [0127.742] recv (in: s=0x6ac, buf=0x27221e0, len=5, flags=0 | out: buf=0x27221e0*) returned 5 [0127.742] recv (in: s=0x6ac, buf=0x27221f9, len=331, flags=0 | out: buf=0x27221f9*) returned 331 [0127.742] InitializeSecurityContextW (in: phCredential=0x19e664, phContext=0x19e6f4, pTargetName=0x271fa28, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x27223b4, Reserved2=0x0, phNewContext=0x2720c0c, pOutput=0x27223c8, pfContextAttr=0x27209ec, ptsExpiry=0x19e65c | out: phNewContext=0x2720c0c, pOutput=0x27223c8, pfContextAttr=0x27209ec, ptsExpiry=0x19e65c) returned 0x90312 [0127.742] recv (in: s=0x6ac, buf=0x2722458, len=5, flags=0 | out: buf=0x2722458*) returned 5 [0127.742] recv (in: s=0x6ac, buf=0x2722471, len=4, flags=0 | out: buf=0x2722471*) returned 4 [0127.743] InitializeSecurityContextW (in: phCredential=0x19e5c0, phContext=0x19e650, pTargetName=0x271fa28, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x27224e8, Reserved2=0x0, phNewContext=0x2720c0c, pOutput=0x27224fc, pfContextAttr=0x27209ec, ptsExpiry=0x19e5b8 | out: phNewContext=0x2720c0c, pOutput=0x27224fc, pfContextAttr=0x27209ec, ptsExpiry=0x19e5b8) returned 0x90312 [0127.942] FreeContextBuffer (in: pvContextBuffer=0x77a048 | out: pvContextBuffer=0x77a048) returned 0x0 [0127.942] send (s=0x6ac, buf=0x2722578*, len=134, flags=0) returned 134 [0127.943] recv (in: s=0x6ac, buf=0x2722578, len=5, flags=0 | out: buf=0x2722578*) returned 5 [0128.103] recv (in: s=0x6ac, buf=0x2722625, len=218, flags=0 | out: buf=0x2722625*) returned 218 [0128.103] InitializeSecurityContextW (in: phCredential=0x19e51c, phContext=0x19e5ac, pTargetName=0x271fa28, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2722770, Reserved2=0x0, phNewContext=0x2720c0c, pOutput=0x2722784, pfContextAttr=0x27209ec, ptsExpiry=0x19e514 | out: phNewContext=0x2720c0c, pOutput=0x2722784, pfContextAttr=0x27209ec, ptsExpiry=0x19e514) returned 0x90312 [0128.104] recv (in: s=0x6ac, buf=0x2722814, len=5, flags=0 | out: buf=0x2722814*) returned 5 [0128.104] recv (in: s=0x6ac, buf=0x272282d, len=1, flags=0 | out: buf=0x272282d*) returned 1 [0128.104] InitializeSecurityContextW (in: phCredential=0x19e478, phContext=0x19e508, pTargetName=0x271fa28, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x27228a0, Reserved2=0x0, phNewContext=0x2720c0c, pOutput=0x27228b4, pfContextAttr=0x27209ec, ptsExpiry=0x19e470 | out: phNewContext=0x2720c0c, pOutput=0x27228b4, pfContextAttr=0x27209ec, ptsExpiry=0x19e470) returned 0x90312 [0128.104] recv (in: s=0x6ac, buf=0x2722944, len=5, flags=0 | out: buf=0x2722944*) returned 5 [0128.104] recv (in: s=0x6ac, buf=0x272295d, len=48, flags=0 | out: buf=0x272295d*) returned 48 [0128.104] InitializeSecurityContextW (in: phCredential=0x19e3d4, phContext=0x19e464, pTargetName=0x271fa28, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2722a00, Reserved2=0x0, phNewContext=0x2720c0c, pOutput=0x2722a14, pfContextAttr=0x27209ec, ptsExpiry=0x19e3cc | out: phNewContext=0x2720c0c, pOutput=0x2722a14, pfContextAttr=0x27209ec, ptsExpiry=0x19e3cc) returned 0x0 [0128.106] QueryContextAttributesW (in: phContext=0x2720c0c, ulAttribute=0x4, pBuffer=0x2722aa4 | out: pBuffer=0x2722aa4) returned 0x0 [0128.106] QueryContextAttributesW (in: phContext=0x2720c0c, ulAttribute=0x5a, pBuffer=0x2722ae0 | out: pBuffer=0x2722ae0) returned 0x0 [0128.106] QueryContextAttributesW (in: phContext=0x2720c0c, ulAttribute=0x53, pBuffer=0x2722b2c | out: pBuffer=0x2722b2c) returned 0x0 [0128.107] CertDuplicateCertificateContext (pCertContext=0x77f4b68) returned 0x77f4b68 [0128.107] CertDuplicateStore (hCertStore=0x785e90) returned 0x785e90 [0128.107] CertEnumCertificatesInStore (hCertStore=0x785e90, pPrevCertContext=0x0) returned 