# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Jun 3 2020 08:38:37 # Log Creation Date: 01.09.2020 07:43:31.020 Process: id = "1" image_name = "salary.exe" filename = "c:\\users\\fd1hvy\\desktop\\salary.exe" page_root = "0xb1f2000" os_pid = "0x1120" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x560" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\Salary.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x111c [0060.371] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0061.223] RoInitialize () returned 0x1 [0061.224] RoUninitialize () returned 0x0 [0064.879] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0xefead0 | out: phkResult=0xefead0*=0x0) returned 0x2 [0064.879] RegCloseKey (hKey=0x80000002) returned 0x0 [0064.887] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0xefed28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0064.916] IsAppThemed () returned 0x1 [0064.922] CoTaskMemAlloc (cb=0xf0) returned 0x1053da8 [0064.923] CreateActCtxA (pActCtx=0xeff278) returned 0x1048c5c [0065.056] CoTaskMemFree (pv=0x1053da8) [0065.147] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc198 [0065.148] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc197 [0065.166] GetUserNameW (in: lpBuffer=0xeff0a0, pcbBuffer=0xeff318 | out: lpBuffer="FD1HVy", pcbBuffer=0xeff318) returned 1 [0065.185] GetComputerNameW (in: lpBuffer=0xeff0a0, nSize=0xeff318 | out: lpBuffer="NQDPDE", nSize=0xeff318) returned 1 [0067.410] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Salary.exe.config", nBufferLength=0x105, lpBuffer=0xefeb78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Salary.exe.config", lpFilePart=0x0) returned 0x29 [0068.319] GetCurrentProcess () returned 0xffffffff [0068.319] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xefeee0 | out: TokenHandle=0xefeee0*=0x2cc) returned 1 [0068.323] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0xefe96c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0068.326] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0xefeed8 | out: lpFileInformation=0xefeed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0068.328] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0xefe938, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0068.328] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0xefeee0 | out: lpFileInformation=0xefeee0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0068.330] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0xefe8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0068.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefee18) returned 1 [0068.331] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0068.331] GetFileType (hFile=0x2d0) returned 0x1 [0068.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefee14) returned 1 [0068.331] GetFileType (hFile=0x2d0) returned 0x1 [0068.550] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0xefeed4 | out: lpFileSizeHigh=0xefeed4*=0x0) returned 0x8c8f [0068.551] ReadFile (in: hFile=0x2d0, lpBuffer=0x2e19b84, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefee90, lpOverlapped=0x0 | out: lpBuffer=0x2e19b84*, lpNumberOfBytesRead=0xefee90*=0x1000, lpOverlapped=0x0) returned 1 [0068.773] ReadFile (in: hFile=0x2d0, lpBuffer=0x2e19b84, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefed3c, lpOverlapped=0x0 | out: lpBuffer=0x2e19b84*, lpNumberOfBytesRead=0xefed3c*=0x1000, lpOverlapped=0x0) returned 1 [0068.776] ReadFile (in: hFile=0x2d0, lpBuffer=0x2e19b84, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefebf0, lpOverlapped=0x0 | out: lpBuffer=0x2e19b84*, lpNumberOfBytesRead=0xefebf0*=0x1000, lpOverlapped=0x0) returned 1 [0068.777] ReadFile (in: hFile=0x2d0, lpBuffer=0x2e19b84, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefebf0, lpOverlapped=0x0 | out: lpBuffer=0x2e19b84*, lpNumberOfBytesRead=0xefebf0*=0x1000, lpOverlapped=0x0) returned 1 [0068.777] ReadFile (in: hFile=0x2d0, lpBuffer=0x2e19b84, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefebf0, lpOverlapped=0x0 | out: lpBuffer=0x2e19b84*, lpNumberOfBytesRead=0xefebf0*=0x1000, lpOverlapped=0x0) returned 1 [0068.778] ReadFile (in: hFile=0x2d0, lpBuffer=0x2e19b84, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefeb28, lpOverlapped=0x0 | out: lpBuffer=0x2e19b84*, lpNumberOfBytesRead=0xefeb28*=0x1000, lpOverlapped=0x0) returned 1 [0068.909] ReadFile (in: hFile=0x2d0, lpBuffer=0x2e19b84, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefecac, lpOverlapped=0x0 | out: lpBuffer=0x2e19b84*, lpNumberOfBytesRead=0xefecac*=0x1000, lpOverlapped=0x0) returned 1 [0068.911] ReadFile (in: hFile=0x2d0, lpBuffer=0x2e19b84, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefebb8, lpOverlapped=0x0 | out: lpBuffer=0x2e19b84*, lpNumberOfBytesRead=0xefebb8*=0x1000, lpOverlapped=0x0) returned 1 [0068.912] ReadFile (in: hFile=0x2d0, lpBuffer=0x2e19b84, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefebb8, lpOverlapped=0x0 | out: lpBuffer=0x2e19b84*, lpNumberOfBytesRead=0xefebb8*=0xc8f, lpOverlapped=0x0) returned 1 [0068.912] ReadFile (in: hFile=0x2d0, lpBuffer=0x2e19b84, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefec7c, lpOverlapped=0x0 | out: lpBuffer=0x2e19b84*, lpNumberOfBytesRead=0xefec7c*=0x0, lpOverlapped=0x0) returned 1 [0068.912] CloseHandle (hObject=0x2d0) returned 1 [0068.914] GetCurrentProcess () returned 0xffffffff [0068.914] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xeff028 | out: TokenHandle=0xeff028*=0x2d0) returned 1 [0068.915] GetCurrentProcess () returned 0xffffffff [0068.915] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xeff028 | out: TokenHandle=0xeff028*=0x2d4) returned 1 [0068.915] GetCurrentProcess () returned 0xffffffff [0068.915] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xefeee0 | out: TokenHandle=0xefeee0*=0x2d8) returned 1 [0068.916] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Salary.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\salary.exe.config"), fInfoLevelId=0x0, lpFileInformation=0xefeed8 | out: lpFileInformation=0xefeed8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0068.916] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Salary.exe.config", nBufferLength=0x105, lpBuffer=0xefe938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Salary.exe.config", lpFilePart=0x0) returned 0x29 [0068.916] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Salary.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\salary.exe.config"), fInfoLevelId=0x0, lpFileInformation=0xefeee0 | out: lpFileInformation=0xefeee0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0068.917] GetCurrentProcess () returned 0xffffffff [0068.917] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xeff028 | out: TokenHandle=0xeff028*=0x2dc) returned 1 [0068.917] GetCurrentProcess () returned 0xffffffff [0068.917] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xeff028 | out: TokenHandle=0xeff028*=0x2e0) returned 1 [0069.008] GetCurrentProcess () returned 0xffffffff [0069.008] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xefee88 | out: TokenHandle=0xefee88*=0x2e4) returned 1 [0069.014] GetCurrentProcess () returned 0xffffffff [0069.014] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xefee98 | out: TokenHandle=0xefee98*=0x2e8) returned 1 [0069.500] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0069.507] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x6fd40000 [0070.748] AdjustWindowRectEx (in: lpRect=0xeff2b8, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50081 | out: lpRect=0xeff2b8) returned 1 [0070.752] GetCurrentProcess () returned 0xffffffff [0070.752] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0xeff1cc, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xeff1cc*=0x2f0) returned 1 [0070.763] GetCurrentActCtx (in: lphActCtx=0xeff12c | out: lphActCtx=0xeff12c*=0x0) returned 1 [0070.763] ActivateActCtx (in: hActCtx=0x1048c5c, lpCookie=0xeff13c | out: hActCtx=0x1048c5c, lpCookie=0xeff13c) returned 1 [0070.763] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0070.816] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x6fb30000 [0072.659] GetModuleHandleW (lpModuleName="user32.dll") returned 0x750c0000 [0072.659] GetProcAddress (hModule=0x750c0000, lpProcName="DefWindowProcW") returned 0x743c0140 [0072.660] GetStockObject (i=5) returned 0x900015 [0072.665] GetModuleHandleW (lpModuleName=0x0) returned 0xb20000 [0072.669] CoTaskMemAlloc (cb=0x5a) returned 0x1052278 [0072.669] RegisterClassW (lpWndClass=0xefefe0) returned 0xc19a [0072.670] CoTaskMemFree (pv=0x1052278) [0072.670] GetModuleHandleW (lpModuleName=0x0) returned 0xb20000 [0072.670] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0xb20000, lpParam=0x0) returned 0x602c6 [0072.674] SetWindowLongW (hWnd=0x602c6, nIndex=-4, dwNewLong=1950089536) returned 47842750 [0072.675] GetWindowLongW (hWnd=0x602c6, nIndex=-4) returned 1950089536 [0072.678] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0xefe800 | out: phkResult=0xefe800*=0x308) returned 0x0 [0072.679] RegQueryValueExW (in: hKey=0x308, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0xefe820, lpData=0x0, lpcbData=0xefe81c*=0x0 | out: lpType=0xefe820*=0x0, lpData=0x0, lpcbData=0xefe81c*=0x0) returned 0x2 [0072.679] RegQueryValueExW (in: hKey=0x308, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0xefe820, lpData=0x0, lpcbData=0xefe81c*=0x0 | out: lpType=0xefe820*=0x0, lpData=0x0, lpcbData=0xefe81c*=0x0) returned 0x2 [0072.679] RegCloseKey (hKey=0x308) returned 0x0 [0072.680] SetWindowLongW (hWnd=0x602c6, nIndex=-4, dwNewLong=47842790) returned 1950089536 [0072.681] GetWindowLongW (hWnd=0x602c6, nIndex=-4) returned 47842790 [0072.681] GetWindowLongW (hWnd=0x602c6, nIndex=-16) returned 113311744 [0072.682] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc19b [0072.683] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc19c [0072.683] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x602c6, Msg=0x81, wParam=0x0, lParam=0xefeb50) returned 0x1 [0072.685] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x602c6, Msg=0x83, wParam=0x0, lParam=0xefeb3c) returned 0x0 [0073.139] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x602c6, Msg=0x1, wParam=0x0, lParam=0xefeb50) returned 0x0 [0073.140] GetClientRect (in: hWnd=0x602c6, lpRect=0xefe838 | out: lpRect=0xefe838) returned 1 [0073.140] GetWindowRect (in: hWnd=0x602c6, lpRect=0xefe838 | out: lpRect=0xefe838) returned 1 [0073.142] GetParent (hWnd=0x602c6) returned 0x0 [0073.142] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1dab0001) returned 1 [0073.171] EtwEventRegister (in: ProviderId=0x2e35dfc, EnableCallback=0x2da060e, CallbackContext=0x0, RegHandle=0x2e35dd8 | out: RegHandle=0x2e35dd8) returned 0x0 [0073.257] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0073.258] AdjustWindowRectEx (in: lpRect=0xeff264, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0xeff264) returned 1 [0073.258] GetSystemMetrics (nIndex=59) returned 1460 [0073.258] GetSystemMetrics (nIndex=60) returned 920 [0073.258] GetSystemMetrics (nIndex=34) returned 136 [0073.258] GetSystemMetrics (nIndex=35) returned 39 [0073.258] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0073.259] AdjustWindowRectEx (in: lpRect=0xeff164, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0xeff164) returned 1 [0073.264] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Salary.exe.config", nBufferLength=0x105, lpBuffer=0xefeb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Salary.exe.config", lpFilePart=0x0) returned 0x29 [0073.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeff4) returned 1 [0073.265] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Salary.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\salary.exe.config"), fInfoLevelId=0x0, lpFileInformation=0xeff070 | out: lpFileInformation=0xeff070*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0073.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeff0) returned 1 [0079.054] GetSystemMetrics (nIndex=11) returned 32 [0079.054] GetSystemMetrics (nIndex=12) returned 32 [0079.055] GetDC (hWnd=0x0) returned 0x10105d6 [0079.058] GetDeviceCaps (hdc=0x10105d6, index=12) returned 32 [0079.058] GetDeviceCaps (hdc=0x10105d6, index=14) returned 1 [0079.058] ReleaseDC (hWnd=0x0, hDC=0x10105d6) returned 1 [0079.059] CreateIconFromResourceEx (presbits=0x2e48fc8, dwResSize=0x10a8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0xb0089 [0079.068] CreateCompatibleDC (hdc=0x0) returned 0x2b010510 [0079.072] GetSystemDefaultLCID () returned 0x409 [0079.072] GetStockObject (i=17) returned 0xa01c1 [0079.073] GetObjectW (in: h=0xa01c1, c=92, pv=0xefefb4 | out: pv=0xefefb4) returned 92 [0079.074] GetDC (hWnd=0x0) returned 0x10105d6 [0079.231] GdiplusStartup (in: token=0xfc5ee8, input=0xefe568, output=0xefe5b8 | out: token=0xfc5ee8, output=0xefe5b8) returned 0x0 [0079.238] CoTaskMemAlloc (cb=0x5c) returned 0x1052620 [0079.239] GdipCreateFontFromLogfontW (hdc=0x10105d6, logfont=0x1052620, font=0xeff07c) returned 0x0 [0080.386] CoTaskMemFree (pv=0x1052620) [0080.387] CoTaskMemAlloc (cb=0x5c) returned 0x1052620 [0080.387] CoTaskMemFree (pv=0x1052620) [0080.388] CoTaskMemAlloc (cb=0x5c) returned 0x10521a8 [0080.388] CoTaskMemFree (pv=0x10521a8) [0080.388] GdipGetFontUnit (font=0x2d91f08, unit=0xeff044) returned 0x0 [0080.389] GdipGetFontSize (font=0x2d91f08, size=0xeff048) returned 0x0 [0080.389] GdipGetFontStyle (font=0x2d91f08, style=0xeff040) returned 0x0 [0080.389] GdipGetFamily (font=0x2d91f08, family=0xeff03c) returned 0x0 [0080.390] GdipGetFontSize (font=0x2d91f08, size=0x2e4a534) returned 0x0 [0080.390] ReleaseDC (hWnd=0x0, hDC=0x10105d6) returned 1 [0080.390] GetDC (hWnd=0x0) returned 0xf0105ee [0080.391] GdipCreateFromHDC (hdc=0xf0105ee, graphics=0xeff058) returned 0x0 [0080.397] GdipGetDpiY (graphics=0x66af260, dpi=0x2e4a610) returned 0x0 [0080.398] GdipGetFontHeight (font=0x2d91f08, graphics=0x66af260, height=0xeff050) returned 0x0 [0080.398] GdipGetEmHeight (family=0x2d99440, style=0, EmHeight=0xeff058) returned 0x0 [0080.398] GdipGetLineSpacing (family=0x2d99440, style=0, LineSpacing=0xeff058) returned 0x0 [0080.399] GdipDeleteGraphics (graphics=0x66af260) returned 0x0 [0080.399] ReleaseDC (hWnd=0x0, hDC=0xf0105ee) returned 1 [0080.399] GdipCreateFont (fontFamily=0x2d99440, emSize=0x41040000, style=0, unit=0x3, font=0x2e4a62c) returned 0x0 [0080.399] GdipGetFontSize (font=0x2d9ef48, size=0x2e4a630) returned 0x0 [0080.399] GdipDeleteFont (font=0x2d91f08) returned 0x0 [0080.400] GetDC (hWnd=0x0) returned 0xf0105ee [0080.400] GdipCreateFromHDC (hdc=0xf0105ee, graphics=0xeff08c) returned 0x0 [0080.401] CoTaskMemAlloc (cb=0x5c) returned 0x1052688 [0080.402] GdipGetLogFontW (font=0x2d9ef48, graphics=0x66af260, logfontW=0x1052688) returned 0x0 [0080.406] CoTaskMemFree (pv=0x1052688) [0080.406] CoTaskMemAlloc (cb=0x5c) returned 0x10522e0 [0080.406] CoTaskMemFree (pv=0x10522e0) [0080.406] CoTaskMemAlloc (cb=0x5c) returned 0x10522e0 [0080.406] CoTaskMemFree (pv=0x10522e0) [0080.406] GdipDeleteGraphics (graphics=0x66af260) returned 0x0 [0080.406] ReleaseDC (hWnd=0x0, hDC=0xf0105ee) returned 1 [0080.407] CoTaskMemAlloc (cb=0x5c) returned 0x10523b0 [0080.407] CreateFontIndirectW (lplf=0x10523b0) returned 0x430a0512 [0080.407] CoTaskMemFree (pv=0x10523b0) [0080.407] SelectObject (hdc=0x2b010510, h=0x430a0512) returned 0x8a01c2 [0080.408] GetTextMetricsW (in: hdc=0x2b010510, lptm=0xeff198 | out: lptm=0xeff198) returned 1 [0080.408] GetTextExtentPoint32W (in: hdc=0x2b010510, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x2e4a858 | out: psizl=0x2e4a858) returned 1 [0080.443] SelectObject (hdc=0x2b010510, h=0x8a01c2) returned 0x430a0512 [0080.446] DeleteDC (hdc=0x2b010510) returned 1 [0080.447] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0080.447] AdjustWindowRectEx (in: lpRect=0xefeee0, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0xefeee0) returned 1 [0080.447] AdjustWindowRectEx (in: lpRect=0xeff124, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0xeff124) returned 1 [0080.447] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0080.447] AdjustWindowRectEx (in: lpRect=0xefee58, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0xefee58) returned 1 [0080.447] AdjustWindowRectEx (in: lpRect=0xefef5c, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0xefef5c) returned 1 [0080.448] GetSystemMetrics (nIndex=34) returned 136 [0080.448] GetSystemMetrics (nIndex=35) returned 39 [0080.448] GetCurrentActCtx (in: lphActCtx=0xeff2ec | out: lphActCtx=0xeff2ec*=0x0) returned 1 [0080.449] ActivateActCtx (in: hActCtx=0x1048c5c, lpCookie=0xeff2fc | out: hActCtx=0x1048c5c, lpCookie=0xeff2fc) returned 1 [0080.449] GetCurrentActCtx (in: lphActCtx=0xeff10c | out: lphActCtx=0xeff10c*=0x1048c5c) returned 1 [0080.449] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0080.449] AdjustWindowRectEx (in: lpRect=0xeff04c, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0xeff04c) returned 1 [0080.449] GetModuleHandleW (lpModuleName=0x0) returned 0xb20000 [0080.449] CreateWindowExW (dwExStyle=0x50080, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", lpWindowName="hidden tear", dwStyle=0x2cf0000, X=-2147483648, Y=-2147483648, nWidth=140, nHeight=92, hWndParent=0x0, hMenu=0x0, hInstance=0xb20000, lpParam=0x0) returned 0x302c0 [0080.450] SetWindowLongW (hWnd=0x302c0, nIndex=-4, dwNewLong=1950089536) returned 47842750 [0080.450] GetWindowLongW (hWnd=0x302c0, nIndex=-4) returned 1950089536 [0080.451] SetWindowLongW (hWnd=0x302c0, nIndex=-4, dwNewLong=47842870) returned 1950089536 [0080.451] GetWindowLongW (hWnd=0x302c0, nIndex=-4) returned 47842870 [0080.451] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned 114229248 [0080.451] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0x81, wParam=0x0, lParam=0xefeb30) returned 0x1 [0080.454] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0x83, wParam=0x0, lParam=0xefeb1c) returned 0x0 [0080.456] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0x1, wParam=0x0, lParam=0xefeb30) returned 0x0 [0080.456] GetClientRect (in: hWnd=0x302c0, lpRect=0xefe7e8 | out: lpRect=0xefe7e8) returned 1 [0080.456] GetWindowRect (in: hWnd=0x302c0, lpRect=0xefe7e8 | out: lpRect=0xefe7e8) returned 1 [0080.456] SetWindowTextW (hWnd=0x302c0, lpString="hidden tear") returned 1 [0080.456] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0xc, wParam=0x0, lParam=0x2e35a40) returned 0x1 [0080.466] GetUserObjectInformationA (in: hObj=0x13c, nIndex=1, pvInfo=0x2e4ad74, nLength=0xc, lpnLengthNeeded=0xefe6e0 | out: pvInfo=0x2e4ad74, lpnLengthNeeded=0xefe6e0) returned 1 [0080.470] SetConsoleCtrlHandler (HandlerRoutine=0x2da065e, Add=1) returned 1 [0080.470] GetModuleHandleW (lpModuleName=0x0) returned 0xb20000 [0080.471] GetModuleHandleW (lpModuleName=0x0) returned 0xb20000 [0080.472] GetClassInfoW (in: hInstance=0xb20000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWndClass=0x2e4add8 | out: lpWndClass=0x2e4add8) returned 0 [0080.474] CoTaskMemAlloc (cb=0x58) returned 0x104bb78 [0080.474] RegisterClassW (lpWndClass=0xefe630) returned 0xc19e [0080.474] CoTaskMemFree (pv=0x104bb78) [0080.475] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0xb20000, lpParam=0x0) returned 0x400ec [0080.481] NtdllDefWindowProc_W (hWnd=0x400ec, Msg=0x83, wParam=0x0, lParam=0xefe15c) returned 0x0 [0080.482] NtdllDefWindowProc_W (hWnd=0x400ec, Msg=0x1, wParam=0x0, lParam=0xefe170) returned 0x0 [0080.482] NtdllDefWindowProc_W (hWnd=0x400ec, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0080.482] NtdllDefWindowProc_W (hWnd=0x400ec, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0080.487] GetStartupInfoW (in: lpStartupInfo=0x2e4b230 | out: lpStartupInfo=0x2e4b230*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\Salary.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0080.489] GetParent (hWnd=0x302c0) returned 0x0 [0080.489] SetWindowLongW (hWnd=0x302c0, nIndex=-8, dwNewLong=0) returned 0 [0080.490] GetSystemMetrics (nIndex=49) returned 16 [0080.490] GetSystemMetrics (nIndex=50) returned 16 [0080.491] CreateIconFromResourceEx (presbits=0x2e4b2b0, dwResSize=0x468, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x12029d [0080.492] SendMessageW (hWnd=0x302c0, Msg=0x80, wParam=0x0, lParam=0x12029d) returned 0x0 [0080.492] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0x80, wParam=0x0, lParam=0x12029d) returned 0x0 [0080.493] SendMessageW (hWnd=0x302c0, Msg=0x80, wParam=0x1, lParam=0xb0089) returned 0x0 [0080.493] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0x80, wParam=0x1, lParam=0xb0089) returned 0x0 [0080.493] GetSystemMenu (hWnd=0x302c0, bRevert=0) returned 0x701ed [0080.496] GetWindowPlacement (in: hWnd=0x302c0, lpwndpl=0xeff11c | out: lpwndpl=0xeff11c) returned 1 [0080.496] EnableMenuItem (hMenu=0x701ed, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0080.496] EnableMenuItem (hMenu=0x701ed, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0080.496] EnableMenuItem (hMenu=0x701ed, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0080.496] EnableMenuItem (hMenu=0x701ed, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0080.497] EnableMenuItem (hMenu=0x701ed, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0080.497] GetClientRect (in: hWnd=0x302c0, lpRect=0xeff160 | out: lpRect=0xeff160) returned 1 [0080.497] GetClientRect (in: hWnd=0x302c0, lpRect=0xeff0c0 | out: lpRect=0xeff0c0) returned 1 [0080.497] GetWindowRect (in: hWnd=0x302c0, lpRect=0xeff0c0 | out: lpRect=0xeff0c0) returned 1 [0080.497] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0080.497] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned 114229248 [0080.498] GetWindowTextLengthW (hWnd=0x302c0) returned 11 [0080.498] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0080.498] GetSystemMetrics (nIndex=42) returned 0 [0080.498] GetWindowTextW (in: hWnd=0x302c0, lpString=0xeff038, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0080.498] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0xd, wParam=0xc, lParam=0xeff038) returned 0xb [0080.499] GetWindowTextLengthW (hWnd=0x302c0) returned 11 [0080.499] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0080.499] GetSystemMetrics (nIndex=42) returned 0 [0080.499] GetWindowTextW (in: hWnd=0x302c0, lpString=0xeff038, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0080.499] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0xd, wParam=0xc, lParam=0xeff038) returned 0xb [0080.499] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned 114229248 [0080.499] GetWindowLongW (hWnd=0x302c0, nIndex=-20) returned 328064 [0080.499] SetWindowLongW (hWnd=0x302c0, nIndex=-16, dwNewLong=47120384) returned 114229248 [0080.501] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0x7c, wParam=0xfffffff0, lParam=0xeff0bc) returned 0x0 [0080.501] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0x7d, wParam=0xfffffff0, lParam=0xeff0bc) returned 0x0 [0080.504] SetWindowLongW (hWnd=0x302c0, nIndex=-20, dwNewLong=327808) returned 328064 [0080.504] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0x7c, wParam=0xffffffec, lParam=0xeff0bc) returned 0x0 [0080.504] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0x7d, wParam=0xffffffec, lParam=0xeff0bc) returned 0x0 [0080.505] SetWindowPos (hWnd=0x302c0, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0080.505] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0x46, wParam=0x0, lParam=0xeff0d4) returned 0x0 [0080.505] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0x83, wParam=0x1, lParam=0xeff0ac) returned 0x0 [0080.506] GetWindowPlacement (in: hWnd=0x302c0, lpwndpl=0xefee00 | out: lpwndpl=0xefee00) returned 1 [0080.506] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0x47, wParam=0x0, lParam=0xeff0d4) returned 0x0 [0080.506] GetClientRect (in: hWnd=0x302c0, lpRect=0xefedb0 | out: lpRect=0xefedb0) returned 1 [0080.506] GetWindowRect (in: hWnd=0x302c0, lpRect=0xefedb0 | out: lpRect=0xefedb0) returned 1 [0080.507] RedrawWindow (hWnd=0x302c0, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0080.507] GetSystemMenu (hWnd=0x302c0, bRevert=0) returned 0x701ed [0080.507] GetWindowPlacement (in: hWnd=0x302c0, lpwndpl=0xeff10c | out: lpwndpl=0xeff10c) returned 1 [0080.507] EnableMenuItem (hMenu=0x701ed, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0080.508] EnableMenuItem (hMenu=0x701ed, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0080.508] EnableMenuItem (hMenu=0x701ed, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0080.508] EnableMenuItem (hMenu=0x701ed, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0080.508] EnableMenuItem (hMenu=0x701ed, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0080.508] ShowWindow (hWnd=0x302c0, nCmdShow=5) [0080.508] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0080.509] GetWindowTextLengthW (hWnd=0x302c0) returned 11 [0080.509] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0080.509] GetSystemMetrics (nIndex=42) returned 0 [0080.509] GetWindowTextW (in: hWnd=0x302c0, lpString=0xefecfc, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0080.509] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0xd, wParam=0xc, lParam=0xefecfc) returned 0xb [0080.520] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0080.520] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned 114229248 [0080.520] GetWindowTextLengthW (hWnd=0x302c0) returned 11 [0080.520] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0080.520] GetSystemMetrics (nIndex=42) returned 0 [0080.520] GetWindowTextW (in: hWnd=0x302c0, lpString=0xefebdc, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0080.520] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0xd, wParam=0xc, lParam=0xefebdc) returned 0xb [0080.520] GetWindowTextLengthW (hWnd=0x302c0) returned 11 [0080.520] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0080.520] GetSystemMetrics (nIndex=42) returned 0 [0080.520] GetWindowTextW (in: hWnd=0x302c0, lpString=0xefebdc, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0080.520] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0xd, wParam=0xc, lParam=0xefebdc) returned 0xb [0080.520] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned 114229248 [0080.520] GetWindowLongW (hWnd=0x302c0, nIndex=-20) returned 328064 [0080.521] SetWindowLongW (hWnd=0x302c0, nIndex=-16, dwNewLong=315555840) returned 114229248 [0080.521] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0x7c, wParam=0xfffffff0, lParam=0xefec64) returned 0x0 [0080.530] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0x7d, wParam=0xfffffff0, lParam=0xefec64) returned 0x0 [0080.531] SetWindowLongW (hWnd=0x302c0, nIndex=-20, dwNewLong=852096) returned 328064 [0080.531] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0x7c, wParam=0xffffffec, lParam=0xefec64) returned 0x0 [0080.532] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0x7d, wParam=0xffffffec, lParam=0xefec64) returned 0x0 [0080.532] SetWindowPos (hWnd=0x302c0, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0080.532] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0x46, wParam=0x0, lParam=0xefec7c) returned 0x0 [0080.532] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0x83, wParam=0x1, lParam=0xefec54) returned 0x0 [0080.534] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0x85, wParam=0x56040527, lParam=0x0) returned 0x0 [0080.535] GetWindowPlacement (in: hWnd=0x302c0, lpwndpl=0xefe9c4 | out: lpwndpl=0xefe9c4) returned 1 [0080.535] GetClientRect (in: hWnd=0x302c0, lpRect=0xefe970 | out: lpRect=0xefe970) returned 1 [0080.535] GetWindowTextLengthW (hWnd=0x302c0) returned 11 [0080.536] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0080.536] GetSystemMetrics (nIndex=42) returned 0 [0080.536] GetWindowTextW (in: hWnd=0x302c0, lpString=0xefe830, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0080.536] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0xd, wParam=0xc, lParam=0xefe830) returned 0xb [0080.536] GetClientRect (in: hWnd=0x302c0, lpRect=0xefe878 | out: lpRect=0xefe878) returned 1 [0080.538] GetSysColor (nIndex=10) returned 0xb4b4b4 [0080.538] GetSysColor (nIndex=2) returned 0xd1b499 [0080.538] GetSysColor (nIndex=9) returned 0x0 [0080.538] GetSysColor (nIndex=12) returned 0xababab [0080.538] GetSysColor (nIndex=15) returned 0xf0f0f0 [0080.538] GetSysColor (nIndex=20) returned 0xffffff [0080.538] GetSysColor (nIndex=16) returned 0xa0a0a0 [0080.538] GetSysColor (nIndex=15) returned 0xf0f0f0 [0080.538] GetSysColor (nIndex=16) returned 0xa0a0a0 [0080.538] GetSysColor (nIndex=21) returned 0x696969 [0080.538] GetSysColor (nIndex=22) returned 0xe3e3e3 [0080.538] GetSysColor (nIndex=20) returned 0xffffff [0080.538] GetSysColor (nIndex=18) returned 0x0 [0080.538] GetSysColor (nIndex=1) returned 0x0 [0080.538] GetSysColor (nIndex=27) returned 0xead1b9 [0080.538] GetSysColor (nIndex=28) returned 0xf2e4d7 [0080.538] GetSysColor (nIndex=17) returned 0x6d6d6d [0080.538] GetSysColor (nIndex=13) returned 0xd77800 [0080.538] GetSysColor (nIndex=14) returned 0xffffff [0080.538] GetSysColor (nIndex=26) returned 0xcc6600 [0080.538] GetSysColor (nIndex=11) returned 0xfcf7f4 [0080.538] GetSysColor (nIndex=3) returned 0xdbcdbf [0080.539] GetSysColor (nIndex=19) returned 0x0 [0080.539] GetSysColor (nIndex=24) returned 0xe1ffff [0080.539] GetSysColor (nIndex=23) returned 0x0 [0080.539] GetSysColor (nIndex=4) returned 0xf0f0f0 [0080.539] GetSysColor (nIndex=30) returned 0xf0f0f0 [0080.539] GetSysColor (nIndex=29) returned 0xd77800 [0080.539] GetSysColor (nIndex=7) returned 0x0 [0080.539] GetSysColor (nIndex=0) returned 0xc8c8c8 [0080.539] GetSysColor (nIndex=5) returned 0xffffff [0080.539] GetSysColor (nIndex=6) returned 0x646464 [0080.539] GetSysColor (nIndex=8) returned 0x0 [0080.540] GetSystemMetrics (nIndex=80) returned 1 [0080.547] EnumDisplayMonitors (hdc=0x0, lprcClip=0x0, lpfnEnum=0x2da06ae, dwData=0x0) returned 1 [0080.557] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0xefe4d8 | out: lpmi=0xefe4d8) returned 1 [0080.557] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x8601053c [0080.558] GetDeviceCaps (hdc=0x8601053c, index=12) returned 32 [0080.558] GetDeviceCaps (hdc=0x8601053c, index=14) returned 1 [0080.558] DeleteDC (hdc=0x8601053c) returned 1 [0080.558] GetCurrentObject (hdc=0xf0105ee, type=0x1) returned 0xb00017 [0080.558] GetCurrentObject (hdc=0xf0105ee, type=0x2) returned 0x900010 [0080.558] GetCurrentObject (hdc=0xf0105ee, type=0x7) returned 0x210501a2 [0080.558] GetCurrentObject (hdc=0xf0105ee, type=0x6) returned 0x8a01c2 [0080.559] SaveDC (hdc=0xf0105ee) returned 1 [0080.559] GetNearestColor (hdc=0xf0105ee, color=0xf0f0f0) returned 0xf0f0f0 [0080.560] CreateSolidBrush (color=0xf0f0f0) returned 0x4b10065f [0080.560] FillRect (hDC=0xf0105ee, lprc=0xefe718, hbr=0x4b10065f) returned 1 [0080.560] DeleteObject (ho=0x4b10065f) returned 1 [0080.561] RestoreDC (hdc=0xf0105ee, nSavedDC=-1) returned 1 [0080.611] GetWindowPlacement (in: hWnd=0x302c0, lpwndpl=0xefe9a8 | out: lpwndpl=0xefe9a8) returned 1 [0080.611] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0x47, wParam=0x0, lParam=0xefec7c) returned 0x0 [0080.611] GetClientRect (in: hWnd=0x302c0, lpRect=0xefe958 | out: lpRect=0xefe958) returned 1 [0080.611] GetWindowRect (in: hWnd=0x302c0, lpRect=0xefe958 | out: lpRect=0xefe958) returned 1 [0080.612] RedrawWindow (hWnd=0x302c0, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0080.612] GetSystemMenu (hWnd=0x302c0, bRevert=0) returned 0x701ed [0080.612] GetWindowPlacement (in: hWnd=0x302c0, lpwndpl=0xefecb0 | out: lpwndpl=0xefecb0) returned 1 [0080.612] EnableMenuItem (hMenu=0x701ed, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0080.612] EnableMenuItem (hMenu=0x701ed, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0080.612] EnableMenuItem (hMenu=0x701ed, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0080.612] EnableMenuItem (hMenu=0x701ed, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0080.612] EnableMenuItem (hMenu=0x701ed, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0080.617] SetLayeredWindowAttributes (hwnd=0x302c0, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0080.623] GetCurrentThreadId () returned 0x111c [0080.628] EnumThreadWindows (dwThreadId=0x111c, lpfn=0x2da06d6, lParam=0x302c0) returned 1 [0080.855] GetWindowLongW (hWnd=0x400ec, nIndex=-8) returned 0 [0080.855] GetWindowLongW (hWnd=0x302c0, nIndex=-8) returned 0 [0080.855] GetWindowLongW (hWnd=0x302d0, nIndex=-8) returned 197312 [0081.050] SetWindowLongW (hWnd=0x302d0, nIndex=-8, dwNewLong=0) returned 197312 [0081.055] GetParent (hWnd=0x302c0) returned 0x0 [0081.055] GetWindowLongW (hWnd=0x302c0, nIndex=-20) returned 852352 [0081.055] DestroyWindow (hWnd=0x302c0) returned 1 [0081.055] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0081.158] GetWindowTextLengthW (hWnd=0x302c0) returned 11 [0081.158] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0081.158] GetSystemMetrics (nIndex=42) returned 0 [0081.158] GetWindowTextW (in: hWnd=0x302c0, lpString=0xefe7ac, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0081.158] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0xd, wParam=0xc, lParam=0xefe7ac) returned 0xb [0081.159] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0081.160] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0081.162] GetCurrentActCtx (in: lphActCtx=0xefec10 | out: lphActCtx=0xefec10*=0x1048c5c) returned 1 [0081.162] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0081.162] GetModuleHandleW (lpModuleName=0x0) returned 0xb20000 [0081.163] CreateWindowExW (dwExStyle=0x90080, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", lpWindowName="hidden tear", dwStyle=0x2cf0000, X=104, Y=104, nWidth=140, nHeight=92, hWndParent=0x0, hMenu=0x0, hInstance=0xb20000, lpParam=0x0) returned 0x80030 [0081.163] SetWindowLongW (hWnd=0x80030, nIndex=-4, dwNewLong=1950089536) returned 47842750 [0081.163] GetWindowLongW (hWnd=0x80030, nIndex=-4) returned 1950089536 [0081.163] SetWindowLongW (hWnd=0x80030, nIndex=-4, dwNewLong=47843070) returned 1950089536 [0081.164] GetWindowLongW (hWnd=0x80030, nIndex=-4) returned 47843070 [0081.164] GetWindowLongW (hWnd=0x80030, nIndex=-16) returned 114229248 [0081.165] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x80030, Msg=0x81, wParam=0x0, lParam=0xefe630) returned 0x1 [0081.166] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x80030, Msg=0x83, wParam=0x0, lParam=0xefe61c) returned 0x0 [0081.166] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x80030, Msg=0x1, wParam=0x0, lParam=0xefe630) returned 0x0 [0081.166] GetClientRect (in: hWnd=0x80030, lpRect=0xefe2e8 | out: lpRect=0xefe2e8) returned 1 [0081.166] GetWindowRect (in: hWnd=0x80030, lpRect=0xefe2e8 | out: lpRect=0xefe2e8) returned 1 [0081.167] SetWindowTextW (hWnd=0x80030, lpString="hidden tear") returned 1 [0081.167] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x80030, Msg=0xc, wParam=0x0, lParam=0x2e4c738) returned 0x1 [0081.167] SetLayeredWindowAttributes (hwnd=0x80030, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0081.169] GetStartupInfoW (in: lpStartupInfo=0x2e4ca14 | out: lpStartupInfo=0x2e4ca14*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\Salary.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0081.170] GetParent (hWnd=0x80030) returned 0x0 [0081.170] GetStockObject (i=5) returned 0x900015 [0081.171] GetModuleHandleW (lpModuleName=0x0) returned 0xb20000 [0081.171] CoTaskMemAlloc (cb=0x5a) returned 0x1052758 [0081.171] RegisterClassW (lpWndClass=0xefeaec) returned 0xc19f [0081.172] CoTaskMemFree (pv=0x1052758) [0081.172] GetModuleHandleW (lpModuleName=0x0) returned 0xb20000 [0081.172] CreateWindowExW (dwExStyle=0x80, lpClassName="WindowsForms10.Window.0.app.0.141b42a_r9_ad1", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0xb20000, lpParam=0x0) returned 0x6008c [0081.172] SetWindowLongW (hWnd=0x6008c, nIndex=-4, dwNewLong=1950089536) returned 47843110 [0081.175] GetWindowLongW (hWnd=0x6008c, nIndex=-4) returned 1950089536 [0081.175] SetWindowLongW (hWnd=0x6008c, nIndex=-4, dwNewLong=47843150) returned 1950089536 [0081.175] GetWindowLongW (hWnd=0x6008c, nIndex=-4) returned 47843150 [0081.175] GetWindowLongW (hWnd=0x6008c, nIndex=-16) returned 79691776 [0081.178] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6008c, Msg=0x24, wParam=0x0, lParam=0xefe664) returned 0x0 [0081.178] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6008c, Msg=0x81, wParam=0x0, lParam=0xefe658) returned 0x1 [0081.179] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6008c, Msg=0x83, wParam=0x0, lParam=0xefe644) returned 0x0 [0081.180] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6008c, Msg=0x1, wParam=0x0, lParam=0xefe658) returned 0x0 [0081.181] SetWindowLongW (hWnd=0x80030, nIndex=-8, dwNewLong=393356) returned 0 [0081.182] SendMessageW (hWnd=0x80030, Msg=0x80, wParam=0x0, lParam=0x12029d) returned 0x0 [0081.182] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x80030, Msg=0x80, wParam=0x0, lParam=0x12029d) returned 0x0 [0081.182] SendMessageW (hWnd=0x80030, Msg=0x80, wParam=0x1, lParam=0xb0089) returned 0x0 [0081.182] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x80030, Msg=0x80, wParam=0x1, lParam=0xb0089) returned 0x0 [0081.385] GetSystemMenu (hWnd=0x80030, bRevert=0) returned 0x1902a9 [0081.385] GetWindowPlacement (in: hWnd=0x80030, lpwndpl=0xefec20 | out: lpwndpl=0xefec20) returned 1 [0081.386] EnableMenuItem (hMenu=0x1902a9, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0081.386] EnableMenuItem (hMenu=0x1902a9, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0081.386] EnableMenuItem (hMenu=0x1902a9, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0081.386] EnableMenuItem (hMenu=0x1902a9, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0081.386] EnableMenuItem (hMenu=0x1902a9, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0081.386] GetClientRect (in: hWnd=0x80030, lpRect=0xefec64 | out: lpRect=0xefec64) returned 1 [0081.386] GetClientRect (in: hWnd=0x80030, lpRect=0xefebc4 | out: lpRect=0xefebc4) returned 1 [0081.386] GetWindowRect (in: hWnd=0x80030, lpRect=0xefebc4 | out: lpRect=0xefebc4) returned 1 [0081.386] SetWindowPos (hWnd=0x80030, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1 [0081.386] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x80030, Msg=0x46, wParam=0x0, lParam=0xefeb2c) returned 0x0 [0081.391] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x80030, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0081.393] GetWindowPlacement (in: hWnd=0x80030, lpwndpl=0xefe874 | out: lpwndpl=0xefe874) returned 1 [0081.393] GetClientRect (in: hWnd=0x80030, lpRect=0xefe820 | out: lpRect=0xefe820) returned 1 [0081.393] GetWindowTextLengthW (hWnd=0x80030) returned 11 [0081.393] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x80030, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0081.394] GetSystemMetrics (nIndex=42) returned 0 [0081.394] GetWindowTextW (in: hWnd=0x80030, lpString=0xefe6e0, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0081.394] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x80030, Msg=0xd, wParam=0xc, lParam=0xefe6e0) returned 0xb [0081.394] GetClientRect (in: hWnd=0x80030, lpRect=0xefe728 | out: lpRect=0xefe728) returned 1 [0081.394] GetCurrentObject (hdc=0x60100ce, type=0x1) returned 0xb00017 [0081.394] GetCurrentObject (hdc=0x60100ce, type=0x2) returned 0x900010 [0081.394] GetCurrentObject (hdc=0x60100ce, type=0x7) returned 0x250507a7 [0081.394] GetCurrentObject (hdc=0x60100ce, type=0x6) returned 0x8a01c2 [0081.394] SaveDC (hdc=0x60100ce) returned 1 [0081.394] GetNearestColor (hdc=0x60100ce, color=0xf0f0f0) returned 0xf0f0f0 [0081.394] CreateSolidBrush (color=0xf0f0f0) returned 0x4c10065f [0081.394] FillRect (hDC=0x60100ce, lprc=0xefe5c8, hbr=0x4c10065f) returned 1 [0081.395] DeleteObject (ho=0x4c10065f) returned 1 [0081.395] RestoreDC (hdc=0x60100ce, nSavedDC=-1) returned 1 [0081.395] GetWindowPlacement (in: hWnd=0x80030, lpwndpl=0xefe858 | out: lpwndpl=0xefe858) returned 1 [0081.395] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x80030, Msg=0x47, wParam=0x0, lParam=0xefeb2c) returned 0x0 [0081.395] GetClientRect (in: hWnd=0x80030, lpRect=0xefe808 | out: lpRect=0xefe808) returned 1 [0081.395] GetWindowRect (in: hWnd=0x80030, lpRect=0xefe808 | out: lpRect=0xefe808) returned 1 [0081.427] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x80030, Msg=0x83, wParam=0x1, lParam=0xefe644) returned 0x0 [0081.429] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x80030, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0081.431] GetWindowPlacement (in: hWnd=0x80030, lpwndpl=0xefe3b4 | out: lpwndpl=0xefe3b4) returned 1 [0081.431] GetClientRect (in: hWnd=0x80030, lpRect=0xefe360 | out: lpRect=0xefe360) returned 1 [0081.431] GetWindowTextLengthW (hWnd=0x80030) returned 11 [0081.431] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x80030, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0081.431] GetSystemMetrics (nIndex=42) returned 0 [0081.431] GetWindowTextW (in: hWnd=0x80030, lpString=0xefe220, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0081.431] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x80030, Msg=0xd, wParam=0xc, lParam=0xefe220) returned 0xb [0081.431] GetClientRect (in: hWnd=0x80030, lpRect=0xefe268 | out: lpRect=0xefe268) returned 1 [0081.431] GetCurrentObject (hdc=0x10105d6, type=0x1) returned 0xb00017 [0081.431] GetCurrentObject (hdc=0x10105d6, type=0x2) returned 0x900010 [0081.431] GetCurrentObject (hdc=0x10105d6, type=0x7) returned 0x250507a7 [0081.432] GetCurrentObject (hdc=0x10105d6, type=0x6) returned 0x8a01c2 [0081.432] SaveDC (hdc=0x10105d6) returned 1 [0081.432] GetNearestColor (hdc=0x10105d6, color=0xf0f0f0) returned 0xf0f0f0 [0081.432] CreateSolidBrush (color=0xf0f0f0) returned 0x4d10065f [0081.432] FillRect (hDC=0x10105d6, lprc=0xefe108, hbr=0x4d10065f) returned 1 [0081.432] DeleteObject (ho=0x4d10065f) returned 1 [0081.432] RestoreDC (hdc=0x10105d6, nSavedDC=-1) returned 1 [0081.433] SetWindowLongW (hWnd=0x80030, nIndex=-8, dwNewLong=393356) returned 393356 [0081.435] SendMessageW (hWnd=0x6008c, Msg=0x80, wParam=0x1, lParam=0xb0089) returned 0x0 [0081.435] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6008c, Msg=0x80, wParam=0x1, lParam=0xb0089) returned 0x0 [0081.437] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0081.437] GetWindowLongW (hWnd=0x80030, nIndex=-16) returned 382664704 [0081.437] GetWindowTextLengthW (hWnd=0x80030) returned 11 [0081.437] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x80030, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0081.437] GetSystemMetrics (nIndex=42) returned 0 [0081.437] GetWindowTextW (in: hWnd=0x80030, lpString=0xefeb3c, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0081.437] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x80030, Msg=0xd, wParam=0xc, lParam=0xefeb3c) returned 0xb [0081.438] GetWindowTextLengthW (hWnd=0x80030) returned 11 [0081.438] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x80030, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0081.438] GetSystemMetrics (nIndex=42) returned 0 [0081.438] GetWindowTextW (in: hWnd=0x80030, lpString=0xefeb3c, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0081.438] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x80030, Msg=0xd, wParam=0xc, lParam=0xefeb3c) returned 0xb [0081.439] GetWindowLongW (hWnd=0x80030, nIndex=-16) returned 382664704 [0081.439] GetWindowLongW (hWnd=0x80030, nIndex=-20) returned 590208 [0081.439] SetWindowLongW (hWnd=0x80030, nIndex=-16, dwNewLong=315555840) returned 382664704 [0081.439] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x80030, Msg=0x7c, wParam=0xfffffff0, lParam=0xefebc4) returned 0x0 [0081.440] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x80030, Msg=0x7d, wParam=0xfffffff0, lParam=0xefebc4) returned 0x0 [0081.441] SetWindowLongW (hWnd=0x80030, nIndex=-20, dwNewLong=589952) returned 590208 [0081.441] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x80030, Msg=0x7c, wParam=0xffffffec, lParam=0xefebc4) returned 0x0 [0081.441] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x80030, Msg=0x7d, wParam=0xffffffec, lParam=0xefebc4) returned 0x0 [0081.442] SetWindowPos (hWnd=0x80030, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0081.442] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x80030, Msg=0x46, wParam=0x0, lParam=0xefebdc) returned 0x0 [0081.442] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x80030, Msg=0x83, wParam=0x1, lParam=0xefebb4) returned 0x0 [0081.444] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x80030, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0081.446] GetWindowPlacement (in: hWnd=0x80030, lpwndpl=0xefe924 | out: lpwndpl=0xefe924) returned 1 [0081.446] GetClientRect (in: hWnd=0x80030, lpRect=0xefe8d0 | out: lpRect=0xefe8d0) returned 1 [0081.446] GetWindowTextLengthW (hWnd=0x80030) returned 11 [0081.446] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x80030, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0081.446] GetSystemMetrics (nIndex=42) returned 0 [0081.446] GetWindowTextW (in: hWnd=0x80030, lpString=0xefe790, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0081.446] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x80030, Msg=0xd, wParam=0xc, lParam=0xefe790) returned 0xb [0081.446] GetClientRect (in: hWnd=0x80030, lpRect=0xefe7d8 | out: lpRect=0xefe7d8) returned 1 [0081.446] GetCurrentObject (hdc=0x60100ce, type=0x1) returned 0xb00017 [0081.446] GetCurrentObject (hdc=0x60100ce, type=0x2) returned 0x900010 [0081.446] GetCurrentObject (hdc=0x60100ce, type=0x7) returned 0x250507a7 [0081.446] GetCurrentObject (hdc=0x60100ce, type=0x6) returned 0x8a01c2 [0081.446] SaveDC (hdc=0x60100ce) returned 1 [0081.447] GetNearestColor (hdc=0x60100ce, color=0xf0f0f0) returned 0xf0f0f0 [0081.447] CreateSolidBrush (color=0xf0f0f0) returned 0x4e10065f [0081.447] FillRect (hDC=0x60100ce, lprc=0xefe678, hbr=0x4e10065f) returned 1 [0081.447] DeleteObject (ho=0x4e10065f) returned 1 [0081.447] RestoreDC (hdc=0x60100ce, nSavedDC=-1) returned 1 [0081.447] GetWindowPlacement (in: hWnd=0x80030, lpwndpl=0xefe908 | out: lpwndpl=0xefe908) returned 1 [0081.447] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x80030, Msg=0x47, wParam=0x0, lParam=0xefebdc) returned 0x0 [0081.448] GetClientRect (in: hWnd=0x80030, lpRect=0xefe8b8 | out: lpRect=0xefe8b8) returned 1 [0081.448] GetWindowRect (in: hWnd=0x80030, lpRect=0xefe8b8 | out: lpRect=0xefe8b8) returned 1 [0081.448] RedrawWindow (hWnd=0x80030, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0081.448] GetSystemMenu (hWnd=0x80030, bRevert=0) returned 0x1902a9 [0081.449] GetWindowPlacement (in: hWnd=0x80030, lpwndpl=0xefec10 | out: lpwndpl=0xefec10) returned 1 [0081.449] EnableMenuItem (hMenu=0x1902a9, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0081.449] EnableMenuItem (hMenu=0x1902a9, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0081.449] EnableMenuItem (hMenu=0x1902a9, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0081.449] EnableMenuItem (hMenu=0x1902a9, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0081.449] EnableMenuItem (hMenu=0x1902a9, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0081.449] SetWindowLongW (hWnd=0x302d0, nIndex=-8, dwNewLong=524336) returned 262380 [0082.013] GetFullPathNameW (in: lpFileName="C:\\FD1HVy\\UGMH", nBufferLength=0x105, lpBuffer=0xefe794, lpFilePart=0x0 | out: lpBuffer="C:\\FD1HVy\\UGMH", lpFilePart=0x0) returned 0xe [0082.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec44) returned 1 [0082.013] GetFileAttributesExW (in: lpFileName="C:\\FD1HVy\\UGMH" (normalized: "c:\\fd1hvy\\ugmh"), fInfoLevelId=0x0, lpFileInformation=0xefecc0 | out: lpFileInformation=0xefecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0082.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec40) returned 1 [0082.014] GetFullPathNameW (in: lpFileName="C:\\FD1HVy\\UGMH", nBufferLength=0x105, lpBuffer=0xefe79c, lpFilePart=0x0 | out: lpBuffer="C:\\FD1HVy\\UGMH", lpFilePart=0x0) returned 0xe [0082.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebd8) returned 1 [0082.014] GetFileAttributesExW (in: lpFileName="C:\\FD1HVy\\UGMH" (normalized: "c:\\fd1hvy\\ugmh"), fInfoLevelId=0x0, lpFileInformation=0xefec54 | out: lpFileInformation=0xefec54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0082.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebd4) returned 1 [0082.