0x77f5108 [0128.107] CertDuplicateCertificateContext (pCertContext=0x77f5108) returned 0x77f5108 [0128.107] CertEnumCertificatesInStore (hCertStore=0x785e90, pPrevCertContext=0x77f5108) returned 0x77f4848 [0128.107] CertDuplicateCertificateContext (pCertContext=0x77f4848) returned 0x77f4848 [0128.107] CertEnumCertificatesInStore (hCertStore=0x785e90, pPrevCertContext=0x77f4848) returned 0x77f48e8 [0128.107] CertDuplicateCertificateContext (pCertContext=0x77f48e8) returned 0x77f48e8 [0128.107] CertEnumCertificatesInStore (hCertStore=0x785e90, pPrevCertContext=0x77f48e8) returned 0x77f4b68 [0128.108] CertDuplicateCertificateContext (pCertContext=0x77f4b68) returned 0x77f4b68 [0128.108] CertEnumCertificatesInStore (hCertStore=0x785e90, pPrevCertContext=0x77f4b68) returned 0x0 [0128.108] CertCloseStore (hCertStore=0x785e90, dwFlags=0x0) returned 1 [0128.108] CertFreeCertificateContext (pCertContext=0x77f4b68) returned 1 [0128.108] CertOpenStore (lpszStoreProvider=0x2, dwEncodingType=0x10001, hCryptProv=0x0, dwFlags=0x2204, pvPara=0x0) returned 0x785ff8 [0128.108] CertAddCRLLinkToStore (in: hCertStore=0x785ff8, pCrlContext=0x77f5108, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0128.108] CertAddCRLLinkToStore (in: hCertStore=0x785ff8, pCrlContext=0x77f4848, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0128.108] CertAddCRLLinkToStore (in: hCertStore=0x785ff8, pCrlContext=0x77f48e8, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0128.108] CertAddCRLLinkToStore (in: hCertStore=0x785ff8, pCrlContext=0x77f4b68, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0128.109] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x7865c0 [0128.109] CertGetCertificateChain (in: hChainEngine=0x0, pCertContext=0x77f4b68, pTime=0x19e3e4, hAdditionalStore=0x785ff8, pChainPara=0x19e324, dwFlags=0x0, pvReserved=0x0, ppChainContext=0x19e318 | out: ppChainContext=0x19e318) returned 1 [0128.114] LocalFree (hMem=0x7865c0) returned 0x0 [0128.114] CertDuplicateCertificateChain (pChainContext=0x794428) returned 0x794428 [0128.115] CertDuplicateCertificateContext (pCertContext=0x77f4b68) returned 0x77f4b68 [0128.115] CertDuplicateCertificateContext (pCertContext=0x77f4ac8) returned 0x77f4ac8 [0128.115] CertDuplicateCertificateContext (pCertContext=0x77f4c08) returned 0x77f4c08 [0128.115] CertFreeCertificateChain (pChainContext=0x794428) [0128.115] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x1, pChainContext=0x794428, pPolicyPara=0x19e4c4, pPolicyStatus=0x19e4b0 | out: pPolicyStatus=0x19e4b0) returned 1 [0128.115] SetLastError (dwErrCode=0x0) [0128.115] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x4, pChainContext=0x794428, pPolicyPara=0x19e524, pPolicyStatus=0x19e4d8 | out: pPolicyStatus=0x19e4d8) returned 1 [0128.115] CertFreeCertificateChain (pChainContext=0x794428) [0128.115] CertFreeCertificateContext (pCertContext=0x77f4b68) returned 1 [0128.116] EncryptMessage (in: phContext=0x2720c0c, fQOP=0x0, pMessage=0x2738604, MessageSeqNo=0x0 | out: pMessage=0x2738604) returned 0x0 [0128.116] send (s=0x6ac, buf=0x26f0388*, len=218, flags=0) returned 218 [0128.116] setsockopt (s=0x6ac, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0128.117] recv (in: s=0x6ac, buf=0x26fafa0, len=5, flags=0 | out: buf=0x26fafa0*) returned 5 [0128.295] recv (in: s=0x6ac, buf=0x26fafa5, len=448, flags=0 | out: buf=0x26fafa5*) returned 448 [0128.295] DecryptMessage (in: phContext=0x2720c0c, pMessage=0x2778b24, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2778b24, pfQOP=0x0) returned 0x0 [0128.297] setsockopt (s=0x6ac, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0128.313] GetWindowThreadProcessId (in: hWnd=0x7002e, lpdwProcessId=0x19ef00 | out: lpdwProcessId=0x19ef00) returned 0x1164 [0128.313] GetCurrentThreadId () returned 0x1164 [0128.313] RegisterClipboardFormatW (lpszFormat="WindowsForms12_ThreadCallbackMessage") returned 0xc1a2 [0128.314] PostMessageW (hWnd=0x7002e, Msg=0xc1a2, wParam=0x0, lParam=0x0) returned 1 [0128.314] GetWindowTextLengthW (hWnd=0x7002e) returned 11 [0128.314] GetSystemMetrics (nIndex=42) returned 0 [0128.314] GetWindowTextW (in: hWnd=0x7002e, lpString=0x19ee74, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0128.318] OleInitialize (pvReserved=0x0) returned 0x0 [0128.319] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x19f42c | out: lplpMessageFilter=0x19f42c*=0x0) returned 0x0 [0128.320] PeekMessageW (in: lpMsg=0x19f400, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19f400) returned 1 [0128.320] IsWindowUnicode (hWnd=0x7002e) returned 1 [0128.320] GetMessageW (in: lpMsg=0x19f400, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19f400) returned 1 [0128.322] TranslateMessage (lpMsg=0x19f400) returned 0 [0128.322] DispatchMessageW (lpMsg=0x19f400) returned 0x0 [0128.328] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x19ee9c | out: lpwndpl=0x19ee9c) returned 1 [0128.328] GetClientRect (in: hWnd=0x7002e, lpRect=0x19ee48 | out: lpRect=0x19ee48) returned 1 [0128.328] GetWindowTextLengthW (hWnd=0x7002e) returned 11 [0128.328] GetSystemMetrics (nIndex=42) returned 0 [0128.328] GetWindowTextW (in: hWnd=0x7002e, lpString=0x19ed08, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0128.329] GetClientRect (in: hWnd=0x7002e, lpRect=0x19ed50 | out: lpRect=0x19ed50) returned 1 [0128.329] GetCurrentObject (hdc=0xf0105ee, type=0x1) returned 0xb00017 [0128.329] GetCurrentObject (hdc=0xf0105ee, type=0x2) returned 0x900010 [0128.329] GetCurrentObject (hdc=0xf0105ee, type=0x7) returned 0x6a0507be [0128.329] GetCurrentObject (hdc=0xf0105ee, type=0x6) returned 0x8a01c2 [0128.329] SaveDC (hdc=0xf0105ee) returned 1 [0128.329] GetNearestColor (hdc=0xf0105ee, color=0xf0f0f0) returned 0xf0f0f0 [0128.329] CreateSolidBrush (color=0xf0f0f0) returned 0x4b1007eb [0128.329] FillRect (hDC=0xf0105ee, lprc=0x19ebf0, hbr=0x4b1007eb) returned 1 [0128.330] DeleteObject (ho=0x4b1007eb) returned 1 [0128.330] RestoreDC (hdc=0xf0105ee, nSavedDC=-1) returned 1 [0128.331] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x19ee80 | out: lpwndpl=0x19ee80) returned 1 [0128.331] GetClientRect (in: hWnd=0x7002e, lpRect=0x19ee30 | out: lpRect=0x19ee30) returned 1 [0128.331] GetWindowRect (in: hWnd=0x7002e, lpRect=0x19ee30 | out: lpRect=0x19ee30) returned 1 [0128.334] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x19e9dc | out: lpwndpl=0x19e9dc) returned 1 [0128.334] GetClientRect (in: hWnd=0x7002e, lpRect=0x19e988 | out: lpRect=0x19e988) returned 1 [0128.334] GetWindowTextLengthW (hWnd=0x7002e) returned 11 [0128.334] GetSystemMetrics (nIndex=42) returned 0 [0128.334] GetWindowTextW (in: hWnd=0x7002e, lpString=0x19e848, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0128.334] GetClientRect (in: hWnd=0x7002e, lpRect=0x19e890 | out: lpRect=0x19e890) returned 1 [0128.334] GetCurrentObject (hdc=0x10105d6, type=0x1) returned 0xb00017 [0128.334] GetCurrentObject (hdc=0x10105d6, type=0x2) returned 0x900010 [0128.334] GetCurrentObject (hdc=0x10105d6, type=0x7) returned 0x6a0507be [0128.334] GetCurrentObject (hdc=0x10105d6, type=0x6) returned 0x8a01c2 [0128.335] SaveDC (hdc=0x10105d6) returned 1 [0128.335] GetNearestColor (hdc=0x10105d6, color=0xf0f0f0) returned 0xf0f0f0 [0128.335] CreateSolidBrush (color=0xf0f0f0) returned 0x4c1007eb [0128.335] FillRect (hDC=0x10105d6, lprc=0x19e730, hbr=0x4c1007eb) returned 1 [0128.335] DeleteObject (ho=0x4c1007eb) returned 1 [0128.335] RestoreDC (hdc=0x10105d6, nSavedDC=-1) returned 1 [0128.336] PeekMessageW (in: lpMsg=0x19f400, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19f400) returned 1 [0128.336] IsWindowUnicode (hWnd=0x30202) returned 1 [0128.336] GetMessageW (in: lpMsg=0x19f400, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19f400) returned 1 [0128.336] TranslateMessage (lpMsg=0x19f400) returned 0 [0128.336] DispatchMessageW (lpMsg=0x19f400) returned 0x0 [0128.336] PeekMessageW (in: lpMsg=0x19f400, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19f400) returned 1 [0128.336] GetMessageA (in: lpMsg=0x19f400, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19f400) returned 0 [0128.341] DestroyCursor (hCursor=0x901f1) returned 1 [0128.346] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x19eec8 | out: lpwndpl=0x19eec8) returned 1 [0128.347] GetClientRect (in: hWnd=0x7002e, lpRect=0x19ee78 | out: lpRect=0x19ee78) returned 1 [0128.347] GetWindowRect (in: hWnd=0x7002e, lpRect=0x19ee78 | out: lpRect=0x19ee78) returned 1 [0128.347] PostThreadMessageW (idThread=0x1164, Msg=0x12, wParam=0x0, lParam=0x0) returned 1 [0128.365] GetCurrentThreadId () returned 0x1164 [0128.366] IsWindowVisible (hWnd=0x70030) returned 0 [0128.366] IsWindowVisible (hWnd=0x801f8) returned 0 [0128.366] GetCurrentThreadId () returned 0x1164 [0128.366] GetCurrentThreadId () returned 0x1164 [0128.367] IsWindowVisible (hWnd=0x70030) returned 0 [0128.367] IsWindowVisible (hWnd=0x801f8) returned 0 [0128.368] OleUninitialize () [0128.369] CloseHandle (hObject=0x380) returned 1 [0128.369] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1da90002) returned 1 [0128.371] CoGetContextToken (in: pToken=0x19fdb0 | out: pToken=0x19fdb0) returned 0x0 [0128.371] CObjectContext::QueryInterface () returned 0x0 [0128.371] CObjectContext::GetCurrentThreadType () returned 0x0 [0128.371] Release () returned 0x0 [0128.372] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x13880, cHandles=0x1, pHandles=0x7029c0*=0x26c, lpdwindex=0x19fc54 | out: lpdwindex=0x19fc54) returned 0x0 [0128.483] CloseHandle (hObject=0x2a0) returned 1 [0128.484] CloseHandle (hObject=0x264) returned 1 [0128.484] CloseHandle (hObject=0x268) returned 1 [0128.500] CloseHandle (hObject=0x354) returned 1 [0128.508] CloseHandle (hObject=0x1d4) returned 1 [0128.516] CloseHandle (hObject=0x230) returned 1 Thread: id = 2 os_tid = 0x300 Thread: id = 3 os_tid = 0x4b4 Thread: id = 4 os_tid = 0x1350 [0065.166] CloseHandle (hObject=0x31c) returned 1 [0065.166] CloseHandle (hObject=0x31c) returned 1 [0065.167] CloseHandle (hObject=0x320) returned 1 [0065.167] CloseHandle (hObject=0x31c) returned 1 [0065.167] CloseHandle (hObject=0x31c) returned 1 [0066.797] CoGetContextToken (in: pToken=0x472fc74 | out: pToken=0x472fc74) returned 0x800401f0 [0066.797] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0066.797] RoInitialize () returned 0x1 [0066.797] RoUninitialize () returned 0x0 [0102.973] CloseHandle (hObject=0x378) returned 1 [0102.973] CloseHandle (hObject=0x364) returned 1 [0102.973] CloseHandle (hObject=0x374) returned 1 [0102.974] CloseHandle (hObject=0x370) returned 1 [0102.974] CloseHandle (hObject=0x36c) returned 1 [0102.974] CloseHandle (hObject=0x368) returned 1 [0102.974] CloseHandle (hObject=0xf0) returned 1 [0102.975] CloseHandle (hObject=0x37c) returned 1 [0128.391] SetClassLongW (hWnd=0x402cc, nIndex=-24, dwNewLong=1950089536) returned 0x4ba05be [0128.391] PostMessageW (hWnd=0x402cc, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0128.392] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0128.393] UnregisterClassW (lpClassName="WindowsForms10.Window.0.app.0.141b42a_r36_ad1", hInstance=0x400000) returned 1 [0128.393] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0128.393] UnregisterClassW (lpClassName="WindowsForms10.Window.8.app.0.141b42a_r36_ad1", hInstance=0x400000) returned 0 [0128.395] EtwEventUnregister (RegHandle=0x73ab50) returned 0x0 [0128.395] EtwEventUnregister (RegHandle=0x73b2e8) returned 0x0 [0128.397] IsWindow (hWnd=0x70030) returned 1 [0128.398] GetModuleHandleW (lpModuleName="user32.dll") returned 0x750c0000 [0128.