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebd8) returned 1 [0082.015] GetFileAttributesExW (in: lpFileName="C:\\FD1HVy\\UGMH" (normalized: "c:\\fd1hvy\\ugmh"), fInfoLevelId=0x0, lpFileInformation=0xefec54 | out: lpFileInformation=0xefec54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0082.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebd4) returned 1 [0082.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebd8) returned 1 [0082.015] GetFileAttributesExW (in: lpFileName="C:\\FD1HVy" (normalized: "c:\\fd1hvy"), fInfoLevelId=0x0, lpFileInformation=0xefec54 | out: lpFileInformation=0xefec54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0082.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebd4) returned 1 [0082.061] CreateDirectoryW (lpPathName="C:\\FD1HVy" (normalized: "c:\\fd1hvy"), lpSecurityAttributes=0x0) returned 1 [0082.063] CreateDirectoryW (lpPathName="C:\\FD1HVy\\UGMH" (normalized: "c:\\fd1hvy\\ugmh"), lpSecurityAttributes=0x0) returned 1 [0082.287] GetCurrentProcessId () returned 0x1120 [0082.298] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0xefe5cc | out: lpLuid=0xefe5cc*(LowPart=0x14, HighPart=0)) returned 1 [0082.301] GetCurrentProcess () returned 0xffffffff [0082.301] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0xefe5c8 | out: TokenHandle=0xefe5c8*=0x350) returned 1 [0082.302] AdjustTokenPrivileges (in: TokenHandle=0x350, DisableAllPrivileges=0, NewState=0x2e4d8dc*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0082.302] CloseHandle (hObject=0x350) returned 1 [0082.429] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3e31a48, Length=0x20000, ResultLength=0xefecb4 | out: SystemInformation=0x3e31a48, ResultLength=0xefecb4*=0x24d18) returned 0xc0000004 [0082.441] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3e51a68, Length=0x27518, ResultLength=0xefecb4 | out: SystemInformation=0x3e51a68, ResultLength=0xefecb4*=0x1ac78) returned 0x0 [0082.626] CoTaskMemAlloc (cb=0x20e) returned 0x1075b98 [0082.626] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x1075b98 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0082.626] CoTaskMemFree (pv=0x1075b98) [0082.639] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Salary.exe", nBufferLength=0x105, lpBuffer=0xefe7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Salary.exe", lpFilePart=0x0) returned 0x22 [0082.639] GetFullPathNameW (in: lpFileName="C:\\FD1HVy\\UGMH\\local.exe", nBufferLength=0x105, lpBuffer=0xefe7a8, lpFilePart=0x0 | out: lpBuffer="C:\\FD1HVy\\UGMH\\local.exe", lpFilePart=0x0) returned 0x18 [0082.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec5c) returned 1 [0082.639] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Salary.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\salary.exe"), fInfoLevelId=0x0, lpFileInformation=0xefecd8 | out: lpFileInformation=0xefecd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94ac1000, ftCreationTime.dwHighDateTime=0x1d68033, ftLastAccessTime.dwLowDateTime=0x94ac1000, ftLastAccessTime.dwHighDateTime=0x1d68033, ftLastWriteTime.dwLowDateTime=0xf750dc00, ftLastWriteTime.dwHighDateTime=0x1d68032, nFileSizeHigh=0x0, nFileSizeLow=0x35400)) returned 1 [0082.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec58) returned 1 [0082.640] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\Salary.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\salary.exe"), lpNewFileName="C:\\FD1HVy\\UGMH\\local.exe" (normalized: "c:\\fd1hvy\\ugmh\\local.exe")) returned 1 [0082.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec08) returned 1 [0082.841] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x105, lpBuffer=0xefe6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0082.842] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\*", lpFindFileData=0xefe930 | out: lpFindFileData=0xefe930*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa60cff27, ftLastAccessTime.dwHighDateTime=0x1d68033, ftLastWriteTime.dwLowDateTime=0xc75b2a75, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104dc70 [0082.843] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa60cff27, ftLastAccessTime.dwHighDateTime=0x1d68033, ftLastWriteTime.dwLowDateTime=0xc75b2a75, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.843] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x234ac530, ftCreationTime.dwHighDateTime=0x1d5e9db, ftLastAccessTime.dwLowDateTime=0xfa88cb10, ftLastAccessTime.dwHighDateTime=0x1d5ec2d, ftLastWriteTime.dwLowDateTime=0xfa88cb10, ftLastWriteTime.dwHighDateTime=0x1d5ec2d, nFileSizeHigh=0x0, nFileSizeLow=0x13317, dwReserved0=0x0, dwReserved1=0x0, cFileName="-hNL3OcngCIZAr219.avi", cAlternateFileName="-HNL3O~1.AVI")) returned 1 [0082.844] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8c04650, ftCreationTime.dwHighDateTime=0x1d5ef92, ftLastAccessTime.dwLowDateTime=0x85fef200, ftLastAccessTime.dwHighDateTime=0x1d5e1ac, ftLastWriteTime.dwLowDateTime=0x85fef200, ftLastWriteTime.dwHighDateTime=0x1d5e1ac, nFileSizeHigh=0x0, nFileSizeLow=0x1721b, dwReserved0=0x0, dwReserved1=0x0, cFileName="2giC_j.wav", cAlternateFileName="")) returned 1 [0082.844] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61881a30, ftCreationTime.dwHighDateTime=0x1d5f0a4, ftLastAccessTime.dwLowDateTime=0x14a50ca0, ftLastAccessTime.dwHighDateTime=0x1d5f018, ftLastWriteTime.dwLowDateTime=0x14a50ca0, ftLastWriteTime.dwHighDateTime=0x1d5f018, nFileSizeHigh=0x0, nFileSizeLow=0x27cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="3WQMoZqxtfxvMQK.mp4", cAlternateFileName="3WQMOZ~1.MP4")) returned 1 [0082.844] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4db09090, ftCreationTime.dwHighDateTime=0x1d5e812, ftLastAccessTime.dwLowDateTime=0xde395ab0, ftLastAccessTime.dwHighDateTime=0x1d5e4b2, ftLastWriteTime.dwLowDateTime=0xde395ab0, ftLastWriteTime.dwHighDateTime=0x1d5e4b2, nFileSizeHigh=0x0, nFileSizeLow=0xd47a, dwReserved0=0x0, dwReserved1=0x0, cFileName="66a_FviVPhsSRG.swf", cAlternateFileName="66A_FV~1.SWF")) returned 1 [0082.844] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x967f570, ftCreationTime.dwHighDateTime=0x1d5e3c8, ftLastAccessTime.dwLowDateTime=0x3f1b8e40, ftLastAccessTime.dwHighDateTime=0x1d5ef6a, ftLastWriteTime.dwLowDateTime=0x3f1b8e40, ftLastWriteTime.dwHighDateTime=0x1d5ef6a, nFileSizeHigh=0x0, nFileSizeLow=0xf25d, dwReserved0=0x0, dwReserved1=0x0, cFileName="6iCPTll49y.avi", cAlternateFileName="6ICPTL~1.AVI")) returned 1 [0082.844] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3b066c0, ftCreationTime.dwHighDateTime=0x1d5e706, ftLastAccessTime.dwLowDateTime=0x537f6170, ftLastAccessTime.dwHighDateTime=0x1d5e729, ftLastWriteTime.dwLowDateTime=0x537f6170, ftLastWriteTime.dwHighDateTime=0x1d5e729, nFileSizeHigh=0x0, nFileSizeLow=0x16e35, dwReserved0=0x0, dwReserved1=0x0, cFileName="8QmOZ6BwfJ6Z.flv", cAlternateFileName="8QMOZ6~1.FLV")) returned 1 [0082.845] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0082.845] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e658460, ftCreationTime.dwHighDateTime=0x1d5ee0e, ftLastAccessTime.dwLowDateTime=0x319057b0, ftLastAccessTime.dwHighDateTime=0x1d5e754, ftLastWriteTime.dwLowDateTime=0x319057b0, ftLastWriteTime.dwHighDateTime=0x1d5e754, nFileSizeHigh=0x0, nFileSizeLow=0x16ac9, dwReserved0=0x0, dwReserved1=0x0, cFileName="DPDskqIc2.mkv", cAlternateFileName="DPDSKQ~1.MKV")) returned 1 [0082.845] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcecad450, ftCreationTime.dwHighDateTime=0x1d5ece6, ftLastAccessTime.dwLowDateTime=0x61823020, ftLastAccessTime.dwHighDateTime=0x1d5eba9, ftLastWriteTime.dwLowDateTime=0x61823020, ftLastWriteTime.dwHighDateTime=0x1d5eba9, nFileSizeHigh=0x0, nFileSizeLow=0x1106, dwReserved0=0x0, dwReserved1=0x0, cFileName="eA-CcPkssw4kHgXe.bmp", cAlternateFileName="EA-CCP~1.BMP")) returned 1 [0082.845] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b59a0e0, ftCreationTime.dwHighDateTime=0x1d5e30c, ftLastAccessTime.dwLowDateTime=0x8378c5f0, ftLastAccessTime.dwHighDateTime=0x1d5e365, ftLastWriteTime.dwLowDateTime=0x8378c5f0, ftLastWriteTime.dwHighDateTime=0x1d5e365, nFileSizeHigh=0x0, nFileSizeLow=0x9dc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eAGGa29zIdAHHTYD9.xlsx", cAlternateFileName="EAGGA2~1.XLS")) returned 1 [0082.845] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35a198d0, ftCreationTime.dwHighDateTime=0x1d5e715, ftLastAccessTime.dwLowDateTime=0xcac26da0, ftLastAccessTime.dwHighDateTime=0x1d5e5a2, ftLastWriteTime.dwLowDateTime=0xcac26da0, ftLastWriteTime.dwHighDateTime=0x1d5e5a2, nFileSizeHigh=0x0, nFileSizeLow=0x5e95, dwReserved0=0x0, dwReserved1=0x0, cFileName="EJOJDrrWOuUMEJw.m4a", cAlternateFileName="EJOJDR~1.M4A")) returned 1 [0082.845] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83716aa0, ftCreationTime.dwHighDateTime=0x1d5e791, ftLastAccessTime.dwLowDateTime=0xb33ea890, ftLastAccessTime.dwHighDateTime=0x1d5ef5e, ftLastWriteTime.dwLowDateTime=0xb33ea890, ftLastWriteTime.dwHighDateTime=0x1d5ef5e, nFileSizeHigh=0x0, nFileSizeLow=0xc522, dwReserved0=0x0, dwReserved1=0x0, cFileName="E_cmfpG.mp3", cAlternateFileName="")) returned 1 [0082.845] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6062f570, ftCreationTime.dwHighDateTime=0x1d5e5bf, ftLastAccessTime.dwLowDateTime=0x6e4d0c80, ftLastAccessTime.dwHighDateTime=0x1d5e41f, ftLastWriteTime.dwLowDateTime=0x6e4d0c80, ftLastWriteTime.dwHighDateTime=0x1d5e41f, nFileSizeHigh=0x0, nFileSizeLow=0x3235, dwReserved0=0x0, dwReserved1=0x0, cFileName="GcUvkFGPjBDuY6Da.m4a", cAlternateFileName="GCUVKF~1.M4A")) returned 1 [0082.846] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdf9a4c0, ftCreationTime.dwHighDateTime=0x1d5eb3d, ftLastAccessTime.dwLowDateTime=0x3492b6a0, ftLastAccessTime.dwHighDateTime=0x1d5ed04, ftLastWriteTime.dwLowDateTime=0x3492b6a0, ftLastWriteTime.dwHighDateTime=0x1d5ed04, nFileSizeHigh=0x0, nFileSizeLow=0xc634, dwReserved0=0x0, dwReserved1=0x0, cFileName="geNLXx1UJHj5cvhn.mp4", cAlternateFileName="GENLXX~1.MP4")) returned 1 [0082.846] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec7fbe00, ftCreationTime.dwHighDateTime=0x1d5ec93, ftLastAccessTime.dwLowDateTime=0xb3a443c0, ftLastAccessTime.dwHighDateTime=0x1d5ed93, ftLastWriteTime.dwLowDateTime=0xb3a443c0, ftLastWriteTime.dwHighDateTime=0x1d5ed93, nFileSizeHigh=0x0, nFileSizeLow=0x13392, dwReserved0=0x0, dwReserved1=0x0, cFileName="gwqVZvHz5I_z_.m4a", cAlternateFileName="GWQVZV~1.M4A")) returned 1 [0082.846] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x970d56b0, ftCreationTime.dwHighDateTime=0x1d5e9d4, ftLastAccessTime.dwLowDateTime=0xe1ec8d50, ftLastAccessTime.dwHighDateTime=0x1d5ea05, ftLastWriteTime.dwLowDateTime=0xe1ec8d50, ftLastWriteTime.dwHighDateTime=0x1d5ea05, nFileSizeHigh=0x0, nFileSizeLow=0x140be, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieRIe2k_x6kM51eV.pps", cAlternateFileName="IERIE2~1.PPS")) returned 1 [0082.846] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x246c8560, ftCreationTime.dwHighDateTime=0x1d5e176, ftLastAccessTime.dwLowDateTime=0xf9bca810, ftLastAccessTime.dwHighDateTime=0x1d5eb96, ftLastWriteTime.dwLowDateTime=0xf9bca810, ftLastWriteTime.dwHighDateTime=0x1d5eb96, nFileSizeHigh=0x0, nFileSizeLow=0x10edb, dwReserved0=0x0, dwReserved1=0x0, cFileName="IKlpA0NfijVXH.png", cAlternateFileName="IKLPA0~1.PNG")) returned 1 [0082.846] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29b98d20, ftCreationTime.dwHighDateTime=0x1d5edb4, ftLastAccessTime.dwLowDateTime=0xbcc63b30, ftLastAccessTime.dwHighDateTime=0x1d5e10d, ftLastWriteTime.dwLowDateTime=0xbcc63b30, ftLastWriteTime.dwHighDateTime=0x1d5e10d, nFileSizeHigh=0x0, nFileSizeLow=0x13eb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITcW0ZQZpCR4cr.m4a", cAlternateFileName="ITCW0Z~1.M4A")) returned 1 [0082.846] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4859fc00, ftCreationTime.dwHighDateTime=0x1d5e0ef, ftLastAccessTime.dwLowDateTime=0x3155e710, ftLastAccessTime.dwHighDateTime=0x1d5ed44, ftLastWriteTime.dwLowDateTime=0x3155e710, ftLastWriteTime.dwHighDateTime=0x1d5ed44, nFileSizeHigh=0x0, nFileSizeLow=0x6e55, dwReserved0=0x0, dwReserved1=0x0, cFileName="IUfRKqu81Ri.mp3", cAlternateFileName="IUFRKQ~1.MP3")) returned 1 [0082.846] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d0d99b0, ftCreationTime.dwHighDateTime=0x1d5f0c6, ftLastAccessTime.dwLowDateTime=0x98c8c640, ftLastAccessTime.dwHighDateTime=0x1d5ea6c, ftLastWriteTime.dwLowDateTime=0x98c8c640, ftLastWriteTime.dwHighDateTime=0x1d5ea6c, nFileSizeHigh=0x0, nFileSizeLow=0x13f07, dwReserved0=0x0, dwReserved1=0x0, cFileName="kDNWA.avi", cAlternateFileName="")) returned 1 [0082.847] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f568d70, ftCreationTime.dwHighDateTime=0x1d5e8ff, ftLastAccessTime.dwLowDateTime=0x137d8aa0, ftLastAccessTime.dwHighDateTime=0x1d5e9d8, ftLastWriteTime.dwLowDateTime=0x137d8aa0, ftLastWriteTime.dwHighDateTime=0x1d5e9d8, nFileSizeHigh=0x0, nFileSizeLow=0x126e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="kO2D0WzDoiPh0Aq.swf", cAlternateFileName="KO2D0W~1.SWF")) returned 1 [0082.847] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb00f0640, ftCreationTime.dwHighDateTime=0x1d5e6c8, ftLastAccessTime.dwLowDateTime=0x2052d350, ftLastAccessTime.dwHighDateTime=0x1d5eaca, ftLastWriteTime.dwLowDateTime=0x2052d350, ftLastWriteTime.dwHighDateTime=0x1d5eaca, nFileSizeHigh=0x0, nFileSizeLow=0xdd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="kpKG IbF.mp3", cAlternateFileName="KPKGIB~1.MP3")) returned 1 [0082.847] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c996af0, ftCreationTime.dwHighDateTime=0x1d5eeb9, ftLastAccessTime.dwLowDateTime=0x686e5dc0, ftLastAccessTime.dwHighDateTime=0x1d5ec06, ftLastWriteTime.dwLowDateTime=0x686e5dc0, ftLastWriteTime.dwHighDateTime=0x1d5ec06, nFileSizeHigh=0x0, nFileSizeLow=0xd2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lcz8MH.wav", cAlternateFileName="")) returned 1 [0082.847] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f10bb30, ftCreationTime.dwHighDateTime=0x1d5edf0, ftLastAccessTime.dwLowDateTime=0x97da86d0, ftLastAccessTime.dwHighDateTime=0x1d5f0dc, ftLastWriteTime.dwLowDateTime=0x97da86d0, ftLastWriteTime.dwHighDateTime=0x1d5f0dc, nFileSizeHigh=0x0, nFileSizeLow=0xd75f, dwReserved0=0x0, dwReserved1=0x0, cFileName="n67Tv9.mp3", cAlternateFileName="")) returned 1 [0082.847] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54bb0290, ftCreationTime.dwHighDateTime=0x1d5ecb7, ftLastAccessTime.dwLowDateTime=0x493fcd40, ftLastAccessTime.dwHighDateTime=0x1d5edd6, ftLastWriteTime.dwLowDateTime=0x493fcd40, ftLastWriteTime.dwHighDateTime=0x1d5edd6, nFileSizeHigh=0x0, nFileSizeLow=0x330b, dwReserved0=0x0, dwReserved1=0x0, cFileName="nEUOkP9.mp4", cAlternateFileName="")) returned 1 [0082.847] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87b82b40, ftCreationTime.dwHighDateTime=0x1d5e600, ftLastAccessTime.dwLowDateTime=0x67493ed0, ftLastAccessTime.dwHighDateTime=0x1d5ef60, ftLastWriteTime.dwLowDateTime=0x67493ed0, ftLastWriteTime.dwHighDateTime=0x1d5ef60, nFileSizeHigh=0x0, nFileSizeLow=0x4af2, dwReserved0=0x0, dwReserved1=0x0, cFileName="NmC1S11.png", cAlternateFileName="")) returned 1 [0082.848] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a5a30, ftCreationTime.dwHighDateTime=0x1d5e90a, ftLastAccessTime.dwLowDateTime=0x17978470, ftLastAccessTime.dwHighDateTime=0x1d5ecb1, ftLastWriteTime.dwLowDateTime=0x17978470, ftLastWriteTime.dwHighDateTime=0x1d5ecb1, nFileSizeHigh=0x0, nFileSizeLow=0x1303d, dwReserved0=0x0, dwReserved1=0x0, cFileName="NsB5NpMvHsgPQiue-.png", cAlternateFileName="NSB5NP~1.PNG")) returned 1 [0082.848] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x460533d0, ftCreationTime.dwHighDateTime=0x1d5e7c4, ftLastAccessTime.dwLowDateTime=0xea127280, ftLastAccessTime.dwHighDateTime=0x1d5f0fc, ftLastWriteTime.dwLowDateTime=0xea127280, ftLastWriteTime.dwHighDateTime=0x1d5f0fc, nFileSizeHigh=0x0, nFileSizeLow=0x1141, dwReserved0=0x0, dwReserved1=0x0, cFileName="NvL60GwqP.ppt", cAlternateFileName="NVL60G~1.PPT")) returned 1 [0082.848] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd83c1fe0, ftCreationTime.dwHighDateTime=0x1d5e524, ftLastAccessTime.dwLowDateTime=0x28872fe0, ftLastAccessTime.dwHighDateTime=0x1d5e2f9, ftLastWriteTime.dwLowDateTime=0x28872fe0, ftLastWriteTime.dwHighDateTime=0x1d5e2f9, nFileSizeHigh=0x0, nFileSizeLow=0x631c, dwReserved0=0x0, dwReserved1=0x0, cFileName="tEL KEKy5u2J3QD3I7.bmp", cAlternateFileName="TELKEK~1.BMP")) returned 1 [0082.848] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85edca0, ftCreationTime.dwHighDateTime=0x1d5e989, ftLastAccessTime.dwLowDateTime=0xd5852e90, ftLastAccessTime.dwHighDateTime=0x1d5ee2a, ftLastWriteTime.dwLowDateTime=0xd5852e90, ftLastWriteTime.dwHighDateTime=0x1d5ee2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uJvn1eNK", cAlternateFileName="")) returned 1 [0082.848] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x715bfa20, ftCreationTime.dwHighDateTime=0x1d5e9c5, ftLastAccessTime.dwLowDateTime=0x49469ec0, ftLastAccessTime.dwHighDateTime=0x1d5e86a, ftLastWriteTime.dwLowDateTime=0x49469ec0, ftLastWriteTime.dwHighDateTime=0x1d5e86a, nFileSizeHigh=0x0, nFileSizeLow=0x6c07, dwReserved0=0x0, dwReserved1=0x0, cFileName="ux3rT5FNwZkNBWR.bmp", cAlternateFileName="UX3RT5~1.BMP")) returned 1 [0082.848] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe178cf10, ftCreationTime.dwHighDateTime=0x1d5ebd5, ftLastAccessTime.dwLowDateTime=0x3ce81850, ftLastAccessTime.dwHighDateTime=0x1d5e91b, ftLastWriteTime.dwLowDateTime=0x3ce81850, ftLastWriteTime.dwHighDateTime=0x1d5e91b, nFileSizeHigh=0x0, nFileSizeLow=0x10abc, dwReserved0=0x0, dwReserved1=0x0, cFileName="V89ICi2G.pdf", cAlternateFileName="")) returned 1 [0082.848] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a653a0, ftCreationTime.dwHighDateTime=0x1d5e142, ftLastAccessTime.dwLowDateTime=0x505d7360, ftLastAccessTime.dwHighDateTime=0x1d5e5e9, ftLastWriteTime.dwLowDateTime=0x505d7360, ftLastWriteTime.dwHighDateTime=0x1d5e5e9, nFileSizeHigh=0x0, nFileSizeLow=0xaed1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vaxq5.gif", cAlternateFileName="")) returned 1 [0082.849] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x486880d0, ftCreationTime.dwHighDateTime=0x1d5f0db, ftLastAccessTime.dwLowDateTime=0x35546b70, ftLastAccessTime.dwHighDateTime=0x1d5eb00, ftLastWriteTime.dwLowDateTime=0x35546b70, ftLastWriteTime.dwHighDateTime=0x1d5eb00, nFileSizeHigh=0x0, nFileSizeLow=0x7991, dwReserved0=0x0, dwReserved1=0x0, cFileName="vzq8yByGgLRh.mkv", cAlternateFileName="VZQ8YB~1.MKV")) returned 1 [0082.849] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd634fdd0, ftCreationTime.dwHighDateTime=0x1d5eacd, ftLastAccessTime.dwLowDateTime=0xe05ca060, ftLastAccessTime.dwHighDateTime=0x1d5ede8, ftLastWriteTime.dwLowDateTime=0xe05ca060, ftLastWriteTime.dwHighDateTime=0x1d5ede8, nFileSizeHigh=0x0, nFileSizeLow=0x10190, dwReserved0=0x0, dwReserved1=0x0, cFileName="w-tMU4AmH_pKak.png", cAlternateFileName="W-TMU4~1.PNG")) returned 1 [0082.849] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2272e0, ftCreationTime.dwHighDateTime=0x1d5e57b, ftLastAccessTime.dwLowDateTime=0x75458d50, ftLastAccessTime.dwHighDateTime=0x1d5e0e6, ftLastWriteTime.dwLowDateTime=0x75458d50, ftLastWriteTime.dwHighDateTime=0x1d5e0e6, nFileSizeHigh=0x0, nFileSizeLow=0x2d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="XbMXvFNLh2Gmyt iVhk.gif", cAlternateFileName="XBMXVF~1.GIF")) returned 1 [0082.849] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb53e15a0, ftCreationTime.dwHighDateTime=0x1d5e909, ftLastAccessTime.dwLowDateTime=0xdce4fbc0, ftLastAccessTime.dwHighDateTime=0x1d5e556, ftLastWriteTime.dwLowDateTime=0xdce4fbc0, ftLastWriteTime.dwHighDateTime=0x1d5e556, nFileSizeHigh=0x0, nFileSizeLow=0x1467b, dwReserved0=0x0, dwReserved1=0x0, cFileName="XduHjTYUvMSMI6_qg.bmp", cAlternateFileName="XDUHJT~1.BMP")) returned 1 [0082.849] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43720150, ftCreationTime.dwHighDateTime=0x1d5eb9f, ftLastAccessTime.dwLowDateTime=0xd67bc5e0, ftLastAccessTime.dwHighDateTime=0x1d5e55e, ftLastWriteTime.dwLowDateTime=0xd67bc5e0, ftLastWriteTime.dwHighDateTime=0x1d5e55e, nFileSizeHigh=0x0, nFileSizeLow=0xdb55, dwReserved0=0x0, dwReserved1=0x0, cFileName="xkHvjMU.bmp", cAlternateFileName="")) returned 1 [0082.849] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x925d8340, ftCreationTime.dwHighDateTime=0x1d5ef03, ftLastAccessTime.dwLowDateTime=0x41db40, ftLastAccessTime.dwHighDateTime=0x1d5e298, ftLastWriteTime.dwLowDateTime=0x41db40, ftLastWriteTime.dwHighDateTime=0x1d5e298, nFileSizeHigh=0x0, nFileSizeLow=0x170d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="xW3hq1GBEdp.flv", cAlternateFileName="XW3HQ1~1.FLV")) returned 1 [0082.849] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92e813b0, ftCreationTime.dwHighDateTime=0x1d5eb58, ftLastAccessTime.dwLowDateTime=0x78110b50, ftLastAccessTime.dwHighDateTime=0x1d5edc9, ftLastWriteTime.dwLowDateTime=0x78110b50, ftLastWriteTime.dwHighDateTime=0x1d5edc9, nFileSizeHigh=0x0, nFileSizeLow=0x5a35, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZimQCQi8Z.gif", cAlternateFileName="ZIMQCQ~1.GIF")) returned 1 [0082.850] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37432900, ftCreationTime.dwHighDateTime=0x1d5e8c4, ftLastAccessTime.dwLowDateTime=0x908c1400, ftLastAccessTime.dwHighDateTime=0x1d5e120, ftLastWriteTime.dwLowDateTime=0x908c1400, ftLastWriteTime.dwHighDateTime=0x1d5e120, nFileSizeHigh=0x0, nFileSizeLow=0x5c29, dwReserved0=0x0, dwReserved1=0x0, cFileName="_T kudUg.m4a", cAlternateFileName="_TKUDU~1.M4A")) returned 1 [0082.850] FindNextFileW (in: hFindFile=0x104dc70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0082.850] FindClose (in: hFindFile=0x104dc70 | out: hFindFile=0x104dc70) returned 1 [0082.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebc4) returned 1 [0082.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebd0) returned 1 [0082.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec08) returned 1 [0082.850] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x105, lpBuffer=0xefe6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0082.850] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\*", lpFindFileData=0xefe930 | out: lpFindFileData=0xefe930*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc75b2a75, ftLastAccessTime.dwHighDateTime=0x1d68033, ftLastWriteTime.dwLowDateTime=0xc75b2a75, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104d9f0 [0082.851] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc75b2a75, ftLastAccessTime.dwHighDateTime=0x1d68033, ftLastWriteTime.dwLowDateTime=0xc75b2a75, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.851] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x234ac530, ftCreationTime.dwHighDateTime=0x1d5e9db, ftLastAccessTime.dwLowDateTime=0xfa88cb10, ftLastAccessTime.dwHighDateTime=0x1d5ec2d, ftLastWriteTime.dwLowDateTime=0xfa88cb10, ftLastWriteTime.dwHighDateTime=0x1d5ec2d, nFileSizeHigh=0x0, nFileSizeLow=0x13317, dwReserved0=0x0, dwReserved1=0x0, cFileName="-hNL3OcngCIZAr219.avi", cAlternateFileName="-HNL3O~1.AVI")) returned 1 [0082.851] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8c04650, ftCreationTime.dwHighDateTime=0x1d5ef92, ftLastAccessTime.dwLowDateTime=0x85fef200, ftLastAccessTime.dwHighDateTime=0x1d5e1ac, ftLastWriteTime.dwLowDateTime=0x85fef200, ftLastWriteTime.dwHighDateTime=0x1d5e1ac, nFileSizeHigh=0x0, nFileSizeLow=0x1721b, dwReserved0=0x0, dwReserved1=0x0, cFileName="2giC_j.wav", cAlternateFileName="")) returned 1 [0082.852] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61881a30, ftCreationTime.dwHighDateTime=0x1d5f0a4, ftLastAccessTime.dwLowDateTime=0x14a50ca0, ftLastAccessTime.dwHighDateTime=0x1d5f018, ftLastWriteTime.dwLowDateTime=0x14a50ca0, ftLastWriteTime.dwHighDateTime=0x1d5f018, nFileSizeHigh=0x0, nFileSizeLow=0x27cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="3WQMoZqxtfxvMQK.mp4", cAlternateFileName="3WQMOZ~1.MP4")) returned 1 [0082.852] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4db09090, ftCreationTime.dwHighDateTime=0x1d5e812, ftLastAccessTime.dwLowDateTime=0xde395ab0, ftLastAccessTime.dwHighDateTime=0x1d5e4b2, ftLastWriteTime.dwLowDateTime=0xde395ab0, ftLastWriteTime.dwHighDateTime=0x1d5e4b2, nFileSizeHigh=0x0, nFileSizeLow=0xd47a, dwReserved0=0x0, dwReserved1=0x0, cFileName="66a_FviVPhsSRG.swf", cAlternateFileName="66A_FV~1.SWF")) returned 1 [0082.852] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x967f570, ftCreationTime.dwHighDateTime=0x1d5e3c8, ftLastAccessTime.dwLowDateTime=0x3f1b8e40, ftLastAccessTime.dwHighDateTime=0x1d5ef6a, ftLastWriteTime.dwLowDateTime=0x3f1b8e40, ftLastWriteTime.dwHighDateTime=0x1d5ef6a, nFileSizeHigh=0x0, nFileSizeLow=0xf25d, dwReserved0=0x0, dwReserved1=0x0, cFileName="6iCPTll49y.avi", cAlternateFileName="6ICPTL~1.AVI")) returned 1 [0082.852] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3b066c0, ftCreationTime.dwHighDateTime=0x1d5e706, ftLastAccessTime.dwLowDateTime=0x537f6170, ftLastAccessTime.dwHighDateTime=0x1d5e729, ftLastWriteTime.dwLowDateTime=0x537f6170, ftLastWriteTime.dwHighDateTime=0x1d5e729, nFileSizeHigh=0x0, nFileSizeLow=0x16e35, dwReserved0=0x0, dwReserved1=0x0, cFileName="8QmOZ6BwfJ6Z.flv", cAlternateFileName="8QMOZ6~1.FLV")) returned 1 [0082.852] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0082.852] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e658460, ftCreationTime.dwHighDateTime=0x1d5ee0e, ftLastAccessTime.dwLowDateTime=0x319057b0, ftLastAccessTime.dwHighDateTime=0x1d5e754, ftLastWriteTime.dwLowDateTime=0x319057b0, ftLastWriteTime.dwHighDateTime=0x1d5e754, nFileSizeHigh=0x0, nFileSizeLow=0x16ac9, dwReserved0=0x0, dwReserved1=0x0, cFileName="DPDskqIc2.mkv", cAlternateFileName="DPDSKQ~1.MKV")) returned 1 [0082.853] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcecad450, ftCreationTime.dwHighDateTime=0x1d5ece6, ftLastAccessTime.dwLowDateTime=0x61823020, ftLastAccessTime.dwHighDateTime=0x1d5eba9, ftLastWriteTime.dwLowDateTime=0x61823020, ftLastWriteTime.dwHighDateTime=0x1d5eba9, nFileSizeHigh=0x0, nFileSizeLow=0x1106, dwReserved0=0x0, dwReserved1=0x0, cFileName="eA-CcPkssw4kHgXe.bmp", cAlternateFileName="EA-CCP~1.BMP")) returned 1 [0082.853] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b59a0e0, ftCreationTime.dwHighDateTime=0x1d5e30c, ftLastAccessTime.dwLowDateTime=0x8378c5f0, ftLastAccessTime.dwHighDateTime=0x1d5e365, ftLastWriteTime.dwLowDateTime=0x8378c5f0, ftLastWriteTime.dwHighDateTime=0x1d5e365, nFileSizeHigh=0x0, nFileSizeLow=0x9dc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eAGGa29zIdAHHTYD9.xlsx", cAlternateFileName="EAGGA2~1.XLS")) returned 1 [0082.853] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35a198d0, ftCreationTime.dwHighDateTime=0x1d5e715, ftLastAccessTime.dwLowDateTime=0xcac26da0, ftLastAccessTime.dwHighDateTime=0x1d5e5a2, ftLastWriteTime.dwLowDateTime=0xcac26da0, ftLastWriteTime.dwHighDateTime=0x1d5e5a2, nFileSizeHigh=0x0, nFileSizeLow=0x5e95, dwReserved0=0x0, dwReserved1=0x0, cFileName="EJOJDrrWOuUMEJw.m4a", cAlternateFileName="EJOJDR~1.M4A")) returned 1 [0082.853] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83716aa0, ftCreationTime.dwHighDateTime=0x1d5e791, ftLastAccessTime.dwLowDateTime=0xb33ea890, ftLastAccessTime.dwHighDateTime=0x1d5ef5e, ftLastWriteTime.dwLowDateTime=0xb33ea890, ftLastWriteTime.dwHighDateTime=0x1d5ef5e, nFileSizeHigh=0x0, nFileSizeLow=0xc522, dwReserved0=0x0, dwReserved1=0x0, cFileName="E_cmfpG.mp3", cAlternateFileName="")) returned 1 [0082.853] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6062f570, ftCreationTime.dwHighDateTime=0x1d5e5bf, ftLastAccessTime.dwLowDateTime=0x6e4d0c80, ftLastAccessTime.dwHighDateTime=0x1d5e41f, ftLastWriteTime.dwLowDateTime=0x6e4d0c80, ftLastWriteTime.dwHighDateTime=0x1d5e41f, nFileSizeHigh=0x0, nFileSizeLow=0x3235, dwReserved0=0x0, dwReserved1=0x0, cFileName="GcUvkFGPjBDuY6Da.m4a", cAlternateFileName="GCUVKF~1.M4A")) returned 1 [0082.854] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdf9a4c0, ftCreationTime.dwHighDateTime=0x1d5eb3d, ftLastAccessTime.dwLowDateTime=0x3492b6a0, ftLastAccessTime.dwHighDateTime=0x1d5ed04, ftLastWriteTime.dwLowDateTime=0x3492b6a0, ftLastWriteTime.dwHighDateTime=0x1d5ed04, nFileSizeHigh=0x0, nFileSizeLow=0xc634, dwReserved0=0x0, dwReserved1=0x0, cFileName="geNLXx1UJHj5cvhn.mp4", cAlternateFileName="GENLXX~1.MP4")) returned 1 [0082.854] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec7fbe00, ftCreationTime.dwHighDateTime=0x1d5ec93, ftLastAccessTime.dwLowDateTime=0xb3a443c0, ftLastAccessTime.dwHighDateTime=0x1d5ed93, ftLastWriteTime.dwLowDateTime=0xb3a443c0, ftLastWriteTime.dwHighDateTime=0x1d5ed93, nFileSizeHigh=0x0, nFileSizeLow=0x13392, dwReserved0=0x0, dwReserved1=0x0, cFileName="gwqVZvHz5I_z_.m4a", cAlternateFileName="GWQVZV~1.M4A")) returned 1 [0082.854] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x970d56b0, ftCreationTime.dwHighDateTime=0x1d5e9d4, ftLastAccessTime.dwLowDateTime=0xe1ec8d50, ftLastAccessTime.dwHighDateTime=0x1d5ea05, ftLastWriteTime.dwLowDateTime=0xe1ec8d50, ftLastWriteTime.dwHighDateTime=0x1d5ea05, nFileSizeHigh=0x0, nFileSizeLow=0x140be, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieRIe2k_x6kM51eV.pps", cAlternateFileName="IERIE2~1.PPS")) returned 1 [0082.854] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x246c8560, ftCreationTime.dwHighDateTime=0x1d5e176, ftLastAccessTime.dwLowDateTime=0xf9bca810, ftLastAccessTime.dwHighDateTime=0x1d5eb96, ftLastWriteTime.dwLowDateTime=0xf9bca810, ftLastWriteTime.dwHighDateTime=0x1d5eb96, nFileSizeHigh=0x0, nFileSizeLow=0x10edb, dwReserved0=0x0, dwReserved1=0x0, cFileName="IKlpA0NfijVXH.png", cAlternateFileName="IKLPA0~1.PNG")) returned 1 [0082.854] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29b98d20, ftCreationTime.dwHighDateTime=0x1d5edb4, ftLastAccessTime.dwLowDateTime=0xbcc63b30, ftLastAccessTime.dwHighDateTime=0x1d5e10d, ftLastWriteTime.dwLowDateTime=0xbcc63b30, ftLastWriteTime.dwHighDateTime=0x1d5e10d, nFileSizeHigh=0x0, nFileSizeLow=0x13eb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITcW0ZQZpCR4cr.m4a", cAlternateFileName="ITCW0Z~1.M4A")) returned 1 [0082.854] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4859fc00, ftCreationTime.dwHighDateTime=0x1d5e0ef, ftLastAccessTime.dwLowDateTime=0x3155e710, ftLastAccessTime.dwHighDateTime=0x1d5ed44, ftLastWriteTime.dwLowDateTime=0x3155e710, ftLastWriteTime.dwHighDateTime=0x1d5ed44, nFileSizeHigh=0x0, nFileSizeLow=0x6e55, dwReserved0=0x0, dwReserved1=0x0, cFileName="IUfRKqu81Ri.mp3", cAlternateFileName="IUFRKQ~1.MP3")) returned 1 [0082.855] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d0d99b0, ftCreationTime.dwHighDateTime=0x1d5f0c6, ftLastAccessTime.dwLowDateTime=0x98c8c640, ftLastAccessTime.dwHighDateTime=0x1d5ea6c, ftLastWriteTime.dwLowDateTime=0x98c8c640, ftLastWriteTime.dwHighDateTime=0x1d5ea6c, nFileSizeHigh=0x0, nFileSizeLow=0x13f07, dwReserved0=0x0, dwReserved1=0x0, cFileName="kDNWA.avi", cAlternateFileName="")) returned 1 [0082.855] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f568d70, ftCreationTime.dwHighDateTime=0x1d5e8ff, ftLastAccessTime.dwLowDateTime=0x137d8aa0, ftLastAccessTime.dwHighDateTime=0x1d5e9d8, ftLastWriteTime.dwLowDateTime=0x137d8aa0, ftLastWriteTime.dwHighDateTime=0x1d5e9d8, nFileSizeHigh=0x0, nFileSizeLow=0x126e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="kO2D0WzDoiPh0Aq.swf", cAlternateFileName="KO2D0W~1.SWF")) returned 1 [0082.855] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb00f0640, ftCreationTime.dwHighDateTime=0x1d5e6c8, ftLastAccessTime.dwLowDateTime=0x2052d350, ftLastAccessTime.dwHighDateTime=0x1d5eaca, ftLastWriteTime.dwLowDateTime=0x2052d350, ftLastWriteTime.dwHighDateTime=0x1d5eaca, nFileSizeHigh=0x0, nFileSizeLow=0xdd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="kpKG IbF.mp3", cAlternateFileName="KPKGIB~1.MP3")) returned 1 [0082.855] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c996af0, ftCreationTime.dwHighDateTime=0x1d5eeb9, ftLastAccessTime.dwLowDateTime=0x686e5dc0, ftLastAccessTime.dwHighDateTime=0x1d5ec06, ftLastWriteTime.dwLowDateTime=0x686e5dc0, ftLastWriteTime.dwHighDateTime=0x1d5ec06, nFileSizeHigh=0x0, nFileSizeLow=0xd2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lcz8MH.wav", cAlternateFileName="")) returned 1 [0082.855] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f10bb30, ftCreationTime.dwHighDateTime=0x1d5edf0, ftLastAccessTime.dwLowDateTime=0x97da86d0, ftLastAccessTime.dwHighDateTime=0x1d5f0dc, ftLastWriteTime.dwLowDateTime=0x97da86d0, ftLastWriteTime.dwHighDateTime=0x1d5f0dc, nFileSizeHigh=0x0, nFileSizeLow=0xd75f, dwReserved0=0x0, dwReserved1=0x0, cFileName="n67Tv9.mp3", cAlternateFileName="")) returned 1 [0082.856] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54bb0290, ftCreationTime.dwHighDateTime=0x1d5ecb7, ftLastAccessTime.dwLowDateTime=0x493fcd40, ftLastAccessTime.dwHighDateTime=0x1d5edd6, ftLastWriteTime.dwLowDateTime=0x493fcd40, ftLastWriteTime.dwHighDateTime=0x1d5edd6, nFileSizeHigh=0x0, nFileSizeLow=0x330b, dwReserved0=0x0, dwReserved1=0x0, cFileName="nEUOkP9.mp4", cAlternateFileName="")) returned 1 [0082.856] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87b82b40, ftCreationTime.dwHighDateTime=0x1d5e600, ftLastAccessTime.dwLowDateTime=0x67493ed0, ftLastAccessTime.dwHighDateTime=0x1d5ef60, ftLastWriteTime.dwLowDateTime=0x67493ed0, ftLastWriteTime.dwHighDateTime=0x1d5ef60, nFileSizeHigh=0x0, nFileSizeLow=0x4af2, dwReserved0=0x0, dwReserved1=0x0, cFileName="NmC1S11.png", cAlternateFileName="")) returned 1 [0082.856] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a5a30, ftCreationTime.dwHighDateTime=0x1d5e90a, ftLastAccessTime.dwLowDateTime=0x17978470, ftLastAccessTime.dwHighDateTime=0x1d5ecb1, ftLastWriteTime.dwLowDateTime=0x17978470, ftLastWriteTime.dwHighDateTime=0x1d5ecb1, nFileSizeHigh=0x0, nFileSizeLow=0x1303d, dwReserved0=0x0, dwReserved1=0x0, cFileName="NsB5NpMvHsgPQiue-.png", cAlternateFileName="NSB5NP~1.PNG")) returned 1 [0082.856] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x460533d0, ftCreationTime.dwHighDateTime=0x1d5e7c4, ftLastAccessTime.dwLowDateTime=0xea127280, ftLastAccessTime.dwHighDateTime=0x1d5f0fc, ftLastWriteTime.dwLowDateTime=0xea127280, ftLastWriteTime.dwHighDateTime=0x1d5f0fc, nFileSizeHigh=0x0, nFileSizeLow=0x1141, dwReserved0=0x0, dwReserved1=0x0, cFileName="NvL60GwqP.ppt", cAlternateFileName="NVL60G~1.PPT")) returned 1 [0082.856] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd83c1fe0, ftCreationTime.dwHighDateTime=0x1d5e524, ftLastAccessTime.dwLowDateTime=0x28872fe0, ftLastAccessTime.dwHighDateTime=0x1d5e2f9, ftLastWriteTime.dwLowDateTime=0x28872fe0, ftLastWriteTime.dwHighDateTime=0x1d5e2f9, nFileSizeHigh=0x0, nFileSizeLow=0x631c, dwReserved0=0x0, dwReserved1=0x0, cFileName="tEL KEKy5u2J3QD3I7.bmp", cAlternateFileName="TELKEK~1.BMP")) returned 1 [0082.856] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85edca0, ftCreationTime.dwHighDateTime=0x1d5e989, ftLastAccessTime.dwLowDateTime=0xd5852e90, ftLastAccessTime.dwHighDateTime=0x1d5ee2a, ftLastWriteTime.dwLowDateTime=0xd5852e90, ftLastWriteTime.dwHighDateTime=0x1d5ee2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uJvn1eNK", cAlternateFileName="")) returned 1 [0082.857] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x715bfa20, ftCreationTime.dwHighDateTime=0x1d5e9c5, ftLastAccessTime.dwLowDateTime=0x49469ec0, ftLastAccessTime.dwHighDateTime=0x1d5e86a, ftLastWriteTime.dwLowDateTime=0x49469ec0, ftLastWriteTime.dwHighDateTime=0x1d5e86a, nFileSizeHigh=0x0, nFileSizeLow=0x6c07, dwReserved0=0x0, dwReserved1=0x0, cFileName="ux3rT5FNwZkNBWR.bmp", cAlternateFileName="UX3RT5~1.BMP")) returned 1 [0082.857] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe178cf10, ftCreationTime.dwHighDateTime=0x1d5ebd5, ftLastAccessTime.dwLowDateTime=0x3ce81850, ftLastAccessTime.dwHighDateTime=0x1d5e91b, ftLastWriteTime.dwLowDateTime=0x3ce81850, ftLastWriteTime.dwHighDateTime=0x1d5e91b, nFileSizeHigh=0x0, nFileSizeLow=0x10abc, dwReserved0=0x0, dwReserved1=0x0, cFileName="V89ICi2G.pdf", cAlternateFileName="")) returned 1 [0082.857] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a653a0, ftCreationTime.dwHighDateTime=0x1d5e142, ftLastAccessTime.dwLowDateTime=0x505d7360, ftLastAccessTime.dwHighDateTime=0x1d5e5e9, ftLastWriteTime.dwLowDateTime=0x505d7360, ftLastWriteTime.dwHighDateTime=0x1d5e5e9, nFileSizeHigh=0x0, nFileSizeLow=0xaed1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vaxq5.gif", cAlternateFileName="")) returned 1 [0082.857] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x486880d0, ftCreationTime.dwHighDateTime=0x1d5f0db, ftLastAccessTime.dwLowDateTime=0x35546b70, ftLastAccessTime.dwHighDateTime=0x1d5eb00, ftLastWriteTime.dwLowDateTime=0x35546b70, ftLastWriteTime.dwHighDateTime=0x1d5eb00, nFileSizeHigh=0x0, nFileSizeLow=0x7991, dwReserved0=0x0, dwReserved1=0x0, cFileName="vzq8yByGgLRh.mkv", cAlternateFileName="VZQ8YB~1.MKV")) returned 1 [0082.857] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd634fdd0, ftCreationTime.dwHighDateTime=0x1d5eacd, ftLastAccessTime.dwLowDateTime=0xe05ca060, ftLastAccessTime.dwHighDateTime=0x1d5ede8, ftLastWriteTime.dwLowDateTime=0xe05ca060, ftLastWriteTime.dwHighDateTime=0x1d5ede8, nFileSizeHigh=0x0, nFileSizeLow=0x10190, dwReserved0=0x0, dwReserved1=0x0, cFileName="w-tMU4AmH_pKak.png", cAlternateFileName="W-TMU4~1.PNG")) returned 1 [0082.858] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2272e0, ftCreationTime.dwHighDateTime=0x1d5e57b, ftLastAccessTime.dwLowDateTime=0x75458d50, ftLastAccessTime.dwHighDateTime=0x1d5e0e6, ftLastWriteTime.dwLowDateTime=0x75458d50, ftLastWriteTime.dwHighDateTime=0x1d5e0e6, nFileSizeHigh=0x0, nFileSizeLow=0x2d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="XbMXvFNLh2Gmyt iVhk.gif", cAlternateFileName="XBMXVF~1.GIF")) returned 1 [0082.858] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb53e15a0, ftCreationTime.dwHighDateTime=0x1d5e909, ftLastAccessTime.dwLowDateTime=0xdce4fbc0, ftLastAccessTime.dwHighDateTime=0x1d5e556, ftLastWriteTime.dwLowDateTime=0xdce4fbc0, ftLastWriteTime.dwHighDateTime=0x1d5e556, nFileSizeHigh=0x0, nFileSizeLow=0x1467b, dwReserved0=0x0, dwReserved1=0x0, cFileName="XduHjTYUvMSMI6_qg.bmp", cAlternateFileName="XDUHJT~1.BMP")) returned 1 [0082.858] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43720150, ftCreationTime.dwHighDateTime=0x1d5eb9f, ftLastAccessTime.dwLowDateTime=0xd67bc5e0, ftLastAccessTime.dwHighDateTime=0x1d5e55e, ftLastWriteTime.dwLowDateTime=0xd67bc5e0, ftLastWriteTime.dwHighDateTime=0x1d5e55e, nFileSizeHigh=0x0, nFileSizeLow=0xdb55, dwReserved0=0x0, dwReserved1=0x0, cFileName="xkHvjMU.bmp", cAlternateFileName="")) returned 1 [0082.858] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x925d8340, ftCreationTime.dwHighDateTime=0x1d5ef03, ftLastAccessTime.dwLowDateTime=0x41db40, ftLastAccessTime.dwHighDateTime=0x1d5e298, ftLastWriteTime.dwLowDateTime=0x41db40, ftLastWriteTime.dwHighDateTime=0x1d5e298, nFileSizeHigh=0x0, nFileSizeLow=0x170d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="xW3hq1GBEdp.flv", cAlternateFileName="XW3HQ1~1.FLV")) returned 1 [0082.858] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92e813b0, ftCreationTime.dwHighDateTime=0x1d5eb58, ftLastAccessTime.dwLowDateTime=0x78110b50, ftLastAccessTime.dwHighDateTime=0x1d5edc9, ftLastWriteTime.dwLowDateTime=0x78110b50, ftLastWriteTime.dwHighDateTime=0x1d5edc9, nFileSizeHigh=0x0, nFileSizeLow=0x5a35, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZimQCQi8Z.gif", cAlternateFileName="ZIMQCQ~1.GIF")) returned 1 [0082.858] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37432900, ftCreationTime.dwHighDateTime=0x1d5e8c4, ftLastAccessTime.dwLowDateTime=0x908c1400, ftLastAccessTime.dwHighDateTime=0x1d5e120, ftLastWriteTime.dwLowDateTime=0x908c1400, ftLastWriteTime.dwHighDateTime=0x1d5e120, nFileSizeHigh=0x0, nFileSizeLow=0x5c29, dwReserved0=0x0, dwReserved1=0x0, cFileName="_T kudUg.m4a", cAlternateFileName="_TKUDU~1.M4A")) returned 1 [0082.859] FindNextFileW (in: hFindFile=0x104d9f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37432900, ftCreationTime.dwHighDateTime=0x1d5e8c4, ftLastAccessTime.dwLowDateTime=0x908c1400, ftLastAccessTime.dwHighDateTime=0x1d5e120, ftLastWriteTime.dwLowDateTime=0x908c1400, ftLastWriteTime.dwHighDateTime=0x1d5e120, nFileSizeHigh=0x0, nFileSizeLow=0x5c29, dwReserved0=0x0, dwReserved1=0x0, cFileName="_T kudUg.m4a", cAlternateFileName="_TKUDU~1.M4A")) returned 0 [0082.859] FindClose (in: hFindFile=0x104d9f0 | out: hFindFile=0x104d9f0) returned 1 [0082.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebc4) returned 1 [0082.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebd0) returned 1 [0083.206] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-hNL3OcngCIZAr219.avi", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-hNL3OcngCIZAr219.avi", lpFilePart=0x0) returned 0x2d [0083.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0083.206] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-hNL3OcngCIZAr219.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\-hnl3ocngcizar219.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0083.206] GetFileType (hFile=0x350) returned 0x1 [0083.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0083.206] GetFileType (hFile=0x350) returned 0x1 [0083.207] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x13317 [0083.208] ReadFile (in: hFile=0x350, lpBuffer=0x2e7eeac, nNumberOfBytesToRead=0x13317, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2e7eeac*, lpNumberOfBytesRead=0xefeb5c*=0x13317, lpOverlapped=0x0) returned 1 [0083.209] CloseHandle (hObject=0x350) returned 1 [0091.125] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0xefe504, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0091.126] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0xefe568, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0091.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea1c) returned 1 [0091.126] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0xefea98 | out: lpFileInformation=0xefea98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0091.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea18) returned 1 [0091.724] BCryptGetFipsAlgorithmMode (in: pfEnabled=0xefe974 | out: pfEnabled=0xefe974) returned 0x0 [0093.682] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0093.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0093.682] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0093.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0093.683] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-hNL3OcngCIZAr219.avi", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-hNL3OcngCIZAr219.avi", lpFilePart=0x0) returned 0x2d [0093.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0093.683] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-hNL3OcngCIZAr219.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\-hnl3ocngcizar219.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x408 [0093.683] GetFileType (hFile=0x408) returned 0x1 [0093.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0093.683] GetFileType (hFile=0x408) returned 0x1 [0093.684] WriteFile (in: hFile=0x408, lpBuffer=0x2f2fa00*, nNumberOfBytesToWrite=0x13320, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2f2fa00*, lpNumberOfBytesWritten=0xefeb50*=0x13320, lpOverlapped=0x0) returned 1 [0093.686] CloseHandle (hObject=0x408) returned 1 [0093.689] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-hNL3OcngCIZAr219.avi", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-hNL3OcngCIZAr219.avi", lpFilePart=0x0) returned 0x2d [0093.690] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-hNL3OcngCIZAr219.avi.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-hNL3OcngCIZAr219.avi.UGMH", lpFilePart=0x0) returned 0x32 [0093.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0093.690] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-hNL3OcngCIZAr219.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\-hnl3ocngcizar219.avi"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x234ac530, ftCreationTime.dwHighDateTime=0x1d5e9db, ftLastAccessTime.dwLowDateTime=0xfa88cb10, ftLastAccessTime.dwHighDateTime=0x1d5ec2d, ftLastWriteTime.dwLowDateTime=0xcdf0a3a4, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x13320)) returned 1 [0093.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0093.690] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\-hNL3OcngCIZAr219.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\-hnl3ocngcizar219.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\-hNL3OcngCIZAr219.avi.UGMH" (normalized: "c:\\users\\fd1hvy\\desktop\\-hnl3ocngcizar219.avi.ugmh")) returned 1 [0093.892] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\3WQMoZqxtfxvMQK.mp4", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\3WQMoZqxtfxvMQK.mp4", lpFilePart=0x0) returned 0x2b [0093.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0093.893] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\3WQMoZqxtfxvMQK.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\3wqmozqxtfxvmqk.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x408 [0093.893] GetFileType (hFile=0x408) returned 0x1 [0093.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0093.893] GetFileType (hFile=0x408) returned 0x1 [0093.893] GetFileSize (in: hFile=0x408, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x27cc [0093.894] ReadFile (in: hFile=0x408, lpBuffer=0x2f43188, nNumberOfBytesToRead=0x27cc, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2f43188*, lpNumberOfBytesRead=0xefeb5c*=0x27cc, lpOverlapped=0x0) returned 1 [0093.894] CloseHandle (hObject=0x408) returned 1 [0094.156] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0094.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0094.156] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0094.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0094.156] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\3WQMoZqxtfxvMQK.mp4", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\3WQMoZqxtfxvMQK.mp4", lpFilePart=0x0) returned 0x2b [0094.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0094.156] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\3WQMoZqxtfxvMQK.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\3wqmozqxtfxvmqk.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x408 [0094.158] GetFileType (hFile=0x408) returned 0x1 [0094.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0094.158] GetFileType (hFile=0x408) returned 0x1 [0094.158] WriteFile (in: hFile=0x408, lpBuffer=0x2f9c67c*, nNumberOfBytesToWrite=0x27d0, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2f9c67c*, lpNumberOfBytesWritten=0xefeb50*=0x27d0, lpOverlapped=0x0) returned 1 [0094.159] CloseHandle (hObject=0x408) returned 1 [0094.160] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\3WQMoZqxtfxvMQK.mp4", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\3WQMoZqxtfxvMQK.mp4", lpFilePart=0x0) returned 0x2b [0094.160] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\3WQMoZqxtfxvMQK.mp4.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\3WQMoZqxtfxvMQK.mp4.UGMH", lpFilePart=0x0) returned 0x30 [0094.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0094.160] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\3WQMoZqxtfxvMQK.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\3wqmozqxtfxvmqk.mp4"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61881a30, ftCreationTime.dwHighDateTime=0x1d5f0a4, ftLastAccessTime.dwLowDateTime=0x14a50ca0, ftLastAccessTime.dwHighDateTime=0x1d5f018, ftLastWriteTime.dwLowDateTime=0xce382c0d, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x27d0)) returned 1 [0094.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0094.160] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\3WQMoZqxtfxvMQK.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\3wqmozqxtfxvmqk.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\3WQMoZqxtfxvMQK.mp4.UGMH" (normalized: "c:\\users\\fd1hvy\\desktop\\3wqmozqxtfxvmqk.mp4.ugmh")) returned 1 [0094.161] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6iCPTll49y.avi", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\6iCPTll49y.avi", lpFilePart=0x0) returned 0x26 [0094.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0094.161] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6iCPTll49y.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\6icptll49y.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x408 [0094.161] GetFileType (hFile=0x408) returned 0x1 [0094.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0094.161] GetFileType (hFile=0x408) returned 0x1 [0094.161] GetFileSize (in: hFile=0x408, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0xf25d [0094.162] ReadFile (in: hFile=0x408, lpBuffer=0x2f9f290, nNumberOfBytesToRead=0xf25d, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2f9f290*, lpNumberOfBytesRead=0xefeb5c*=0xf25d, lpOverlapped=0x0) returned 1 [0094.164] CloseHandle (hObject=0x408) returned 1 [0094.322] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0094.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0094.323] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0094.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0094.323] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6iCPTll49y.avi", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\6iCPTll49y.avi", lpFilePart=0x0) returned 0x26 [0094.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0094.323] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6iCPTll49y.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\6icptll49y.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x408 [0094.323] GetFileType (hFile=0x408) returned 0x1 [0094.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0094.323] GetFileType (hFile=0x408) returned 0x1 [0094.323] WriteFile (in: hFile=0x408, lpBuffer=0x2e4bba0*, nNumberOfBytesToWrite=0xf260, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2e4bba0*, lpNumberOfBytesWritten=0xefeb50*=0xf260, lpOverlapped=0x0) returned 1 [0094.325] CloseHandle (hObject=0x408) returned 1 [0094.327] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6iCPTll49y.avi", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\6iCPTll49y.avi", lpFilePart=0x0) returned 0x26 [0094.327] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6iCPTll49y.avi.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\6iCPTll49y.avi.UGMH", lpFilePart=0x0) returned 0x2b [0094.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0094.328] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6iCPTll49y.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\6icptll49y.avi"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x967f570, ftCreationTime.dwHighDateTime=0x1d5e3c8, ftLastAccessTime.dwLowDateTime=0x3f1b8e40, ftLastAccessTime.dwHighDateTime=0x1d5ef6a, ftLastWriteTime.dwLowDateTime=0xce5264a9, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xf260)) returned 1 [0094.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0094.328] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\6iCPTll49y.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\6icptll49y.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\6iCPTll49y.avi.UGMH" (normalized: "c:\\users\\fd1hvy\\desktop\\6icptll49y.avi.ugmh")) returned 1 [0094.328] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\DPDskqIc2.mkv", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\DPDskqIc2.mkv", lpFilePart=0x0) returned 0x25 [0094.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0094.328] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DPDskqIc2.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\dpdskqic2.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x408 [0094.329] GetFileType (hFile=0x408) returned 0x1 [0094.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0094.329] GetFileType (hFile=0x408) returned 0x1 [0094.329] GetFileSize (in: hFile=0x408, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x16ac9 [0094.329] ReadFile (in: hFile=0x408, lpBuffer=0x3ebdaa0, nNumberOfBytesToRead=0x16ac9, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x3ebdaa0*, lpNumberOfBytesRead=0xefeb5c*=0x16ac9, lpOverlapped=0x0) returned 1 [0094.332] CloseHandle (hObject=0x408) returned 1 [0094.683] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0094.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0094.683] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0094.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0094.684] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\DPDskqIc2.mkv", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\DPDskqIc2.mkv", lpFilePart=0x0) returned 0x25 [0094.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0094.684] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DPDskqIc2.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\dpdskqic2.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0094.685] GetFileType (hFile=0x2e4) returned 0x1 [0094.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0094.685] GetFileType (hFile=0x2e4) returned 0x1 [0094.685] WriteFile (in: hFile=0x2e4, lpBuffer=0x3f2f0e8*, nNumberOfBytesToWrite=0x16ad0, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x3f2f0e8*, lpNumberOfBytesWritten=0xefeb50*=0x16ad0, lpOverlapped=0x0) returned 1 [0094.687] CloseHandle (hObject=0x2e4) returned 1 [0094.690] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\DPDskqIc2.mkv", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\DPDskqIc2.mkv", lpFilePart=0x0) returned 0x25 [0094.690] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\DPDskqIc2.mkv.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\DPDskqIc2.mkv.UGMH", lpFilePart=0x0) returned 0x2a [0094.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0094.690] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\DPDskqIc2.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\dpdskqic2.mkv"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e658460, ftCreationTime.dwHighDateTime=0x1d5ee0e, ftLastAccessTime.dwLowDateTime=0x319057b0, ftLastAccessTime.dwHighDateTime=0x1d5e754, ftLastWriteTime.dwLowDateTime=0xce8963a9, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x16ad0)) returned 1 [0094.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0094.690] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\DPDskqIc2.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\dpdskqic2.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\DPDskqIc2.mkv.UGMH" (normalized: "c:\\users\\fd1hvy\\desktop\\dpdskqic2.mkv.ugmh")) returned 1 [0094.691] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\eA-CcPkssw4kHgXe.bmp", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\eA-CcPkssw4kHgXe.bmp", lpFilePart=0x0) returned 0x2c [0094.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0094.691] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\eA-CcPkssw4kHgXe.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\ea-ccpkssw4khgxe.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0094.691] GetFileType (hFile=0x2e4) returned 0x1 [0094.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0094.691] GetFileType (hFile=0x2e4) returned 0x1 [0094.691] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x1106 [0094.691] ReadFile (in: hFile=0x2e4, lpBuffer=0x2ea8578, nNumberOfBytesToRead=0x1106, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2ea8578*, lpNumberOfBytesRead=0xefeb5c*=0x1106, lpOverlapped=0x0) returned 1 [0094.692] CloseHandle (hObject=0x2e4) returned 1 [0094.708] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0094.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0094.708] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0094.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0094.708] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\eA-CcPkssw4kHgXe.bmp", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\eA-CcPkssw4kHgXe.bmp", lpFilePart=0x0) returned 0x2c [0094.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0094.709] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\eA-CcPkssw4kHgXe.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\ea-ccpkssw4khgxe.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0094.710] GetFileType (hFile=0x2e4) returned 0x1 [0094.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0094.710] GetFileType (hFile=0x2e4) returned 0x1 [0094.710] WriteFile (in: hFile=0x2e4, lpBuffer=0x2efa8b0*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2efa8b0*, lpNumberOfBytesWritten=0xefeb50*=0x1110, lpOverlapped=0x0) returned 1 [0094.711] CloseHandle (hObject=0x2e4) returned 1 [0094.782] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\eA-CcPkssw4kHgXe.bmp", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\eA-CcPkssw4kHgXe.bmp", lpFilePart=0x0) returned 0x2c [0094.782] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\eA-CcPkssw4kHgXe.bmp.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\eA-CcPkssw4kHgXe.bmp.UGMH", lpFilePart=0x0) returned 0x31 [0094.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0094.782] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\eA-CcPkssw4kHgXe.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\ea-ccpkssw4khgxe.bmp"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcecad450, ftCreationTime.dwHighDateTime=0x1d5ece6, ftLastAccessTime.dwLowDateTime=0x61823020, ftLastAccessTime.dwHighDateTime=0x1d5eba9, ftLastWriteTime.dwLowDateTime=0xce98bdf3, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x1110)) returned 1 [0094.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0094.782] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\eA-CcPkssw4kHgXe.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\ea-ccpkssw4khgxe.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\eA-CcPkssw4kHgXe.bmp.UGMH" (normalized: "c:\\users\\fd1hvy\\desktop\\ea-ccpkssw4khgxe.bmp.ugmh")) returned 1 [0094.783] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\eAGGa29zIdAHHTYD9.xlsx", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\eAGGa29zIdAHHTYD9.xlsx", lpFilePart=0x0) returned 0x2e [0094.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0094.783] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\eAGGa29zIdAHHTYD9.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\eagga29zidahhtyd9.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0094.783] GetFileType (hFile=0x2e4) returned 0x1 [0094.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0094.783] GetFileType (hFile=0x2e4) returned 0x1 [0094.783] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x9dc8 [0094.783] ReadFile (in: hFile=0x2e4, lpBuffer=0x2efbe18, nNumberOfBytesToRead=0x9dc8, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2efbe18*, lpNumberOfBytesRead=0xefeb5c*=0x9dc8, lpOverlapped=0x0) returned 1 [0094.784] CloseHandle (hObject=0x2e4) returned 1 [0094.803] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0094.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0094.803] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0094.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0094.803] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\eAGGa29zIdAHHTYD9.xlsx", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\eAGGa29zIdAHHTYD9.xlsx", lpFilePart=0x0) returned 0x2e [0094.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0094.803] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\eAGGa29zIdAHHTYD9.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\eagga29zidahhtyd9.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0094.805] GetFileType (hFile=0x2e4) returned 0x1 [0094.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0094.805] GetFileType (hFile=0x2e4) returned 0x1 [0094.805] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f7a10c*, nNumberOfBytesToWrite=0x9dd0, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2f7a10c*, lpNumberOfBytesWritten=0xefeb50*=0x9dd0, lpOverlapped=0x0) returned 1 [0094.806] CloseHandle (hObject=0x2e4) returned 1 [0094.808] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\eAGGa29zIdAHHTYD9.xlsx", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\eAGGa29zIdAHHTYD9.xlsx", lpFilePart=0x0) returned 0x2e [0094.808] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\eAGGa29zIdAHHTYD9.xlsx.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\eAGGa29zIdAHHTYD9.xlsx.UGMH", lpFilePart=0x0) returned 0x33 [0094.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0094.808] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\eAGGa29zIdAHHTYD9.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\eagga29zidahhtyd9.xlsx"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b59a0e0, ftCreationTime.dwHighDateTime=0x1d5e30c, ftLastAccessTime.dwLowDateTime=0x8378c5f0, ftLastAccessTime.dwHighDateTime=0x1d5e365, ftLastWriteTime.dwLowDateTime=0xce9b216a, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x9dd0)) returned 1 [0094.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0094.808] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\eAGGa29zIdAHHTYD9.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\eagga29zidahhtyd9.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\eAGGa29zIdAHHTYD9.xlsx.UGMH" (normalized: "c:\\users\\fd1hvy\\desktop\\eagga29zidahhtyd9.xlsx.ugmh")) returned 1 [0094.809] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\E_cmfpG.mp3", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\E_cmfpG.mp3", lpFilePart=0x0) returned 0x23 [0094.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0094.809] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\E_cmfpG.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\e_cmfpg.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0094.809] GetFileType (hFile=0x2e4) returned 0x1 [0094.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0094.809] GetFileType (hFile=0x2e4) returned 0x1 [0094.810] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0xc522 [0094.810] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f84330, nNumberOfBytesToRead=0xc522, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2f84330*, lpNumberOfBytesRead=0xefeb5c*=0xc522, lpOverlapped=0x0) returned 1 [0094.811] CloseHandle (hObject=0x2e4) returned 1 [0094.915] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0094.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0094.915] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0094.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0094.915] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\E_cmfpG.mp3", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\E_cmfpG.mp3", lpFilePart=0x0) returned 0x23 [0094.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0094.916] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\E_cmfpG.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\e_cmfpg.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0094.917] GetFileType (hFile=0x2e4) returned 0x1 [0094.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0094.917] GetFileType (hFile=0x2e4) returned 0x1 [0094.917] WriteFile (in: hFile=0x2e4, lpBuffer=0x2ff60bc*, nNumberOfBytesToWrite=0xc530, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2ff60bc*, lpNumberOfBytesWritten=0xefeb50*=0xc530, lpOverlapped=0x0) returned 1 [0094.923] CloseHandle (hObject=0x2e4) returned 1 [0094.925] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\E_cmfpG.mp3", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\E_cmfpG.mp3", lpFilePart=0x0) returned 0x23 [0094.925] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\E_cmfpG.mp3.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\E_cmfpG.mp3.UGMH", lpFilePart=0x0) returned 0x28 [0094.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0094.925] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\E_cmfpG.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\e_cmfpg.mp3"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83716aa0, ftCreationTime.dwHighDateTime=0x1d5e791, ftLastAccessTime.dwLowDateTime=0xb33ea890, ftLastAccessTime.dwHighDateTime=0x1d5ef5e, ftLastWriteTime.dwLowDateTime=0xceae3440, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xc530)) returned 1 [0094.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0094.925] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\E_cmfpG.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\e_cmfpg.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\E_cmfpG.mp3.UGMH" (normalized: "c:\\users\\fd1hvy\\desktop\\e_cmfpg.mp3.ugmh")) returned 1 [0094.926] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\geNLXx1UJHj5cvhn.mp4", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\geNLXx1UJHj5cvhn.mp4", lpFilePart=0x0) returned 0x2c [0094.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0094.926] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\geNLXx1UJHj5cvhn.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\genlxx1ujhj5cvhn.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0094.926] GetFileType (hFile=0x2e4) returned 0x1 [0094.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0094.926] GetFileType (hFile=0x2e4) returned 0x1 [0094.926] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0xc634 [0094.926] ReadFile (in: hFile=0x2e4, lpBuffer=0x30029f8, nNumberOfBytesToRead=0xc634, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x30029f8*, lpNumberOfBytesRead=0xefeb5c*=0xc634, lpOverlapped=0x0) returned 1 [0094.927] CloseHandle (hObject=0x2e4) returned 1 [0095.235] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0095.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0095.235] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0095.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0095.235] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\geNLXx1UJHj5cvhn.mp4", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\geNLXx1UJHj5cvhn.mp4", lpFilePart=0x0) returned 0x2c [0095.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0095.236] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\geNLXx1UJHj5cvhn.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\genlxx1ujhj5cvhn.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0095.237] GetFileType (hFile=0x2e4) returned 0x1 [0095.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0095.237] GetFileType (hFile=0x2e4) returned 0x1 [0095.237] WriteFile (in: hFile=0x2e4, lpBuffer=0x3074ab0*, nNumberOfBytesToWrite=0xc640, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x3074ab0*, lpNumberOfBytesWritten=0xefeb50*=0xc640, lpOverlapped=0x0) returned 1 [0095.239] CloseHandle (hObject=0x2e4) returned 1 [0095.241] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\geNLXx1UJHj5cvhn.mp4", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\geNLXx1UJHj5cvhn.mp4", lpFilePart=0x0) returned 0x2c [0095.241] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\geNLXx1UJHj5cvhn.mp4.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\geNLXx1UJHj5cvhn.mp4.UGMH", lpFilePart=0x0) returned 0x31 [0095.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0095.241] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\geNLXx1UJHj5cvhn.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\genlxx1ujhj5cvhn.mp4"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdf9a4c0, ftCreationTime.dwHighDateTime=0x1d5eb3d, ftLastAccessTime.dwLowDateTime=0x3492b6a0, ftLastAccessTime.dwHighDateTime=0x1d5ed04, ftLastWriteTime.dwLowDateTime=0xcedde341, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xc640)) returned 1 [0095.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0095.241] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\geNLXx1UJHj5cvhn.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\genlxx1ujhj5cvhn.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\geNLXx1UJHj5cvhn.mp4.UGMH" (normalized: "c:\\users\\fd1hvy\\desktop\\genlxx1ujhj5cvhn.mp4.ugmh")) returned 1 [0095.242] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\IKlpA0NfijVXH.png", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\IKlpA0NfijVXH.png", lpFilePart=0x0) returned 0x29 [0095.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0095.242] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\IKlpA0NfijVXH.png" (normalized: "c:\\users\\fd1hvy\\desktop\\iklpa0nfijvxh.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0095.242] GetFileType (hFile=0x2e4) returned 0x1 [0095.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0095.242] GetFileType (hFile=0x2e4) returned 0x1 [0095.242] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x10edb [0095.243] ReadFile (in: hFile=0x2e4, lpBuffer=0x3081560, nNumberOfBytesToRead=0x10edb, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x3081560*, lpNumberOfBytesRead=0xefeb5c*=0x10edb, lpOverlapped=0x0) returned 1 [0095.244] CloseHandle (hObject=0x2e4) returned 1 [0095.381] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0095.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0095.382] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0095.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0095.382] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\IKlpA0NfijVXH.png", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\IKlpA0NfijVXH.png", lpFilePart=0x0) returned 0x29 [0095.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0095.382] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\IKlpA0NfijVXH.png" (normalized: "c:\\users\\fd1hvy\\desktop\\iklpa0nfijvxh.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0095.383] GetFileType (hFile=0x2e4) returned 0x1 [0095.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0095.383] GetFileType (hFile=0x2e4) returned 0x1 [0095.383] WriteFile (in: hFile=0x2e4, lpBuffer=0x3100ffc*, nNumberOfBytesToWrite=0x10ee0, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x3100ffc*, lpNumberOfBytesWritten=0xefeb50*=0x10ee0, lpOverlapped=0x0) returned 1 [0095.385] CloseHandle (hObject=0x2e4) returned 1 [0095.389] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\IKlpA0NfijVXH.png", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\IKlpA0NfijVXH.png", lpFilePart=0x0) returned 0x29 [0095.389] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\IKlpA0NfijVXH.png.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\IKlpA0NfijVXH.png.UGMH", lpFilePart=0x0) returned 0x2e [0095.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0095.389] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\IKlpA0NfijVXH.png" (normalized: "c:\\users\\fd1hvy\\desktop\\iklpa0nfijvxh.png"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x246c8560, ftCreationTime.dwHighDateTime=0x1d5e176, ftLastAccessTime.dwLowDateTime=0xf9bca810, ftLastAccessTime.dwHighDateTime=0x1d5eb96, ftLastWriteTime.dwLowDateTime=0xcef3584a, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x10ee0)) returned 1 [0095.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0095.389] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\IKlpA0NfijVXH.png" (normalized: "c:\\users\\fd1hvy\\desktop\\iklpa0nfijvxh.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\IKlpA0NfijVXH.png.UGMH" (normalized: "c:\\users\\fd1hvy\\desktop\\iklpa0nfijvxh.png.ugmh")) returned 1 [0095.390] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\IUfRKqu81Ri.mp3", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\IUfRKqu81Ri.mp3", lpFilePart=0x0) returned 0x27 [0095.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0095.390] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\IUfRKqu81Ri.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\iufrkqu81ri.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0095.390] GetFileType (hFile=0x2e4) returned 0x1 [0095.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0095.390] GetFileType (hFile=0x2e4) returned 0x1 [0095.486] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x6e55 [0095.487] ReadFile (in: hFile=0x2e4, lpBuffer=0x311230c, nNumberOfBytesToRead=0x6e55, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x311230c*, lpNumberOfBytesRead=0xefeb5c*=0x6e55, lpOverlapped=0x0) returned 1 [0095.488] CloseHandle (hObject=0x2e4) returned 1 [0095.528] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0095.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0095.528] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0095.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0095.528] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\IUfRKqu81Ri.mp3", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\IUfRKqu81Ri.mp3", lpFilePart=0x0) returned 0x27 [0095.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0095.528] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\IUfRKqu81Ri.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\iufrkqu81ri.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0095.529] GetFileType (hFile=0x2e4) returned 0x1 [0095.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0095.529] GetFileType (hFile=0x2e4) returned 0x1 [0095.530] WriteFile (in: hFile=0x2e4, lpBuffer=0x31818d4*, nNumberOfBytesToWrite=0x6e60, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x31818d4*, lpNumberOfBytesWritten=0xefeb50*=0x6e60, lpOverlapped=0x0) returned 1 [0095.642] CloseHandle (hObject=0x2e4) returned 1 [0095.650] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\IUfRKqu81Ri.mp3", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\IUfRKqu81Ri.mp3", lpFilePart=0x0) returned 0x27 [0095.650] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\IUfRKqu81Ri.mp3.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\IUfRKqu81Ri.mp3.UGMH", lpFilePart=0x0) returned 0x2c [0095.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0095.650] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\IUfRKqu81Ri.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\iufrkqu81ri.mp3"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4859fc00, ftCreationTime.dwHighDateTime=0x1d5e0ef, ftLastAccessTime.dwLowDateTime=0x3155e710, ftLastAccessTime.dwHighDateTime=0x1d5ed44, ftLastWriteTime.dwLowDateTime=0xcf1be09d, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x6e60)) returned 1 [0095.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0095.651] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\IUfRKqu81Ri.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\iufrkqu81ri.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\IUfRKqu81Ri.mp3.UGMH" (normalized: "c:\\users\\fd1hvy\\desktop\\iufrkqu81ri.mp3.ugmh")) returned 1 [0095.653] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\kDNWA.avi", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\kDNWA.avi", lpFilePart=0x0) returned 0x21 [0095.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0095.654] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\kDNWA.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\kdnwa.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0095.654] GetFileType (hFile=0x2e4) returned 0x1 [0095.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0095.654] GetFileType (hFile=0x2e4) returned 0x1 [0095.654] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x13f07 [0095.656] ReadFile (in: hFile=0x2e4, lpBuffer=0x3188b20, nNumberOfBytesToRead=0x13f07, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x3188b20*, lpNumberOfBytesRead=0xefeb5c*=0x13f07, lpOverlapped=0x0) returned 1 [0095.657] CloseHandle (hObject=0x2e4) returned 1 [0095.836] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0095.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0095.836] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0095.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0095.836] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\kDNWA.avi", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\kDNWA.avi", lpFilePart=0x0) returned 0x21 [0095.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0095.836] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\kDNWA.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\kdnwa.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0095.837] GetFileType (hFile=0x2e4) returned 0x1 [0095.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0095.837] GetFileType (hFile=0x2e4) returned 0x1 [0095.837] WriteFile (in: hFile=0x2e4, lpBuffer=0x321164c*, nNumberOfBytesToWrite=0x13f10, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x321164c*, lpNumberOfBytesWritten=0xefeb50*=0x13f10, lpOverlapped=0x0) returned 1 [0095.840] CloseHandle (hObject=0x2e4) returned 1 [0095.947] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\kDNWA.avi", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\kDNWA.avi", lpFilePart=0x0) returned 0x21 [0095.947] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\kDNWA.avi.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\kDNWA.avi.UGMH", lpFilePart=0x0) returned 0x26 [0095.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0095.947] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\kDNWA.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\kdnwa.avi"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d0d99b0, ftCreationTime.dwHighDateTime=0x1d5f0c6, ftLastAccessTime.dwLowDateTime=0x98c8c640, ftLastAccessTime.dwHighDateTime=0x1d5ea6c, ftLastWriteTime.dwLowDateTime=0xcf492d17, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x13f10)) returned 1 [0095.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0095.948] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\kDNWA.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\kdnwa.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\kDNWA.avi.UGMH" (normalized: "c:\\users\\fd1hvy\\desktop\\kdnwa.avi.ugmh")) returned 1 [0095.948] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\kpKG IbF.mp3", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\kpKG IbF.mp3", lpFilePart=0x0) returned 0x24 [0095.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0095.948] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\kpKG IbF.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\kpkg ibf.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0095.949] GetFileType (hFile=0x2e4) returned 0x1 [0095.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0095.949] GetFileType (hFile=0x2e4) returned 0x1 [0095.949] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0xdd3 [0095.950] ReadFile (in: hFile=0x2e4, lpBuffer=0x3226714, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x3226714*, lpNumberOfBytesRead=0xefeb5c*=0xdd3, lpOverlapped=0x0) returned 1 [0095.951] CloseHandle (hObject=0x2e4) returned 1 [0096.219] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0096.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0096.219] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0096.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0096.219] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\kpKG IbF.mp3", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\kpKG IbF.mp3", lpFilePart=0x0) returned 0x24 [0096.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0096.220] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\kpKG IbF.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\kpkg ibf.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0096.314] GetFileType (hFile=0x2e4) returned 0x1 [0096.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0096.314] GetFileType (hFile=0x2e4) returned 0x1 [0096.315] WriteFile (in: hFile=0x2e4, lpBuffer=0x2e78c80*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0xefeb24, lpOverlapped=0x0 | out: lpBuffer=0x2e78c80*, lpNumberOfBytesWritten=0xefeb24*=0xde0, lpOverlapped=0x0) returned 1 [0096.316] CloseHandle (hObject=0x2e4) returned 1 [0096.417] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\kpKG IbF.mp3", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\kpKG IbF.mp3", lpFilePart=0x0) returned 0x24 [0096.417] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\kpKG IbF.mp3.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\kpKG IbF.mp3.UGMH", lpFilePart=0x0) returned 0x29 [0096.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0096.417] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\kpKG IbF.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\kpkg ibf.mp3"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb00f0640, ftCreationTime.dwHighDateTime=0x1d5e6c8, ftLastAccessTime.dwLowDateTime=0x2052d350, ftLastAccessTime.dwHighDateTime=0x1d5eaca, ftLastWriteTime.dwLowDateTime=0xcf8265f1, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xde0)) returned 1 [0096.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0096.417] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\kpKG IbF.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\kpkg ibf.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\kpKG IbF.mp3.UGMH" (normalized: "c:\\users\\fd1hvy\\desktop\\kpkg ibf.mp3.ugmh")) returned 1 [0096.502] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\n67Tv9.mp3", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\n67Tv9.mp3", lpFilePart=0x0) returned 0x22 [0096.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0096.502] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\n67Tv9.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\n67tv9.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0096.502] GetFileType (hFile=0x2e4) returned 0x1 [0096.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0096.502] GetFileType (hFile=0x2e4) returned 0x1 [0096.502] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0xd75f [0096.502] ReadFile (in: hFile=0x2e4, lpBuffer=0x2e79ea8, nNumberOfBytesToRead=0xd75f, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2e79ea8*, lpNumberOfBytesRead=0xefeb5c*=0xd75f, lpOverlapped=0x0) returned 1 [0096.503] CloseHandle (hObject=0x2e4) returned 1 [0096.636] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0096.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0096.636] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0096.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0096.636] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\n67Tv9.mp3", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\n67Tv9.mp3", lpFilePart=0x0) returned 0x22 [0096.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0096.636] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\n67Tv9.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\n67tv9.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0096.744] GetFileType (hFile=0x2e4) returned 0x1 [0096.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0096.744] GetFileType (hFile=0x2e4) returned 0x1 [0096.744] WriteFile (in: hFile=0x2e4, lpBuffer=0x2eef420*, nNumberOfBytesToWrite=0xd760, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2eef420*, lpNumberOfBytesWritten=0xefeb50*=0xd760, lpOverlapped=0x0) returned 1 [0096.746] CloseHandle (hObject=0x2e4) returned 1 [0096.849] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\n67Tv9.mp3", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\n67Tv9.mp3", lpFilePart=0x0) returned 0x22 [0096.849] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\n67Tv9.mp3.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\n67Tv9.mp3.UGMH", lpFilePart=0x0) returned 0x27 [0096.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0096.850] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\n67Tv9.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\n67tv9.mp3"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f10bb30, ftCreationTime.dwHighDateTime=0x1d5edf0, ftLastAccessTime.dwLowDateTime=0x97da86d0, ftLastAccessTime.dwHighDateTime=0x1d5f0dc, ftLastWriteTime.dwLowDateTime=0xcfc2c50c, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xd760)) returned 1 [0096.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0096.850] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\n67Tv9.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\n67tv9.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\n67Tv9.mp3.UGMH" (normalized: "c:\\users\\fd1hvy\\desktop\\n67tv9.mp3.ugmh")) returned 1 [0096.901] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\nEUOkP9.mp4", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\nEUOkP9.mp4", lpFilePart=0x0) returned 0x23 [0096.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0096.901] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nEUOkP9.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\neuokp9.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0096.901] GetFileType (hFile=0x2e4) returned 0x1 [0096.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0096.901] GetFileType (hFile=0x2e4) returned 0x1 [0096.901] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x330b [0096.901] ReadFile (in: hFile=0x2e4, lpBuffer=0x2efcf44, nNumberOfBytesToRead=0x330b, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2efcf44*, lpNumberOfBytesRead=0xefeb5c*=0x330b, lpOverlapped=0x0) returned 1 [0096.902] CloseHandle (hObject=0x2e4) returned 1 [0096.920] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0096.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0096.920] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0096.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0096.920] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\nEUOkP9.mp4", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\nEUOkP9.mp4", lpFilePart=0x0) returned 0x23 [0096.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0096.920] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nEUOkP9.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\neuokp9.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0097.142] GetFileType (hFile=0x2e4) returned 0x1 [0097.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0097.142] GetFileType (hFile=0x2e4) returned 0x1 [0097.143] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f59c7c*, nNumberOfBytesToWrite=0x3310, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2f59c7c*, lpNumberOfBytesWritten=0xefeb50*=0x3310, lpOverlapped=0x0) returned 1 [0097.144] CloseHandle (hObject=0x2e4) returned 1 [0097.148] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\nEUOkP9.mp4", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\nEUOkP9.mp4", lpFilePart=0x0) returned 0x23 [0097.148] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\nEUOkP9.mp4.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\nEUOkP9.mp4.UGMH", lpFilePart=0x0) returned 0x28 [0097.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0097.148] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\nEUOkP9.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\neuokp9.mp4"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54bb0290, ftCreationTime.dwHighDateTime=0x1d5ecb7, ftLastAccessTime.dwLowDateTime=0x493fcd40, ftLastAccessTime.dwHighDateTime=0x1d5edd6, ftLastWriteTime.dwLowDateTime=0xd000c1fe, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x3310)) returned 1 [0097.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0097.148] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\nEUOkP9.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\neuokp9.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\nEUOkP9.mp4.UGMH" (normalized: "c:\\users\\fd1hvy\\desktop\\neuokp9.mp4.ugmh")) returned 1 [0097.149] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\NmC1S11.png", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\NmC1S11.png", lpFilePart=0x0) returned 0x23 [0097.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0097.149] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\NmC1S11.png" (normalized: "c:\\users\\fd1hvy\\desktop\\nmc1s11.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0097.149] GetFileType (hFile=0x2e4) returned 0x1 [0097.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0097.149] GetFileType (hFile=0x2e4) returned 0x1 [0097.149] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x4af2 [0097.149] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f5d358, nNumberOfBytesToRead=0x4af2, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2f5d358*, lpNumberOfBytesRead=0xefeb5c*=0x4af2, lpOverlapped=0x0) returned 1 [0097.150] CloseHandle (hObject=0x2e4) returned 1 [0097.168] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0097.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0097.168] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0097.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0097.168] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\NmC1S11.png", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\NmC1S11.png", lpFilePart=0x0) returned 0x23 [0097.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0097.168] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\NmC1S11.png" (normalized: "c:\\users\\fd1hvy\\desktop\\nmc1s11.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0097.169] GetFileType (hFile=0x2e4) returned 0x1 [0097.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0097.169] GetFileType (hFile=0x2e4) returned 0x1 [0097.170] WriteFile (in: hFile=0x2e4, lpBuffer=0x2fc1840*, nNumberOfBytesToWrite=0x4b00, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2fc1840*, lpNumberOfBytesWritten=0xefeb50*=0x4b00, lpOverlapped=0x0) returned 1 [0097.171] CloseHandle (hObject=0x2e4) returned 1 [0097.172] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\NmC1S11.png", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\NmC1S11.png", lpFilePart=0x0) returned 0x23 [0097.172] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\NmC1S11.png.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\NmC1S11.png.UGMH", lpFilePart=0x0) returned 0x28 [0097.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0097.173] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\NmC1S11.png" (normalized: "c:\\users\\fd1hvy\\desktop\\nmc1s11.png"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87b82b40, ftCreationTime.dwHighDateTime=0x1d5e600, ftLastAccessTime.dwLowDateTime=0x67493ed0, ftLastAccessTime.dwHighDateTime=0x1d5ef60, ftLastWriteTime.dwLowDateTime=0xd005a59e, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x4b00)) returned 1 [0097.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0097.173] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\NmC1S11.png" (normalized: "c:\\users\\fd1hvy\\desktop\\nmc1s11.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\NmC1S11.png.UGMH" (normalized: "c:\\users\\fd1hvy\\desktop\\nmc1s11.png.ugmh")) returned 1 [0097.173] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\NsB5NpMvHsgPQiue-.png", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\NsB5NpMvHsgPQiue-.png", lpFilePart=0x0) returned 0x2d [0097.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0097.173] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\NsB5NpMvHsgPQiue-.png" (normalized: "c:\\users\\fd1hvy\\desktop\\nsb5npmvhsgpqiue-.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0097.174] GetFileType (hFile=0x2e4) returned 0x1 [0097.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0097.174] GetFileType (hFile=0x2e4) returned 0x1 [0097.174] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x1303d [0097.174] ReadFile (in: hFile=0x2e4, lpBuffer=0x2fc6734, nNumberOfBytesToRead=0x1303d, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2fc6734*, lpNumberOfBytesRead=0xefeb5c*=0x1303d, lpOverlapped=0x0) returned 1 [0097.175] CloseHandle (hObject=0x2e4) returned 1 [0097.305] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0097.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0097.306] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0097.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0097.309] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\NsB5NpMvHsgPQiue-.png", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\NsB5NpMvHsgPQiue-.png", lpFilePart=0x0) returned 0x2d [0097.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0097.310] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\NsB5NpMvHsgPQiue-.png" (normalized: "c:\\users\\fd1hvy\\desktop\\nsb5npmvhsgpqiue-.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0097.310] GetFileType (hFile=0x2e4) returned 0x1 [0097.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0097.310] GetFileType (hFile=0x2e4) returned 0x1 [0097.310] WriteFile (in: hFile=0x2e4, lpBuffer=0x2e4f4c4*, nNumberOfBytesToWrite=0x13040, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2e4f4c4*, lpNumberOfBytesWritten=0xefeb50*=0x13040, lpOverlapped=0x0) returned 1 [0097.313] CloseHandle (hObject=0x2e4) returned 1 [0097.317] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\NsB5NpMvHsgPQiue-.png", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\NsB5NpMvHsgPQiue-.png", lpFilePart=0x0) returned 0x2d [0097.317] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\NsB5NpMvHsgPQiue-.png.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\NsB5NpMvHsgPQiue-.png.UGMH", lpFilePart=0x0) returned 0x32 [0097.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0097.317] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\NsB5NpMvHsgPQiue-.png" (normalized: "c:\\users\\fd1hvy\\desktop\\nsb5npmvhsgpqiue-.png"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a5a30, ftCreationTime.dwHighDateTime=0x1d5e90a, ftLastAccessTime.dwLowDateTime=0x17978470, ftLastAccessTime.dwHighDateTime=0x1d5ecb1, ftLastWriteTime.dwLowDateTime=0xd01b26f0, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x13040)) returned 1 [0097.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0097.317] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\NsB5NpMvHsgPQiue-.png" (normalized: "c:\\users\\fd1hvy\\desktop\\nsb5npmvhsgpqiue-.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\NsB5NpMvHsgPQiue-.png.UGMH" (normalized: "c:\\users\\fd1hvy\\desktop\\nsb5npmvhsgpqiue-.png.ugmh")) returned 1 [0097.413] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\NvL60GwqP.ppt", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\NvL60GwqP.ppt", lpFilePart=0x0) returned 0x25 [0097.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0097.413] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\NvL60GwqP.ppt" (normalized: "c:\\users\\fd1hvy\\desktop\\nvl60gwqp.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0097.413] GetFileType (hFile=0x2e4) returned 0x1 [0097.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0097.414] GetFileType (hFile=0x2e4) returned 0x1 [0097.414] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x1141 [0097.414] ReadFile (in: hFile=0x2e4, lpBuffer=0x2e6293c, nNumberOfBytesToRead=0x1141, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2e6293c*, lpNumberOfBytesRead=0xefeb5c*=0x1141, lpOverlapped=0x0) returned 1 [0097.414] CloseHandle (hObject=0x2e4) returned 1 [0097.586] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0097.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0097.586] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0097.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0097.587] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\NvL60GwqP.ppt", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\NvL60GwqP.ppt", lpFilePart=0x0) returned 0x25 [0097.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0097.587] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\NvL60GwqP.ppt" (normalized: "c:\\users\\fd1hvy\\desktop\\nvl60gwqp.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0097.588] GetFileType (hFile=0x2e4) returned 0x1 [0097.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0097.588] GetFileType (hFile=0x2e4) returned 0x1 [0097.588] WriteFile (in: hFile=0x2e4, lpBuffer=0x2eb4f10*, nNumberOfBytesToWrite=0x1150, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2eb4f10*, lpNumberOfBytesWritten=0xefeb50*=0x1150, lpOverlapped=0x0) returned 1 [0097.589] CloseHandle (hObject=0x2e4) returned 1 [0097.591] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\NvL60GwqP.ppt", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\NvL60GwqP.ppt", lpFilePart=0x0) returned 0x25 [0097.591] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\NvL60GwqP.ppt.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\NvL60GwqP.ppt.UGMH", lpFilePart=0x0) returned 0x2a [0097.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0097.591] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\NvL60GwqP.ppt" (normalized: "c:\\users\\fd1hvy\\desktop\\nvl60gwqp.ppt"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x460533d0, ftCreationTime.dwHighDateTime=0x1d5e7c4, ftLastAccessTime.dwLowDateTime=0xea127280, ftLastAccessTime.dwHighDateTime=0x1d5f0fc, ftLastWriteTime.dwLowDateTime=0xd043c2d1, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x1150)) returned 1 [0097.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0097.591] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\NvL60GwqP.ppt" (normalized: "c:\\users\\fd1hvy\\desktop\\nvl60gwqp.