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x472fa14, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcWÙqö¥l\x12ðù§s\x98ür\x04\x01", lpUsedDefaultChar=0x0) returned 14 [0128.398] GetProcAddress (hModule=0x750c0000, lpProcName="DefWindowProcW") returned 0x743c0140 [0128.399] SetClassLongW (hWnd=0x70030, nIndex=-24, dwNewLong=1950089536) returned 0x4ba0686 [0128.399] IsWindow (hWnd=0x70030) returned 1 [0128.400] PostMessageW (hWnd=0x70030, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0128.400] SetConsoleCtrlHandler (HandlerRoutine=0x4ba065e, Add=0) returned 1 [0128.418] GdipDeleteFont (font=0x231ef48) returned 0x0 [0128.419] DeleteObject (ho=0x190a019b) returned 1 [0128.419] DestroyCursor (hCursor=0x90127) returned 1 [0128.420] CertFreeCertificateContext (pCertContext=0x77f4ac8) returned 1 [0128.421] CertFreeCertificateContext (pCertContext=0x77f4b68) returned 1 [0128.423] CertFreeCertificateContext (pCertContext=0x77f50b8) returned 1 [0128.423] CertFreeCertificateContext (pCertContext=0x77f5068) returned 1 [0128.424] CertFreeCertificateContext (pCertContext=0x77f4de8) returned 1 [0128.424] CertCloseStore (hCertStore=0x77e42a0, dwFlags=0x0) returned 1 [0128.425] CertFreeCertificateContext (pCertContext=0x77f4de8) returned 1 [0128.425] CertFreeCertificateContext (pCertContext=0x77f4fc8) returned 1 [0128.427] DeleteSecurityContext (phContext=0x26e93a0) returned 0x0 [0128.428] CloseHandle (hObject=0x5d0) returned 1 [0128.429] setsockopt (s=0x5c0, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0128.430] closesocket (s=0x5c0) returned 0 [0128.430] CloseHandle (hObject=0x5c4) returned 1 [0128.431] setsockopt (s=0x5b4, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0128.431] closesocket (s=0x5b4) returned 0 [0128.431] CloseHandle (hObject=0x5bc) returned 1 [0128.432] setsockopt (s=0x5ac, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0128.432] closesocket (s=0x5ac) returned 0 [0128.434] CertCloseStore (hCertStore=0x785ff8, dwFlags=0x0) returned 1 [0128.435] CloseHandle (hObject=0x564) returned 1 [0128.435] CloseHandle (hObject=0x560) returned 1 [0128.436] CloseHandle (hObject=0x524) returned 1 [0128.436] CloseHandle (hObject=0x520) returned 1 [0128.436] CertFreeCertificateContext (pCertContext=0x77f4b68) returned 1 [0128.437] CertFreeCertificateContext (pCertContext=0x77f48e8) returned 1 [0128.437] WinHttpCloseHandle (hInternet=0x77d5ab8) returned 1 [0128.437] CloseHandle (hObject=0x4d8) returned 1 [0128.438] CloseHandle (hObject=0x4d4) returned 1 [0128.438] RegCloseKey (hKey=0x4d0) returned 0x0 [0128.438] CloseHandle (hObject=0x4cc) returned 1 [0128.439] RegCloseKey (hKey=0x4c8) returned 0x0 [0128.439] CloseHandle (hObject=0x4c4) returned 1 [0128.439] RegCloseKey (hKey=0x4c0) returned 0x0 [0128.440] RegCloseKey (hKey=0x4bc) returned 0x0 [0128.440] CloseHandle (hObject=0x4a4) returned 1 [0128.440] setsockopt (s=0x498, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0128.440] closesocket (s=0x498) returned 0 [0128.441] CloseHandle (hObject=0x49c) returned 1 [0128.442] setsockopt (s=0x490, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0128.442] closesocket (s=0x490) returned 0 [0128.442] CloseHandle (hObject=0x494) returned 1 [0128.442] CloseHandle (hObject=0x428) returned 1 [0128.443] CloseHandle (hObject=0x424) returned 1 [0128.443] CloseHandle (hObject=0x420) returned 1 [0128.443] CloseHandle (hObject=0x410) returned 1 [0128.444] CloseHandle (hObject=0x378) returned 1 [0128.444] CloseHandle (hObject=0x364) returned 1 [0128.444] CloseHandle (hObject=0x374) returned 1 [0128.445] CertFreeCertificateContext (pCertContext=0x77f4848) returned 1 [0128.445] CertFreeCertificateContext (pCertContext=0x77f5108) returned 1 [0128.446] CloseHandle (hObject=0x368) returned 1 [0128.446] CloseHandle (hObject=0xf0) returned 1 [0128.446] CloseHandle (hObject=0x37c) returned 1 [0128.447] UnmapViewOfFile (lpBaseAddress=0x78d0000) returned 1 [0128.453] FreeCredentialsHandle (phCredential=0x26e919c) returned 0x0 [0128.454] DeleteSecurityContext (phContext=0x2720c0c) returned 0x0 [0128.455] setsockopt (s=0x6ac, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0128.455] closesocket (s=0x6ac) returned 0 [0128.456] RegCloseKey (hKey=0x80000004) returned 0x0 [0128.466] CertFreeCertificateContext (pCertContext=0x77f4c08) returned 1 [0128.468] SleepEx (dwMilliseconds=0xffffffff, bAlertable=0) Thread: id = 5 os_tid = 0x1338 [0069.338] GetCurrentProcess () returned 0xffffffff [0069.339] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0069.339] IsDebuggerPresent () returned 0 [0074.321] Sleep (dwMilliseconds=0x1f4) [0074.846] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0074.846] IsDebuggerPresent () returned 0 [0074.847] Sleep (dwMilliseconds=0x1f4) [0075.349] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0075.349] IsDebuggerPresent () returned 0 [0075.350] Sleep (dwMilliseconds=0x1f4) [0075.851] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0075.851] IsDebuggerPresent () returned 0 [0075.852] Sleep (dwMilliseconds=0x1f4) [0076.365] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0076.365] IsDebuggerPresent () returned 0 [0076.366] Sleep (dwMilliseconds=0x1f4) [0076.881] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0076.881] IsDebuggerPresent () returned 0 [0076.882] Sleep (dwMilliseconds=0x1f4) [0077.388] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0077.388] IsDebuggerPresent () returned 0 [0077.389] Sleep (dwMilliseconds=0x1f4) [0077.903] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0077.903] IsDebuggerPresent () returned 0 [0077.904] Sleep (dwMilliseconds=0x1f4) [0078.409] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0078.409] IsDebuggerPresent () returned 0 [0078.410] Sleep (dwMilliseconds=0x1f4) [0078.925] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0078.925] IsDebuggerPresent () returned 0 [0078.926] Sleep (dwMilliseconds=0x1f4) [0079.450] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0079.450] IsDebuggerPresent () returned 0 [0079.451] Sleep (dwMilliseconds=0x1f4) [0079.956] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0079.957] IsDebuggerPresent () returned 0 [0079.958] Sleep (dwMilliseconds=0x1f4) [0081.711] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0081.711] IsDebuggerPresent () returned 0 [0081.712] Sleep (dwMilliseconds=0x1f4) [0082.217] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0082.217] IsDebuggerPresent () returned 0 [0082.218] Sleep (dwMilliseconds=0x1f4) [0082.731] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0082.732] IsDebuggerPresent () returned 0 [0082.732] Sleep (dwMilliseconds=0x1f4) [0083.247] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0083.248] IsDebuggerPresent () returned 0 [0083.248] Sleep (dwMilliseconds=0x1f4) [0083.750] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0083.750] IsDebuggerPresent () returned 0 [0089.004] Sleep (dwMilliseconds=0x1f4) [0095.208] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0095.208] IsDebuggerPresent () returned 0 [0095.209] Sleep (dwMilliseconds=0x1f4) [0095.724] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0095.724] IsDebuggerPresent () returned 0 [0095.725] Sleep (dwMilliseconds=0x1f4) [0096.239] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0096.239] IsDebuggerPresent () returned 0 [0096.241] Sleep (dwMilliseconds=0x1f4) [0096.755] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0096.755] IsDebuggerPresent () returned 0 [0096.756] Sleep (dwMilliseconds=0x1f4) [0097.262] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0097.262] IsDebuggerPresent () returned 0 [0097.263] Sleep (dwMilliseconds=0x1f4) [0097.777] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0097.777] IsDebuggerPresent () returned 0 [0097.778] Sleep (dwMilliseconds=0x1f4) [0098.286] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0098.286] IsDebuggerPresent () returned 0 [0098.287] Sleep (dwMilliseconds=0x1f4) [0098.801] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0098.801] IsDebuggerPresent () returned 0 [0098.802] Sleep (dwMilliseconds=0x1f4) [0099.497] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0099.498] IsDebuggerPresent () returned 0 [0099.498] Sleep (dwMilliseconds=0x1f4) [0100.007] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0100.007] IsDebuggerPresent () returned 0 [0100.008] Sleep (dwMilliseconds=0x1f4) [0100.673] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0100.673] IsDebuggerPresent () returned 0 [0100.674] Sleep (dwMilliseconds=0x1f4) [0101.176] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0101.176] IsDebuggerPresent () returned 0 [0101.177] Sleep (dwMilliseconds=0x1f4) [0101.730] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0101.730] IsDebuggerPresent () returned 0 [0101.731] Sleep (dwMilliseconds=0x1f4) [0102.241] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0102.241] IsDebuggerPresent () returned 0 [0102.241] Sleep (dwMilliseconds=0x1f4) [0102.756] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0102.756] IsDebuggerPresent () returned 0 [0102.757] Sleep (dwMilliseconds=0x1f4) [0103.272] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0103.273] IsDebuggerPresent () returned 0 [0103.274] Sleep (dwMilliseconds=0x1f4) [0103.787] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0103.787] IsDebuggerPresent () returned 0 [0103.788] Sleep (dwMilliseconds=0x1f4) [0104.303] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0104.303] IsDebuggerPresent () returned 0 [0104.304] Sleep (dwMilliseconds=0x1f4) [0104.818] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0104.818] IsDebuggerPresent () returned 0 [0104.819] Sleep (dwMilliseconds=0x1f4) [0105.334] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0105.334] IsDebuggerPresent () returned 0 [0105.335] Sleep (dwMilliseconds=0x1f4) [0105.880] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0105.880] IsDebuggerPresent () returned 0 [0106.040] Sleep (dwMilliseconds=0x1f4) [0106.553] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0106.553] IsDebuggerPresent () returned 0 [0106.553] Sleep (dwMilliseconds=0x1f4) [0107.068] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0107.068] IsDebuggerPresent () returned 0 [0107.069] Sleep (dwMilliseconds=0x1f4) [0107.575] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0107.575] IsDebuggerPresent () returned 0 [0107.576] Sleep (dwMilliseconds=0x1f4) [0108.092] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0108.092] IsDebuggerPresent () returned 0 [0108.093] Sleep (dwMilliseconds=0x1f4) [0108.597] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0108.597] IsDebuggerPresent () returned 0 [0108.598] Sleep (dwMilliseconds=0x1f4) [0114.099] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0114.099] IsDebuggerPresent () returned 0 [0114.100] Sleep (dwMilliseconds=0x1f4) [0114.615] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0114.615] IsDebuggerPresent () returned 0 [0114.615] Sleep (dwMilliseconds=0x1f4) [0115.653] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0115.653] IsDebuggerPresent () returned 0 [0115.654] Sleep (dwMilliseconds=0x1f4) [0116.195] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0116.195] IsDebuggerPresent () returned 0 [0116.196] Sleep (dwMilliseconds=0x1f4) [0117.260] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0117.260] IsDebuggerPresent () returned 0 [0117.261] Sleep (dwMilliseconds=0x1f4) [0117.858] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0117.858] IsDebuggerPresent () returned 0 [0123.183] Sleep (dwMilliseconds=0x1f4) [0124.595] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0124.595] IsDebuggerPresent () returned 0 [0124.596] Sleep (dwMilliseconds=0x1f4) [0125.631] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0125.631] IsDebuggerPresent () returned 0 [0125.632] Sleep (dwMilliseconds=0x1f4) [0126.265] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0126.265] IsDebuggerPresent () returned 0 [0126.266] Sleep (dwMilliseconds=0x1f4) [0126.782] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0126.782] IsDebuggerPresent () returned 0 [0126.783] Sleep (dwMilliseconds=0x1f4) [0127.296] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0127.296] IsDebuggerPresent () returned 0 [0127.297] Sleep (dwMilliseconds=0x1f4) [0127.810] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0127.810] IsDebuggerPresent () returned 0 [0127.811] Sleep (dwMilliseconds=0x1f4) [0128.323] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x242ff7c | out: pbDebuggerPresent=0x242ff7c) returned 1 [0128.323] IsDebuggerPresent () returned 0 [0128.324] Sleep (dwMilliseconds=0x1f4) Thread: id = 6 os_tid = 0xdf0 Thread: id = 7 os_tid = 0xa7c Thread: id = 8 os_tid = 0xe00 Thread: id = 9 os_tid = 0xf94 Thread: id = 10 os_tid = 0xda4 Thread: id = 11 os_tid = 0x1360 [0120.205] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0120.205] RoInitialize () returned 0x1 [0120.205] RoUninitialize () returned 0x0 [0120.208] ResetEvent (hEvent=0x36c) returned 1 Thread: id = 12 os_tid = 0xe90 Thread: id = 13 os_tid = 0x1048 Thread: id = 14 os_tid = 0x994 [0128.403] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\hidden-tear.exe.log") returned 81 [0128.403] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\hidden-tear.exe.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\hidden-tear.exe.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.403] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\hidden-tear.exe.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\hidden-tear.exe.log"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x51c [0128.406] WriteFile (in: hFile=0x51c, lpBuffer=0x70f480*, nNumberOfBytesToWrite=0x501, lpNumberOfBytesWritten=0x817f9c0, lpOverlapped=0x0 | out: lpBuffer=0x70f480*, lpNumberOfBytesWritten=0x817f9c0*=0x501, lpOverlapped=0x0) returned 1 [0128.408] CloseHandle (hObject=0x51c) returned 1 [0128.468] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x817fd64, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x817fd64*=0x6ac) returned 1 [0128.469] CloseHandle (hObject=0x0) returned 0 [0128.469] SleepEx (dwMilliseconds=0x14, bAlertable=0)