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\NvL60GwqP.ppt.UGMH" (normalized: "c:\\users\\fd1hvy\\desktop\\nvl60gwqp.ppt.ugmh")) returned 1 [0097.592] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tEL KEKy5u2J3QD3I7.bmp", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tEL KEKy5u2J3QD3I7.bmp", lpFilePart=0x0) returned 0x2e [0097.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0097.592] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tEL KEKy5u2J3QD3I7.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\tel keky5u2j3qd3i7.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0097.592] GetFileType (hFile=0x2e4) returned 0x1 [0097.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0097.592] GetFileType (hFile=0x2e4) returned 0x1 [0097.592] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x631c [0097.592] ReadFile (in: hFile=0x2e4, lpBuffer=0x2eb6470, nNumberOfBytesToRead=0x631c, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2eb6470*, lpNumberOfBytesRead=0xefeb5c*=0x631c, lpOverlapped=0x0) returned 1 [0097.593] CloseHandle (hObject=0x2e4) returned 1 [0097.770] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0097.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0097.771] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0097.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0097.771] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tEL KEKy5u2J3QD3I7.bmp", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tEL KEKy5u2J3QD3I7.bmp", lpFilePart=0x0) returned 0x2e [0097.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0097.771] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tEL KEKy5u2J3QD3I7.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\tel keky5u2j3qd3i7.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0097.772] GetFileType (hFile=0x2e4) returned 0x1 [0097.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0097.772] GetFileType (hFile=0x2e4) returned 0x1 [0097.772] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f221f4*, nNumberOfBytesToWrite=0x6320, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2f221f4*, lpNumberOfBytesWritten=0xefeb50*=0x6320, lpOverlapped=0x0) returned 1 [0097.774] CloseHandle (hObject=0x2e4) returned 1 [0097.775] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tEL KEKy5u2J3QD3I7.bmp", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tEL KEKy5u2J3QD3I7.bmp", lpFilePart=0x0) returned 0x2e [0097.775] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tEL KEKy5u2J3QD3I7.bmp.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tEL KEKy5u2J3QD3I7.bmp.UGMH", lpFilePart=0x0) returned 0x33 [0097.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0097.775] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tEL KEKy5u2J3QD3I7.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\tel keky5u2j3qd3i7.bmp"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd83c1fe0, ftCreationTime.dwHighDateTime=0x1d5e524, ftLastAccessTime.dwLowDateTime=0x28872fe0, ftLastAccessTime.dwHighDateTime=0x1d5e2f9, ftLastWriteTime.dwLowDateTime=0xd0604ac1, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x6320)) returned 1 [0097.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0097.776] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\tEL KEKy5u2J3QD3I7.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\tel keky5u2j3qd3i7.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\tEL KEKy5u2J3QD3I7.bmp.UGMH" (normalized: "c:\\users\\fd1hvy\\desktop\\tel keky5u2j3qd3i7.bmp.ugmh")) returned 1 [0097.776] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ux3rT5FNwZkNBWR.bmp", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ux3rT5FNwZkNBWR.bmp", lpFilePart=0x0) returned 0x2b [0097.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0097.776] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ux3rT5FNwZkNBWR.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\ux3rt5fnwzknbwr.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0097.776] GetFileType (hFile=0x2e4) returned 0x1 [0097.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0097.777] GetFileType (hFile=0x2e4) returned 0x1 [0097.777] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x6c07 [0097.777] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f28970, nNumberOfBytesToRead=0x6c07, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2f28970*, lpNumberOfBytesRead=0xefeb5c*=0x6c07, lpOverlapped=0x0) returned 1 [0097.778] CloseHandle (hObject=0x2e4) returned 1 [0097.872] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0097.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0097.872] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0097.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0097.872] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ux3rT5FNwZkNBWR.bmp", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ux3rT5FNwZkNBWR.bmp", lpFilePart=0x0) returned 0x2b [0097.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0097.873] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ux3rT5FNwZkNBWR.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\ux3rt5fnwzknbwr.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0097.874] GetFileType (hFile=0x2e4) returned 0x1 [0097.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0097.874] GetFileType (hFile=0x2e4) returned 0x1 [0097.874] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f973a8*, nNumberOfBytesToWrite=0x6c10, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2f973a8*, lpNumberOfBytesWritten=0xefeb50*=0x6c10, lpOverlapped=0x0) returned 1 [0097.876] CloseHandle (hObject=0x2e4) returned 1 [0097.878] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ux3rT5FNwZkNBWR.bmp", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ux3rT5FNwZkNBWR.bmp", lpFilePart=0x0) returned 0x2b [0097.878] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ux3rT5FNwZkNBWR.bmp.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ux3rT5FNwZkNBWR.bmp.UGMH", lpFilePart=0x0) returned 0x30 [0097.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0097.879] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ux3rT5FNwZkNBWR.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\ux3rt5fnwzknbwr.bmp"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x715bfa20, ftCreationTime.dwHighDateTime=0x1d5e9c5, ftLastAccessTime.dwLowDateTime=0x49469ec0, ftLastAccessTime.dwHighDateTime=0x1d5e86a, ftLastWriteTime.dwLowDateTime=0xd0710c6b, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x6c10)) returned 1 [0097.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0097.879] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ux3rT5FNwZkNBWR.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\ux3rt5fnwzknbwr.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ux3rT5FNwZkNBWR.bmp.UGMH" (normalized: "c:\\users\\fd1hvy\\desktop\\ux3rt5fnwzknbwr.bmp.ugmh")) returned 1 [0097.880] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\V89ICi2G.pdf", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\V89ICi2G.pdf", lpFilePart=0x0) returned 0x24 [0097.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0097.880] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\V89ICi2G.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\v89ici2g.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0097.880] GetFileType (hFile=0x2e4) returned 0x1 [0097.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0097.880] GetFileType (hFile=0x2e4) returned 0x1 [0097.880] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x10abc [0097.880] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f9e3dc, nNumberOfBytesToRead=0x10abc, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2f9e3dc*, lpNumberOfBytesRead=0xefeb5c*=0x10abc, lpOverlapped=0x0) returned 1 [0097.881] CloseHandle (hObject=0x2e4) returned 1 [0098.189] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0098.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0098.189] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0098.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0098.190] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\V89ICi2G.pdf", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\V89ICi2G.pdf", lpFilePart=0x0) returned 0x24 [0098.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0098.190] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\V89ICi2G.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\v89ici2g.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0098.192] GetFileType (hFile=0x2e4) returned 0x1 [0098.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0098.192] GetFileType (hFile=0x2e4) returned 0x1 [0098.192] WriteFile (in: hFile=0x2e4, lpBuffer=0x301d214*, nNumberOfBytesToWrite=0x10ac0, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x301d214*, lpNumberOfBytesWritten=0xefeb50*=0x10ac0, lpOverlapped=0x0) returned 1 [0098.195] CloseHandle (hObject=0x2e4) returned 1 [0098.202] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\V89ICi2G.pdf", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\V89ICi2G.pdf", lpFilePart=0x0) returned 0x24 [0098.202] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\V89ICi2G.pdf.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\V89ICi2G.pdf.UGMH", lpFilePart=0x0) returned 0x29 [0098.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0098.202] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\V89ICi2G.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\v89ici2g.pdf"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe178cf10, ftCreationTime.dwHighDateTime=0x1d5ebd5, ftLastAccessTime.dwLowDateTime=0x3ce81850, ftLastAccessTime.dwHighDateTime=0x1d5e91b, ftLastWriteTime.dwLowDateTime=0xd0a0accc, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x10ac0)) returned 1 [0098.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0098.203] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\V89ICi2G.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\v89ici2g.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\V89ICi2G.pdf.UGMH" (normalized: "c:\\users\\fd1hvy\\desktop\\v89ici2g.pdf.ugmh")) returned 1 [0098.204] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vzq8yByGgLRh.mkv", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vzq8yByGgLRh.mkv", lpFilePart=0x0) returned 0x28 [0098.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0098.204] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vzq8yByGgLRh.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\vzq8ybygglrh.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0098.204] GetFileType (hFile=0x2e4) returned 0x1 [0098.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0098.204] GetFileType (hFile=0x2e4) returned 0x1 [0098.204] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x7991 [0098.205] ReadFile (in: hFile=0x2e4, lpBuffer=0x302e0dc, nNumberOfBytesToRead=0x7991, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x302e0dc*, lpNumberOfBytesRead=0xefeb5c*=0x7991, lpOverlapped=0x0) returned 1 [0098.206] CloseHandle (hObject=0x2e4) returned 1 [0098.340] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0098.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0098.340] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0098.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0098.340] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vzq8yByGgLRh.mkv", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vzq8yByGgLRh.mkv", lpFilePart=0x0) returned 0x28 [0098.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0098.340] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vzq8yByGgLRh.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\vzq8ybygglrh.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0098.342] GetFileType (hFile=0x2e4) returned 0x1 [0098.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0098.342] GetFileType (hFile=0x2e4) returned 0x1 [0098.342] WriteFile (in: hFile=0x2e4, lpBuffer=0x2e9eeb4*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2e9eeb4*, lpNumberOfBytesWritten=0xefeb50*=0x79a0, lpOverlapped=0x0) returned 1 [0098.344] CloseHandle (hObject=0x2e4) returned 1 [0098.350] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vzq8yByGgLRh.mkv", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vzq8yByGgLRh.mkv", lpFilePart=0x0) returned 0x28 [0098.350] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vzq8yByGgLRh.mkv.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vzq8yByGgLRh.mkv.UGMH", lpFilePart=0x0) returned 0x2d [0098.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0098.350] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vzq8yByGgLRh.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\vzq8ybygglrh.mkv"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x486880d0, ftCreationTime.dwHighDateTime=0x1d5f0db, ftLastAccessTime.dwLowDateTime=0x35546b70, ftLastAccessTime.dwHighDateTime=0x1d5eb00, ftLastWriteTime.dwLowDateTime=0xd0b88541, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x79a0)) returned 1 [0098.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0098.350] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\vzq8yByGgLRh.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\vzq8ybygglrh.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\vzq8yByGgLRh.mkv.UGMH" (normalized: "c:\\users\\fd1hvy\\desktop\\vzq8ybygglrh.mkv.ugmh")) returned 1 [0098.351] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\w-tMU4AmH_pKak.png", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\w-tMU4AmH_pKak.png", lpFilePart=0x0) returned 0x2a [0098.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0098.351] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\w-tMU4AmH_pKak.png" (normalized: "c:\\users\\fd1hvy\\desktop\\w-tmu4amh_pkak.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0098.352] GetFileType (hFile=0x2e4) returned 0x1 [0098.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0098.352] GetFileType (hFile=0x2e4) returned 0x1 [0098.352] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x10190 [0098.352] ReadFile (in: hFile=0x2e4, lpBuffer=0x2ea6c74, nNumberOfBytesToRead=0x10190, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2ea6c74*, lpNumberOfBytesRead=0xefeb5c*=0x10190, lpOverlapped=0x0) returned 1 [0098.353] CloseHandle (hObject=0x2e4) returned 1 [0098.471] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0098.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0098.471] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0098.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0098.471] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\w-tMU4AmH_pKak.png", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\w-tMU4AmH_pKak.png", lpFilePart=0x0) returned 0x2a [0098.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0098.471] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\w-tMU4AmH_pKak.png" (normalized: "c:\\users\\fd1hvy\\desktop\\w-tmu4amh_pkak.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0098.473] GetFileType (hFile=0x2e4) returned 0x1 [0098.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0098.473] GetFileType (hFile=0x2e4) returned 0x1 [0098.473] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f240a8*, nNumberOfBytesToWrite=0x101a0, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2f240a8*, lpNumberOfBytesWritten=0xefeb50*=0x101a0, lpOverlapped=0x0) returned 1 [0098.475] CloseHandle (hObject=0x2e4) returned 1 [0098.477] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\w-tMU4AmH_pKak.png", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\w-tMU4AmH_pKak.png", lpFilePart=0x0) returned 0x2a [0098.477] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\w-tMU4AmH_pKak.png.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\w-tMU4AmH_pKak.png.UGMH", lpFilePart=0x0) returned 0x2f [0098.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0098.477] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\w-tMU4AmH_pKak.png" (normalized: "c:\\users\\fd1hvy\\desktop\\w-tmu4amh_pkak.png"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd634fdd0, ftCreationTime.dwHighDateTime=0x1d5eacd, ftLastAccessTime.dwLowDateTime=0xe05ca060, ftLastAccessTime.dwHighDateTime=0x1d5ede8, ftLastWriteTime.dwLowDateTime=0xd0cb9762, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x101a0)) returned 1 [0098.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0098.478] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\w-tMU4AmH_pKak.png" (normalized: "c:\\users\\fd1hvy\\desktop\\w-tmu4amh_pkak.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\w-tMU4AmH_pKak.png.UGMH" (normalized: "c:\\users\\fd1hvy\\desktop\\w-tmu4amh_pkak.png.ugmh")) returned 1 [0098.478] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XduHjTYUvMSMI6_qg.bmp", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XduHjTYUvMSMI6_qg.bmp", lpFilePart=0x0) returned 0x2d [0098.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0098.478] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\XduHjTYUvMSMI6_qg.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\xduhjtyuvmsmi6_qg.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0098.478] GetFileType (hFile=0x2e4) returned 0x1 [0098.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0098.478] GetFileType (hFile=0x2e4) returned 0x1 [0098.479] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x1467b [0098.479] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f3469c, nNumberOfBytesToRead=0x1467b, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2f3469c*, lpNumberOfBytesRead=0xefeb5c*=0x1467b, lpOverlapped=0x0) returned 1 [0098.480] CloseHandle (hObject=0x2e4) returned 1 [0098.598] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0098.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0098.599] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0098.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0098.599] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XduHjTYUvMSMI6_qg.bmp", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XduHjTYUvMSMI6_qg.bmp", lpFilePart=0x0) returned 0x2d [0098.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0098.599] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\XduHjTYUvMSMI6_qg.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\xduhjtyuvmsmi6_qg.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0098.600] GetFileType (hFile=0x2e4) returned 0x1 [0098.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0098.600] GetFileType (hFile=0x2e4) returned 0x1 [0098.600] WriteFile (in: hFile=0x2e4, lpBuffer=0x2fbe818*, nNumberOfBytesToWrite=0x14680, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2fbe818*, lpNumberOfBytesWritten=0xefeb50*=0x14680, lpOverlapped=0x0) returned 1 [0098.603] CloseHandle (hObject=0x2e4) returned 1 [0098.605] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XduHjTYUvMSMI6_qg.bmp", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XduHjTYUvMSMI6_qg.bmp", lpFilePart=0x0) returned 0x2d [0098.605] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XduHjTYUvMSMI6_qg.bmp.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XduHjTYUvMSMI6_qg.bmp.UGMH", lpFilePart=0x0) returned 0x32 [0098.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0098.605] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XduHjTYUvMSMI6_qg.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\xduhjtyuvmsmi6_qg.bmp"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb53e15a0, ftCreationTime.dwHighDateTime=0x1d5e909, ftLastAccessTime.dwLowDateTime=0xdce4fbc0, ftLastAccessTime.dwHighDateTime=0x1d5e556, ftLastWriteTime.dwLowDateTime=0xd0dea8d8, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x14680)) returned 1 [0098.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0098.606] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\XduHjTYUvMSMI6_qg.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\xduhjtyuvmsmi6_qg.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\XduHjTYUvMSMI6_qg.bmp.UGMH" (normalized: "c:\\users\\fd1hvy\\desktop\\xduhjtyuvmsmi6_qg.bmp.ugmh")) returned 1 [0098.606] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\xkHvjMU.bmp", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\xkHvjMU.bmp", lpFilePart=0x0) returned 0x23 [0098.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0098.606] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\xkHvjMU.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\xkhvjmu.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0098.606] GetFileType (hFile=0x2e4) returned 0x1 [0098.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0098.607] GetFileType (hFile=0x2e4) returned 0x1 [0098.607] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0xdb55 [0098.607] ReadFile (in: hFile=0x2e4, lpBuffer=0x2fd32c8, nNumberOfBytesToRead=0xdb55, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2fd32c8*, lpNumberOfBytesRead=0xefeb5c*=0xdb55, lpOverlapped=0x0) returned 1 [0098.608] CloseHandle (hObject=0x2e4) returned 1 [0098.629] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0098.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0098.629] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0098.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0098.629] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\xkHvjMU.bmp", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\xkHvjMU.bmp", lpFilePart=0x0) returned 0x23 [0098.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0098.629] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\xkHvjMU.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\xkhvjmu.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0098.630] GetFileType (hFile=0x2e4) returned 0x1 [0098.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0098.630] GetFileType (hFile=0x2e4) returned 0x1 [0098.630] WriteFile (in: hFile=0x2e4, lpBuffer=0x30492e4*, nNumberOfBytesToWrite=0xdb60, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x30492e4*, lpNumberOfBytesWritten=0xefeb50*=0xdb60, lpOverlapped=0x0) returned 1 [0098.632] CloseHandle (hObject=0x2e4) returned 1 [0098.634] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\xkHvjMU.bmp", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\xkHvjMU.bmp", lpFilePart=0x0) returned 0x23 [0098.634] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\xkHvjMU.bmp.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\xkHvjMU.bmp.UGMH", lpFilePart=0x0) returned 0x28 [0098.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0098.634] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\xkHvjMU.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\xkhvjmu.bmp"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43720150, ftCreationTime.dwHighDateTime=0x1d5eb9f, ftLastAccessTime.dwLowDateTime=0xd67bc5e0, ftLastAccessTime.dwHighDateTime=0x1d5e55e, ftLastWriteTime.dwLowDateTime=0xd0e3ba52, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xdb60)) returned 1 [0098.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0098.634] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\xkHvjMU.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\xkhvjmu.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\xkHvjMU.bmp.UGMH" (normalized: "c:\\users\\fd1hvy\\desktop\\xkhvjmu.bmp.ugmh")) returned 1 [0098.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb94) returned 1 [0098.635] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK", nBufferLength=0x105, lpBuffer=0xefe648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK", lpFilePart=0x0) returned 0x20 [0098.635] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\*", lpFindFileData=0xefe8bc | out: lpFindFileData=0xefe8bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85edca0, ftCreationTime.dwHighDateTime=0x1d5e989, ftLastAccessTime.dwLowDateTime=0xd5852e90, ftLastAccessTime.dwHighDateTime=0x1d5ee2a, ftLastWriteTime.dwLowDateTime=0xd5852e90, ftLastWriteTime.dwHighDateTime=0x1d5ee2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8150668 [0098.635] FindNextFileW (in: hFindFile=0x8150668, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85edca0, ftCreationTime.dwHighDateTime=0x1d5e989, ftLastAccessTime.dwLowDateTime=0xd5852e90, ftLastAccessTime.dwHighDateTime=0x1d5ee2a, ftLastWriteTime.dwLowDateTime=0xd5852e90, ftLastWriteTime.dwHighDateTime=0x1d5ee2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.636] FindNextFileW (in: hFindFile=0x8150668, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8c5f820, ftCreationTime.dwHighDateTime=0x1d5e67d, ftLastAccessTime.dwLowDateTime=0x54e70c60, ftLastAccessTime.dwHighDateTime=0x1d5e437, ftLastWriteTime.dwLowDateTime=0x54e70c60, ftLastWriteTime.dwHighDateTime=0x1d5e437, nFileSizeHigh=0x0, nFileSizeLow=0x15ecf, dwReserved0=0x0, dwReserved1=0x0, cFileName="AfgARJ.mp3", cAlternateFileName="")) returned 1 [0098.636] FindNextFileW (in: hFindFile=0x8150668, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93a3fb60, ftCreationTime.dwHighDateTime=0x1d5e3de, ftLastAccessTime.dwLowDateTime=0xd4df0c90, ftLastAccessTime.dwHighDateTime=0x1d5ea92, ftLastWriteTime.dwLowDateTime=0xd4df0c90, ftLastWriteTime.dwHighDateTime=0x1d5ea92, nFileSizeHigh=0x0, nFileSizeLow=0x7ced, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apu_3HKNloAeD.pptx", cAlternateFileName="APU_3H~1.PPT")) returned 1 [0098.636] FindNextFileW (in: hFindFile=0x8150668, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2db1d50, ftCreationTime.dwHighDateTime=0x1d5e32c, ftLastAccessTime.dwLowDateTime=0xa8bac20, ftLastAccessTime.dwHighDateTime=0x1d5e6c1, ftLastWriteTime.dwLowDateTime=0xa8bac20, ftLastWriteTime.dwHighDateTime=0x1d5e6c1, nFileSizeHigh=0x0, nFileSizeLow=0x13a49, dwReserved0=0x0, dwReserved1=0x0, cFileName="F52q7h1ytKx.xls", cAlternateFileName="F52Q7H~1.XLS")) returned 1 [0098.636] FindNextFileW (in: hFindFile=0x8150668, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f78a60, ftCreationTime.dwHighDateTime=0x1d5e653, ftLastAccessTime.dwLowDateTime=0x62f93050, ftLastAccessTime.dwHighDateTime=0x1d5ecc8, ftLastWriteTime.dwLowDateTime=0x62f93050, ftLastWriteTime.dwHighDateTime=0x1d5ecc8, nFileSizeHigh=0x0, nFileSizeLow=0x10a45, dwReserved0=0x0, dwReserved1=0x0, cFileName="huGql8L_ DP0Oe6yT.bmp", cAlternateFileName="HUGQL8~1.BMP")) returned 1 [0098.636] FindNextFileW (in: hFindFile=0x8150668, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9e579f0, ftCreationTime.dwHighDateTime=0x1d5e38c, ftLastAccessTime.dwLowDateTime=0x956b4bf0, ftLastAccessTime.dwHighDateTime=0x1d5ef65, ftLastWriteTime.dwLowDateTime=0x956b4bf0, ftLastWriteTime.dwHighDateTime=0x1d5ef65, nFileSizeHigh=0x0, nFileSizeLow=0xb681, dwReserved0=0x0, dwReserved1=0x0, cFileName="iDZ244LOqe122Zu.xls", cAlternateFileName="IDZ244~1.XLS")) returned 1 [0098.637] FindNextFileW (in: hFindFile=0x8150668, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97a11e50, ftCreationTime.dwHighDateTime=0x1d5e50a, ftLastAccessTime.dwLowDateTime=0x471a2e50, ftLastAccessTime.dwHighDateTime=0x1d5eb8a, ftLastWriteTime.dwLowDateTime=0x471a2e50, ftLastWriteTime.dwHighDateTime=0x1d5eb8a, nFileSizeHigh=0x0, nFileSizeLow=0xb060, dwReserved0=0x0, dwReserved1=0x0, cFileName="IhDxMWn.m4a", cAlternateFileName="")) returned 1 [0098.637] FindNextFileW (in: hFindFile=0x8150668, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7cf0b30, ftCreationTime.dwHighDateTime=0x1d5e9cf, ftLastAccessTime.dwLowDateTime=0x7961eb70, ftLastAccessTime.dwHighDateTime=0x1d5ecaf, ftLastWriteTime.dwLowDateTime=0x7961eb70, ftLastWriteTime.dwHighDateTime=0x1d5ecaf, nFileSizeHigh=0x0, nFileSizeLow=0x835c, dwReserved0=0x0, dwReserved1=0x0, cFileName="irIR6kTqqFmhEQ.m4a", cAlternateFileName="IRIR6K~1.M4A")) returned 1 [0098.637] FindNextFileW (in: hFindFile=0x8150668, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9749b80, ftCreationTime.dwHighDateTime=0x1d5e4df, ftLastAccessTime.dwLowDateTime=0x220d0520, ftLastAccessTime.dwHighDateTime=0x1d5f11a, ftLastWriteTime.dwLowDateTime=0x220d0520, ftLastWriteTime.dwHighDateTime=0x1d5f11a, nFileSizeHigh=0x0, nFileSizeLow=0xb6f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="XXXL7.swf", cAlternateFileName="")) returned 1 [0098.729] FindNextFileW (in: hFindFile=0x8150668, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc81a40, ftCreationTime.dwHighDateTime=0x1d5ea43, ftLastAccessTime.dwLowDateTime=0x9449c120, ftLastAccessTime.dwHighDateTime=0x1d5ee7a, ftLastWriteTime.dwLowDateTime=0x9449c120, ftLastWriteTime.dwHighDateTime=0x1d5ee7a, nFileSizeHigh=0x0, nFileSizeLow=0xb5b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="YfX9Q.ots", cAlternateFileName="")) returned 1 [0098.729] FindNextFileW (in: hFindFile=0x8150668, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb0f7710, ftCreationTime.dwHighDateTime=0x1d5e2a6, ftLastAccessTime.dwLowDateTime=0x62d2a650, ftLastAccessTime.dwHighDateTime=0x1d5f0ca, ftLastWriteTime.dwLowDateTime=0x62d2a650, ftLastWriteTime.dwHighDateTime=0x1d5f0ca, nFileSizeHigh=0x0, nFileSizeLow=0x901f, dwReserved0=0x0, dwReserved1=0x0, cFileName="YWUfkqwJ.m4a", cAlternateFileName="")) returned 1 [0098.729] FindNextFileW (in: hFindFile=0x8150668, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0098.729] FindClose (in: hFindFile=0x8150668 | out: hFindFile=0x8150668) returned 1 [0098.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb50) returned 1 [0098.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb5c) returned 1 [0098.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb94) returned 1 [0098.729] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK", nBufferLength=0x105, lpBuffer=0xefe648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK", lpFilePart=0x0) returned 0x20 [0098.730] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\*", lpFindFileData=0xefe8bc | out: lpFindFileData=0xefe8bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85edca0, ftCreationTime.dwHighDateTime=0x1d5e989, ftLastAccessTime.dwLowDateTime=0xd5852e90, ftLastAccessTime.dwHighDateTime=0x1d5ee2a, ftLastWriteTime.dwLowDateTime=0xd5852e90, ftLastWriteTime.dwHighDateTime=0x1d5ee2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8150368 [0098.730] FindNextFileW (in: hFindFile=0x8150368, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85edca0, ftCreationTime.dwHighDateTime=0x1d5e989, ftLastAccessTime.dwLowDateTime=0xd5852e90, ftLastAccessTime.dwHighDateTime=0x1d5ee2a, ftLastWriteTime.dwLowDateTime=0xd5852e90, ftLastWriteTime.dwHighDateTime=0x1d5ee2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.730] FindNextFileW (in: hFindFile=0x8150368, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8c5f820, ftCreationTime.dwHighDateTime=0x1d5e67d, ftLastAccessTime.dwLowDateTime=0x54e70c60, ftLastAccessTime.dwHighDateTime=0x1d5e437, ftLastWriteTime.dwLowDateTime=0x54e70c60, ftLastWriteTime.dwHighDateTime=0x1d5e437, nFileSizeHigh=0x0, nFileSizeLow=0x15ecf, dwReserved0=0x0, dwReserved1=0x0, cFileName="AfgARJ.mp3", cAlternateFileName="")) returned 1 [0098.730] FindNextFileW (in: hFindFile=0x8150368, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93a3fb60, ftCreationTime.dwHighDateTime=0x1d5e3de, ftLastAccessTime.dwLowDateTime=0xd4df0c90, ftLastAccessTime.dwHighDateTime=0x1d5ea92, ftLastWriteTime.dwLowDateTime=0xd4df0c90, ftLastWriteTime.dwHighDateTime=0x1d5ea92, nFileSizeHigh=0x0, nFileSizeLow=0x7ced, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apu_3HKNloAeD.pptx", cAlternateFileName="APU_3H~1.PPT")) returned 1 [0098.730] FindNextFileW (in: hFindFile=0x8150368, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2db1d50, ftCreationTime.dwHighDateTime=0x1d5e32c, ftLastAccessTime.dwLowDateTime=0xa8bac20, ftLastAccessTime.dwHighDateTime=0x1d5e6c1, ftLastWriteTime.dwLowDateTime=0xa8bac20, ftLastWriteTime.dwHighDateTime=0x1d5e6c1, nFileSizeHigh=0x0, nFileSizeLow=0x13a49, dwReserved0=0x0, dwReserved1=0x0, cFileName="F52q7h1ytKx.xls", cAlternateFileName="F52Q7H~1.XLS")) returned 1 [0098.731] FindNextFileW (in: hFindFile=0x8150368, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f78a60, ftCreationTime.dwHighDateTime=0x1d5e653, ftLastAccessTime.dwLowDateTime=0x62f93050, ftLastAccessTime.dwHighDateTime=0x1d5ecc8, ftLastWriteTime.dwLowDateTime=0x62f93050, ftLastWriteTime.dwHighDateTime=0x1d5ecc8, nFileSizeHigh=0x0, nFileSizeLow=0x10a45, dwReserved0=0x0, dwReserved1=0x0, cFileName="huGql8L_ DP0Oe6yT.bmp", cAlternateFileName="HUGQL8~1.BMP")) returned 1 [0098.731] FindNextFileW (in: hFindFile=0x8150368, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9e579f0, ftCreationTime.dwHighDateTime=0x1d5e38c, ftLastAccessTime.dwLowDateTime=0x956b4bf0, ftLastAccessTime.dwHighDateTime=0x1d5ef65, ftLastWriteTime.dwLowDateTime=0x956b4bf0, ftLastWriteTime.dwHighDateTime=0x1d5ef65, nFileSizeHigh=0x0, nFileSizeLow=0xb681, dwReserved0=0x0, dwReserved1=0x0, cFileName="iDZ244LOqe122Zu.xls", cAlternateFileName="IDZ244~1.XLS")) returned 1 [0098.731] FindNextFileW (in: hFindFile=0x8150368, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97a11e50, ftCreationTime.dwHighDateTime=0x1d5e50a, ftLastAccessTime.dwLowDateTime=0x471a2e50, ftLastAccessTime.dwHighDateTime=0x1d5eb8a, ftLastWriteTime.dwLowDateTime=0x471a2e50, ftLastWriteTime.dwHighDateTime=0x1d5eb8a, nFileSizeHigh=0x0, nFileSizeLow=0xb060, dwReserved0=0x0, dwReserved1=0x0, cFileName="IhDxMWn.m4a", cAlternateFileName="")) returned 1 [0098.731] FindNextFileW (in: hFindFile=0x8150368, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7cf0b30, ftCreationTime.dwHighDateTime=0x1d5e9cf, ftLastAccessTime.dwLowDateTime=0x7961eb70, ftLastAccessTime.dwHighDateTime=0x1d5ecaf, ftLastWriteTime.dwLowDateTime=0x7961eb70, ftLastWriteTime.dwHighDateTime=0x1d5ecaf, nFileSizeHigh=0x0, nFileSizeLow=0x835c, dwReserved0=0x0, dwReserved1=0x0, cFileName="irIR6kTqqFmhEQ.m4a", cAlternateFileName="IRIR6K~1.M4A")) returned 1 [0098.731] FindNextFileW (in: hFindFile=0x8150368, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9749b80, ftCreationTime.dwHighDateTime=0x1d5e4df, ftLastAccessTime.dwLowDateTime=0x220d0520, ftLastAccessTime.dwHighDateTime=0x1d5f11a, ftLastWriteTime.dwLowDateTime=0x220d0520, ftLastWriteTime.dwHighDateTime=0x1d5f11a, nFileSizeHigh=0x0, nFileSizeLow=0xb6f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="XXXL7.swf", cAlternateFileName="")) returned 1 [0098.731] FindNextFileW (in: hFindFile=0x8150368, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc81a40, ftCreationTime.dwHighDateTime=0x1d5ea43, ftLastAccessTime.dwLowDateTime=0x9449c120, ftLastAccessTime.dwHighDateTime=0x1d5ee7a, ftLastWriteTime.dwLowDateTime=0x9449c120, ftLastWriteTime.dwHighDateTime=0x1d5ee7a, nFileSizeHigh=0x0, nFileSizeLow=0xb5b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="YfX9Q.ots", cAlternateFileName="")) returned 1 [0098.731] FindNextFileW (in: hFindFile=0x8150368, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb0f7710, ftCreationTime.dwHighDateTime=0x1d5e2a6, ftLastAccessTime.dwLowDateTime=0x62d2a650, ftLastAccessTime.dwHighDateTime=0x1d5f0ca, ftLastWriteTime.dwLowDateTime=0x62d2a650, ftLastWriteTime.dwHighDateTime=0x1d5f0ca, nFileSizeHigh=0x0, nFileSizeLow=0x901f, dwReserved0=0x0, dwReserved1=0x0, cFileName="YWUfkqwJ.m4a", cAlternateFileName="")) returned 1 [0098.732] FindNextFileW (in: hFindFile=0x8150368, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb0f7710, ftCreationTime.dwHighDateTime=0x1d5e2a6, ftLastAccessTime.dwLowDateTime=0x62d2a650, ftLastAccessTime.dwHighDateTime=0x1d5f0ca, ftLastWriteTime.dwLowDateTime=0x62d2a650, ftLastWriteTime.dwHighDateTime=0x1d5f0ca, nFileSizeHigh=0x0, nFileSizeLow=0x901f, dwReserved0=0x0, dwReserved1=0x0, cFileName="YWUfkqwJ.m4a", cAlternateFileName="")) returned 0 [0098.732] FindClose (in: hFindFile=0x8150368 | out: hFindFile=0x8150368) returned 1 [0098.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb50) returned 1 [0098.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb5c) returned 1 [0098.732] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\AfgARJ.mp3", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\AfgARJ.mp3", lpFilePart=0x0) returned 0x2b [0098.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0098.732] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\AfgARJ.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\ujvn1enk\\afgarj.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0098.732] GetFileType (hFile=0x2e4) returned 0x1 [0098.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0098.732] GetFileType (hFile=0x2e4) returned 0x1 [0098.732] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0x15ecf [0098.733] ReadFile (in: hFile=0x2e4, lpBuffer=0x4087a58, nNumberOfBytesToRead=0x15ecf, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x4087a58*, lpNumberOfBytesRead=0xefeae8*=0x15ecf, lpOverlapped=0x0) returned 1 [0098.735] CloseHandle (hObject=0x2e4) returned 1 [0098.761] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0098.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0098.761] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0098.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0098.761] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\AfgARJ.mp3", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\AfgARJ.mp3", lpFilePart=0x0) returned 0x2b [0098.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0098.761] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\AfgARJ.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\ujvn1enk\\afgarj.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0098.763] GetFileType (hFile=0x2e4) returned 0x1 [0098.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0098.763] GetFileType (hFile=0x2e4) returned 0x1 [0098.763] WriteFile (in: hFile=0x2e4, lpBuffer=0x40f54a8*, nNumberOfBytesToWrite=0x15ed0, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x40f54a8*, lpNumberOfBytesWritten=0xefeadc*=0x15ed0, lpOverlapped=0x0) returned 1 [0098.765] CloseHandle (hObject=0x2e4) returned 1 [0098.819] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\AfgARJ.mp3", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\AfgARJ.mp3", lpFilePart=0x0) returned 0x2b [0098.819] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\AfgARJ.mp3.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\AfgARJ.mp3.UGMH", lpFilePart=0x0) returned 0x30 [0098.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0098.819] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\AfgARJ.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\ujvn1enk\\afgarj.mp3"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8c5f820, ftCreationTime.dwHighDateTime=0x1d5e67d, ftLastAccessTime.dwLowDateTime=0x54e70c60, ftLastAccessTime.dwHighDateTime=0x1d5e437, ftLastWriteTime.dwLowDateTime=0xd1000a54, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x15ed0)) returned 1 [0098.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0098.820] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\AfgARJ.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\ujvn1enk\\afgarj.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\AfgARJ.mp3.UGMH" (normalized: "c:\\users\\fd1hvy\\desktop\\ujvn1enk\\afgarj.mp3.ugmh")) returned 1 [0098.820] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\Apu_3HKNloAeD.pptx", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\Apu_3HKNloAeD.pptx", lpFilePart=0x0) returned 0x33 [0098.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0098.821] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\Apu_3HKNloAeD.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\ujvn1enk\\apu_3hknloaed.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0098.821] GetFileType (hFile=0x2e4) returned 0x1 [0098.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0098.821] GetFileType (hFile=0x2e4) returned 0x1 [0098.821] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0x7ced [0098.821] ReadFile (in: hFile=0x2e4, lpBuffer=0x2eb584c, nNumberOfBytesToRead=0x7ced, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x2eb584c*, lpNumberOfBytesRead=0xefeae8*=0x7ced, lpOverlapped=0x0) returned 1 [0098.822] CloseHandle (hObject=0x2e4) returned 1 [0098.840] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0098.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0098.840] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0098.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0098.840] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\Apu_3HKNloAeD.pptx", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\Apu_3HKNloAeD.pptx", lpFilePart=0x0) returned 0x33 [0098.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0098.840] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\Apu_3HKNloAeD.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\ujvn1enk\\apu_3hknloaed.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0098.842] GetFileType (hFile=0x2e4) returned 0x1 [0098.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0098.842] GetFileType (hFile=0x2e4) returned 0x1 [0098.842] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f296e4*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x2f296e4*, lpNumberOfBytesWritten=0xefeadc*=0x7cf0, lpOverlapped=0x0) returned 1 [0098.844] CloseHandle (hObject=0x2e4) returned 1 [0098.846] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\Apu_3HKNloAeD.pptx", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\Apu_3HKNloAeD.pptx", lpFilePart=0x0) returned 0x33 [0098.846] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\Apu_3HKNloAeD.pptx.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\Apu_3HKNloAeD.pptx.UGMH", lpFilePart=0x0) returned 0x38 [0098.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0098.846] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\Apu_3HKNloAeD.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\ujvn1enk\\apu_3hknloaed.pptx"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93a3fb60, ftCreationTime.dwHighDateTime=0x1d5e3de, ftLastAccessTime.dwLowDateTime=0xd4df0c90, ftLastAccessTime.dwHighDateTime=0x1d5ea92, ftLastWriteTime.dwLowDateTime=0xd104cdfe, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x7cf0)) returned 1 [0098.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0098.846] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\Apu_3HKNloAeD.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\ujvn1enk\\apu_3hknloaed.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\Apu_3HKNloAeD.pptx.UGMH" (normalized: "c:\\users\\fd1hvy\\desktop\\ujvn1enk\\apu_3hknloaed.pptx.ugmh")) returned 1 [0098.847] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\F52q7h1ytKx.xls", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\F52q7h1ytKx.xls", lpFilePart=0x0) returned 0x30 [0098.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0098.847] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\F52q7h1ytKx.xls" (normalized: "c:\\users\\fd1hvy\\desktop\\ujvn1enk\\f52q7h1ytkx.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0098.847] GetFileType (hFile=0x2e4) returned 0x1 [0098.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0098.847] GetFileType (hFile=0x2e4) returned 0x1 [0098.847] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0x13a49 [0098.847] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f31854, nNumberOfBytesToRead=0x13a49, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x2f31854*, lpNumberOfBytesRead=0xefeae8*=0x13a49, lpOverlapped=0x0) returned 1 [0098.849] CloseHandle (hObject=0x2e4) returned 1 [0098.927] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0098.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0098.927] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0098.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0098.928] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\F52q7h1ytKx.xls", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\F52q7h1ytKx.xls", lpFilePart=0x0) returned 0x30 [0098.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0098.928] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\F52q7h1ytKx.xls" (normalized: "c:\\users\\fd1hvy\\desktop\\ujvn1enk\\f52q7h1ytkx.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0099.053] GetFileType (hFile=0x2e4) returned 0x1 [0099.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0099.053] GetFileType (hFile=0x2e4) returned 0x1 [0099.053] WriteFile (in: hFile=0x2e4, lpBuffer=0x2fb9540*, nNumberOfBytesToWrite=0x13a50, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x2fb9540*, lpNumberOfBytesWritten=0xefeadc*=0x13a50, lpOverlapped=0x0) returned 1 [0099.055] CloseHandle (hObject=0x2e4) returned 1 [0099.065] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\F52q7h1ytKx.xls", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\F52q7h1ytKx.xls", lpFilePart=0x0) returned 0x30 [0099.065] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\F52q7h1ytKx.xls.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\F52q7h1ytKx.xls.UGMH", lpFilePart=0x0) returned 0x35 [0099.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0099.066] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\F52q7h1ytKx.xls" (normalized: "c:\\users\\fd1hvy\\desktop\\ujvn1enk\\f52q7h1ytkx.xls"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2db1d50, ftCreationTime.dwHighDateTime=0x1d5e32c, ftLastAccessTime.dwLowDateTime=0xa8bac20, ftLastAccessTime.dwHighDateTime=0x1d5e6c1, ftLastWriteTime.dwLowDateTime=0xd1265fd8, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x13a50)) returned 1 [0099.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0099.066] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\F52q7h1ytKx.xls" (normalized: "c:\\users\\fd1hvy\\desktop\\ujvn1enk\\f52q7h1ytkx.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\F52q7h1ytKx.xls.UGMH" (normalized: "c:\\users\\fd1hvy\\desktop\\ujvn1enk\\f52q7h1ytkx.xls.ugmh")) returned 1 [0099.066] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\huGql8L_ DP0Oe6yT.bmp", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\huGql8L_ DP0Oe6yT.bmp", lpFilePart=0x0) returned 0x36 [0099.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0099.066] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\huGql8L_ DP0Oe6yT.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\ujvn1enk\\hugql8l_ dp0oe6yt.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0099.067] GetFileType (hFile=0x2e4) returned 0x1 [0099.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0099.067] GetFileType (hFile=0x2e4) returned 0x1 [0099.067] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0x10a45 [0099.067] ReadFile (in: hFile=0x2e4, lpBuffer=0x2fcd408, nNumberOfBytesToRead=0x10a45, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x2fcd408*, lpNumberOfBytesRead=0xefeae8*=0x10a45, lpOverlapped=0x0) returned 1 [0099.068] CloseHandle (hObject=0x2e4) returned 1 [0099.156] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0099.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0099.156] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0099.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0099.156] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\huGql8L_ DP0Oe6yT.bmp", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\huGql8L_ DP0Oe6yT.bmp", lpFilePart=0x0) returned 0x36 [0099.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0099.156] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\huGql8L_ DP0Oe6yT.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\ujvn1enk\\hugql8l_ dp0oe6yt.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0099.158] GetFileType (hFile=0x2e4) returned 0x1 [0099.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0099.158] GetFileType (hFile=0x2e4) returned 0x1 [0099.158] WriteFile (in: hFile=0x2e4, lpBuffer=0x2e5df4c*, nNumberOfBytesToWrite=0x10a50, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x2e5df4c*, lpNumberOfBytesWritten=0xefeadc*=0x10a50, lpOverlapped=0x0) returned 1 [0099.160] CloseHandle (hObject=0x2e4) returned 1 [0099.165] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\huGql8L_ DP0Oe6yT.bmp", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\huGql8L_ DP0Oe6yT.bmp", lpFilePart=0x0) returned 0x36 [0099.165] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\huGql8L_ DP0Oe6yT.bmp.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\huGql8L_ DP0Oe6yT.bmp.UGMH", lpFilePart=0x0) returned 0x3b [0099.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0099.165] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\huGql8L_ DP0Oe6yT.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\ujvn1enk\\hugql8l_ dp0oe6yt.bmp"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f78a60, ftCreationTime.dwHighDateTime=0x1d5e653, ftLastAccessTime.dwLowDateTime=0x62f93050, ftLastAccessTime.dwHighDateTime=0x1d5ecc8, ftLastWriteTime.dwLowDateTime=0xd1347dbe, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x10a50)) returned 1 [0099.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0099.165] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\huGql8L_ DP0Oe6yT.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\ujvn1enk\\hugql8l_ dp0oe6yt.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\huGql8L_ DP0Oe6yT.bmp.UGMH" (normalized: "c:\\users\\fd1hvy\\desktop\\ujvn1enk\\hugql8l_ dp0oe6yt.bmp.ugmh")) returned 1 [0099.166] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\iDZ244LOqe122Zu.xls", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\iDZ244LOqe122Zu.xls", lpFilePart=0x0) returned 0x34 [0099.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0099.166] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\iDZ244LOqe122Zu.xls" (normalized: "c:\\users\\fd1hvy\\desktop\\ujvn1enk\\idz244loqe122zu.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0099.167] GetFileType (hFile=0x2e4) returned 0x1 [0099.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0099.167] GetFileType (hFile=0x2e4) returned 0x1 [0099.167] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0xb681 [0099.167] ReadFile (in: hFile=0x2e4, lpBuffer=0x2e6ee48, nNumberOfBytesToRead=0xb681, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x2e6ee48*, lpNumberOfBytesRead=0xefeae8*=0xb681, lpOverlapped=0x0) returned 1 [0099.168] CloseHandle (hObject=0x2e4) returned 1 [0099.507] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0099.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0099.507] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0099.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0099.507] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\iDZ244LOqe122Zu.xls", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\iDZ244LOqe122Zu.xls", lpFilePart=0x0) returned 0x34 [0099.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0099.507] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\iDZ244LOqe122Zu.xls" (normalized: "c:\\users\\fd1hvy\\desktop\\ujvn1enk\\idz244loqe122zu.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0099.509] GetFileType (hFile=0x2e4) returned 0x1 [0099.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0099.509] GetFileType (hFile=0x2e4) returned 0x1 [0099.509] WriteFile (in: hFile=0x2e4, lpBuffer=0x2ede150*, nNumberOfBytesToWrite=0xb690, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x2ede150*, lpNumberOfBytesWritten=0xefeadc*=0xb690, lpOverlapped=0x0) returned 1 [0099.511] CloseHandle (hObject=0x2e4) returned 1 [0099.514] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\iDZ244LOqe122Zu.xls", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\iDZ244LOqe122Zu.xls", lpFilePart=0x0) returned 0x34 [0099.514] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\iDZ244LOqe122Zu.xls.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\iDZ244LOqe122Zu.xls.UGMH", lpFilePart=0x0) returned 0x39 [0099.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0099.514] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\iDZ244LOqe122Zu.xls" (normalized: "c:\\users\\fd1hvy\\desktop\\ujvn1enk\\idz244loqe122zu.xls"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9e579f0, ftCreationTime.dwHighDateTime=0x1d5e38c, ftLastAccessTime.dwLowDateTime=0x956b4bf0, ftLastAccessTime.dwHighDateTime=0x1d5ef65, ftLastWriteTime.dwLowDateTime=0xd168f285, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xb690)) returned 1 [0099.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0099.514] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\iDZ244LOqe122Zu.xls" (normalized: "c:\\users\\fd1hvy\\desktop\\ujvn1enk\\idz244loqe122zu.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\iDZ244LOqe122Zu.xls.UGMH" (normalized: "c:\\users\\fd1hvy\\desktop\\ujvn1enk\\idz244loqe122zu.xls.ugmh")) returned 1 [0099.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec08) returned 1 [0099.515] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links", nBufferLength=0x105, lpBuffer=0xefe6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links", lpFilePart=0x0) returned 0x15 [0099.515] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\*", lpFindFileData=0xefe930 | out: lpFindFileData=0xefe930*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8150268 [0099.516] FindNextFileW (in: hFindFile=0x8150268, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.516] FindNextFileW (in: hFindFile=0x8150268, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcee4480b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0099.627] FindNextFileW (in: hFindFile=0x8150268, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4428f2bb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4428f2bb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce90d59d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0099.627] FindNextFileW (in: hFindFile=0x8150268, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442b54f3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x442b54f3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcec7abde, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x3ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0099.628] FindNextFileW (in: hFindFile=0x8150268, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x94664823, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 1 [0099.628] FindNextFileW (in: hFindFile=0x8150268, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0099.628] FindClose (in: hFindFile=0x8150268 | out: hFindFile=0x8150268) returned 1 [0099.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebc4) returned 1 [0099.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebd0) returned 1 [0099.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec08) returned 1 [0099.628] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links", nBufferLength=0x105, lpBuffer=0xefe6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links", lpFilePart=0x0) returned 0x15 [0099.628] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\*", lpFindFileData=0xefe930 | out: lpFindFileData=0xefe930*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8150428 [0099.629] FindNextFileW (in: hFindFile=0x8150428, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.629] FindNextFileW (in: hFindFile=0x8150428, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcee4480b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0099.629] FindNextFileW (in: hFindFile=0x8150428, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4428f2bb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4428f2bb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce90d59d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0099.630] FindNextFileW (in: hFindFile=0x8150428, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442b54f3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x442b54f3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcec7abde, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x3ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0099.630] FindNextFileW (in: hFindFile=0x8150428, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x94664823, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 1 [0099.630] FindNextFileW (in: hFindFile=0x8150428, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x94664823, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 0 [0099.630] FindClose (in: hFindFile=0x8150428 | out: hFindFile=0x8150428) returned 1 [0099.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebc4) returned 1 [0099.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebd0) returned 1 [0099.631] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x21 [0099.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0099.631] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0099.632] GetFileType (hFile=0x2e4) returned 0x1 [0099.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0099.632] GetFileType (hFile=0x2e4) returned 0x1 [0099.632] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x1f5 [0099.632] ReadFile (in: hFile=0x2e4, lpBuffer=0x2eeb0ec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2eeb0ec*, lpNumberOfBytesRead=0xefeb5c*=0x1f5, lpOverlapped=0x0) returned 1 [0099.633] CloseHandle (hObject=0x2e4) returned 1 [0099.654] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0099.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0099.654] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0099.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0099.655] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x21 [0099.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0099.655] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0099.656] GetFileType (hFile=0x2e4) returned 0x1 [0099.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0099.656] GetFileType (hFile=0x2e4) returned 0x1 [0099.656] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f39aa4*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0xefeb24, lpOverlapped=0x0 | out: lpBuffer=0x2f39aa4*, lpNumberOfBytesWritten=0xefeb24*=0x200, lpOverlapped=0x0) returned 1 [0099.657] CloseHandle (hObject=0x2e4) returned 1 [0099.659] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x21 [0099.659] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Desktop.lnk.UGMH", lpFilePart=0x0) returned 0x26 [0099.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0099.659] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4428f2bb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4428f2bb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xd180c948, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x200)) returned 1 [0099.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0099.659] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk.UGMH" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk.ugmh")) returned 1 [0099.660] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x23 [0099.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0099.660] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0099.660] GetFileType (hFile=0x2e4) returned 0x1 [0099.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0099.660] GetFileType (hFile=0x2e4) returned 0x1 [0099.660] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x3ae [0099.660] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f3b064, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2f3b064*, lpNumberOfBytesRead=0xefeb5c*=0x3ae, lpOverlapped=0x0) returned 1 [0099.751] CloseHandle (hObject=0x2e4) returned 1 [0099.773] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0099.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0099.774] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0099.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0099.774] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x23 [0099.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0099.774] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0099.776] GetFileType (hFile=0x2e4) returned 0x1 [0099.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0099.776] GetFileType (hFile=0x2e4) returned 0x1 [0099.776] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f8a28c*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0xefeb24, lpOverlapped=0x0 | out: lpBuffer=0x2f8a28c*, lpNumberOfBytesWritten=0xefeb24*=0x3b0, lpOverlapped=0x0) returned 1 [0099.777] CloseHandle (hObject=0x2e4) returned 1 [0099.782] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x23 [0099.783] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Downloads.lnk.UGMH", lpFilePart=0x0) returned 0x28 [0099.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0099.783] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442b54f3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x442b54f3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xd193dc2f, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x3b0)) returned 1 [0099.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0099.783] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk.UGMH" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk.ugmh")) returned 1 [0099.784] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", lpFilePart=0x0) returned 0x22 [0099.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0099.784] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0099.876] GetFileType (hFile=0x2e4) returned 0x1 [0099.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0099.876] GetFileType (hFile=0x2e4) returned 0x1 [0099.876] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x53a [0099.876] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f8b9e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2f8b9e4*, lpNumberOfBytesRead=0xefeb5c*=0x53a, lpOverlapped=0x0) returned 1 [0099.878] CloseHandle (hObject=0x2e4) returned 1 [0099.894] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0099.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0099.894] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0099.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0099.894] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", lpFilePart=0x0) returned 0x22 [0099.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0099.894] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0099.895] GetFileType (hFile=0x2e4) returned 0x1 [0099.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0099.895] GetFileType (hFile=0x2e4) returned 0x1 [0099.895] WriteFile (in: hFile=0x2e4, lpBuffer=0x2fdb3e0*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0xefeb24, lpOverlapped=0x0 | out: lpBuffer=0x2fdb3e0*, lpNumberOfBytesWritten=0xefeb24*=0x540, lpOverlapped=0x0) returned 1 [0099.896] CloseHandle (hObject=0x2e4) returned 1 [0099.897] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", lpFilePart=0x0) returned 0x22 [0099.897] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk.UGMH", lpFilePart=0x0) returned 0x27 [0099.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0099.897] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xd1a48c43, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x540)) returned 1 [0099.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0099.897] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk.UGMH" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk.ugmh")) returned 1 [0099.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec08) returned 1 [0099.906] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Contacts", nBufferLength=0x105, lpBuffer=0xefe6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Contacts", lpFilePart=0x0) returned 0x18 [0099.906] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Contacts\\*", lpFindFileData=0xefe930 | out: lpFindFileData=0xefe930*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x81505a8 [0099.906] FindNextFileW (in: hFindFile=0x81505a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.906] FindNextFileW (in: hFindFile=0x81505a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0099.907] FindNextFileW (in: hFindFile=0x81505a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0099.907] FindClose (in: hFindFile=0x81505a8 | out: hFindFile=0x81505a8) returned 1 [0099.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebc4) returned 1 [0099.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebd0) returned 1 [0099.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec08) returned 1 [0099.907] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Contacts", nBufferLength=0x105, lpBuffer=0xefe6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Contacts", lpFilePart=0x0) returned 0x18 [0099.907] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Contacts\\*", lpFindFileData=0xefe930 | out: lpFindFileData=0xefe930*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x81504e8 [0099.908] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.908] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0099.908] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0099.908] FindClose (in: hFindFile=0x81504e8 | out: hFindFile=0x81504e8) returned 1 [0099.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebc4) returned 1 [0099.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebd0) returned 1 [0099.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec08) returned 1 [0099.908] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x105, lpBuffer=0xefe6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0099.908] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\*", lpFindFileData=0xefe930 | out: lpFindFileData=0xefe930*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd0e3ba52, ftLastAccessTime.dwHighDateTime=0x1d68033, ftLastWriteTime.dwLowDateTime=0xd0e3ba52, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x81506a8 [0099.909] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd0e3ba52, ftLastAccessTime.dwHighDateTime=0x1d68033, ftLastWriteTime.dwLowDateTime=0xd0e3ba52, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.909] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x234ac530, ftCreationTime.dwHighDateTime=0x1d5e9db, ftLastAccessTime.dwLowDateTime=0xfa88cb10, ftLastAccessTime.dwHighDateTime=0x1d5ec2d, ftLastWriteTime.dwLowDateTime=0xcdf0a3a4, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x13320, dwReserved0=0x0, dwReserved1=0x0, cFileName="-hNL3OcngCIZAr219.avi.UGMH", cAlternateFileName="-HNL3O~1.UGM")) returned 1 [0099.909] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8c04650, ftCreationTime.dwHighDateTime=0x1d5ef92, ftLastAccessTime.dwLowDateTime=0x85fef200, ftLastAccessTime.dwHighDateTime=0x1d5e1ac, ftLastWriteTime.dwLowDateTime=0x85fef200, ftLastWriteTime.dwHighDateTime=0x1d5e1ac, nFileSizeHigh=0x0, nFileSizeLow=0x1721b, dwReserved0=0x0, dwReserved1=0x0, cFileName="2giC_j.wav", cAlternateFileName="")) returned 1 [0099.909] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61881a30, ftCreationTime.dwHighDateTime=0x1d5f0a4, ftLastAccessTime.dwLowDateTime=0x14a50ca0, ftLastAccessTime.dwHighDateTime=0x1d5f018, ftLastWriteTime.dwLowDateTime=0xce382c0d, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x27d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3WQMoZqxtfxvMQK.mp4.UGMH", cAlternateFileName="3WQMOZ~1.UGM")) returned 1 [0099.909] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4db09090, ftCreationTime.dwHighDateTime=0x1d5e812, ftLastAccessTime.dwLowDateTime=0xde395ab0, ftLastAccessTime.dwHighDateTime=0x1d5e4b2, ftLastWriteTime.dwLowDateTime=0xde395ab0, ftLastWriteTime.dwHighDateTime=0x1d5e4b2, nFileSizeHigh=0x0, nFileSizeLow=0xd47a, dwReserved0=0x0, dwReserved1=0x0, cFileName="66a_FviVPhsSRG.swf", cAlternateFileName="66A_FV~1.SWF")) returned 1 [0099.909] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x967f570, ftCreationTime.dwHighDateTime=0x1d5e3c8, ftLastAccessTime.dwLowDateTime=0x3f1b8e40, ftLastAccessTime.dwHighDateTime=0x1d5ef6a, ftLastWriteTime.dwLowDateTime=0xce5264a9, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xf260, dwReserved0=0x0, dwReserved1=0x0, cFileName="6iCPTll49y.avi.UGMH", cAlternateFileName="6ICPTL~1.UGM")) returned 1 [0099.909] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3b066c0, ftCreationTime.dwHighDateTime=0x1d5e706, ftLastAccessTime.dwLowDateTime=0x537f6170, ftLastAccessTime.dwHighDateTime=0x1d5e729, ftLastWriteTime.dwLowDateTime=0x537f6170, ftLastWriteTime.dwHighDateTime=0x1d5e729, nFileSizeHigh=0x0, nFileSizeLow=0x16e35, dwReserved0=0x0, dwReserved1=0x0, cFileName="8QmOZ6BwfJ6Z.flv", cAlternateFileName="8QMOZ6~1.FLV")) returned 1 [0099.910] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0099.910] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e658460, ftCreationTime.dwHighDateTime=0x1d5ee0e, ftLastAccessTime.dwLowDateTime=0x319057b0, ftLastAccessTime.dwHighDateTime=0x1d5e754, ftLastWriteTime.dwLowDateTime=0xce8963a9, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x16ad0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DPDskqIc2.mkv.UGMH", cAlternateFileName="DPDSKQ~1.UGM")) returned 1 [0099.910] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcecad450, ftCreationTime.dwHighDateTime=0x1d5ece6, ftLastAccessTime.dwLowDateTime=0x61823020, ftLastAccessTime.dwHighDateTime=0x1d5eba9, ftLastWriteTime.dwLowDateTime=0xce98bdf3, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x1110, dwReserved0=0x0, dwReserved1=0x0, cFileName="eA-CcPkssw4kHgXe.bmp.UGMH", cAlternateFileName="EA-CCP~1.UGM")) returned 1 [0099.910] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b59a0e0, ftCreationTime.dwHighDateTime=0x1d5e30c, ftLastAccessTime.dwLowDateTime=0x8378c5f0, ftLastAccessTime.dwHighDateTime=0x1d5e365, ftLastWriteTime.dwLowDateTime=0xce9b216a, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x9dd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eAGGa29zIdAHHTYD9.xlsx.UGMH", cAlternateFileName="EAGGA2~1.UGM")) returned 1 [0099.910] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35a198d0, ftCreationTime.dwHighDateTime=0x1d5e715, ftLastAccessTime.dwLowDateTime=0xcac26da0, ftLastAccessTime.dwHighDateTime=0x1d5e5a2, ftLastWriteTime.dwLowDateTime=0xcac26da0, ftLastWriteTime.dwHighDateTime=0x1d5e5a2, nFileSizeHigh=0x0, nFileSizeLow=0x5e95, dwReserved0=0x0, dwReserved1=0x0, cFileName="EJOJDrrWOuUMEJw.m4a", cAlternateFileName="EJOJDR~1.M4A")) returned 1 [0099.910] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83716aa0, ftCreationTime.dwHighDateTime=0x1d5e791, ftLastAccessTime.dwLowDateTime=0xb33ea890, ftLastAccessTime.dwHighDateTime=0x1d5ef5e, ftLastWriteTime.dwLowDateTime=0xceae3440, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xc530, dwReserved0=0x0, dwReserved1=0x0, cFileName="E_cmfpG.mp3.UGMH", cAlternateFileName="E_CMFP~1.UGM")) returned 1 [0099.910] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6062f570, ftCreationTime.dwHighDateTime=0x1d5e5bf, ftLastAccessTime.dwLowDateTime=0x6e4d0c80, ftLastAccessTime.dwHighDateTime=0x1d5e41f, ftLastWriteTime.dwLowDateTime=0x6e4d0c80, ftLastWriteTime.dwHighDateTime=0x1d5e41f, nFileSizeHigh=0x0, nFileSizeLow=0x3235, dwReserved0=0x0, dwReserved1=0x0, cFileName="GcUvkFGPjBDuY6Da.m4a", cAlternateFileName="GCUVKF~1.M4A")) returned 1 [0099.911] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdf9a4c0, ftCreationTime.dwHighDateTime=0x1d5eb3d, ftLastAccessTime.dwLowDateTime=0x3492b6a0, ftLastAccessTime.dwHighDateTime=0x1d5ed04, ftLastWriteTime.dwLowDateTime=0xcedde341, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xc640, dwReserved0=0x0, dwReserved1=0x0, cFileName="geNLXx1UJHj5cvhn.mp4.UGMH", cAlternateFileName="GENLXX~1.UGM")) returned 1 [0099.911] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec7fbe00, ftCreationTime.dwHighDateTime=0x1d5ec93, ftLastAccessTime.dwLowDateTime=0xb3a443c0, ftLastAccessTime.dwHighDateTime=0x1d5ed93, ftLastWriteTime.dwLowDateTime=0xb3a443c0, ftLastWriteTime.dwHighDateTime=0x1d5ed93, nFileSizeHigh=0x0, nFileSizeLow=0x13392, dwReserved0=0x0, dwReserved1=0x0, cFileName="gwqVZvHz5I_z_.m4a", cAlternateFileName="GWQVZV~1.M4A")) returned 1 [0099.911] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x970d56b0, ftCreationTime.dwHighDateTime=0x1d5e9d4, ftLastAccessTime.dwLowDateTime=0xe1ec8d50, ftLastAccessTime.dwHighDateTime=0x1d5ea05, ftLastWriteTime.dwLowDateTime=0xe1ec8d50, ftLastWriteTime.dwHighDateTime=0x1d5ea05, nFileSizeHigh=0x0, nFileSizeLow=0x140be, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieRIe2k_x6kM51eV.pps", cAlternateFileName="IERIE2~1.PPS")) returned 1 [0099.911] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x246c8560, ftCreationTime.dwHighDateTime=0x1d5e176, ftLastAccessTime.dwLowDateTime=0xf9bca810, ftLastAccessTime.dwHighDateTime=0x1d5eb96, ftLastWriteTime.dwLowDateTime=0xcef3584a, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x10ee0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IKlpA0NfijVXH.png.UGMH", cAlternateFileName="IKLPA0~1.UGM")) returned 1 [0099.911] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29b98d20, ftCreationTime.dwHighDateTime=0x1d5edb4, ftLastAccessTime.dwLowDateTime=0xbcc63b30, ftLastAccessTime.dwHighDateTime=0x1d5e10d, ftLastWriteTime.dwLowDateTime=0xbcc63b30, ftLastWriteTime.dwHighDateTime=0x1d5e10d, nFileSizeHigh=0x0, nFileSizeLow=0x13eb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITcW0ZQZpCR4cr.m4a", cAlternateFileName="ITCW0Z~1.M4A")) returned 1 [0099.911] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4859fc00, ftCreationTime.dwHighDateTime=0x1d5e0ef, ftLastAccessTime.dwLowDateTime=0x3155e710, ftLastAccessTime.dwHighDateTime=0x1d5ed44, ftLastWriteTime.dwLowDateTime=0xcf1be09d, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x6e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="IUfRKqu81Ri.mp3.UGMH", cAlternateFileName="IUFRKQ~1.UGM")) returned 1 [0099.911] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d0d99b0, ftCreationTime.dwHighDateTime=0x1d5f0c6, ftLastAccessTime.dwLowDateTime=0x98c8c640, ftLastAccessTime.dwHighDateTime=0x1d5ea6c, ftLastWriteTime.dwLowDateTime=0xcf492d17, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x13f10, dwReserved0=0x0, dwReserved1=0x0, cFileName="kDNWA.avi.UGMH", cAlternateFileName="KDNWAA~1.UGM")) returned 1 [0099.912] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f568d70, ftCreationTime.dwHighDateTime=0x1d5e8ff, ftLastAccessTime.dwLowDateTime=0x137d8aa0, ftLastAccessTime.dwHighDateTime=0x1d5e9d8, ftLastWriteTime.dwLowDateTime=0x137d8aa0, ftLastWriteTime.dwHighDateTime=0x1d5e9d8, nFileSizeHigh=0x0, nFileSizeLow=0x126e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="kO2D0WzDoiPh0Aq.swf", cAlternateFileName="KO2D0W~1.SWF")) returned 1 [0099.912] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb00f0640, ftCreationTime.dwHighDateTime=0x1d5e6c8, ftLastAccessTime.dwLowDateTime=0x2052d350, ftLastAccessTime.dwHighDateTime=0x1d5eaca, ftLastWriteTime.dwLowDateTime=0xcf8265f1, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xde0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kpKG IbF.mp3.UGMH", cAlternateFileName="KPKGIB~1.UGM")) returned 1 [0099.912] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c996af0, ftCreationTime.dwHighDateTime=0x1d5eeb9, ftLastAccessTime.dwLowDateTime=0x686e5dc0, ftLastAccessTime.dwHighDateTime=0x1d5ec06, ftLastWriteTime.dwLowDateTime=0x686e5dc0, ftLastWriteTime.dwHighDateTime=0x1d5ec06, nFileSizeHigh=0x0, nFileSizeLow=0xd2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lcz8MH.wav", cAlternateFileName="")) returned 1 [0099.912] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f10bb30, ftCreationTime.dwHighDateTime=0x1d5edf0, ftLastAccessTime.dwLowDateTime=0x97da86d0, ftLastAccessTime.dwHighDateTime=0x1d5f0dc, ftLastWriteTime.dwLowDateTime=0xcfc2c50c, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xd760, dwReserved0=0x0, dwReserved1=0x0, cFileName="n67Tv9.mp3.UGMH", cAlternateFileName="N67TV9~1.UGM")) returned 1 [0099.912] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54bb0290, ftCreationTime.dwHighDateTime=0x1d5ecb7, ftLastAccessTime.dwLowDateTime=0x493fcd40, ftLastAccessTime.dwHighDateTime=0x1d5edd6, ftLastWriteTime.dwLowDateTime=0xd000c1fe, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x3310, dwReserved0=0x0, dwReserved1=0x0, cFileName="nEUOkP9.mp4.UGMH", cAlternateFileName="NEUOKP~1.UGM")) returned 1 [0099.912] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87b82b40, ftCreationTime.dwHighDateTime=0x1d5e600, ftLastAccessTime.dwLowDateTime=0x67493ed0, ftLastAccessTime.dwHighDateTime=0x1d5ef60, ftLastWriteTime.dwLowDateTime=0xd005a59e, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x4b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="NmC1S11.png.UGMH", cAlternateFileName="NMC1S1~1.UGM")) returned 1 [0099.912] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a5a30, ftCreationTime.dwHighDateTime=0x1d5e90a, ftLastAccessTime.dwLowDateTime=0x17978470, ftLastAccessTime.dwHighDateTime=0x1d5ecb1, ftLastWriteTime.dwLowDateTime=0xd01b26f0, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x13040, dwReserved0=0x0, dwReserved1=0x0, cFileName="NsB5NpMvHsgPQiue-.png.UGMH", cAlternateFileName="NSB5NP~1.UGM")) returned 1 [0099.912] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x460533d0, ftCreationTime.dwHighDateTime=0x1d5e7c4, ftLastAccessTime.dwLowDateTime=0xea127280, ftLastAccessTime.dwHighDateTime=0x1d5f0fc, ftLastWriteTime.dwLowDateTime=0xd043c2d1, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x1150, dwReserved0=0x0, dwReserved1=0x0, cFileName="NvL60GwqP.ppt.UGMH", cAlternateFileName="NVL60G~1.UGM")) returned 1 [0099.913] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd83c1fe0, ftCreationTime.dwHighDateTime=0x1d5e524, ftLastAccessTime.dwLowDateTime=0x28872fe0, ftLastAccessTime.dwHighDateTime=0x1d5e2f9, ftLastWriteTime.dwLowDateTime=0xd0604ac1, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x6320, dwReserved0=0x0, dwReserved1=0x0, cFileName="tEL KEKy5u2J3QD3I7.bmp.UGMH", cAlternateFileName="TELKEK~1.UGM")) returned 1 [0099.913] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85edca0, ftCreationTime.dwHighDateTime=0x1d5e989, ftLastAccessTime.dwLowDateTime=0xd168f285, ftLastAccessTime.dwHighDateTime=0x1d68033, ftLastWriteTime.dwLowDateTime=0xd168f285, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uJvn1eNK", cAlternateFileName="")) returned 1 [0099.913] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x715bfa20, ftCreationTime.dwHighDateTime=0x1d5e9c5, ftLastAccessTime.dwLowDateTime=0x49469ec0, ftLastAccessTime.dwHighDateTime=0x1d5e86a, ftLastWriteTime.dwLowDateTime=0xd0710c6b, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x6c10, dwReserved0=0x0, dwReserved1=0x0, cFileName="ux3rT5FNwZkNBWR.bmp.UGMH", cAlternateFileName="UX3RT5~1.UGM")) returned 1 [0099.913] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe178cf10, ftCreationTime.dwHighDateTime=0x1d5ebd5, ftLastAccessTime.dwLowDateTime=0x3ce81850, ftLastAccessTime.dwHighDateTime=0x1d5e91b, ftLastWriteTime.dwLowDateTime=0xd0a0accc, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x10ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="V89ICi2G.pdf.UGMH", cAlternateFileName="V89ICI~1.UGM")) returned 1 [0099.913] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a653a0, ftCreationTime.dwHighDateTime=0x1d5e142, ftLastAccessTime.dwLowDateTime=0x505d7360, ftLastAccessTime.dwHighDateTime=0x1d5e5e9, ftLastWriteTime.dwLowDateTime=0x505d7360, ftLastWriteTime.dwHighDateTime=0x1d5e5e9, nFileSizeHigh=0x0, nFileSizeLow=0xaed1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vaxq5.gif", cAlternateFileName="")) returned 1 [0099.913] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x486880d0, ftCreationTime.dwHighDateTime=0x1d5f0db, ftLastAccessTime.dwLowDateTime=0x35546b70, ftLastAccessTime.dwHighDateTime=0x1d5eb00, ftLastWriteTime.dwLowDateTime=0xd0b88541, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x79a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vzq8yByGgLRh.mkv.UGMH", cAlternateFileName="VZQ8YB~1.UGM")) returned 1 [0099.913] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd634fdd0, ftCreationTime.dwHighDateTime=0x1d5eacd, ftLastAccessTime.dwLowDateTime=0xe05ca060, ftLastAccessTime.dwHighDateTime=0x1d5ede8, ftLastWriteTime.dwLowDateTime=0xd0cb9762, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x101a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="w-tMU4AmH_pKak.png.UGMH", cAlternateFileName="W-TMU4~1.UGM")) returned 1 [0099.914] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2272e0, ftCreationTime.dwHighDateTime=0x1d5e57b, ftLastAccessTime.dwLowDateTime=0x75458d50, ftLastAccessTime.dwHighDateTime=0x1d5e0e6, ftLastWriteTime.dwLowDateTime=0x75458d50, ftLastWriteTime.dwHighDateTime=0x1d5e0e6, nFileSizeHigh=0x0, nFileSizeLow=0x2d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="XbMXvFNLh2Gmyt iVhk.gif", cAlternateFileName="XBMXVF~1.GIF")) returned 1 [0099.914] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb53e15a0, ftCreationTime.dwHighDateTime=0x1d5e909, ftLastAccessTime.dwLowDateTime=0xdce4fbc0, ftLastAccessTime.dwHighDateTime=0x1d5e556, ftLastWriteTime.dwLowDateTime=0xd0dea8d8, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x14680, dwReserved0=0x0, dwReserved1=0x0, cFileName="XduHjTYUvMSMI6_qg.bmp.UGMH", cAlternateFileName="XDUHJT~1.UGM")) returned 1 [0099.914] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43720150, ftCreationTime.dwHighDateTime=0x1d5eb9f, ftLastAccessTime.dwLowDateTime=0xd67bc5e0, ftLastAccessTime.dwHighDateTime=0x1d5e55e, ftLastWriteTime.dwLowDateTime=0xd0e3ba52, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xdb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="xkHvjMU.bmp.UGMH", cAlternateFileName="XKHVJM~1.UGM")) returned 1 [0099.914] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x925d8340, ftCreationTime.dwHighDateTime=0x1d5ef03, ftLastAccessTime.dwLowDateTime=0x41db40, ftLastAccessTime.dwHighDateTime=0x1d5e298, ftLastWriteTime.dwLowDateTime=0x41db40, ftLastWriteTime.dwHighDateTime=0x1d5e298, nFileSizeHigh=0x0, nFileSizeLow=0x170d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="xW3hq1GBEdp.flv", cAlternateFileName="XW3HQ1~1.FLV")) returned 1 [0099.914] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92e813b0, ftCreationTime.dwHighDateTime=0x1d5eb58, ftLastAccessTime.dwLowDateTime=0x78110b50, ftLastAccessTime.dwHighDateTime=0x1d5edc9, ftLastWriteTime.dwLowDateTime=0x78110b50, ftLastWriteTime.dwHighDateTime=0x1d5edc9, nFileSizeHigh=0x0, nFileSizeLow=0x5a35, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZimQCQi8Z.gif", cAlternateFileName="ZIMQCQ~1.GIF")) returned 1 [0099.914] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37432900, ftCreationTime.dwHighDateTime=0x1d5e8c4, ftLastAccessTime.dwLowDateTime=0x908c1400, ftLastAccessTime.dwHighDateTime=0x1d5e120, ftLastWriteTime.dwLowDateTime=0x908c1400, ftLastWriteTime.dwHighDateTime=0x1d5e120, nFileSizeHigh=0x0, nFileSizeLow=0x5c29, dwReserved0=0x0, dwReserved1=0x0, cFileName="_T kudUg.m4a", cAlternateFileName="_TKUDU~1.M4A")) returned 1 [0099.914] FindNextFileW (in: hFindFile=0x81506a8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0099.915] FindClose (in: hFindFile=0x81506a8 | out: hFindFile=0x81506a8) returned 1 [0099.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebc4) returned 1 [0099.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebd0) returned 1 [0099.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec08) returned 1 [0099.915] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x105, lpBuffer=0xefe6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0099.915] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\*", lpFindFileData=0xefe930 | out: lpFindFileData=0xefe930*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd0e3ba52, ftLastAccessTime.dwHighDateTime=0x1d68033, ftLastWriteTime.dwLowDateTime=0xd0e3ba52, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x81504e8 [0099.915] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd0e3ba52, ftLastAccessTime.dwHighDateTime=0x1d68033, ftLastWriteTime.dwLowDateTime=0xd0e3ba52, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.915] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x234ac530, ftCreationTime.dwHighDateTime=0x1d5e9db, ftLastAccessTime.dwLowDateTime=0xfa88cb10, ftLastAccessTime.dwHighDateTime=0x1d5ec2d, ftLastWriteTime.dwLowDateTime=0xcdf0a3a4, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x13320, dwReserved0=0x0, dwReserved1=0x0, cFileName="-hNL3OcngCIZAr219.avi.UGMH", cAlternateFileName="-HNL3O~1.UGM")) returned 1 [0099.915] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8c04650, ftCreationTime.dwHighDateTime=0x1d5ef92, ftLastAccessTime.dwLowDateTime=0x85fef200, ftLastAccessTime.dwHighDateTime=0x1d5e1ac, ftLastWriteTime.dwLowDateTime=0x85fef200, ftLastWriteTime.dwHighDateTime=0x1d5e1ac, nFileSizeHigh=0x0, nFileSizeLow=0x1721b, dwReserved0=0x0, dwReserved1=0x0, cFileName="2giC_j.wav", cAlternateFileName="")) returned 1 [0099.916] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61881a30, ftCreationTime.dwHighDateTime=0x1d5f0a4, ftLastAccessTime.dwLowDateTime=0x14a50ca0, ftLastAccessTime.dwHighDateTime=0x1d5f018, ftLastWriteTime.dwLowDateTime=0xce382c0d, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x27d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3WQMoZqxtfxvMQK.mp4.UGMH", cAlternateFileName="3WQMOZ~1.UGM")) returned 1 [0099.916] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4db09090, ftCreationTime.dwHighDateTime=0x1d5e812, ftLastAccessTime.dwLowDateTime=0xde395ab0, ftLastAccessTime.dwHighDateTime=0x1d5e4b2, ftLastWriteTime.dwLowDateTime=0xde395ab0, ftLastWriteTime.dwHighDateTime=0x1d5e4b2, nFileSizeHigh=0x0, nFileSizeLow=0xd47a, dwReserved0=0x0, dwReserved1=0x0, cFileName="66a_FviVPhsSRG.swf", cAlternateFileName="66A_FV~1.SWF")) returned 1 [0099.916] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x967f570, ftCreationTime.dwHighDateTime=0x1d5e3c8, ftLastAccessTime.dwLowDateTime=0x3f1b8e40, ftLastAccessTime.dwHighDateTime=0x1d5ef6a, ftLastWriteTime.dwLowDateTime=0xce5264a9, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xf260, dwReserved0=0x0, dwReserved1=0x0, cFileName="6iCPTll49y.avi.UGMH", cAlternateFileName="6ICPTL~1.UGM")) returned 1 [0099.916] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3b066c0, ftCreationTime.dwHighDateTime=0x1d5e706, ftLastAccessTime.dwLowDateTime=0x537f6170, ftLastAccessTime.dwHighDateTime=0x1d5e729, ftLastWriteTime.dwLowDateTime=0x537f6170, ftLastWriteTime.dwHighDateTime=0x1d5e729, nFileSizeHigh=0x0, nFileSizeLow=0x16e35, dwReserved0=0x0, dwReserved1=0x0, cFileName="8QmOZ6BwfJ6Z.flv", cAlternateFileName="8QMOZ6~1.FLV")) returned 1 [0099.916] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0099.916] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e658460, ftCreationTime.dwHighDateTime=0x1d5ee0e, ftLastAccessTime.dwLowDateTime=0x319057b0, ftLastAccessTime.dwHighDateTime=0x1d5e754, ftLastWriteTime.dwLowDateTime=0xce8963a9, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x16ad0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DPDskqIc2.mkv.UGMH", cAlternateFileName="DPDSKQ~1.UGM")) returned 1 [0099.916] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcecad450, ftCreationTime.dwHighDateTime=0x1d5ece6, ftLastAccessTime.dwLowDateTime=0x61823020, ftLastAccessTime.dwHighDateTime=0x1d5eba9, ftLastWriteTime.dwLowDateTime=0xce98bdf3, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x1110, dwReserved0=0x0, dwReserved1=0x0, cFileName="eA-CcPkssw4kHgXe.bmp.UGMH", cAlternateFileName="EA-CCP~1.UGM")) returned 1 [0099.917] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b59a0e0, ftCreationTime.dwHighDateTime=0x1d5e30c, ftLastAccessTime.dwLowDateTime=0x8378c5f0, ftLastAccessTime.dwHighDateTime=0x1d5e365, ftLastWriteTime.dwLowDateTime=0xce9b216a, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x9dd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eAGGa29zIdAHHTYD9.xlsx.UGMH", cAlternateFileName="EAGGA2~1.UGM")) returned 1 [0099.917] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35a198d0, ftCreationTime.dwHighDateTime=0x1d5e715, ftLastAccessTime.dwLowDateTime=0xcac26da0, ftLastAccessTime.dwHighDateTime=0x1d5e5a2, ftLastWriteTime.dwLowDateTime=0xcac26da0, ftLastWriteTime.dwHighDateTime=0x1d5e5a2, nFileSizeHigh=0x0, nFileSizeLow=0x5e95, dwReserved0=0x0, dwReserved1=0x0, cFileName="EJOJDrrWOuUMEJw.m4a", cAlternateFileName="EJOJDR~1.M4A")) returned 1 [0099.917] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83716aa0, ftCreationTime.dwHighDateTime=0x1d5e791, ftLastAccessTime.dwLowDateTime=0xb33ea890, ftLastAccessTime.dwHighDateTime=0x1d5ef5e, ftLastWriteTime.dwLowDateTime=0xceae3440, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xc530, dwReserved0=0x0, dwReserved1=0x0, cFileName="E_cmfpG.mp3.UGMH", cAlternateFileName="E_CMFP~1.UGM")) returned 1 [0099.917] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6062f570, ftCreationTime.dwHighDateTime=0x1d5e5bf, ftLastAccessTime.dwLowDateTime=0x6e4d0c80, ftLastAccessTime.dwHighDateTime=0x1d5e41f, ftLastWriteTime.dwLowDateTime=0x6e4d0c80, ftLastWriteTime.dwHighDateTime=0x1d5e41f, nFileSizeHigh=0x0, nFileSizeLow=0x3235, dwReserved0=0x0, dwReserved1=0x0, cFileName="GcUvkFGPjBDuY6Da.m4a", cAlternateFileName="GCUVKF~1.M4A")) returned 1 [0099.917] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdf9a4c0, ftCreationTime.dwHighDateTime=0x1d5eb3d, ftLastAccessTime.dwLowDateTime=0x3492b6a0, ftLastAccessTime.dwHighDateTime=0x1d5ed04, ftLastWriteTime.dwLowDateTime=0xcedde341, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xc640, dwReserved0=0x0, dwReserved1=0x0, cFileName="geNLXx1UJHj5cvhn.mp4.UGMH", cAlternateFileName="GENLXX~1.UGM")) returned 1 [0099.918] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec7fbe00, ftCreationTime.dwHighDateTime=0x1d5ec93, ftLastAccessTime.dwLowDateTime=0xb3a443c0, ftLastAccessTime.dwHighDateTime=0x1d5ed93, ftLastWriteTime.dwLowDateTime=0xb3a443c0, ftLastWriteTime.dwHighDateTime=0x1d5ed93, nFileSizeHigh=0x0, nFileSizeLow=0x13392, dwReserved0=0x0, dwReserved1=0x0, cFileName="gwqVZvHz5I_z_.m4a", cAlternateFileName="GWQVZV~1.M4A")) returned 1 [0099.918] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x970d56b0, ftCreationTime.dwHighDateTime=0x1d5e9d4, ftLastAccessTime.dwLowDateTime=0xe1ec8d50, ftLastAccessTime.dwHighDateTime=0x1d5ea05, ftLastWriteTime.dwLowDateTime=0xe1ec8d50, ftLastWriteTime.dwHighDateTime=0x1d5ea05, nFileSizeHigh=0x0, nFileSizeLow=0x140be, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieRIe2k_x6kM51eV.pps", cAlternateFileName="IERIE2~1.PPS")) returned 1 [0099.918] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x246c8560, ftCreationTime.dwHighDateTime=0x1d5e176, ftLastAccessTime.dwLowDateTime=0xf9bca810, ftLastAccessTime.dwHighDateTime=0x1d5eb96, ftLastWriteTime.dwLowDateTime=0xcef3584a, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x10ee0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IKlpA0NfijVXH.png.UGMH", cAlternateFileName="IKLPA0~1.UGM")) returned 1 [0099.918] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29b98d20, ftCreationTime.dwHighDateTime=0x1d5edb4, ftLastAccessTime.dwLowDateTime=0xbcc63b30, ftLastAccessTime.dwHighDateTime=0x1d5e10d, ftLastWriteTime.dwLowDateTime=0xbcc63b30, ftLastWriteTime.dwHighDateTime=0x1d5e10d, nFileSizeHigh=0x0, nFileSizeLow=0x13eb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITcW0ZQZpCR4cr.m4a", cAlternateFileName="ITCW0Z~1.M4A")) returned 1 [0099.918] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4859fc00, ftCreationTime.dwHighDateTime=0x1d5e0ef, ftLastAccessTime.dwLowDateTime=0x3155e710, ftLastAccessTime.dwHighDateTime=0x1d5ed44, ftLastWriteTime.dwLowDateTime=0xcf1be09d, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x6e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="IUfRKqu81Ri.mp3.UGMH", cAlternateFileName="IUFRKQ~1.UGM")) returned 1 [0099.918] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d0d99b0, ftCreationTime.dwHighDateTime=0x1d5f0c6, ftLastAccessTime.dwLowDateTime=0x98c8c640, ftLastAccessTime.dwHighDateTime=0x1d5ea6c, ftLastWriteTime.dwLowDateTime=0xcf492d17, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x13f10, dwReserved0=0x0, dwReserved1=0x0, cFileName="kDNWA.avi.UGMH", cAlternateFileName="KDNWAA~1.UGM")) returned 1 [0099.919] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f568d70, ftCreationTime.dwHighDateTime=0x1d5e8ff, ftLastAccessTime.dwLowDateTime=0x137d8aa0, ftLastAccessTime.dwHighDateTime=0x1d5e9d8, ftLastWriteTime.dwLowDateTime=0x137d8aa0, ftLastWriteTime.dwHighDateTime=0x1d5e9d8, nFileSizeHigh=0x0, nFileSizeLow=0x126e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="kO2D0WzDoiPh0Aq.swf", cAlternateFileName="KO2D0W~1.SWF")) returned 1 [0099.919] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb00f0640, ftCreationTime.dwHighDateTime=0x1d5e6c8, ftLastAccessTime.dwLowDateTime=0x2052d350, ftLastAccessTime.dwHighDateTime=0x1d5eaca, ftLastWriteTime.dwLowDateTime=0xcf8265f1, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xde0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kpKG IbF.mp3.UGMH", cAlternateFileName="KPKGIB~1.UGM")) returned 1 [0099.919] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c996af0, ftCreationTime.dwHighDateTime=0x1d5eeb9, ftLastAccessTime.dwLowDateTime=0x686e5dc0, ftLastAccessTime.dwHighDateTime=0x1d5ec06, ftLastWriteTime.dwLowDateTime=0x686e5dc0, ftLastWriteTime.dwHighDateTime=0x1d5ec06, nFileSizeHigh=0x0, nFileSizeLow=0xd2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lcz8MH.wav", cAlternateFileName="")) returned 1 [0099.919] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f10bb30, ftCreationTime.dwHighDateTime=0x1d5edf0, ftLastAccessTime.dwLowDateTime=0x97da86d0, ftLastAccessTime.dwHighDateTime=0x1d5f0dc, ftLastWriteTime.dwLowDateTime=0xcfc2c50c, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xd760, dwReserved0=0x0, dwReserved1=0x0, cFileName="n67Tv9.mp3.UGMH", cAlternateFileName="N67TV9~1.UGM")) returned 1 [0099.919] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54bb0290, ftCreationTime.dwHighDateTime=0x1d5ecb7, ftLastAccessTime.dwLowDateTime=0x493fcd40, ftLastAccessTime.dwHighDateTime=0x1d5edd6, ftLastWriteTime.dwLowDateTime=0xd000c1fe, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x3310, dwReserved0=0x0, dwReserved1=0x0, cFileName="nEUOkP9.mp4.UGMH", cAlternateFileName="NEUOKP~1.UGM")) returned 1 [0099.919] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87b82b40, ftCreationTime.dwHighDateTime=0x1d5e600, ftLastAccessTime.dwLowDateTime=0x67493ed0, ftLastAccessTime.dwHighDateTime=0x1d5ef60, ftLastWriteTime.dwLowDateTime=0xd005a59e, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x4b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="NmC1S11.png.UGMH", cAlternateFileName="NMC1S1~1.UGM")) returned 1 [0099.919] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a5a30, ftCreationTime.dwHighDateTime=0x1d5e90a, ftLastAccessTime.dwLowDateTime=0x17978470, ftLastAccessTime.dwHighDateTime=0x1d5ecb1, ftLastWriteTime.dwLowDateTime=0xd01b26f0, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x13040, dwReserved0=0x0, dwReserved1=0x0, cFileName="NsB5NpMvHsgPQiue-.png.UGMH", cAlternateFileName="NSB5NP~1.UGM")) returned 1 [0099.920] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x460533d0, ftCreationTime.dwHighDateTime=0x1d5e7c4, ftLastAccessTime.dwLowDateTime=0xea127280, ftLastAccessTime.dwHighDateTime=0x1d5f0fc, ftLastWriteTime.dwLowDateTime=0xd043c2d1, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x1150, dwReserved0=0x0, dwReserved1=0x0, cFileName="NvL60GwqP.ppt.UGMH", cAlternateFileName="NVL60G~1.UGM")) returned 1 [0099.920] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd83c1fe0, ftCreationTime.dwHighDateTime=0x1d5e524, ftLastAccessTime.dwLowDateTime=0x28872fe0, ftLastAccessTime.dwHighDateTime=0x1d5e2f9, ftLastWriteTime.dwLowDateTime=0xd0604ac1, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x6320, dwReserved0=0x0, dwReserved1=0x0, cFileName="tEL KEKy5u2J3QD3I7.bmp.UGMH", cAlternateFileName="TELKEK~1.UGM")) returned 1 [0099.920] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85edca0, ftCreationTime.dwHighDateTime=0x1d5e989, ftLastAccessTime.dwLowDateTime=0xd168f285, ftLastAccessTime.dwHighDateTime=0x1d68033, ftLastWriteTime.dwLowDateTime=0xd168f285, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uJvn1eNK", cAlternateFileName="")) returned 1 [0099.920] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x715bfa20, ftCreationTime.dwHighDateTime=0x1d5e9c5, ftLastAccessTime.dwLowDateTime=0x49469ec0, ftLastAccessTime.dwHighDateTime=0x1d5e86a, ftLastWriteTime.dwLowDateTime=0xd0710c6b, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x6c10, dwReserved0=0x0, dwReserved1=0x0, cFileName="ux3rT5FNwZkNBWR.bmp.UGMH", cAlternateFileName="UX3RT5~1.UGM")) returned 1 [0099.920] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe178cf10, ftCreationTime.dwHighDateTime=0x1d5ebd5, ftLastAccessTime.dwLowDateTime=0x3ce81850, ftLastAccessTime.dwHighDateTime=0x1d5e91b, ftLastWriteTime.dwLowDateTime=0xd0a0accc, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x10ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="V89ICi2G.pdf.UGMH", cAlternateFileName="V89ICI~1.UGM")) returned 1 [0099.920] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a653a0, ftCreationTime.dwHighDateTime=0x1d5e142, ftLastAccessTime.dwLowDateTime=0x505d7360, ftLastAccessTime.dwHighDateTime=0x1d5e5e9, ftLastWriteTime.dwLowDateTime=0x505d7360, ftLastWriteTime.dwHighDateTime=0x1d5e5e9, nFileSizeHigh=0x0, nFileSizeLow=0xaed1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vaxq5.gif", cAlternateFileName="")) returned 1 [0099.921] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x486880d0, ftCreationTime.dwHighDateTime=0x1d5f0db, ftLastAccessTime.dwLowDateTime=0x35546b70, ftLastAccessTime.dwHighDateTime=0x1d5eb00, ftLastWriteTime.dwLowDateTime=0xd0b88541, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x79a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vzq8yByGgLRh.mkv.UGMH", cAlternateFileName="VZQ8YB~1.UGM")) returned 1 [0099.921] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd634fdd0, ftCreationTime.dwHighDateTime=0x1d5eacd, ftLastAccessTime.dwLowDateTime=0xe05ca060, ftLastAccessTime.dwHighDateTime=0x1d5ede8, ftLastWriteTime.dwLowDateTime=0xd0cb9762, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x101a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="w-tMU4AmH_pKak.png.UGMH", cAlternateFileName="W-TMU4~1.UGM")) returned 1 [0099.921] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2272e0, ftCreationTime.dwHighDateTime=0x1d5e57b, ftLastAccessTime.dwLowDateTime=0x75458d50, ftLastAccessTime.dwHighDateTime=0x1d5e0e6, ftLastWriteTime.dwLowDateTime=0x75458d50, ftLastWriteTime.dwHighDateTime=0x1d5e0e6, nFileSizeHigh=0x0, nFileSizeLow=0x2d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="XbMXvFNLh2Gmyt iVhk.gif", cAlternateFileName="XBMXVF~1.GIF")) returned 1 [0099.921] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb53e15a0, ftCreationTime.dwHighDateTime=0x1d5e909, ftLastAccessTime.dwLowDateTime=0xdce4fbc0, ftLastAccessTime.dwHighDateTime=0x1d5e556, ftLastWriteTime.dwLowDateTime=0xd0dea8d8, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x14680, dwReserved0=0x0, dwReserved1=0x0, cFileName="XduHjTYUvMSMI6_qg.bmp.UGMH", cAlternateFileName="XDUHJT~1.UGM")) returned 1 [0099.921] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43720150, ftCreationTime.dwHighDateTime=0x1d5eb9f, ftLastAccessTime.dwLowDateTime=0xd67bc5e0, ftLastAccessTime.dwHighDateTime=0x1d5e55e, ftLastWriteTime.dwLowDateTime=0xd0e3ba52, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xdb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="xkHvjMU.bmp.UGMH", cAlternateFileName="XKHVJM~1.UGM")) returned 1 [0099.922] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x925d8340, ftCreationTime.dwHighDateTime=0x1d5ef03, ftLastAccessTime.dwLowDateTime=0x41db40, ftLastAccessTime.dwHighDateTime=0x1d5e298, ftLastWriteTime.dwLowDateTime=0x41db40, ftLastWriteTime.dwHighDateTime=0x1d5e298, nFileSizeHigh=0x0, nFileSizeLow=0x170d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="xW3hq1GBEdp.flv", cAlternateFileName="XW3HQ1~1.FLV")) returned 1 [0099.922] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92e813b0, ftCreationTime.dwHighDateTime=0x1d5eb58, ftLastAccessTime.dwLowDateTime=0x78110b50, ftLastAccessTime.dwHighDateTime=0x1d5edc9, ftLastWriteTime.dwLowDateTime=0x78110b50, ftLastWriteTime.dwHighDateTime=0x1d5edc9, nFileSizeHigh=0x0, nFileSizeLow=0x5a35, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZimQCQi8Z.gif", cAlternateFileName="ZIMQCQ~1.GIF")) returned 1 [0099.922] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37432900, ftCreationTime.dwHighDateTime=0x1d5e8c4, ftLastAccessTime.dwLowDateTime=0x908c1400, ftLastAccessTime.dwHighDateTime=0x1d5e120, ftLastWriteTime.dwLowDateTime=0x908c1400, ftLastWriteTime.dwHighDateTime=0x1d5e120, nFileSizeHigh=0x0, nFileSizeLow=0x5c29, dwReserved0=0x0, dwReserved1=0x0, cFileName="_T kudUg.m4a", cAlternateFileName="_TKUDU~1.M4A")) returned 1 [0099.922] FindNextFileW (in: hFindFile=0x81504e8, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37432900, ftCreationTime.dwHighDateTime=0x1d5e8c4, ftLastAccessTime.dwLowDateTime=0x908c1400, ftLastAccessTime.dwHighDateTime=0x1d5e120, ftLastWriteTime.dwLowDateTime=0x908c1400, ftLastWriteTime.dwHighDateTime=0x1d5e120, nFileSizeHigh=0x0, nFileSizeLow=0x5c29, dwReserved0=0x0, dwReserved1=0x0, cFileName="_T kudUg.m4a", cAlternateFileName="_TKUDU~1.M4A")) returned 0 [0099.922] FindClose (in: hFindFile=0x81504e8 | out: hFindFile=0x81504e8) returned 1 [0099.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebc4) returned 1 [0100.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebd0) returned 1 [0100.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb94) returned 1 [0100.081] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK", nBufferLength=0x105, lpBuffer=0xefe648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK", lpFilePart=0x0) returned 0x20 [0100.081] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\*", lpFindFileData=0xefe8bc | out: lpFindFileData=0xefe8bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85edca0, ftCreationTime.dwHighDateTime=0x1d5e989, ftLastAccessTime.dwLowDateTime=0xd168f285, ftLastAccessTime.dwHighDateTime=0x1d68033, ftLastWriteTime.dwLowDateTime=0xd168f285, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8150228 [0100.081] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85edca0, ftCreationTime.dwHighDateTime=0x1d5e989, ftLastAccessTime.dwLowDateTime=0xd168f285, ftLastAccessTime.dwHighDateTime=0x1d68033, ftLastWriteTime.dwLowDateTime=0xd168f285, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.081] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8c5f820, ftCreationTime.dwHighDateTime=0x1d5e67d, ftLastAccessTime.dwLowDateTime=0x54e70c60, ftLastAccessTime.dwHighDateTime=0x1d5e437, ftLastWriteTime.dwLowDateTime=0xd1000a54, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x15ed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AfgARJ.mp3.UGMH", cAlternateFileName="AFGARJ~1.UGM")) returned 1 [0100.081] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93a3fb60, ftCreationTime.dwHighDateTime=0x1d5e3de, ftLastAccessTime.dwLowDateTime=0xd4df0c90, ftLastAccessTime.dwHighDateTime=0x1d5ea92, ftLastWriteTime.dwLowDateTime=0xd104cdfe, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x7cf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apu_3HKNloAeD.pptx.UGMH", cAlternateFileName="APU_3H~1.UGM")) returned 1 [0100.081] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2db1d50, ftCreationTime.dwHighDateTime=0x1d5e32c, ftLastAccessTime.dwLowDateTime=0xa8bac20, ftLastAccessTime.dwHighDateTime=0x1d5e6c1, ftLastWriteTime.dwLowDateTime=0xd1265fd8, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x13a50, dwReserved0=0x0, dwReserved1=0x0, cFileName="F52q7h1ytKx.xls.UGMH", cAlternateFileName="F52Q7H~1.UGM")) returned 1 [0100.082] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f78a60, ftCreationTime.dwHighDateTime=0x1d5e653, ftLastAccessTime.dwLowDateTime=0x62f93050, ftLastAccessTime.dwHighDateTime=0x1d5ecc8, ftLastWriteTime.dwLowDateTime=0xd1347dbe, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x10a50, dwReserved0=0x0, dwReserved1=0x0, cFileName="huGql8L_ DP0Oe6yT.bmp.UGMH", cAlternateFileName="HUGQL8~1.UGM")) returned 1 [0100.082] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9e579f0, ftCreationTime.dwHighDateTime=0x1d5e38c, ftLastAccessTime.dwLowDateTime=0x956b4bf0, ftLastAccessTime.dwHighDateTime=0x1d5ef65, ftLastWriteTime.dwLowDateTime=0xd168f285, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xb690, dwReserved0=0x0, dwReserved1=0x0, cFileName="iDZ244LOqe122Zu.xls.UGMH", cAlternateFileName="IDZ244~1.UGM")) returned 1 [0100.082] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97a11e50, ftCreationTime.dwHighDateTime=0x1d5e50a, ftLastAccessTime.dwLowDateTime=0x471a2e50, ftLastAccessTime.dwHighDateTime=0x1d5eb8a, ftLastWriteTime.dwLowDateTime=0x471a2e50, ftLastWriteTime.dwHighDateTime=0x1d5eb8a, nFileSizeHigh=0x0, nFileSizeLow=0xb060, dwReserved0=0x0, dwReserved1=0x0, cFileName="IhDxMWn.m4a", cAlternateFileName="")) returned 1 [0100.082] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7cf0b30, ftCreationTime.dwHighDateTime=0x1d5e9cf, ftLastAccessTime.dwLowDateTime=0x7961eb70, ftLastAccessTime.dwHighDateTime=0x1d5ecaf, ftLastWriteTime.dwLowDateTime=0x7961eb70, ftLastWriteTime.dwHighDateTime=0x1d5ecaf, nFileSizeHigh=0x0, nFileSizeLow=0x835c, dwReserved0=0x0, dwReserved1=0x0, cFileName="irIR6kTqqFmhEQ.m4a", cAlternateFileName="IRIR6K~1.M4A")) returned 1 [0100.082] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9749b80, ftCreationTime.dwHighDateTime=0x1d5e4df, ftLastAccessTime.dwLowDateTime=0x220d0520, ftLastAccessTime.dwHighDateTime=0x1d5f11a, ftLastWriteTime.dwLowDateTime=0x220d0520, ftLastWriteTime.dwHighDateTime=0x1d5f11a, nFileSizeHigh=0x0, nFileSizeLow=0xb6f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="XXXL7.swf", cAlternateFileName="")) returned 1 [0100.082] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc81a40, ftCreationTime.dwHighDateTime=0x1d5ea43, ftLastAccessTime.dwLowDateTime=0x9449c120, ftLastAccessTime.dwHighDateTime=0x1d5ee7a, ftLastWriteTime.dwLowDateTime=0x9449c120, ftLastWriteTime.dwHighDateTime=0x1d5ee7a, nFileSizeHigh=0x0, nFileSizeLow=0xb5b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="YfX9Q.ots", cAlternateFileName="")) returned 1 [0100.082] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb0f7710, ftCreationTime.dwHighDateTime=0x1d5e2a6, ftLastAccessTime.dwLowDateTime=0x62d2a650, ftLastAccessTime.dwHighDateTime=0x1d5f0ca, ftLastWriteTime.dwLowDateTime=0x62d2a650, ftLastWriteTime.dwHighDateTime=0x1d5f0ca, nFileSizeHigh=0x0, nFileSizeLow=0x901f, dwReserved0=0x0, dwReserved1=0x0, cFileName="YWUfkqwJ.m4a", cAlternateFileName="")) returned 1 [0100.083] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0100.083] FindClose (in: hFindFile=0x8150228 | out: hFindFile=0x8150228) returned 1 [0100.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb50) returned 1 [0100.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb5c) returned 1 [0100.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb94) returned 1 [0100.083] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK", nBufferLength=0x105, lpBuffer=0xefe648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK", lpFilePart=0x0) returned 0x20 [0100.083] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uJvn1eNK\\*", lpFindFileData=0xefe8bc | out: lpFindFileData=0xefe8bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85edca0, ftCreationTime.dwHighDateTime=0x1d5e989, ftLastAccessTime.dwLowDateTime=0xd168f285, ftLastAccessTime.dwHighDateTime=0x1d68033, ftLastWriteTime.dwLowDateTime=0xd168f285, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8150568 [0100.083] FindNextFileW (in: hFindFile=0x8150568, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe85edca0, ftCreationTime.dwHighDateTime=0x1d5e989, ftLastAccessTime.dwLowDateTime=0xd168f285, ftLastAccessTime.dwHighDateTime=0x1d68033, ftLastWriteTime.dwLowDateTime=0xd168f285, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.083] FindNextFileW (in: hFindFile=0x8150568, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8c5f820, ftCreationTime.dwHighDateTime=0x1d5e67d, ftLastAccessTime.dwLowDateTime=0x54e70c60, ftLastAccessTime.dwHighDateTime=0x1d5e437, ftLastWriteTime.dwLowDateTime=0xd1000a54, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x15ed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AfgARJ.mp3.UGMH", cAlternateFileName="AFGARJ~1.UGM")) returned 1 [0100.084] FindNextFileW (in: hFindFile=0x8150568, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93a3fb60, ftCreationTime.dwHighDateTime=0x1d5e3de, ftLastAccessTime.dwLowDateTime=0xd4df0c90, ftLastAccessTime.dwHighDateTime=0x1d5ea92, ftLastWriteTime.dwLowDateTime=0xd104cdfe, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x7cf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apu_3HKNloAeD.pptx.UGMH", cAlternateFileName="APU_3H~1.UGM")) returned 1 [0100.084] FindNextFileW (in: hFindFile=0x8150568, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2db1d50, ftCreationTime.dwHighDateTime=0x1d5e32c, ftLastAccessTime.dwLowDateTime=0xa8bac20, ftLastAccessTime.dwHighDateTime=0x1d5e6c1, ftLastWriteTime.dwLowDateTime=0xd1265fd8, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x13a50, dwReserved0=0x0, dwReserved1=0x0, cFileName="F52q7h1ytKx.xls.UGMH", cAlternateFileName="F52Q7H~1.UGM")) returned 1 [0100.084] FindNextFileW (in: hFindFile=0x8150568, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f78a60, ftCreationTime.dwHighDateTime=0x1d5e653, ftLastAccessTime.dwLowDateTime=0x62f93050, ftLastAccessTime.dwHighDateTime=0x1d5ecc8, ftLastWriteTime.dwLowDateTime=0xd1347dbe, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x10a50, dwReserved0=0x0, dwReserved1=0x0, cFileName="huGql8L_ DP0Oe6yT.bmp.UGMH", cAlternateFileName="HUGQL8~1.UGM")) returned 1 [0100.084] FindNextFileW (in: hFindFile=0x8150568, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9e579f0, ftCreationTime.dwHighDateTime=0x1d5e38c, ftLastAccessTime.dwLowDateTime=0x956b4bf0, ftLastAccessTime.dwHighDateTime=0x1d5ef65, ftLastWriteTime.dwLowDateTime=0xd168f285, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xb690, dwReserved0=0x0, dwReserved1=0x0, cFileName="iDZ244LOqe122Zu.xls.UGMH", cAlternateFileName="IDZ244~1.UGM")) returned 1 [0100.084] FindNextFileW (in: hFindFile=0x8150568, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97a11e50, ftCreationTime.dwHighDateTime=0x1d5e50a, ftLastAccessTime.dwLowDateTime=0x471a2e50, ftLastAccessTime.dwHighDateTime=0x1d5eb8a, ftLastWriteTime.dwLowDateTime=0x471a2e50, ftLastWriteTime.dwHighDateTime=0x1d5eb8a, nFileSizeHigh=0x0, nFileSizeLow=0xb060, dwReserved0=0x0, dwReserved1=0x0, cFileName="IhDxMWn.m4a", cAlternateFileName="")) returned 1 [0100.084] FindNextFileW (in: hFindFile=0x8150568, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7cf0b30, ftCreationTime.dwHighDateTime=0x1d5e9cf, ftLastAccessTime.dwLowDateTime=0x7961eb70, ftLastAccessTime.dwHighDateTime=0x1d5ecaf, ftLastWriteTime.dwLowDateTime=0x7961eb70, ftLastWriteTime.dwHighDateTime=0x1d5ecaf, nFileSizeHigh=0x0, nFileSizeLow=0x835c, dwReserved0=0x0, dwReserved1=0x0, cFileName="irIR6kTqqFmhEQ.m4a", cAlternateFileName="IRIR6K~1.M4A")) returned 1 [0100.085] FindNextFileW (in: hFindFile=0x8150568, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9749b80, ftCreationTime.dwHighDateTime=0x1d5e4df, ftLastAccessTime.dwLowDateTime=0x220d0520, ftLastAccessTime.dwHighDateTime=0x1d5f11a, ftLastWriteTime.dwLowDateTime=0x220d0520, ftLastWriteTime.dwHighDateTime=0x1d5f11a, nFileSizeHigh=0x0, nFileSizeLow=0xb6f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="XXXL7.swf", cAlternateFileName="")) returned 1 [0100.085] FindNextFileW (in: hFindFile=0x8150568, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc81a40, ftCreationTime.dwHighDateTime=0x1d5ea43, ftLastAccessTime.dwLowDateTime=0x9449c120, ftLastAccessTime.dwHighDateTime=0x1d5ee7a, ftLastWriteTime.dwLowDateTime=0x9449c120, ftLastWriteTime.dwHighDateTime=0x1d5ee7a, nFileSizeHigh=0x0, nFileSizeLow=0xb5b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="YfX9Q.ots", cAlternateFileName="")) returned 1 [0100.085] FindNextFileW (in: hFindFile=0x8150568, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb0f7710, ftCreationTime.dwHighDateTime=0x1d5e2a6, ftLastAccessTime.dwLowDateTime=0x62d2a650, ftLastAccessTime.dwHighDateTime=0x1d5f0ca, ftLastWriteTime.dwLowDateTime=0x62d2a650, ftLastWriteTime.dwHighDateTime=0x1d5f0ca, nFileSizeHigh=0x0, nFileSizeLow=0x901f, dwReserved0=0x0, dwReserved1=0x0, cFileName="YWUfkqwJ.m4a", cAlternateFileName="")) returned 1 [0100.085] FindNextFileW (in: hFindFile=0x8150568, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb0f7710, ftCreationTime.dwHighDateTime=0x1d5e2a6, ftLastAccessTime.dwLowDateTime=0x62d2a650, ftLastAccessTime.dwHighDateTime=0x1d5f0ca, ftLastWriteTime.dwLowDateTime=0x62d2a650, ftLastWriteTime.dwHighDateTime=0x1d5f0ca, nFileSizeHigh=0x0, nFileSizeLow=0x901f, dwReserved0=0x0, dwReserved1=0x0, cFileName="YWUfkqwJ.m4a", cAlternateFileName="")) returned 0 [0100.085] FindClose (in: hFindFile=0x8150568 | out: hFindFile=0x8150568) returned 1 [0100.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb50) returned 1 [0100.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb5c) returned 1 [0100.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec08) returned 1 [0100.085] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0xefe6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0100.085] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0xefe930 | out: lpFindFileData=0xefe930*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe5fc0af4, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe5fc0af4, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8150068 [0100.086] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe5fc0af4, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe5fc0af4, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.086] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16f66420, ftCreationTime.dwHighDateTime=0x1d5e1c9, ftLastAccessTime.dwLowDateTime=0x1a5449f0, ftLastAccessTime.dwHighDateTime=0x1d56b8d, ftLastWriteTime.dwLowDateTime=0x1a5449f0, ftLastWriteTime.dwHighDateTime=0x1d56b8d, nFileSizeHigh=0x0, nFileSizeLow=0x6f38, dwReserved0=0x0, dwReserved1=0x0, cFileName="-A3FjvCXPw1dp0zdl4.docx", cAlternateFileName="-A3FJV~1.DOC")) returned 1 [0100.086] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7802b70, ftCreationTime.dwHighDateTime=0x1d5eed8, ftLastAccessTime.dwLowDateTime=0x91fc1d00, ftLastAccessTime.dwHighDateTime=0x1d5e7ea, ftLastWriteTime.dwLowDateTime=0x91fc1d00, ftLastWriteTime.dwHighDateTime=0x1d5e7ea, nFileSizeHigh=0x0, nFileSizeLow=0x17b98, dwReserved0=0x0, dwReserved1=0x0, cFileName="4Pzz.odp", cAlternateFileName="")) returned 1 [0100.086] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe46680, ftCreationTime.dwHighDateTime=0x1d5d496, ftLastAccessTime.dwLowDateTime=0xa5f0e6d0, ftLastAccessTime.dwHighDateTime=0x1d57bf5, ftLastWriteTime.dwLowDateTime=0xa5f0e6d0, ftLastWriteTime.dwHighDateTime=0x1d57bf5, nFileSizeHigh=0x0, nFileSizeLow=0xf09c, dwReserved0=0x0, dwReserved1=0x0, cFileName="6m-40aatQp3v.xlsx", cAlternateFileName="6M-40A~1.XLS")) returned 1 [0100.086] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca75b830, ftCreationTime.dwHighDateTime=0x1d5e2b8, ftLastAccessTime.dwLowDateTime=0x87cb7e40, ftLastAccessTime.dwHighDateTime=0x1d5e0f4, ftLastWriteTime.dwLowDateTime=0x87cb7e40, ftLastWriteTime.dwHighDateTime=0x1d5e0f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9WWI", cAlternateFileName="")) returned 1 [0100.086] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc23844c0, ftCreationTime.dwHighDateTime=0x1d5e674, ftLastAccessTime.dwLowDateTime=0x106abb20, ftLastAccessTime.dwHighDateTime=0x1d5eda3, ftLastWriteTime.dwLowDateTime=0x106abb20, ftLastWriteTime.dwHighDateTime=0x1d5eda3, nFileSizeHigh=0x0, nFileSizeLow=0x122a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Am31E.doc", cAlternateFileName="")) returned 1 [0100.086] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafca7440, ftCreationTime.dwHighDateTime=0x1d5edfc, ftLastAccessTime.dwLowDateTime=0x3766f630, ftLastAccessTime.dwHighDateTime=0x1d5e82b, ftLastWriteTime.dwLowDateTime=0x3766f630, ftLastWriteTime.dwHighDateTime=0x1d5e82b, nFileSizeHigh=0x0, nFileSizeLow=0x3bed, dwReserved0=0x0, dwReserved1=0x0, cFileName="C94Om.pptx", cAlternateFileName="C94OM~1.PPT")) returned 1 [0100.086] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1651d0e0, ftCreationTime.dwHighDateTime=0x1d5cdab, ftLastAccessTime.dwLowDateTime=0xf5a9530, ftLastAccessTime.dwHighDateTime=0x1d5d27c, ftLastWriteTime.dwLowDateTime=0xf5a9530, ftLastWriteTime.dwHighDateTime=0x1d5d27c, nFileSizeHigh=0x0, nFileSizeLow=0xc9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="cfg_3frcDN_.docx", cAlternateFileName="CFG_3F~1.DOC")) returned 1 [0100.086] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x9daec75b, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x55000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb", cAlternateFileName="DATABA~1.ACC")) returned 1 [0100.086] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440c5760, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440c5760, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0100.086] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d69c520, ftCreationTime.dwHighDateTime=0x1d5eb35, ftLastAccessTime.dwLowDateTime=0x7e07b190, ftLastAccessTime.dwHighDateTime=0x1d5ee77, ftLastWriteTime.dwLowDateTime=0x7e07b190, ftLastWriteTime.dwHighDateTime=0x1d5ee77, nFileSizeHigh=0x0, nFileSizeLow=0x146cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="fflB-V iD4AJY.odp", cAlternateFileName="FFLB-V~1.ODP")) returned 1 [0100.086] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4989cf20, ftCreationTime.dwHighDateTime=0x1d5ee45, ftLastAccessTime.dwLowDateTime=0x3b4e8930, ftLastAccessTime.dwHighDateTime=0x1d5eb63, ftLastWriteTime.dwLowDateTime=0x3b4e8930, ftLastWriteTime.dwHighDateTime=0x1d5eb63, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fyf3ROce0MqAXxsy", cAlternateFileName="FYF3RO~1")) returned 1 [0100.087] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8663410, ftCreationTime.dwHighDateTime=0x1d5e401, ftLastAccessTime.dwLowDateTime=0xd3b29c70, ftLastAccessTime.dwHighDateTime=0x1d5e17c, ftLastWriteTime.dwLowDateTime=0xd3b29c70, ftLastWriteTime.dwHighDateTime=0x1d5e17c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gtt6jcr9z38XE35b3n", cAlternateFileName="GTT6JC~1")) returned 1 [0100.087] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34e7bd90, ftCreationTime.dwHighDateTime=0x1d5e3c6, ftLastAccessTime.dwLowDateTime=0xbdac0970, ftLastAccessTime.dwHighDateTime=0x1d5e1e0, ftLastWriteTime.dwLowDateTime=0xbdac0970, ftLastWriteTime.dwHighDateTime=0x1d5e1e0, nFileSizeHigh=0x0, nFileSizeLow=0x88d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HLN9AR-.ppt", cAlternateFileName="")) returned 1 [0100.087] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99fd9dd0, ftCreationTime.dwHighDateTime=0x1d5794f, ftLastAccessTime.dwLowDateTime=0xe3795e90, ftLastAccessTime.dwHighDateTime=0x1d5ac9e, ftLastWriteTime.dwLowDateTime=0xe3795e90, ftLastWriteTime.dwHighDateTime=0x1d5ac9e, nFileSizeHigh=0x0, nFileSizeLow=0x19df, dwReserved0=0x0, dwReserved1=0x0, cFileName="jf46cCQHTHUr6bLu.pptx", cAlternateFileName="JF46CC~1.PPT")) returned 1 [0100.087] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bb114c0, ftCreationTime.dwHighDateTime=0x1d5b1b2, ftLastAccessTime.dwLowDateTime=0xd1dba850, ftLastAccessTime.dwHighDateTime=0x1d5d6a1, ftLastWriteTime.dwLowDateTime=0xd1dba850, ftLastWriteTime.dwHighDateTime=0x1d5d6a1, nFileSizeHigh=0x0, nFileSizeLow=0x32e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LoQPvjHxg.pptx", cAlternateFileName="LOQPVJ~1.PPT")) returned 1 [0100.087] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3374950, ftCreationTime.dwHighDateTime=0x1d5989d, ftLastAccessTime.dwLowDateTime=0xdcdfd7e0, ftLastAccessTime.dwHighDateTime=0x1d5d31c, ftLastWriteTime.dwLowDateTime=0xdcdfd7e0, ftLastWriteTime.dwHighDateTime=0x1d5d31c, nFileSizeHigh=0x0, nFileSizeLow=0x8b8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="m6mWzL3kkF98Qys.xlsx", cAlternateFileName="M6MWZL~1.XLS")) returned 1 [0100.087] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9711a50, ftCreationTime.dwHighDateTime=0x1d5a24a, ftLastAccessTime.dwLowDateTime=0xba173010, ftLastAccessTime.dwHighDateTime=0x1d5b584, ftLastWriteTime.dwLowDateTime=0xba173010, ftLastWriteTime.dwHighDateTime=0x1d5b584, nFileSizeHigh=0x0, nFileSizeLow=0x4212, dwReserved0=0x0, dwReserved1=0x0, cFileName="MFkMq.xlsx", cAlternateFileName="MFKMQ~1.XLS")) returned 1 [0100.087] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0100.087] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0100.087] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0100.087] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0100.087] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97761e80, ftCreationTime.dwHighDateTime=0x1d57e03, ftLastAccessTime.dwLowDateTime=0x2ab65050, ftLastAccessTime.dwHighDateTime=0x1d5c99c, ftLastWriteTime.dwLowDateTime=0x2ab65050, ftLastWriteTime.dwHighDateTime=0x1d5c99c, nFileSizeHigh=0x0, nFileSizeLow=0x1380e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="N_qeU.xlsx", cAlternateFileName="N_QEU~1.XLS")) returned 1 [0100.087] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x5ee892ad, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0100.087] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f4f940, ftCreationTime.dwHighDateTime=0x1d5cb7d, ftLastAccessTime.dwLowDateTime=0x3f21c580, ftLastAccessTime.dwHighDateTime=0x1d5cc9c, ftLastWriteTime.dwLowDateTime=0x3f21c580, ftLastWriteTime.dwHighDateTime=0x1d5cc9c, nFileSizeHigh=0x0, nFileSizeLow=0xfbc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PWEo-4fye6Te.xlsx", cAlternateFileName="PWEO-4~1.XLS")) returned 1 [0100.087] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ebe8380, ftCreationTime.dwHighDateTime=0x1d5cdbf, ftLastAccessTime.dwLowDateTime=0xccd56130, ftLastAccessTime.dwHighDateTime=0x1d59eab, ftLastWriteTime.dwLowDateTime=0xccd56130, ftLastWriteTime.dwHighDateTime=0x1d59eab, nFileSizeHigh=0x0, nFileSizeLow=0x18e09, dwReserved0=0x0, dwReserved1=0x0, cFileName="rCp7bOOMZeyG1.pptx", cAlternateFileName="RCP7BO~1.PPT")) returned 1 [0100.087] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16b02100, ftCreationTime.dwHighDateTime=0x1d5e245, ftLastAccessTime.dwLowDateTime=0x43f0f4b0, ftLastAccessTime.dwHighDateTime=0x1d5e983, ftLastWriteTime.dwLowDateTime=0x43f0f4b0, ftLastWriteTime.dwHighDateTime=0x1d5e983, nFileSizeHigh=0x0, nFileSizeLow=0x1514c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rv4sPh5pkOC.odp", cAlternateFileName="RV4SPH~1.ODP")) returned 1 [0100.087] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x641dca80, ftCreationTime.dwHighDateTime=0x1d5d61c, ftLastAccessTime.dwLowDateTime=0xa7c6a170, ftLastAccessTime.dwHighDateTime=0x1d5ba20, ftLastWriteTime.dwLowDateTime=0xa7c6a170, ftLastWriteTime.dwHighDateTime=0x1d5ba20, nFileSizeHigh=0x0, nFileSizeLow=0x4757, dwReserved0=0x0, dwReserved1=0x0, cFileName="sC _ 6S20Gfa3.docx", cAlternateFileName="SC_6S2~1.DOC")) returned 1 [0100.087] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58ca5190, ftCreationTime.dwHighDateTime=0x1d5e138, ftLastAccessTime.dwLowDateTime=0x9c504d70, ftLastAccessTime.dwHighDateTime=0x1d5e368, ftLastWriteTime.dwLowDateTime=0x9c504d70, ftLastWriteTime.dwHighDateTime=0x1d5e368, nFileSizeHigh=0x0, nFileSizeLow=0x119d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="tBecqP4TCoDMzd0nx.xlsx", cAlternateFileName="TBECQP~1.XLS")) returned 1 [0100.087] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49829f10, ftCreationTime.dwHighDateTime=0x1d5c8e9, ftLastAccessTime.dwLowDateTime=0x96c88460, ftLastAccessTime.dwHighDateTime=0x1d5e8f6, ftLastWriteTime.dwLowDateTime=0x96c88460, ftLastWriteTime.dwHighDateTime=0x1d5e8f6, nFileSizeHigh=0x0, nFileSizeLow=0x6515, dwReserved0=0x0, dwReserved1=0x0, cFileName="vgOo3uvsomC 6v.docx", cAlternateFileName="VGOO3U~1.DOC")) returned 1 [0100.087] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadb5ec00, ftCreationTime.dwHighDateTime=0x1d5ed13, ftLastAccessTime.dwLowDateTime=0x3c66aa10, ftLastAccessTime.dwHighDateTime=0x1d5e7ac, ftLastWriteTime.dwLowDateTime=0x3c66aa10, ftLastWriteTime.dwHighDateTime=0x1d5e7ac, nFileSizeHigh=0x0, nFileSizeLow=0x9791, dwReserved0=0x0, dwReserved1=0x0, cFileName="W3hC.ppt", cAlternateFileName="")) returned 1 [0100.087] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66365990, ftCreationTime.dwHighDateTime=0x1d56637, ftLastAccessTime.dwLowDateTime=0x52717a80, ftLastAccessTime.dwHighDateTime=0x1d5c946, ftLastWriteTime.dwLowDateTime=0x52717a80, ftLastWriteTime.dwHighDateTime=0x1d5c946, nFileSizeHigh=0x0, nFileSizeLow=0xf107, dwReserved0=0x0, dwReserved1=0x0, cFileName="wjIta66KnkjINWkE2.pptx", cAlternateFileName="WJITA6~1.PPT")) returned 1 [0100.087] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b588990, ftCreationTime.dwHighDateTime=0x1d58994, ftLastAccessTime.dwLowDateTime=0x9f0a39d0, ftLastAccessTime.dwHighDateTime=0x1d58590, ftLastWriteTime.dwLowDateTime=0x9f0a39d0, ftLastWriteTime.dwHighDateTime=0x1d58590, nFileSizeHigh=0x0, nFileSizeLow=0xc2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WKavgS-3C.pptx", cAlternateFileName="WKAVGS~1.PPT")) returned 1 [0100.088] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8634bbf0, ftCreationTime.dwHighDateTime=0x1d5c448, ftLastAccessTime.dwLowDateTime=0x44014c70, ftLastAccessTime.dwHighDateTime=0x1d5699f, ftLastWriteTime.dwLowDateTime=0x44014c70, ftLastWriteTime.dwHighDateTime=0x1d5699f, nFileSizeHigh=0x0, nFileSizeLow=0x147f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="z_jXH-7D9cZO.docx", cAlternateFileName="Z_JXH-~1.DOC")) returned 1 [0100.088] FindNextFileW (in: hFindFile=0x8150068, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0100.088] FindClose (in: hFindFile=0x8150068 | out: hFindFile=0x8150068) returned 1 [0100.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebc4) returned 1 [0100.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebd0) returned 1 [0100.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec08) returned 1 [0100.088] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0xefe6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0100.088] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0xefe930 | out: lpFindFileData=0xefe930*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe5fc0af4, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe5fc0af4, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8150228 [0100.088] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe5fc0af4, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe5fc0af4, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.088] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16f66420, ftCreationTime.dwHighDateTime=0x1d5e1c9, ftLastAccessTime.dwLowDateTime=0x1a5449f0, ftLastAccessTime.dwHighDateTime=0x1d56b8d, ftLastWriteTime.dwLowDateTime=0x1a5449f0, ftLastWriteTime.dwHighDateTime=0x1d56b8d, nFileSizeHigh=0x0, nFileSizeLow=0x6f38, dwReserved0=0x0, dwReserved1=0x0, cFileName="-A3FjvCXPw1dp0zdl4.docx", cAlternateFileName="-A3FJV~1.DOC")) returned 1 [0100.088] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7802b70, ftCreationTime.dwHighDateTime=0x1d5eed8, ftLastAccessTime.dwLowDateTime=0x91fc1d00, ftLastAccessTime.dwHighDateTime=0x1d5e7ea, ftLastWriteTime.dwLowDateTime=0x91fc1d00, ftLastWriteTime.dwHighDateTime=0x1d5e7ea, nFileSizeHigh=0x0, nFileSizeLow=0x17b98, dwReserved0=0x0, dwReserved1=0x0, cFileName="4Pzz.odp", cAlternateFileName="")) returned 1 [0100.088] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe46680, ftCreationTime.dwHighDateTime=0x1d5d496, ftLastAccessTime.dwLowDateTime=0xa5f0e6d0, ftLastAccessTime.dwHighDateTime=0x1d57bf5, ftLastWriteTime.dwLowDateTime=0xa5f0e6d0, ftLastWriteTime.dwHighDateTime=0x1d57bf5, nFileSizeHigh=0x0, nFileSizeLow=0xf09c, dwReserved0=0x0, dwReserved1=0x0, cFileName="6m-40aatQp3v.xlsx", cAlternateFileName="6M-40A~1.XLS")) returned 1 [0100.088] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca75b830, ftCreationTime.dwHighDateTime=0x1d5e2b8, ftLastAccessTime.dwLowDateTime=0x87cb7e40, ftLastAccessTime.dwHighDateTime=0x1d5e0f4, ftLastWriteTime.dwLowDateTime=0x87cb7e40, ftLastWriteTime.dwHighDateTime=0x1d5e0f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9WWI", cAlternateFileName="")) returned 1 [0100.088] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc23844c0, ftCreationTime.dwHighDateTime=0x1d5e674, ftLastAccessTime.dwLowDateTime=0x106abb20, ftLastAccessTime.dwHighDateTime=0x1d5eda3, ftLastWriteTime.dwLowDateTime=0x106abb20, ftLastWriteTime.dwHighDateTime=0x1d5eda3, nFileSizeHigh=0x0, nFileSizeLow=0x122a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Am31E.doc", cAlternateFileName="")) returned 1 [0100.088] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafca7440, ftCreationTime.dwHighDateTime=0x1d5edfc, ftLastAccessTime.dwLowDateTime=0x3766f630, ftLastAccessTime.dwHighDateTime=0x1d5e82b, ftLastWriteTime.dwLowDateTime=0x3766f630, ftLastWriteTime.dwHighDateTime=0x1d5e82b, nFileSizeHigh=0x0, nFileSizeLow=0x3bed, dwReserved0=0x0, dwReserved1=0x0, cFileName="C94Om.pptx", cAlternateFileName="C94OM~1.PPT")) returned 1 [0100.088] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1651d0e0, ftCreationTime.dwHighDateTime=0x1d5cdab, ftLastAccessTime.dwLowDateTime=0xf5a9530, ftLastAccessTime.dwHighDateTime=0x1d5d27c, ftLastWriteTime.dwLowDateTime=0xf5a9530, ftLastWriteTime.dwHighDateTime=0x1d5d27c, nFileSizeHigh=0x0, nFileSizeLow=0xc9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="cfg_3frcDN_.docx", cAlternateFileName="CFG_3F~1.DOC")) returned 1 [0100.088] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x9daec75b, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x55000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb", cAlternateFileName="DATABA~1.ACC")) returned 1 [0100.088] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440c5760, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440c5760, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0100.089] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d69c520, ftCreationTime.dwHighDateTime=0x1d5eb35, ftLastAccessTime.dwLowDateTime=0x7e07b190, ftLastAccessTime.dwHighDateTime=0x1d5ee77, ftLastWriteTime.dwLowDateTime=0x7e07b190, ftLastWriteTime.dwHighDateTime=0x1d5ee77, nFileSizeHigh=0x0, nFileSizeLow=0x146cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="fflB-V iD4AJY.odp", cAlternateFileName="FFLB-V~1.ODP")) returned 1 [0100.089] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4989cf20, ftCreationTime.dwHighDateTime=0x1d5ee45, ftLastAccessTime.dwLowDateTime=0x3b4e8930, ftLastAccessTime.dwHighDateTime=0x1d5eb63, ftLastWriteTime.dwLowDateTime=0x3b4e8930, ftLastWriteTime.dwHighDateTime=0x1d5eb63, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fyf3ROce0MqAXxsy", cAlternateFileName="FYF3RO~1")) returned 1 [0100.089] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8663410, ftCreationTime.dwHighDateTime=0x1d5e401, ftLastAccessTime.dwLowDateTime=0xd3b29c70, ftLastAccessTime.dwHighDateTime=0x1d5e17c, ftLastWriteTime.dwLowDateTime=0xd3b29c70, ftLastWriteTime.dwHighDateTime=0x1d5e17c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gtt6jcr9z38XE35b3n", cAlternateFileName="GTT6JC~1")) returned 1 [0100.089] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34e7bd90, ftCreationTime.dwHighDateTime=0x1d5e3c6, ftLastAccessTime.dwLowDateTime=0xbdac0970, ftLastAccessTime.dwHighDateTime=0x1d5e1e0, ftLastWriteTime.dwLowDateTime=0xbdac0970, ftLastWriteTime.dwHighDateTime=0x1d5e1e0, nFileSizeHigh=0x0, nFileSizeLow=0x88d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HLN9AR-.ppt", cAlternateFileName="")) returned 1 [0100.089] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99fd9dd0, ftCreationTime.dwHighDateTime=0x1d5794f, ftLastAccessTime.dwLowDateTime=0xe3795e90, ftLastAccessTime.dwHighDateTime=0x1d5ac9e, ftLastWriteTime.dwLowDateTime=0xe3795e90, ftLastWriteTime.dwHighDateTime=0x1d5ac9e, nFileSizeHigh=0x0, nFileSizeLow=0x19df, dwReserved0=0x0, dwReserved1=0x0, cFileName="jf46cCQHTHUr6bLu.pptx", cAlternateFileName="JF46CC~1.PPT")) returned 1 [0100.089] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bb114c0, ftCreationTime.dwHighDateTime=0x1d5b1b2, ftLastAccessTime.dwLowDateTime=0xd1dba850, ftLastAccessTime.dwHighDateTime=0x1d5d6a1, ftLastWriteTime.dwLowDateTime=0xd1dba850, ftLastWriteTime.dwHighDateTime=0x1d5d6a1, nFileSizeHigh=0x0, nFileSizeLow=0x32e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LoQPvjHxg.pptx", cAlternateFileName="LOQPVJ~1.PPT")) returned 1 [0100.089] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3374950, ftCreationTime.dwHighDateTime=0x1d5989d, ftLastAccessTime.dwLowDateTime=0xdcdfd7e0, ftLastAccessTime.dwHighDateTime=0x1d5d31c, ftLastWriteTime.dwLowDateTime=0xdcdfd7e0, ftLastWriteTime.dwHighDateTime=0x1d5d31c, nFileSizeHigh=0x0, nFileSizeLow=0x8b8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="m6mWzL3kkF98Qys.xlsx", cAlternateFileName="M6MWZL~1.XLS")) returned 1 [0100.089] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9711a50, ftCreationTime.dwHighDateTime=0x1d5a24a, ftLastAccessTime.dwLowDateTime=0xba173010, ftLastAccessTime.dwHighDateTime=0x1d5b584, ftLastWriteTime.dwLowDateTime=0xba173010, ftLastWriteTime.dwHighDateTime=0x1d5b584, nFileSizeHigh=0x0, nFileSizeLow=0x4212, dwReserved0=0x0, dwReserved1=0x0, cFileName="MFkMq.xlsx", cAlternateFileName="MFKMQ~1.XLS")) returned 1 [0100.089] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0100.089] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0100.089] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0100.089] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0100.089] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97761e80, ftCreationTime.dwHighDateTime=0x1d57e03, ftLastAccessTime.dwLowDateTime=0x2ab65050, ftLastAccessTime.dwHighDateTime=0x1d5c99c, ftLastWriteTime.dwLowDateTime=0x2ab65050, ftLastWriteTime.dwHighDateTime=0x1d5c99c, nFileSizeHigh=0x0, nFileSizeLow=0x1380e, dwReserved0=0x0, dwReserved1=0x0, cFileName="N_qeU.xlsx", cAlternateFileName="N_QEU~1.XLS")) returned 1 [0100.089] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x5ee892ad, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0100.089] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f4f940, ftCreationTime.dwHighDateTime=0x1d5cb7d, ftLastAccessTime.dwLowDateTime=0x3f21c580, ftLastAccessTime.dwHighDateTime=0x1d5cc9c, ftLastWriteTime.dwLowDateTime=0x3f21c580, ftLastWriteTime.dwHighDateTime=0x1d5cc9c, nFileSizeHigh=0x0, nFileSizeLow=0xfbc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PWEo-4fye6Te.xlsx", cAlternateFileName="PWEO-4~1.XLS")) returned 1 [0100.089] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ebe8380, ftCreationTime.dwHighDateTime=0x1d5cdbf, ftLastAccessTime.dwLowDateTime=0xccd56130, ftLastAccessTime.dwHighDateTime=0x1d59eab, ftLastWriteTime.dwLowDateTime=0xccd56130, ftLastWriteTime.dwHighDateTime=0x1d59eab, nFileSizeHigh=0x0, nFileSizeLow=0x18e09, dwReserved0=0x0, dwReserved1=0x0, cFileName="rCp7bOOMZeyG1.pptx", cAlternateFileName="RCP7BO~1.PPT")) returned 1 [0100.089] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16b02100, ftCreationTime.dwHighDateTime=0x1d5e245, ftLastAccessTime.dwLowDateTime=0x43f0f4b0, ftLastAccessTime.dwHighDateTime=0x1d5e983, ftLastWriteTime.dwLowDateTime=0x43f0f4b0, ftLastWriteTime.dwHighDateTime=0x1d5e983, nFileSizeHigh=0x0, nFileSizeLow=0x1514c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rv4sPh5pkOC.odp", cAlternateFileName="RV4SPH~1.ODP")) returned 1 [0100.089] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x641dca80, ftCreationTime.dwHighDateTime=0x1d5d61c, ftLastAccessTime.dwLowDateTime=0xa7c6a170, ftLastAccessTime.dwHighDateTime=0x1d5ba20, ftLastWriteTime.dwLowDateTime=0xa7c6a170, ftLastWriteTime.dwHighDateTime=0x1d5ba20, nFileSizeHigh=0x0, nFileSizeLow=0x4757, dwReserved0=0x0, dwReserved1=0x0, cFileName="sC _ 6S20Gfa3.docx", cAlternateFileName="SC_6S2~1.DOC")) returned 1 [0100.089] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58ca5190, ftCreationTime.dwHighDateTime=0x1d5e138, ftLastAccessTime.dwLowDateTime=0x9c504d70, ftLastAccessTime.dwHighDateTime=0x1d5e368, ftLastWriteTime.dwLowDateTime=0x9c504d70, ftLastWriteTime.dwHighDateTime=0x1d5e368, nFileSizeHigh=0x0, nFileSizeLow=0x119d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="tBecqP4TCoDMzd0nx.xlsx", cAlternateFileName="TBECQP~1.XLS")) returned 1 [0100.089] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49829f10, ftCreationTime.dwHighDateTime=0x1d5c8e9, ftLastAccessTime.dwLowDateTime=0x96c88460, ftLastAccessTime.dwHighDateTime=0x1d5e8f6, ftLastWriteTime.dwLowDateTime=0x96c88460, ftLastWriteTime.dwHighDateTime=0x1d5e8f6, nFileSizeHigh=0x0, nFileSizeLow=0x6515, dwReserved0=0x0, dwReserved1=0x0, cFileName="vgOo3uvsomC 6v.docx", cAlternateFileName="VGOO3U~1.DOC")) returned 1 [0100.089] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadb5ec00, ftCreationTime.dwHighDateTime=0x1d5ed13, ftLastAccessTime.dwLowDateTime=0x3c66aa10, ftLastAccessTime.dwHighDateTime=0x1d5e7ac, ftLastWriteTime.dwLowDateTime=0x3c66aa10, ftLastWriteTime.dwHighDateTime=0x1d5e7ac, nFileSizeHigh=0x0, nFileSizeLow=0x9791, dwReserved0=0x0, dwReserved1=0x0, cFileName="W3hC.ppt", cAlternateFileName="")) returned 1 [0100.089] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66365990, ftCreationTime.dwHighDateTime=0x1d56637, ftLastAccessTime.dwLowDateTime=0x52717a80, ftLastAccessTime.dwHighDateTime=0x1d5c946, ftLastWriteTime.dwLowDateTime=0x52717a80, ftLastWriteTime.dwHighDateTime=0x1d5c946, nFileSizeHigh=0x0, nFileSizeLow=0xf107, dwReserved0=0x0, dwReserved1=0x0, cFileName="wjIta66KnkjINWkE2.pptx", cAlternateFileName="WJITA6~1.PPT")) returned 1 [0100.089] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b588990, ftCreationTime.dwHighDateTime=0x1d58994, ftLastAccessTime.dwLowDateTime=0x9f0a39d0, ftLastAccessTime.dwHighDateTime=0x1d58590, ftLastWriteTime.dwLowDateTime=0x9f0a39d0, ftLastWriteTime.dwHighDateTime=0x1d58590, nFileSizeHigh=0x0, nFileSizeLow=0xc2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WKavgS-3C.pptx", cAlternateFileName="WKAVGS~1.PPT")) returned 1 [0100.090] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8634bbf0, ftCreationTime.dwHighDateTime=0x1d5c448, ftLastAccessTime.dwLowDateTime=0x44014c70, ftLastAccessTime.dwHighDateTime=0x1d5699f, ftLastWriteTime.dwLowDateTime=0x44014c70, ftLastWriteTime.dwHighDateTime=0x1d5699f, nFileSizeHigh=0x0, nFileSizeLow=0x147f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="z_jXH-7D9cZO.docx", cAlternateFileName="Z_JXH-~1.DOC")) returned 1 [0100.090] FindNextFileW (in: hFindFile=0x8150228, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8634bbf0, ftCreationTime.dwHighDateTime=0x1d5c448, ftLastAccessTime.dwLowDateTime=0x44014c70, ftLastAccessTime.dwHighDateTime=0x1d5699f, ftLastWriteTime.dwLowDateTime=0x44014c70, ftLastWriteTime.dwHighDateTime=0x1d5699f, nFileSizeHigh=0x0, nFileSizeLow=0x147f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="z_jXH-7D9cZO.docx", cAlternateFileName="Z_JXH-~1.DOC")) returned 0 [0100.090] FindClose (in: hFindFile=0x8150228 | out: hFindFile=0x8150228) returned 1 [0100.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebc4) returned 1 [0100.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebd0) returned 1 [0100.090] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\-A3FjvCXPw1dp0zdl4.docx", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\-A3FjvCXPw1dp0zdl4.docx", lpFilePart=0x0) returned 0x31 [0100.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0100.090] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\-A3FjvCXPw1dp0zdl4.docx" (normalized: "c:\\users\\fd1hvy\\documents\\-a3fjvcxpw1dp0zdl4.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0100.090] GetFileType (hFile=0x2e4) returned 0x1 [0100.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0100.090] GetFileType (hFile=0x2e4) returned 0x1 [0100.090] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x6f38 [0100.090] ReadFile (in: hFile=0x2e4, lpBuffer=0x2fed63c, nNumberOfBytesToRead=0x6f38, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2fed63c*, lpNumberOfBytesRead=0xefeb5c*=0x6f38, lpOverlapped=0x0) returned 1 [0100.091] CloseHandle (hObject=0x2e4) returned 1 [0100.120] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0100.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0100.120] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0100.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0100.120] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\-A3FjvCXPw1dp0zdl4.docx", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\-A3FjvCXPw1dp0zdl4.docx", lpFilePart=0x0) returned 0x31 [0100.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0100.120] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\-A3FjvCXPw1dp0zdl4.docx" (normalized: "c:\\users\\fd1hvy\\documents\\-a3fjvcxpw1dp0zdl4.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0100.121] GetFileType (hFile=0x2e4) returned 0x1 [0100.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0100.121] GetFileType (hFile=0x2e4) returned 0x1 [0100.121] WriteFile (in: hFile=0x2e4, lpBuffer=0x305d060*, nNumberOfBytesToWrite=0x6f40, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x305d060*, lpNumberOfBytesWritten=0xefeb50*=0x6f40, lpOverlapped=0x0) returned 1 [0100.123] CloseHandle (hObject=0x2e4) returned 1 [0100.124] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\-A3FjvCXPw1dp0zdl4.docx", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\-A3FjvCXPw1dp0zdl4.docx", lpFilePart=0x0) returned 0x31 [0100.124] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\-A3FjvCXPw1dp0zdl4.docx.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\-A3FjvCXPw1dp0zdl4.docx.UGMH", lpFilePart=0x0) returned 0x36 [0100.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0100.124] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\-A3FjvCXPw1dp0zdl4.docx" (normalized: "c:\\users\\fd1hvy\\documents\\-a3fjvcxpw1dp0zdl4.docx"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16f66420, ftCreationTime.dwHighDateTime=0x1d5e1c9, ftLastAccessTime.dwLowDateTime=0x1a5449f0, ftLastAccessTime.dwHighDateTime=0x1d56b8d, ftLastWriteTime.dwLowDateTime=0xd1c5f03c, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x6f40)) returned 1 [0100.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0100.125] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\-A3FjvCXPw1dp0zdl4.docx" (normalized: "c:\\users\\fd1hvy\\documents\\-a3fjvcxpw1dp0zdl4.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\-A3FjvCXPw1dp0zdl4.docx.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\-a3fjvcxpw1dp0zdl4.docx.ugmh")) returned 1 [0100.125] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\6m-40aatQp3v.xlsx", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\6m-40aatQp3v.xlsx", lpFilePart=0x0) returned 0x2b [0100.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0100.125] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\6m-40aatQp3v.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\6m-40aatqp3v.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0100.224] GetFileType (hFile=0x2e4) returned 0x1 [0100.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0100.224] GetFileType (hFile=0x2e4) returned 0x1 [0100.225] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0xf09c [0100.225] ReadFile (in: hFile=0x2e4, lpBuffer=0x3064428, nNumberOfBytesToRead=0xf09c, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x3064428*, lpNumberOfBytesRead=0xefeb5c*=0xf09c, lpOverlapped=0x0) returned 1 [0100.226] CloseHandle (hObject=0x2e4) returned 1 [0100.370] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0100.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0100.371] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0100.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0100.371] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\6m-40aatQp3v.xlsx", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\6m-40aatQp3v.xlsx", lpFilePart=0x0) returned 0x2b [0100.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0100.371] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\6m-40aatQp3v.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\6m-40aatqp3v.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0100.376] GetFileType (hFile=0x2e4) returned 0x1 [0100.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0100.376] GetFileType (hFile=0x2e4) returned 0x1 [0100.376] WriteFile (in: hFile=0x2e4, lpBuffer=0x30de400*, nNumberOfBytesToWrite=0xf0a0, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x30de400*, lpNumberOfBytesWritten=0xefeb50*=0xf0a0, lpOverlapped=0x0) returned 1 [0100.378] CloseHandle (hObject=0x2e4) returned 1 [0100.380] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\6m-40aatQp3v.xlsx", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\6m-40aatQp3v.xlsx", lpFilePart=0x0) returned 0x2b [0100.380] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\6m-40aatQp3v.xlsx.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\6m-40aatQp3v.xlsx.UGMH", lpFilePart=0x0) returned 0x30 [0100.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0100.380] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\6m-40aatQp3v.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\6m-40aatqp3v.xlsx"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe46680, ftCreationTime.dwHighDateTime=0x1d5d496, ftLastAccessTime.dwLowDateTime=0xa5f0e6d0, ftLastAccessTime.dwHighDateTime=0x1d57bf5, ftLastWriteTime.dwLowDateTime=0xd1ee782d, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xf0a0)) returned 1 [0100.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0100.380] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\6m-40aatQp3v.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\6m-40aatqp3v.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\6m-40aatQp3v.xlsx.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\6m-40aatqp3v.xlsx.ugmh")) returned 1 [0100.381] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Am31E.doc", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Am31E.doc", lpFilePart=0x0) returned 0x23 [0100.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0100.381] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Am31E.doc" (normalized: "c:\\users\\fd1hvy\\documents\\am31e.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0100.381] GetFileType (hFile=0x2e4) returned 0x1 [0100.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0100.381] GetFileType (hFile=0x2e4) returned 0x1 [0100.381] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x122a3 [0100.381] ReadFile (in: hFile=0x2e4, lpBuffer=0x30ed8b4, nNumberOfBytesToRead=0x122a3, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x30ed8b4*, lpNumberOfBytesRead=0xefeb5c*=0x122a3, lpOverlapped=0x0) returned 1 [0100.383] CloseHandle (hObject=0x2e4) returned 1 [0100.521] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0100.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0100.521] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0100.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0100.521] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Am31E.doc", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Am31E.doc", lpFilePart=0x0) returned 0x23 [0100.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0100.522] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Am31E.doc" (normalized: "c:\\users\\fd1hvy\\documents\\am31e.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0100.523] GetFileType (hFile=0x2e4) returned 0x1 [0100.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0100.523] GetFileType (hFile=0x2e4) returned 0x1 [0100.524] WriteFile (in: hFile=0x2e4, lpBuffer=0x2ee2018*, nNumberOfBytesToWrite=0x122b0, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2ee2018*, lpNumberOfBytesWritten=0xefeb50*=0x122b0, lpOverlapped=0x0) returned 1 [0100.525] CloseHandle (hObject=0x2e4) returned 1 [0100.528] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Am31E.doc", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Am31E.doc", lpFilePart=0x0) returned 0x23 [0100.528] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Am31E.doc.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Am31E.doc.UGMH", lpFilePart=0x0) returned 0x28 [0100.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0100.528] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Am31E.doc" (normalized: "c:\\users\\fd1hvy\\documents\\am31e.doc"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc23844c0, ftCreationTime.dwHighDateTime=0x1d5e674, ftLastAccessTime.dwLowDateTime=0x106abb20, ftLastAccessTime.dwHighDateTime=0x1d5eda3, ftLastWriteTime.dwLowDateTime=0xd203eabf, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x122b0)) returned 1 [0100.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0100.528] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Am31E.doc" (normalized: "c:\\users\\fd1hvy\\documents\\am31e.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Am31E.doc.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\am31e.doc.ugmh")) returned 1 [0100.530] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\C94Om.pptx", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\C94Om.pptx", lpFilePart=0x0) returned 0x24 [0100.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0100.530] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\C94Om.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\c94om.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0100.530] GetFileType (hFile=0x2e4) returned 0x1 [0100.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0100.530] GetFileType (hFile=0x2e4) returned 0x1 [0100.530] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x3bed [0100.530] ReadFile (in: hFile=0x2e4, lpBuffer=0x2ef4694, nNumberOfBytesToRead=0x3bed, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2ef4694*, lpNumberOfBytesRead=0xefeb5c*=0x3bed, lpOverlapped=0x0) returned 1 [0100.531] CloseHandle (hObject=0x2e4) returned 1 [0100.724] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0100.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0100.725] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0100.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0100.725] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\C94Om.pptx", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\C94Om.pptx", lpFilePart=0x0) returned 0x24 [0100.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0100.725] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\C94Om.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\c94om.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0100.726] GetFileType (hFile=0x2e4) returned 0x1 [0100.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0100.726] GetFileType (hFile=0x2e4) returned 0x1 [0100.726] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f54188*, nNumberOfBytesToWrite=0x3bf0, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2f54188*, lpNumberOfBytesWritten=0xefeb50*=0x3bf0, lpOverlapped=0x0) returned 1 [0100.727] CloseHandle (hObject=0x2e4) returned 1 [0100.729] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\C94Om.pptx", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\C94Om.pptx", lpFilePart=0x0) returned 0x24 [0100.729] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\C94Om.pptx.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\C94Om.pptx.UGMH", lpFilePart=0x0) returned 0x29 [0100.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0100.729] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\C94Om.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\c94om.pptx"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafca7440, ftCreationTime.dwHighDateTime=0x1d5edfc, ftLastAccessTime.dwLowDateTime=0x3766f630, ftLastAccessTime.dwHighDateTime=0x1d5e82b, ftLastWriteTime.dwLowDateTime=0xd222e7a4, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x3bf0)) returned 1 [0100.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0100.729] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\C94Om.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\c94om.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\C94Om.pptx.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\c94om.pptx.ugmh")) returned 1 [0100.730] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\cfg_3frcDN_.docx", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\cfg_3frcDN_.docx", lpFilePart=0x0) returned 0x2a [0100.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0100.730] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\cfg_3frcDN_.docx" (normalized: "c:\\users\\fd1hvy\\documents\\cfg_3frcdn_.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0100.730] GetFileType (hFile=0x2e4) returned 0x1 [0100.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0100.730] GetFileType (hFile=0x2e4) returned 0x1 [0100.730] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0xc9d [0100.730] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f58e14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2f58e14*, lpNumberOfBytesRead=0xefeb5c*=0xc9d, lpOverlapped=0x0) returned 1 [0100.731] CloseHandle (hObject=0x2e4) returned 1 [0100.753] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0100.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0100.753] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0100.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0100.753] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\cfg_3frcDN_.docx", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\cfg_3frcDN_.docx", lpFilePart=0x0) returned 0x2a [0100.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0100.753] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\cfg_3frcDN_.docx" (normalized: "c:\\users\\fd1hvy\\documents\\cfg_3frcdn_.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0100.755] GetFileType (hFile=0x2e4) returned 0x1 [0100.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0100.755] GetFileType (hFile=0x2e4) returned 0x1 [0100.755] WriteFile (in: hFile=0x2e4, lpBuffer=0x2faad04*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0xefeb24, lpOverlapped=0x0 | out: lpBuffer=0x2faad04*, lpNumberOfBytesWritten=0xefeb24*=0xca0, lpOverlapped=0x0) returned 1 [0100.756] CloseHandle (hObject=0x2e4) returned 1 [0100.757] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\cfg_3frcDN_.docx", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\cfg_3frcDN_.docx", lpFilePart=0x0) returned 0x2a [0100.757] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\cfg_3frcDN_.docx.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\cfg_3frcDN_.docx.UGMH", lpFilePart=0x0) returned 0x2f [0100.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0100.757] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\cfg_3frcDN_.docx" (normalized: "c:\\users\\fd1hvy\\documents\\cfg_3frcdn_.docx"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1651d0e0, ftCreationTime.dwHighDateTime=0x1d5cdab, ftLastAccessTime.dwLowDateTime=0xf5a9530, ftLastAccessTime.dwHighDateTime=0x1d5d27c, ftLastWriteTime.dwLowDateTime=0xd227aca9, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xca0)) returned 1 [0100.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0100.758] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\cfg_3frcDN_.docx" (normalized: "c:\\users\\fd1hvy\\documents\\cfg_3frcdn_.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\cfg_3frcDN_.docx.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\cfg_3frcdn_.docx.ugmh")) returned 1 [0100.758] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\HLN9AR-.ppt", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\HLN9AR-.ppt", lpFilePart=0x0) returned 0x25 [0100.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0100.758] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\HLN9AR-.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\hln9ar-.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0100.759] GetFileType (hFile=0x2e4) returned 0x1 [0100.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0100.759] GetFileType (hFile=0x2e4) returned 0x1 [0100.759] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x88d0 [0100.759] ReadFile (in: hFile=0x2e4, lpBuffer=0x2fabf88, nNumberOfBytesToRead=0x88d0, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2fabf88*, lpNumberOfBytesRead=0xefeb5c*=0x88d0, lpOverlapped=0x0) returned 1 [0100.760] CloseHandle (hObject=0x2e4) returned 1 [0100.877] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0100.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0100.877] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0100.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0100.877] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\HLN9AR-.ppt", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\HLN9AR-.ppt", lpFilePart=0x0) returned 0x25 [0100.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0100.877] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\HLN9AR-.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\hln9ar-.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0100.879] GetFileType (hFile=0x2e4) returned 0x1 [0100.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0100.879] GetFileType (hFile=0x2e4) returned 0x1 [0100.879] WriteFile (in: hFile=0x2e4, lpBuffer=0x30239cc*, nNumberOfBytesToWrite=0x88e0, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x30239cc*, lpNumberOfBytesWritten=0xefeb50*=0x88e0, lpOverlapped=0x0) returned 1 [0100.880] CloseHandle (hObject=0x2e4) returned 1 [0100.882] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\HLN9AR-.ppt", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\HLN9AR-.ppt", lpFilePart=0x0) returned 0x25 [0100.882] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\HLN9AR-.ppt.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\HLN9AR-.ppt.UGMH", lpFilePart=0x0) returned 0x2a [0100.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0100.882] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\HLN9AR-.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\hln9ar-.ppt"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34e7bd90, ftCreationTime.dwHighDateTime=0x1d5e3c6, ftLastAccessTime.dwLowDateTime=0xbdac0970, ftLastAccessTime.dwHighDateTime=0x1d5e1e0, ftLastWriteTime.dwLowDateTime=0xd23ac0a4, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x88e0)) returned 1 [0100.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0100.882] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\HLN9AR-.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\hln9ar-.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\HLN9AR-.ppt.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\hln9ar-.ppt.ugmh")) returned 1 [0100.883] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\jf46cCQHTHUr6bLu.pptx", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\jf46cCQHTHUr6bLu.pptx", lpFilePart=0x0) returned 0x2f [0100.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0100.883] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jf46cCQHTHUr6bLu.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\jf46ccqhthur6blu.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0100.883] GetFileType (hFile=0x2e4) returned 0x1 [0100.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0100.883] GetFileType (hFile=0x2e4) returned 0x1 [0100.883] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x19df [0100.883] ReadFile (in: hFile=0x2e4, lpBuffer=0x302c6b4, nNumberOfBytesToRead=0x19df, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x302c6b4*, lpNumberOfBytesRead=0xefeb5c*=0x19df, lpOverlapped=0x0) returned 1 [0100.884] CloseHandle (hObject=0x2e4) returned 1 [0101.051] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0101.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0101.051] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0101.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0101.052] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\jf46cCQHTHUr6bLu.pptx", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\jf46cCQHTHUr6bLu.pptx", lpFilePart=0x0) returned 0x2f [0101.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0101.052] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jf46cCQHTHUr6bLu.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\jf46ccqhthur6blu.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0101.053] GetFileType (hFile=0x2e4) returned 0x1 [0101.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0101.053] GetFileType (hFile=0x2e4) returned 0x1 [0101.053] WriteFile (in: hFile=0x2e4, lpBuffer=0x2e70d28*, nNumberOfBytesToWrite=0x19e0, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2e70d28*, lpNumberOfBytesWritten=0xefeb50*=0x19e0, lpOverlapped=0x0) returned 1 [0101.054] CloseHandle (hObject=0x2e4) returned 1 [0101.055] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\jf46cCQHTHUr6bLu.pptx", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\jf46cCQHTHUr6bLu.pptx", lpFilePart=0x0) returned 0x2f [0101.055] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\jf46cCQHTHUr6bLu.pptx.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\jf46cCQHTHUr6bLu.pptx.UGMH", lpFilePart=0x0) returned 0x34 [0101.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0101.055] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\jf46cCQHTHUr6bLu.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\jf46ccqhthur6blu.pptx"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99fd9dd0, ftCreationTime.dwHighDateTime=0x1d5794f, ftLastAccessTime.dwLowDateTime=0xe3795e90, ftLastAccessTime.dwHighDateTime=0x1d5ac9e, ftLastWriteTime.dwLowDateTime=0xd254fa04, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x19e0)) returned 1 [0101.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0101.055] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\jf46cCQHTHUr6bLu.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\jf46ccqhthur6blu.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\jf46cCQHTHUr6bLu.pptx.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\jf46ccqhthur6blu.pptx.ugmh")) returned 1 [0101.056] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\LoQPvjHxg.pptx", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\LoQPvjHxg.pptx", lpFilePart=0x0) returned 0x28 [0101.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0101.056] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\LoQPvjHxg.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\loqpvjhxg.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0101.056] GetFileType (hFile=0x2e4) returned 0x1 [0101.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0101.056] GetFileType (hFile=0x2e4) returned 0x1 [0101.056] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x32e6 [0101.056] ReadFile (in: hFile=0x2e4, lpBuffer=0x2e72b5c, nNumberOfBytesToRead=0x32e6, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2e72b5c*, lpNumberOfBytesRead=0xefeb5c*=0x32e6, lpOverlapped=0x0) returned 1 [0101.057] CloseHandle (hObject=0x2e4) returned 1 [0101.074] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0101.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0101.074] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0101.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0101.074] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\LoQPvjHxg.pptx", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\LoQPvjHxg.pptx", lpFilePart=0x0) returned 0x28 [0101.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0101.074] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\LoQPvjHxg.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\loqpvjhxg.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0101.075] GetFileType (hFile=0x2e4) returned 0x1 [0101.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0101.075] GetFileType (hFile=0x2e4) returned 0x1 [0101.075] WriteFile (in: hFile=0x2e4, lpBuffer=0x2ecf950*, nNumberOfBytesToWrite=0x32f0, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2ecf950*, lpNumberOfBytesWritten=0xefeb50*=0x32f0, lpOverlapped=0x0) returned 1 [0101.076] CloseHandle (hObject=0x2e4) returned 1 [0101.080] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\LoQPvjHxg.pptx", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\LoQPvjHxg.pptx", lpFilePart=0x0) returned 0x28 [0101.080] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\LoQPvjHxg.pptx.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\LoQPvjHxg.pptx.UGMH", lpFilePart=0x0) returned 0x2d [0101.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0101.080] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\LoQPvjHxg.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\loqpvjhxg.pptx"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bb114c0, ftCreationTime.dwHighDateTime=0x1d5b1b2, ftLastAccessTime.dwLowDateTime=0xd1dba850, ftLastAccessTime.dwHighDateTime=0x1d5d6a1, ftLastWriteTime.dwLowDateTime=0xd259f1c8, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x32f0)) returned 1 [0101.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0101.081] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\LoQPvjHxg.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\loqpvjhxg.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\LoQPvjHxg.pptx.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\loqpvjhxg.pptx.ugmh")) returned 1 [0101.082] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\m6mWzL3kkF98Qys.xlsx", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\m6mWzL3kkF98Qys.xlsx", lpFilePart=0x0) returned 0x2e [0101.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0101.082] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\m6mWzL3kkF98Qys.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\m6mwzl3kkf98qys.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0101.082] GetFileType (hFile=0x2e4) returned 0x1 [0101.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0101.082] GetFileType (hFile=0x2e4) returned 0x1 [0101.082] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x8b8f [0101.082] ReadFile (in: hFile=0x2e4, lpBuffer=0x2ed3068, nNumberOfBytesToRead=0x8b8f, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2ed3068*, lpNumberOfBytesRead=0xefeb5c*=0x8b8f, lpOverlapped=0x0) returned 1 [0101.083] CloseHandle (hObject=0x2e4) returned 1 [0101.196] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0101.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0101.196] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0101.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0101.196] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\m6mWzL3kkF98Qys.xlsx", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\m6mWzL3kkF98Qys.xlsx", lpFilePart=0x0) returned 0x2e [0101.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0101.196] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\m6mWzL3kkF98Qys.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\m6mwzl3kkf98qys.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0101.198] GetFileType (hFile=0x2e4) returned 0x1 [0101.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0101.198] GetFileType (hFile=0x2e4) returned 0x1 [0101.198] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f4b820*, nNumberOfBytesToWrite=0x8b90, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2f4b820*, lpNumberOfBytesWritten=0xefeb50*=0x8b90, lpOverlapped=0x0) returned 1 [0101.200] CloseHandle (hObject=0x2e4) returned 1 [0101.201] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\m6mWzL3kkF98Qys.xlsx", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\m6mWzL3kkF98Qys.xlsx", lpFilePart=0x0) returned 0x2e [0101.201] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\m6mWzL3kkF98Qys.xlsx.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\m6mWzL3kkF98Qys.xlsx.UGMH", lpFilePart=0x0) returned 0x33 [0101.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0101.201] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\m6mWzL3kkF98Qys.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\m6mwzl3kkf98qys.xlsx"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3374950, ftCreationTime.dwHighDateTime=0x1d5989d, ftLastAccessTime.dwLowDateTime=0xdcdfd7e0, ftLastAccessTime.dwHighDateTime=0x1d5d31c, ftLastWriteTime.dwLowDateTime=0xd26a6f9b, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x8b90)) returned 1 [0101.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0101.202] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\m6mWzL3kkF98Qys.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\m6mwzl3kkf98qys.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\m6mWzL3kkF98Qys.xlsx.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\m6mwzl3kkf98qys.xlsx.ugmh")) returned 1 [0101.202] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\MFkMq.xlsx", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\MFkMq.xlsx", lpFilePart=0x0) returned 0x24 [0101.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0101.202] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\MFkMq.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\mfkmq.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0101.202] GetFileType (hFile=0x2e4) returned 0x1 [0101.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0101.202] GetFileType (hFile=0x2e4) returned 0x1 [0101.203] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x4212 [0101.203] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f547ec, nNumberOfBytesToRead=0x4212, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2f547ec*, lpNumberOfBytesRead=0xefeb5c*=0x4212, lpOverlapped=0x0) returned 1 [0101.203] CloseHandle (hObject=0x2e4) returned 1 [0101.220] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0101.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0101.220] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0101.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0101.220] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\MFkMq.xlsx", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\MFkMq.xlsx", lpFilePart=0x0) returned 0x24 [0101.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0101.220] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\MFkMq.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\mfkmq.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0101.221] GetFileType (hFile=0x2e4) returned 0x1 [0101.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0101.221] GetFileType (hFile=0x2e4) returned 0x1 [0101.221] WriteFile (in: hFile=0x2e4, lpBuffer=0x2fb6074*, nNumberOfBytesToWrite=0x4220, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2fb6074*, lpNumberOfBytesWritten=0xefeb50*=0x4220, lpOverlapped=0x0) returned 1 [0101.223] CloseHandle (hObject=0x2e4) returned 1 [0101.224] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\MFkMq.xlsx", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\MFkMq.xlsx", lpFilePart=0x0) returned 0x24 [0101.224] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\MFkMq.xlsx.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\MFkMq.xlsx.UGMH", lpFilePart=0x0) returned 0x29 [0101.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0101.224] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\MFkMq.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\mfkmq.xlsx"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9711a50, ftCreationTime.dwHighDateTime=0x1d5a24a, ftLastAccessTime.dwLowDateTime=0xba173010, ftLastAccessTime.dwHighDateTime=0x1d5b584, ftLastWriteTime.dwLowDateTime=0xd26f33e6, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x4220)) returned 1 [0101.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0101.224] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\MFkMq.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\mfkmq.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\MFkMq.xlsx.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\mfkmq.xlsx.ugmh")) returned 1 [0101.225] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\N_qeU.xlsx", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\N_qeU.xlsx", lpFilePart=0x0) returned 0x24 [0101.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0101.225] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\N_qeU.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\n_qeu.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0101.225] GetFileType (hFile=0x2e4) returned 0x1 [0101.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0101.225] GetFileType (hFile=0x2e4) returned 0x1 [0101.225] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x1380e [0101.225] ReadFile (in: hFile=0x2e4, lpBuffer=0x2fba66c, nNumberOfBytesToRead=0x1380e, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2fba66c*, lpNumberOfBytesRead=0xefeb5c*=0x1380e, lpOverlapped=0x0) returned 1 [0101.226] CloseHandle (hObject=0x2e4) returned 1 [0101.343] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0101.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0101.343] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0101.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0101.343] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\N_qeU.xlsx", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\N_qeU.xlsx", lpFilePart=0x0) returned 0x24 [0101.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0101.344] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\N_qeU.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\n_qeu.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0101.346] GetFileType (hFile=0x2e4) returned 0x1 [0101.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0101.346] GetFileType (hFile=0x2e4) returned 0x1 [0101.346] WriteFile (in: hFile=0x2e4, lpBuffer=0x3041c98*, nNumberOfBytesToWrite=0x13810, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x3041c98*, lpNumberOfBytesWritten=0xefeb50*=0x13810, lpOverlapped=0x0) returned 1 [0101.349] CloseHandle (hObject=0x2e4) returned 1 [0101.352] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\N_qeU.xlsx", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\N_qeU.xlsx", lpFilePart=0x0) returned 0x24 [0101.352] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\N_qeU.xlsx.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\N_qeU.xlsx.UGMH", lpFilePart=0x0) returned 0x29 [0101.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0101.352] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\N_qeU.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\n_qeu.xlsx"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97761e80, ftCreationTime.dwHighDateTime=0x1d57e03, ftLastAccessTime.dwLowDateTime=0x2ab65050, ftLastAccessTime.dwHighDateTime=0x1d5c99c, ftLastWriteTime.dwLowDateTime=0xd2824736, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x13810)) returned 1 [0101.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0101.352] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\N_qeU.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\n_qeu.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\N_qeU.xlsx.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\n_qeu.xlsx.ugmh")) returned 1 [0101.353] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\PWEo-4fye6Te.xlsx", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\PWEo-4fye6Te.xlsx", lpFilePart=0x0) returned 0x2b [0101.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0101.353] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\PWEo-4fye6Te.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\pweo-4fye6te.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0101.353] GetFileType (hFile=0x2e4) returned 0x1 [0101.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0101.353] GetFileType (hFile=0x2e4) returned 0x1 [0101.353] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0xfbc5 [0101.353] ReadFile (in: hFile=0x2e4, lpBuffer=0x3055898, nNumberOfBytesToRead=0xfbc5, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x3055898*, lpNumberOfBytesRead=0xefeb5c*=0xfbc5, lpOverlapped=0x0) returned 1 [0101.354] CloseHandle (hObject=0x2e4) returned 1 [0101.513] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0101.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0101.514] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0101.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0101.514] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\PWEo-4fye6Te.xlsx", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\PWEo-4fye6Te.xlsx", lpFilePart=0x0) returned 0x2b [0101.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0101.514] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\PWEo-4fye6Te.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\pweo-4fye6te.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0101.516] GetFileType (hFile=0x2e4) returned 0x1 [0101.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0101.516] GetFileType (hFile=0x2e4) returned 0x1 [0101.516] WriteFile (in: hFile=0x2e4, lpBuffer=0x2eda77c*, nNumberOfBytesToWrite=0xfbd0, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2eda77c*, lpNumberOfBytesWritten=0xefeb50*=0xfbd0, lpOverlapped=0x0) returned 1 [0101.533] CloseHandle (hObject=0x2e4) returned 1 [0101.536] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\PWEo-4fye6Te.xlsx", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\PWEo-4fye6Te.xlsx", lpFilePart=0x0) returned 0x2b [0101.536] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\PWEo-4fye6Te.xlsx.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\PWEo-4fye6Te.xlsx.UGMH", lpFilePart=0x0) returned 0x30 [0101.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0101.537] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\PWEo-4fye6Te.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\pweo-4fye6te.xlsx"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f4f940, ftCreationTime.dwHighDateTime=0x1d5cb7d, ftLastAccessTime.dwLowDateTime=0x3f21c580, ftLastAccessTime.dwHighDateTime=0x1d5cc9c, ftLastWriteTime.dwLowDateTime=0xd29ee211, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xfbd0)) returned 1 [0101.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0101.537] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\PWEo-4fye6Te.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\pweo-4fye6te.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\PWEo-4fye6Te.xlsx.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\pweo-4fye6te.xlsx.ugmh")) returned 1 [0101.537] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\rCp7bOOMZeyG1.pptx", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\rCp7bOOMZeyG1.pptx", lpFilePart=0x0) returned 0x2c [0101.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0101.538] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\rCp7bOOMZeyG1.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rcp7boomzeyg1.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0101.538] GetFileType (hFile=0x2e4) returned 0x1 [0101.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0101.538] GetFileType (hFile=0x2e4) returned 0x1 [0101.538] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x18e09 [0101.539] ReadFile (in: hFile=0x2e4, lpBuffer=0x3f232a0, nNumberOfBytesToRead=0x18e09, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x3f232a0*, lpNumberOfBytesRead=0xefeb5c*=0x18e09, lpOverlapped=0x0) returned 1 [0101.541] CloseHandle (hObject=0x2e4) returned 1 [0101.770] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0101.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0101.770] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0101.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0101.770] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\rCp7bOOMZeyG1.pptx", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\rCp7bOOMZeyG1.pptx", lpFilePart=0x0) returned 0x2c [0101.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0101.770] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\rCp7bOOMZeyG1.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rcp7boomzeyg1.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0101.770] GetFileType (hFile=0x2e4) returned 0x1 [0101.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0101.771] GetFileType (hFile=0x2e4) returned 0x1 [0101.771] WriteFile (in: hFile=0x2e4, lpBuffer=0x3f9f928*, nNumberOfBytesToWrite=0x18e10, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x3f9f928*, lpNumberOfBytesWritten=0xefeb50*=0x18e10, lpOverlapped=0x0) returned 1 [0101.773] CloseHandle (hObject=0x2e4) returned 1 [0101.776] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\rCp7bOOMZeyG1.pptx", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\rCp7bOOMZeyG1.pptx", lpFilePart=0x0) returned 0x2c [0101.776] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\rCp7bOOMZeyG1.pptx.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\rCp7bOOMZeyG1.pptx.UGMH", lpFilePart=0x0) returned 0x31 [0101.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0101.776] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\rCp7bOOMZeyG1.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rcp7boomzeyg1.pptx"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ebe8380, ftCreationTime.dwHighDateTime=0x1d5cdbf, ftLastAccessTime.dwLowDateTime=0xccd56130, ftLastAccessTime.dwHighDateTime=0x1d59eab, ftLastWriteTime.dwLowDateTime=0xd2c2a6b8, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x18e10)) returned 1 [0101.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0101.776] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\rCp7bOOMZeyG1.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rcp7boomzeyg1.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\rCp7bOOMZeyG1.pptx.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\rcp7boomzeyg1.pptx.ugmh")) returned 1 [0101.777] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sC _ 6S20Gfa3.docx", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\sC _ 6S20Gfa3.docx", lpFilePart=0x0) returned 0x2d [0101.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0101.777] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sC _ 6S20Gfa3.docx" (normalized: "c:\\users\\fd1hvy\\documents\\sc _ 6s20gfa3.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0101.777] GetFileType (hFile=0x2e4) returned 0x1 [0101.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0101.777] GetFileType (hFile=0x2e4) returned 0x1 [0101.777] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x4757 [0101.777] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f37b34, nNumberOfBytesToRead=0x4757, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2f37b34*, lpNumberOfBytesRead=0xefeb5c*=0x4757, lpOverlapped=0x0) returned 1 [0101.778] CloseHandle (hObject=0x2e4) returned 1 [0101.795] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0101.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0101.795] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0101.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0101.795] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sC _ 6S20Gfa3.docx", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\sC _ 6S20Gfa3.docx", lpFilePart=0x0) returned 0x2d [0101.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0101.795] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sC _ 6S20Gfa3.docx" (normalized: "c:\\users\\fd1hvy\\documents\\sc _ 6s20gfa3.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0101.796] GetFileType (hFile=0x2e4) returned 0x1 [0101.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0101.796] GetFileType (hFile=0x2e4) returned 0x1 [0101.797] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f9adfc*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2f9adfc*, lpNumberOfBytesWritten=0xefeb50*=0x4760, lpOverlapped=0x0) returned 1 [0101.798] CloseHandle (hObject=0x2e4) returned 1 [0101.800] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sC _ 6S20Gfa3.docx", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\sC _ 6S20Gfa3.docx", lpFilePart=0x0) returned 0x2d [0101.800] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sC _ 6S20Gfa3.docx.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\sC _ 6S20Gfa3.docx.UGMH", lpFilePart=0x0) returned 0x32 [0101.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0101.800] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sC _ 6S20Gfa3.docx" (normalized: "c:\\users\\fd1hvy\\documents\\sc _ 6s20gfa3.docx"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x641dca80, ftCreationTime.dwHighDateTime=0x1d5d61c, ftLastAccessTime.dwLowDateTime=0xa7c6a170, ftLastAccessTime.dwHighDateTime=0x1d5ba20, ftLastWriteTime.dwLowDateTime=0xd2c76ae9, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x4760)) returned 1 [0101.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0101.800] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sC _ 6S20Gfa3.docx" (normalized: "c:\\users\\fd1hvy\\documents\\sc _ 6s20gfa3.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sC _ 6S20Gfa3.docx.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\sc _ 6s20gfa3.docx.ugmh")) returned 1 [0101.800] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\tBecqP4TCoDMzd0nx.xlsx", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\tBecqP4TCoDMzd0nx.xlsx", lpFilePart=0x0) returned 0x30 [0101.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0101.801] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\tBecqP4TCoDMzd0nx.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\tbecqp4tcodmzd0nx.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0101.801] GetFileType (hFile=0x2e4) returned 0x1 [0101.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0101.801] GetFileType (hFile=0x2e4) returned 0x1 [0101.801] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x119d2 [0101.801] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f9f9bc, nNumberOfBytesToRead=0x119d2, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2f9f9bc*, lpNumberOfBytesRead=0xefeb5c*=0x119d2, lpOverlapped=0x0) returned 1 [0101.802] CloseHandle (hObject=0x2e4) returned 1 [0101.921] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0101.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0101.921] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0101.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0101.922] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\tBecqP4TCoDMzd0nx.xlsx", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\tBecqP4TCoDMzd0nx.xlsx", lpFilePart=0x0) returned 0x30 [0101.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0101.922] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\tBecqP4TCoDMzd0nx.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\tbecqp4tcodmzd0nx.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0101.924] GetFileType (hFile=0x2e4) returned 0x1 [0101.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0101.924] GetFileType (hFile=0x2e4) returned 0x1 [0101.924] WriteFile (in: hFile=0x2e4, lpBuffer=0x3021558*, nNumberOfBytesToWrite=0x119e0, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x3021558*, lpNumberOfBytesWritten=0xefeb50*=0x119e0, lpOverlapped=0x0) returned 1 [0101.926] CloseHandle (hObject=0x2e4) returned 1 [0101.929] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\tBecqP4TCoDMzd0nx.xlsx", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\tBecqP4TCoDMzd0nx.xlsx", lpFilePart=0x0) returned 0x30 [0101.929] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\tBecqP4TCoDMzd0nx.xlsx.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\tBecqP4TCoDMzd0nx.xlsx.UGMH", lpFilePart=0x0) returned 0x35 [0101.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0101.929] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\tBecqP4TCoDMzd0nx.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\tbecqp4tcodmzd0nx.xlsx"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58ca5190, ftCreationTime.dwHighDateTime=0x1d5e138, ftLastAccessTime.dwLowDateTime=0x9c504d70, ftLastAccessTime.dwHighDateTime=0x1d5e368, ftLastWriteTime.dwLowDateTime=0xd2da8bef, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x119e0)) returned 1 [0101.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0101.930] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\tBecqP4TCoDMzd0nx.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\tbecqp4tcodmzd0nx.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\tBecqP4TCoDMzd0nx.xlsx.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\tbecqp4tcodmzd0nx.xlsx.ugmh")) returned 1 [0101.930] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vgOo3uvsomC 6v.docx", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vgOo3uvsomC 6v.docx", lpFilePart=0x0) returned 0x2d [0101.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0101.930] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vgOo3uvsomC 6v.docx" (normalized: "c:\\users\\fd1hvy\\documents\\vgoo3uvsomc 6v.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0101.931] GetFileType (hFile=0x2e4) returned 0x1 [0101.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0101.931] GetFileType (hFile=0x2e4) returned 0x1 [0101.931] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x6515 [0101.931] ReadFile (in: hFile=0x2e4, lpBuffer=0x30333a8, nNumberOfBytesToRead=0x6515, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x30333a8*, lpNumberOfBytesRead=0xefeb5c*=0x6515, lpOverlapped=0x0) returned 1 [0101.932] CloseHandle (hObject=0x2e4) returned 1 [0102.112] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0102.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0102.112] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0102.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0102.112] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vgOo3uvsomC 6v.docx", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vgOo3uvsomC 6v.docx", lpFilePart=0x0) returned 0x2d [0102.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0102.112] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vgOo3uvsomC 6v.docx" (normalized: "c:\\users\\fd1hvy\\documents\\vgoo3uvsomc 6v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0102.113] GetFileType (hFile=0x2e4) returned 0x1 [0102.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0102.113] GetFileType (hFile=0x2e4) returned 0x1 [0102.113] WriteFile (in: hFile=0x2e4, lpBuffer=0x2e96484*, nNumberOfBytesToWrite=0x6520, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2e96484*, lpNumberOfBytesWritten=0xefeb50*=0x6520, lpOverlapped=0x0) returned 1 [0102.115] CloseHandle (hObject=0x2e4) returned 1 [0102.117] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vgOo3uvsomC 6v.docx", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vgOo3uvsomC 6v.docx", lpFilePart=0x0) returned 0x2d [0102.117] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vgOo3uvsomC 6v.docx.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\vgOo3uvsomC 6v.docx.UGMH", lpFilePart=0x0) returned 0x32 [0102.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0102.117] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\vgOo3uvsomC 6v.docx" (normalized: "c:\\users\\fd1hvy\\documents\\vgoo3uvsomc 6v.docx"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49829f10, ftCreationTime.dwHighDateTime=0x1d5c8e9, ftLastAccessTime.dwLowDateTime=0x96c88460, ftLastAccessTime.dwHighDateTime=0x1d5e8f6, ftLastWriteTime.dwLowDateTime=0xd2f718b3, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x6520)) returned 1 [0102.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0102.118] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\vgOo3uvsomC 6v.docx" (normalized: "c:\\users\\fd1hvy\\documents\\vgoo3uvsomc 6v.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\vgOo3uvsomC 6v.docx.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\vgoo3uvsomc 6v.docx.ugmh")) returned 1 [0102.118] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\W3hC.ppt", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\W3hC.ppt", lpFilePart=0x0) returned 0x22 [0102.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0102.118] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\W3hC.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\w3hc.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0102.118] GetFileType (hFile=0x2e4) returned 0x1 [0102.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0102.118] GetFileType (hFile=0x2e4) returned 0x1 [0102.118] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x9791 [0102.119] ReadFile (in: hFile=0x2e4, lpBuffer=0x2e9cdcc, nNumberOfBytesToRead=0x9791, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2e9cdcc*, lpNumberOfBytesRead=0xefeb5c*=0x9791, lpOverlapped=0x0) returned 1 [0102.120] CloseHandle (hObject=0x2e4) returned 1 [0102.136] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0102.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0102.136] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0102.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0102.136] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\W3hC.ppt", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\W3hC.ppt", lpFilePart=0x0) returned 0x22 [0102.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0102.136] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\W3hC.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\w3hc.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0102.138] GetFileType (hFile=0x2e4) returned 0x1 [0102.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0102.138] GetFileType (hFile=0x2e4) returned 0x1 [0102.138] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f19330*, nNumberOfBytesToWrite=0x97a0, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2f19330*, lpNumberOfBytesWritten=0xefeb50*=0x97a0, lpOverlapped=0x0) returned 1 [0102.139] CloseHandle (hObject=0x2e4) returned 1 [0102.141] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\W3hC.ppt", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\W3hC.ppt", lpFilePart=0x0) returned 0x22 [0102.141] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\W3hC.ppt.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\W3hC.ppt.UGMH", lpFilePart=0x0) returned 0x27 [0102.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0102.141] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\W3hC.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\w3hc.ppt"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadb5ec00, ftCreationTime.dwHighDateTime=0x1d5ed13, ftLastAccessTime.dwLowDateTime=0x3c66aa10, ftLastAccessTime.dwHighDateTime=0x1d5e7ac, ftLastWriteTime.dwLowDateTime=0xd2f97bd0, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x97a0)) returned 1 [0102.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0102.141] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\W3hC.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\w3hc.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\W3hC.ppt.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\w3hc.ppt.ugmh")) returned 1 [0102.233] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\wjIta66KnkjINWkE2.pptx", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\wjIta66KnkjINWkE2.pptx", lpFilePart=0x0) returned 0x30 [0102.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0102.233] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\wjIta66KnkjINWkE2.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\wjita66knkjinwke2.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0102.233] GetFileType (hFile=0x2e4) returned 0x1 [0102.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0102.233] GetFileType (hFile=0x2e4) returned 0x1 [0102.233] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0xf107 [0102.234] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f22ec4, nNumberOfBytesToRead=0xf107, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2f22ec4*, lpNumberOfBytesRead=0xefeb5c*=0xf107, lpOverlapped=0x0) returned 1 [0102.235] CloseHandle (hObject=0x2e4) returned 1 [0102.253] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0102.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0102.254] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0102.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0102.254] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\wjIta66KnkjINWkE2.pptx", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\wjIta66KnkjINWkE2.pptx", lpFilePart=0x0) returned 0x30 [0102.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0102.254] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\wjIta66KnkjINWkE2.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\wjita66knkjinwke2.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0102.255] GetFileType (hFile=0x2e4) returned 0x1 [0102.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0102.255] GetFileType (hFile=0x2e4) returned 0x1 [0102.255] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f9cff0*, nNumberOfBytesToWrite=0xf110, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2f9cff0*, lpNumberOfBytesWritten=0xefeb50*=0xf110, lpOverlapped=0x0) returned 1 [0102.257] CloseHandle (hObject=0x2e4) returned 1 [0102.262] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\wjIta66KnkjINWkE2.pptx", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\wjIta66KnkjINWkE2.pptx", lpFilePart=0x0) returned 0x30 [0102.262] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\wjIta66KnkjINWkE2.pptx.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\wjIta66KnkjINWkE2.pptx.UGMH", lpFilePart=0x0) returned 0x35 [0102.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0102.262] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\wjIta66KnkjINWkE2.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\wjita66knkjinwke2.pptx"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66365990, ftCreationTime.dwHighDateTime=0x1d56637, ftLastAccessTime.dwLowDateTime=0x52717a80, ftLastAccessTime.dwHighDateTime=0x1d5c946, ftLastWriteTime.dwLowDateTime=0xd30c8e71, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xf110)) returned 1 [0102.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0102.263] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\wjIta66KnkjINWkE2.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\wjita66knkjinwke2.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\wjIta66KnkjINWkE2.pptx.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\wjita66knkjinwke2.pptx.ugmh")) returned 1 [0102.263] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\WKavgS-3C.pptx", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\WKavgS-3C.pptx", lpFilePart=0x0) returned 0x28 [0102.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0102.263] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\WKavgS-3C.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\wkavgs-3c.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0102.263] GetFileType (hFile=0x2e4) returned 0x1 [0102.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0102.264] GetFileType (hFile=0x2e4) returned 0x1 [0102.264] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0xc2f0 [0102.264] ReadFile (in: hFile=0x2e4, lpBuffer=0x2fac560, nNumberOfBytesToRead=0xc2f0, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2fac560*, lpNumberOfBytesRead=0xefeb5c*=0xc2f0, lpOverlapped=0x0) returned 1 [0102.265] CloseHandle (hObject=0x2e4) returned 1 [0102.380] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0102.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0102.380] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0102.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0102.380] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\WKavgS-3C.pptx", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\WKavgS-3C.pptx", lpFilePart=0x0) returned 0x28 [0102.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0102.380] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\WKavgS-3C.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\wkavgs-3c.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0102.382] GetFileType (hFile=0x2e4) returned 0x1 [0102.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0102.382] GetFileType (hFile=0x2e4) returned 0x1 [0102.382] WriteFile (in: hFile=0x2e4, lpBuffer=0x301dc58*, nNumberOfBytesToWrite=0xc300, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x301dc58*, lpNumberOfBytesWritten=0xefeb50*=0xc300, lpOverlapped=0x0) returned 1 [0102.385] CloseHandle (hObject=0x2e4) returned 1 [0102.387] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\WKavgS-3C.pptx", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\WKavgS-3C.pptx", lpFilePart=0x0) returned 0x28 [0102.387] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\WKavgS-3C.pptx.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\WKavgS-3C.pptx.UGMH", lpFilePart=0x0) returned 0x2d [0102.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0102.387] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\WKavgS-3C.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\wkavgs-3c.pptx"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b588990, ftCreationTime.dwHighDateTime=0x1d58994, ftLastAccessTime.dwLowDateTime=0x9f0a39d0, ftLastAccessTime.dwHighDateTime=0x1d58590, ftLastWriteTime.dwLowDateTime=0xd320c538, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xc300)) returned 1 [0102.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0102.387] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\WKavgS-3C.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\wkavgs-3c.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\WKavgS-3C.pptx.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\wkavgs-3c.pptx.ugmh")) returned 1 [0102.388] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\z_jXH-7D9cZO.docx", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\z_jXH-7D9cZO.docx", lpFilePart=0x0) returned 0x2b [0102.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0102.388] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\z_jXH-7D9cZO.docx" (normalized: "c:\\users\\fd1hvy\\documents\\z_jxh-7d9czo.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0102.388] GetFileType (hFile=0x2e4) returned 0x1 [0102.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0102.388] GetFileType (hFile=0x2e4) returned 0x1 [0102.388] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x147f3 [0102.388] ReadFile (in: hFile=0x2e4, lpBuffer=0x302a370, nNumberOfBytesToRead=0x147f3, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x302a370*, lpNumberOfBytesRead=0xefeb5c*=0x147f3, lpOverlapped=0x0) returned 1 [0102.390] CloseHandle (hObject=0x2e4) returned 1 [0102.515] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0102.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0102.515] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0102.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0102.516] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\z_jXH-7D9cZO.docx", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\z_jXH-7D9cZO.docx", lpFilePart=0x0) returned 0x2b [0102.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0102.516] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\z_jXH-7D9cZO.docx" (normalized: "c:\\users\\fd1hvy\\documents\\z_jxh-7d9czo.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0102.517] GetFileType (hFile=0x2e4) returned 0x1 [0102.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0102.517] GetFileType (hFile=0x2e4) returned 0x1 [0102.517] WriteFile (in: hFile=0x2e4, lpBuffer=0x2ec2be0*, nNumberOfBytesToWrite=0x14800, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2ec2be0*, lpNumberOfBytesWritten=0xefeb50*=0x14800, lpOverlapped=0x0) returned 1 [0102.519] CloseHandle (hObject=0x2e4) returned 1 [0102.522] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\z_jXH-7D9cZO.docx", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\z_jXH-7D9cZO.docx", lpFilePart=0x0) returned 0x2b [0102.522] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\z_jXH-7D9cZO.docx.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\z_jXH-7D9cZO.docx.UGMH", lpFilePart=0x0) returned 0x30 [0102.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0102.522] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\z_jXH-7D9cZO.docx" (normalized: "c:\\users\\fd1hvy\\documents\\z_jxh-7d9czo.docx"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8634bbf0, ftCreationTime.dwHighDateTime=0x1d5c448, ftLastAccessTime.dwLowDateTime=0x44014c70, ftLastAccessTime.dwHighDateTime=0x1d5699f, ftLastWriteTime.dwLowDateTime=0xd333d764, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x14800)) returned 1 [0102.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0102.522] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\z_jXH-7D9cZO.docx" (normalized: "c:\\users\\fd1hvy\\documents\\z_jxh-7d9czo.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\z_jXH-7D9cZO.docx.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\z_jxh-7d9czo.docx.ugmh")) returned 1 [0102.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb94) returned 1 [0102.523] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI", nBufferLength=0x105, lpBuffer=0xefe648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9WWI", lpFilePart=0x0) returned 0x1e [0102.523] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\*", lpFindFileData=0xefe8bc | out: lpFindFileData=0xefe8bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca75b830, ftCreationTime.dwHighDateTime=0x1d5e2b8, ftLastAccessTime.dwLowDateTime=0x87cb7e40, ftLastAccessTime.dwHighDateTime=0x1d5e0f4, ftLastWriteTime.dwLowDateTime=0x87cb7e40, ftLastWriteTime.dwHighDateTime=0x1d5e0f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8150168 [0102.523] FindNextFileW (in: hFindFile=0x8150168, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca75b830, ftCreationTime.dwHighDateTime=0x1d5e2b8, ftLastAccessTime.dwLowDateTime=0x87cb7e40, ftLastAccessTime.dwHighDateTime=0x1d5e0f4, ftLastWriteTime.dwLowDateTime=0x87cb7e40, ftLastWriteTime.dwHighDateTime=0x1d5e0f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.523] FindNextFileW (in: hFindFile=0x8150168, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f8dcf0, ftCreationTime.dwHighDateTime=0x1d5e515, ftLastAccessTime.dwLowDateTime=0xdefd1760, ftLastAccessTime.dwHighDateTime=0x1d5e3d7, ftLastWriteTime.dwLowDateTime=0xdefd1760, ftLastWriteTime.dwHighDateTime=0x1d5e3d7, nFileSizeHigh=0x0, nFileSizeLow=0x81a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="3iAnGfY559.ots", cAlternateFileName="3IANGF~1.OTS")) returned 1 [0102.523] FindNextFileW (in: hFindFile=0x8150168, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0cdcd20, ftCreationTime.dwHighDateTime=0x1d5e715, ftLastAccessTime.dwLowDateTime=0x37e25050, ftLastAccessTime.dwHighDateTime=0x1d5f0f5, ftLastWriteTime.dwLowDateTime=0x37e25050, ftLastWriteTime.dwHighDateTime=0x1d5f0f5, nFileSizeHigh=0x0, nFileSizeLow=0x1110a, dwReserved0=0x0, dwReserved1=0x0, cFileName="3XiE.ppt", cAlternateFileName="")) returned 1 [0102.523] FindNextFileW (in: hFindFile=0x8150168, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4257830, ftCreationTime.dwHighDateTime=0x1d5ea79, ftLastAccessTime.dwLowDateTime=0xb34d0c90, ftLastAccessTime.dwHighDateTime=0x1d5efc3, ftLastWriteTime.dwLowDateTime=0xb34d0c90, ftLastWriteTime.dwHighDateTime=0x1d5efc3, nFileSizeHigh=0x0, nFileSizeLow=0xa33e, dwReserved0=0x0, dwReserved1=0x0, cFileName="5zo2z0GfAzDF6m.xlsx", cAlternateFileName="5ZO2Z0~1.XLS")) returned 1 [0102.523] FindNextFileW (in: hFindFile=0x8150168, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7c15d0, ftCreationTime.dwHighDateTime=0x1d5e583, ftLastAccessTime.dwLowDateTime=0xf498f690, ftLastAccessTime.dwHighDateTime=0x1d5e7e5, ftLastWriteTime.dwLowDateTime=0xf498f690, ftLastWriteTime.dwHighDateTime=0x1d5e7e5, nFileSizeHigh=0x0, nFileSizeLow=0x4852, dwReserved0=0x0, dwReserved1=0x0, cFileName="6I8aiqdPKPoPUC.docx", cAlternateFileName="6I8AIQ~1.DOC")) returned 1 [0102.523] FindNextFileW (in: hFindFile=0x8150168, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d513300, ftCreationTime.dwHighDateTime=0x1d5e1cb, ftLastAccessTime.dwLowDateTime=0xa22aea80, ftLastAccessTime.dwHighDateTime=0x1d5ee7a, ftLastWriteTime.dwLowDateTime=0xa22aea80, ftLastWriteTime.dwHighDateTime=0x1d5ee7a, nFileSizeHigh=0x0, nFileSizeLow=0x2b21, dwReserved0=0x0, dwReserved1=0x0, cFileName="fIOJ129jLEtR.rtf", cAlternateFileName="FIOJ12~1.RTF")) returned 1 [0102.523] FindNextFileW (in: hFindFile=0x8150168, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2733b700, ftCreationTime.dwHighDateTime=0x1d5e79d, ftLastAccessTime.dwLowDateTime=0xdf2b36b0, ftLastAccessTime.dwHighDateTime=0x1d5ecb3, ftLastWriteTime.dwLowDateTime=0xdf2b36b0, ftLastWriteTime.dwHighDateTime=0x1d5ecb3, nFileSizeHigh=0x0, nFileSizeLow=0x81d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="NP0C3ihvqG5p44O8.rtf", cAlternateFileName="NP0C3I~1.RTF")) returned 1 [0102.523] FindNextFileW (in: hFindFile=0x8150168, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe150d380, ftCreationTime.dwHighDateTime=0x1d5e1f7, ftLastAccessTime.dwLowDateTime=0x97ddfce0, ftLastAccessTime.dwHighDateTime=0x1d5e270, ftLastWriteTime.dwLowDateTime=0x97ddfce0, ftLastWriteTime.dwHighDateTime=0x1d5e270, nFileSizeHigh=0x0, nFileSizeLow=0x66e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="VQUy.ppt", cAlternateFileName="")) returned 1 [0102.523] FindNextFileW (in: hFindFile=0x8150168, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0102.524] FindClose (in: hFindFile=0x8150168 | out: hFindFile=0x8150168) returned 1 [0102.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb50) returned 1 [0102.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb5c) returned 1 [0102.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb94) returned 1 [0102.524] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI", nBufferLength=0x105, lpBuffer=0xefe648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9WWI", lpFilePart=0x0) returned 0x1e [0102.524] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\*", lpFindFileData=0xefe8bc | out: lpFindFileData=0xefe8bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca75b830, ftCreationTime.dwHighDateTime=0x1d5e2b8, ftLastAccessTime.dwLowDateTime=0x87cb7e40, ftLastAccessTime.dwHighDateTime=0x1d5e0f4, ftLastWriteTime.dwLowDateTime=0x87cb7e40, ftLastWriteTime.dwHighDateTime=0x1d5e0f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x814ffa8 [0102.524] FindNextFileW (in: hFindFile=0x814ffa8, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca75b830, ftCreationTime.dwHighDateTime=0x1d5e2b8, ftLastAccessTime.dwLowDateTime=0x87cb7e40, ftLastAccessTime.dwHighDateTime=0x1d5e0f4, ftLastWriteTime.dwLowDateTime=0x87cb7e40, ftLastWriteTime.dwHighDateTime=0x1d5e0f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.525] FindNextFileW (in: hFindFile=0x814ffa8, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f8dcf0, ftCreationTime.dwHighDateTime=0x1d5e515, ftLastAccessTime.dwLowDateTime=0xdefd1760, ftLastAccessTime.dwHighDateTime=0x1d5e3d7, ftLastWriteTime.dwLowDateTime=0xdefd1760, ftLastWriteTime.dwHighDateTime=0x1d5e3d7, nFileSizeHigh=0x0, nFileSizeLow=0x81a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="3iAnGfY559.ots", cAlternateFileName="3IANGF~1.OTS")) returned 1 [0102.525] FindNextFileW (in: hFindFile=0x814ffa8, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0cdcd20, ftCreationTime.dwHighDateTime=0x1d5e715, ftLastAccessTime.dwLowDateTime=0x37e25050, ftLastAccessTime.dwHighDateTime=0x1d5f0f5, ftLastWriteTime.dwLowDateTime=0x37e25050, ftLastWriteTime.dwHighDateTime=0x1d5f0f5, nFileSizeHigh=0x0, nFileSizeLow=0x1110a, dwReserved0=0x0, dwReserved1=0x0, cFileName="3XiE.ppt", cAlternateFileName="")) returned 1 [0102.525] FindNextFileW (in: hFindFile=0x814ffa8, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4257830, ftCreationTime.dwHighDateTime=0x1d5ea79, ftLastAccessTime.dwLowDateTime=0xb34d0c90, ftLastAccessTime.dwHighDateTime=0x1d5efc3, ftLastWriteTime.dwLowDateTime=0xb34d0c90, ftLastWriteTime.dwHighDateTime=0x1d5efc3, nFileSizeHigh=0x0, nFileSizeLow=0xa33e, dwReserved0=0x0, dwReserved1=0x0, cFileName="5zo2z0GfAzDF6m.xlsx", cAlternateFileName="5ZO2Z0~1.XLS")) returned 1 [0102.525] FindNextFileW (in: hFindFile=0x814ffa8, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7c15d0, ftCreationTime.dwHighDateTime=0x1d5e583, ftLastAccessTime.dwLowDateTime=0xf498f690, ftLastAccessTime.dwHighDateTime=0x1d5e7e5, ftLastWriteTime.dwLowDateTime=0xf498f690, ftLastWriteTime.dwHighDateTime=0x1d5e7e5, nFileSizeHigh=0x0, nFileSizeLow=0x4852, dwReserved0=0x0, dwReserved1=0x0, cFileName="6I8aiqdPKPoPUC.docx", cAlternateFileName="6I8AIQ~1.DOC")) returned 1 [0102.525] FindNextFileW (in: hFindFile=0x814ffa8, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d513300, ftCreationTime.dwHighDateTime=0x1d5e1cb, ftLastAccessTime.dwLowDateTime=0xa22aea80, ftLastAccessTime.dwHighDateTime=0x1d5ee7a, ftLastWriteTime.dwLowDateTime=0xa22aea80, ftLastWriteTime.dwHighDateTime=0x1d5ee7a, nFileSizeHigh=0x0, nFileSizeLow=0x2b21, dwReserved0=0x0, dwReserved1=0x0, cFileName="fIOJ129jLEtR.rtf", cAlternateFileName="FIOJ12~1.RTF")) returned 1 [0102.525] FindNextFileW (in: hFindFile=0x814ffa8, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2733b700, ftCreationTime.dwHighDateTime=0x1d5e79d, ftLastAccessTime.dwLowDateTime=0xdf2b36b0, ftLastAccessTime.dwHighDateTime=0x1d5ecb3, ftLastWriteTime.dwLowDateTime=0xdf2b36b0, ftLastWriteTime.dwHighDateTime=0x1d5ecb3, nFileSizeHigh=0x0, nFileSizeLow=0x81d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="NP0C3ihvqG5p44O8.rtf", cAlternateFileName="NP0C3I~1.RTF")) returned 1 [0102.525] FindNextFileW (in: hFindFile=0x814ffa8, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe150d380, ftCreationTime.dwHighDateTime=0x1d5e1f7, ftLastAccessTime.dwLowDateTime=0x97ddfce0, ftLastAccessTime.dwHighDateTime=0x1d5e270, ftLastWriteTime.dwLowDateTime=0x97ddfce0, ftLastWriteTime.dwHighDateTime=0x1d5e270, nFileSizeHigh=0x0, nFileSizeLow=0x66e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="VQUy.ppt", cAlternateFileName="")) returned 1 [0102.525] FindNextFileW (in: hFindFile=0x814ffa8, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe150d380, ftCreationTime.dwHighDateTime=0x1d5e1f7, ftLastAccessTime.dwLowDateTime=0x97ddfce0, ftLastAccessTime.dwHighDateTime=0x1d5e270, ftLastWriteTime.dwLowDateTime=0x97ddfce0, ftLastWriteTime.dwHighDateTime=0x1d5e270, nFileSizeHigh=0x0, nFileSizeLow=0x66e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="VQUy.ppt", cAlternateFileName="")) returned 0 [0102.525] FindClose (in: hFindFile=0x814ffa8 | out: hFindFile=0x814ffa8) returned 1 [0102.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb50) returned 1 [0102.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb5c) returned 1 [0102.525] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\3XiE.ppt", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9WWI\\3XiE.ppt", lpFilePart=0x0) returned 0x27 [0102.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0102.525] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\3XiE.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\9wwi\\3xie.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0102.525] GetFileType (hFile=0x2e4) returned 0x1 [0102.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0102.525] GetFileType (hFile=0x2e4) returned 0x1 [0102.526] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0x1110a [0102.526] ReadFile (in: hFile=0x2e4, lpBuffer=0x2ed9638, nNumberOfBytesToRead=0x1110a, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x2ed9638*, lpNumberOfBytesRead=0xefeae8*=0x1110a, lpOverlapped=0x0) returned 1 [0102.527] CloseHandle (hObject=0x2e4) returned 1 [0102.631] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0102.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0102.631] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0102.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0102.632] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\3XiE.ppt", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9WWI\\3XiE.ppt", lpFilePart=0x0) returned 0x27 [0102.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0102.632] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\3XiE.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\9wwi\\3xie.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0102.634] GetFileType (hFile=0x2e4) returned 0x1 [0102.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0102.635] GetFileType (hFile=0x2e4) returned 0x1 [0102.635] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f598c0*, nNumberOfBytesToWrite=0x11110, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x2f598c0*, lpNumberOfBytesWritten=0xefeadc*=0x11110, lpOverlapped=0x0) returned 1 [0102.637] CloseHandle (hObject=0x2e4) returned 1 [0102.639] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\3XiE.ppt", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9WWI\\3XiE.ppt", lpFilePart=0x0) returned 0x27 [0102.639] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\3XiE.ppt.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9WWI\\3XiE.ppt.UGMH", lpFilePart=0x0) returned 0x2c [0102.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0102.639] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\3XiE.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\9wwi\\3xie.ppt"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0cdcd20, ftCreationTime.dwHighDateTime=0x1d5e715, ftLastAccessTime.dwLowDateTime=0x37e25050, ftLastAccessTime.dwHighDateTime=0x1d5f0f5, ftLastWriteTime.dwLowDateTime=0xd346eaf4, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x11110)) returned 1 [0102.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0102.640] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\3XiE.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\9wwi\\3xie.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\3XiE.ppt.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\9wwi\\3xie.ppt.ugmh")) returned 1 [0102.640] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\5zo2z0GfAzDF6m.xlsx", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9WWI\\5zo2z0GfAzDF6m.xlsx", lpFilePart=0x0) returned 0x32 [0102.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0102.640] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\5zo2z0GfAzDF6m.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\9wwi\\5zo2z0gfazdf6m.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0102.641] GetFileType (hFile=0x2e4) returned 0x1 [0102.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0102.641] GetFileType (hFile=0x2e4) returned 0x1 [0102.641] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0xa33e [0102.641] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f6ade8, nNumberOfBytesToRead=0xa33e, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x2f6ade8*, lpNumberOfBytesRead=0xefeae8*=0xa33e, lpOverlapped=0x0) returned 1 [0102.642] CloseHandle (hObject=0x2e4) returned 1 [0102.660] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0102.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0102.660] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0102.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0102.660] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\5zo2z0GfAzDF6m.xlsx", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9WWI\\5zo2z0GfAzDF6m.xlsx", lpFilePart=0x0) returned 0x32 [0102.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0102.661] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\5zo2z0GfAzDF6m.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\9wwi\\5zo2z0gfazdf6m.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0102.662] GetFileType (hFile=0x2e4) returned 0x1 [0102.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0102.662] GetFileType (hFile=0x2e4) returned 0x1 [0102.662] WriteFile (in: hFile=0x2e4, lpBuffer=0x2feac10*, nNumberOfBytesToWrite=0xa340, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x2feac10*, lpNumberOfBytesWritten=0xefeadc*=0xa340, lpOverlapped=0x0) returned 1 [0102.664] CloseHandle (hObject=0x2e4) returned 1 [0103.060] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\5zo2z0GfAzDF6m.xlsx", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9WWI\\5zo2z0GfAzDF6m.xlsx", lpFilePart=0x0) returned 0x32 [0103.060] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\5zo2z0GfAzDF6m.xlsx.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9WWI\\5zo2z0GfAzDF6m.xlsx.UGMH", lpFilePart=0x0) returned 0x37 [0103.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0103.060] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\5zo2z0GfAzDF6m.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\9wwi\\5zo2z0gfazdf6m.xlsx"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4257830, ftCreationTime.dwHighDateTime=0x1d5ea79, ftLastAccessTime.dwLowDateTime=0xb34d0c90, ftLastAccessTime.dwHighDateTime=0x1d5efc3, ftLastWriteTime.dwLowDateTime=0xd3876a39, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xa340)) returned 1 [0103.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0103.061] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\5zo2z0GfAzDF6m.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\9wwi\\5zo2z0gfazdf6m.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\5zo2z0GfAzDF6m.xlsx.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\9wwi\\5zo2z0gfazdf6m.xlsx.ugmh")) returned 1 [0103.061] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\6I8aiqdPKPoPUC.docx", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9WWI\\6I8aiqdPKPoPUC.docx", lpFilePart=0x0) returned 0x32 [0103.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0103.061] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\6I8aiqdPKPoPUC.docx" (normalized: "c:\\users\\fd1hvy\\documents\\9wwi\\6i8aiqdpkpopuc.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0103.061] GetFileType (hFile=0x2e4) returned 0x1 [0103.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0103.062] GetFileType (hFile=0x2e4) returned 0x1 [0103.062] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0x4852 [0103.062] ReadFile (in: hFile=0x2e4, lpBuffer=0x2ff53d4, nNumberOfBytesToRead=0x4852, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x2ff53d4*, lpNumberOfBytesRead=0xefeae8*=0x4852, lpOverlapped=0x0) returned 1 [0103.063] CloseHandle (hObject=0x2e4) returned 1 [0103.079] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0103.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0103.079] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0103.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0103.079] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\6I8aiqdPKPoPUC.docx", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9WWI\\6I8aiqdPKPoPUC.docx", lpFilePart=0x0) returned 0x32 [0103.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0103.079] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\6I8aiqdPKPoPUC.docx" (normalized: "c:\\users\\fd1hvy\\documents\\9wwi\\6i8aiqdpkpopuc.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0103.080] GetFileType (hFile=0x2e4) returned 0x1 [0103.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0103.080] GetFileType (hFile=0x2e4) returned 0x1 [0103.081] WriteFile (in: hFile=0x2e4, lpBuffer=0x3058b9c*, nNumberOfBytesToWrite=0x4860, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x3058b9c*, lpNumberOfBytesWritten=0xefeadc*=0x4860, lpOverlapped=0x0) returned 1 [0103.082] CloseHandle (hObject=0x2e4) returned 1 [0103.084] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\6I8aiqdPKPoPUC.docx", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9WWI\\6I8aiqdPKPoPUC.docx", lpFilePart=0x0) returned 0x32 [0103.084] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\6I8aiqdPKPoPUC.docx.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9WWI\\6I8aiqdPKPoPUC.docx.UGMH", lpFilePart=0x0) returned 0x37 [0103.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0103.084] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\6I8aiqdPKPoPUC.docx" (normalized: "c:\\users\\fd1hvy\\documents\\9wwi\\6i8aiqdpkpopuc.docx"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7c15d0, ftCreationTime.dwHighDateTime=0x1d5e583, ftLastAccessTime.dwLowDateTime=0xf498f690, ftLastAccessTime.dwHighDateTime=0x1d5e7e5, ftLastWriteTime.dwLowDateTime=0xd389acbe, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x4860)) returned 1 [0103.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0103.084] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\6I8aiqdPKPoPUC.docx" (normalized: "c:\\users\\fd1hvy\\documents\\9wwi\\6i8aiqdpkpopuc.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\6I8aiqdPKPoPUC.docx.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\9wwi\\6i8aiqdpkpopuc.docx.ugmh")) returned 1 [0103.085] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\fIOJ129jLEtR.rtf", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9WWI\\fIOJ129jLEtR.rtf", lpFilePart=0x0) returned 0x2f [0103.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0103.085] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\fIOJ129jLEtR.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\9wwi\\fioj129jletr.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0103.085] GetFileType (hFile=0x2e4) returned 0x1 [0103.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0103.085] GetFileType (hFile=0x2e4) returned 0x1 [0103.085] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0x2b21 [0103.085] ReadFile (in: hFile=0x2e4, lpBuffer=0x305d874, nNumberOfBytesToRead=0x2b21, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x305d874*, lpNumberOfBytesRead=0xefeae8*=0x2b21, lpOverlapped=0x0) returned 1 [0103.086] CloseHandle (hObject=0x2e4) returned 1 [0103.291] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0103.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0103.292] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0103.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0103.292] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\fIOJ129jLEtR.rtf", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9WWI\\fIOJ129jLEtR.rtf", lpFilePart=0x0) returned 0x2f [0103.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0103.292] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\fIOJ129jLEtR.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\9wwi\\fioj129jletr.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0103.292] GetFileType (hFile=0x2e4) returned 0x1 [0103.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0103.292] GetFileType (hFile=0x2e4) returned 0x1 [0103.292] WriteFile (in: hFile=0x2e4, lpBuffer=0x2ea65b8*, nNumberOfBytesToWrite=0x2b30, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x2ea65b8*, lpNumberOfBytesWritten=0xefeadc*=0x2b30, lpOverlapped=0x0) returned 1 [0103.293] CloseHandle (hObject=0x2e4) returned 1 [0103.295] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\fIOJ129jLEtR.rtf", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9WWI\\fIOJ129jLEtR.rtf", lpFilePart=0x0) returned 0x2f [0103.295] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\fIOJ129jLEtR.rtf.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9WWI\\fIOJ129jLEtR.rtf.UGMH", lpFilePart=0x0) returned 0x34 [0103.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0103.295] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\fIOJ129jLEtR.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\9wwi\\fioj129jletr.rtf"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d513300, ftCreationTime.dwHighDateTime=0x1d5e1cb, ftLastAccessTime.dwLowDateTime=0xa22aea80, ftLastAccessTime.dwHighDateTime=0x1d5ee7a, ftLastWriteTime.dwLowDateTime=0xd3ab0cea, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x2b30)) returned 1 [0103.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0103.295] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\fIOJ129jLEtR.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\9wwi\\fioj129jletr.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\fIOJ129jLEtR.rtf.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\9wwi\\fioj129jletr.rtf.ugmh")) returned 1 [0103.296] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\NP0C3ihvqG5p44O8.rtf", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9WWI\\NP0C3ihvqG5p44O8.rtf", lpFilePart=0x0) returned 0x33 [0103.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0103.296] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\NP0C3ihvqG5p44O8.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\9wwi\\np0c3ihvqg5p44o8.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0103.296] GetFileType (hFile=0x2e4) returned 0x1 [0103.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0103.296] GetFileType (hFile=0x2e4) returned 0x1 [0103.296] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0x81d6 [0103.296] ReadFile (in: hFile=0x2e4, lpBuffer=0x2ea9554, nNumberOfBytesToRead=0x81d6, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x2ea9554*, lpNumberOfBytesRead=0xefeae8*=0x81d6, lpOverlapped=0x0) returned 1 [0103.297] CloseHandle (hObject=0x2e4) returned 1 [0103.319] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0103.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0103.319] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0103.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0103.319] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\NP0C3ihvqG5p44O8.rtf", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9WWI\\NP0C3ihvqG5p44O8.rtf", lpFilePart=0x0) returned 0x33 [0103.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0103.319] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\NP0C3ihvqG5p44O8.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\9wwi\\np0c3ihvqg5p44o8.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0103.374] GetFileType (hFile=0x2e4) returned 0x1 [0103.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0103.374] GetFileType (hFile=0x2e4) returned 0x1 [0103.374] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f1edf8*, nNumberOfBytesToWrite=0x81e0, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x2f1edf8*, lpNumberOfBytesWritten=0xefeadc*=0x81e0, lpOverlapped=0x0) returned 1 [0103.376] CloseHandle (hObject=0x2e4) returned 1 [0103.378] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\NP0C3ihvqG5p44O8.rtf", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9WWI\\NP0C3ihvqG5p44O8.rtf", lpFilePart=0x0) returned 0x33 [0103.378] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\NP0C3ihvqG5p44O8.rtf.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9WWI\\NP0C3ihvqG5p44O8.rtf.UGMH", lpFilePart=0x0) returned 0x38 [0103.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0103.378] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\NP0C3ihvqG5p44O8.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\9wwi\\np0c3ihvqg5p44o8.rtf"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2733b700, ftCreationTime.dwHighDateTime=0x1d5e79d, ftLastAccessTime.dwLowDateTime=0xdf2b36b0, ftLastAccessTime.dwHighDateTime=0x1d5ecb3, ftLastWriteTime.dwLowDateTime=0xd3b6f9b1, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x81e0)) returned 1 [0103.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0103.378] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\NP0C3ihvqG5p44O8.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\9wwi\\np0c3ihvqg5p44o8.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\NP0C3ihvqG5p44O8.rtf.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\9wwi\\np0c3ihvqg5p44o8.rtf.ugmh")) returned 1 [0103.379] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\VQUy.ppt", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9WWI\\VQUy.ppt", lpFilePart=0x0) returned 0x27 [0103.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0103.379] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\VQUy.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\9wwi\\vquy.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0103.379] GetFileType (hFile=0x2e4) returned 0x1 [0103.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0103.380] GetFileType (hFile=0x2e4) returned 0x1 [0103.380] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0x66e6 [0103.380] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f2743c, nNumberOfBytesToRead=0x66e6, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x2f2743c*, lpNumberOfBytesRead=0xefeae8*=0x66e6, lpOverlapped=0x0) returned 1 [0103.381] CloseHandle (hObject=0x2e4) returned 1 [0103.407] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0103.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0103.407] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0103.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0103.407] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\VQUy.ppt", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9WWI\\VQUy.ppt", lpFilePart=0x0) returned 0x27 [0103.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0103.407] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\VQUy.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\9wwi\\vquy.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0103.409] GetFileType (hFile=0x2e4) returned 0x1 [0103.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0103.409] GetFileType (hFile=0x2e4) returned 0x1 [0103.409] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f944d4*, nNumberOfBytesToWrite=0x66f0, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x2f944d4*, lpNumberOfBytesWritten=0xefeadc*=0x66f0, lpOverlapped=0x0) returned 1 [0103.411] CloseHandle (hObject=0x2e4) returned 1 [0103.413] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\VQUy.ppt", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9WWI\\VQUy.ppt", lpFilePart=0x0) returned 0x27 [0103.413] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\VQUy.ppt.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9WWI\\VQUy.ppt.UGMH", lpFilePart=0x0) returned 0x2c [0103.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0103.413] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\VQUy.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\9wwi\\vquy.ppt"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe150d380, ftCreationTime.dwHighDateTime=0x1d5e1f7, ftLastAccessTime.dwLowDateTime=0x97ddfce0, ftLastAccessTime.dwHighDateTime=0x1d5e270, ftLastWriteTime.dwLowDateTime=0xd3bbbf0c, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x66f0)) returned 1 [0103.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0103.413] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\VQUy.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\9wwi\\vquy.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\9WWI\\VQUy.ppt.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\9wwi\\vquy.ppt.ugmh")) returned 1 [0103.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb94) returned 1 [0103.414] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy", nBufferLength=0x105, lpBuffer=0xefe648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy", lpFilePart=0x0) returned 0x2a [0103.414] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\*", lpFindFileData=0xefe8bc | out: lpFindFileData=0xefe8bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4989cf20, ftCreationTime.dwHighDateTime=0x1d5ee45, ftLastAccessTime.dwLowDateTime=0x3b4e8930, ftLastAccessTime.dwHighDateTime=0x1d5eb63, ftLastWriteTime.dwLowDateTime=0x3b4e8930, ftLastWriteTime.dwHighDateTime=0x1d5eb63, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x81502e8 [0103.457] FindNextFileW (in: hFindFile=0x81502e8, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4989cf20, ftCreationTime.dwHighDateTime=0x1d5ee45, ftLastAccessTime.dwLowDateTime=0x3b4e8930, ftLastAccessTime.dwHighDateTime=0x1d5eb63, ftLastWriteTime.dwLowDateTime=0x3b4e8930, ftLastWriteTime.dwHighDateTime=0x1d5eb63, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.457] FindNextFileW (in: hFindFile=0x81502e8, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99cea440, ftCreationTime.dwHighDateTime=0x1d5eabe, ftLastAccessTime.dwLowDateTime=0xfbe5cc30, ftLastAccessTime.dwHighDateTime=0x1d5ebef, ftLastWriteTime.dwLowDateTime=0xfbe5cc30, ftLastWriteTime.dwHighDateTime=0x1d5ebef, nFileSizeHigh=0x0, nFileSizeLow=0x707f, dwReserved0=0x0, dwReserved1=0x0, cFileName="5CRpSexs288Od0cP5SHE.pdf", cAlternateFileName="5CRPSE~1.PDF")) returned 1 [0103.457] FindNextFileW (in: hFindFile=0x81502e8, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9a3b3950, ftCreationTime.dwHighDateTime=0x1d5e48a, ftLastAccessTime.dwLowDateTime=0x9fb78c60, ftLastAccessTime.dwHighDateTime=0x1d5e2fc, ftLastWriteTime.dwLowDateTime=0x9fb78c60, ftLastWriteTime.dwHighDateTime=0x1d5e2fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="aFyYZcH", cAlternateFileName="")) returned 1 [0103.457] FindNextFileW (in: hFindFile=0x81502e8, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3dbc890, ftCreationTime.dwHighDateTime=0x1d5e5be, ftLastAccessTime.dwLowDateTime=0xc422ea80, ftLastAccessTime.dwHighDateTime=0x1d5e573, ftLastWriteTime.dwLowDateTime=0xc422ea80, ftLastWriteTime.dwHighDateTime=0x1d5e573, nFileSizeHigh=0x0, nFileSizeLow=0x16eb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="gyTiPsjlZPe7kreU.ots", cAlternateFileName="GYTIPS~1.OTS")) returned 1 [0103.457] FindNextFileW (in: hFindFile=0x81502e8, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x642b45c0, ftCreationTime.dwHighDateTime=0x1d5e256, ftLastAccessTime.dwLowDateTime=0x58a00290, ftLastAccessTime.dwHighDateTime=0x1d5e2bf, ftLastWriteTime.dwLowDateTime=0x58a00290, ftLastWriteTime.dwHighDateTime=0x1d5e2bf, nFileSizeHigh=0x0, nFileSizeLow=0x15e9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="j8kqy4BcTs1.odp", cAlternateFileName="J8KQY4~1.ODP")) returned 1 [0103.457] FindNextFileW (in: hFindFile=0x81502e8, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f52500, ftCreationTime.dwHighDateTime=0x1d5ef27, ftLastAccessTime.dwLowDateTime=0x865b7d70, ftLastAccessTime.dwHighDateTime=0x1d5ed7f, ftLastWriteTime.dwLowDateTime=0x865b7d70, ftLastWriteTime.dwHighDateTime=0x1d5ed7f, nFileSizeHigh=0x0, nFileSizeLow=0x1426e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LxdHMV.pdf", cAlternateFileName="")) returned 1 [0103.457] FindNextFileW (in: hFindFile=0x81502e8, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef0d74d0, ftCreationTime.dwHighDateTime=0x1d5f064, ftLastAccessTime.dwLowDateTime=0x67002c20, ftLastAccessTime.dwHighDateTime=0x1d5f106, ftLastWriteTime.dwLowDateTime=0x67002c20, ftLastWriteTime.dwHighDateTime=0x1d5f106, nFileSizeHigh=0x0, nFileSizeLow=0x79c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="M6HZIFQIm4S0tKzaytnN.doc", cAlternateFileName="M6HZIF~1.DOC")) returned 1 [0103.457] FindNextFileW (in: hFindFile=0x81502e8, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3783a00, ftCreationTime.dwHighDateTime=0x1d5e6f7, ftLastAccessTime.dwLowDateTime=0x70fac390, ftLastAccessTime.dwHighDateTime=0x1d5e952, ftLastWriteTime.dwLowDateTime=0x70fac390, ftLastWriteTime.dwHighDateTime=0x1d5e952, nFileSizeHigh=0x0, nFileSizeLow=0xb208, dwReserved0=0x0, dwReserved1=0x0, cFileName="op_rvj.xls", cAlternateFileName="")) returned 1 [0103.457] FindNextFileW (in: hFindFile=0x81502e8, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc47d70, ftCreationTime.dwHighDateTime=0x1d5ea49, ftLastAccessTime.dwLowDateTime=0x23cb8480, ftLastAccessTime.dwHighDateTime=0x1d5e5d6, ftLastWriteTime.dwLowDateTime=0x23cb8480, ftLastWriteTime.dwHighDateTime=0x1d5e5d6, nFileSizeHigh=0x0, nFileSizeLow=0x3c6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RjZQCFqkbwx5z rYrXh.xls", cAlternateFileName="RJZQCF~1.XLS")) returned 1 [0103.457] FindNextFileW (in: hFindFile=0x81502e8, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d1a8f30, ftCreationTime.dwHighDateTime=0x1d5e54c, ftLastAccessTime.dwLowDateTime=0xf9b2f0, ftLastAccessTime.dwHighDateTime=0x1d5ef64, ftLastWriteTime.dwLowDateTime=0xf9b2f0, ftLastWriteTime.dwHighDateTime=0x1d5ef64, nFileSizeHigh=0x0, nFileSizeLow=0xd508, dwReserved0=0x0, dwReserved1=0x0, cFileName="vuxUSCOR3Z p3QB2vQ.odt", cAlternateFileName="VUXUSC~1.ODT")) returned 1 [0103.457] FindNextFileW (in: hFindFile=0x81502e8, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30330170, ftCreationTime.dwHighDateTime=0x1d5e7df, ftLastAccessTime.dwLowDateTime=0xb917ddf0, ftLastAccessTime.dwHighDateTime=0x1d5e657, ftLastWriteTime.dwLowDateTime=0xb917ddf0, ftLastWriteTime.dwHighDateTime=0x1d5e657, nFileSizeHigh=0x0, nFileSizeLow=0xdad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="yquKKuMk_s.rtf", cAlternateFileName="YQUKKU~1.RTF")) returned 1 [0103.457] FindNextFileW (in: hFindFile=0x81502e8, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0103.458] FindClose (in: hFindFile=0x81502e8 | out: hFindFile=0x81502e8) returned 1 [0103.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb50) returned 1 [0103.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb5c) returned 1 [0103.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb94) returned 1 [0103.458] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy", nBufferLength=0x105, lpBuffer=0xefe648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy", lpFilePart=0x0) returned 0x2a [0103.458] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\*", lpFindFileData=0xefe8bc | out: lpFindFileData=0xefe8bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4989cf20, ftCreationTime.dwHighDateTime=0x1d5ee45, ftLastAccessTime.dwLowDateTime=0x3b4e8930, ftLastAccessTime.dwHighDateTime=0x1d5eb63, ftLastWriteTime.dwLowDateTime=0x3b4e8930, ftLastWriteTime.dwHighDateTime=0x1d5eb63, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8150428 [0103.458] FindNextFileW (in: hFindFile=0x8150428, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4989cf20, ftCreationTime.dwHighDateTime=0x1d5ee45, ftLastAccessTime.dwLowDateTime=0x3b4e8930, ftLastAccessTime.dwHighDateTime=0x1d5eb63, ftLastWriteTime.dwLowDateTime=0x3b4e8930, ftLastWriteTime.dwHighDateTime=0x1d5eb63, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.458] FindNextFileW (in: hFindFile=0x8150428, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99cea440, ftCreationTime.dwHighDateTime=0x1d5eabe, ftLastAccessTime.dwLowDateTime=0xfbe5cc30, ftLastAccessTime.dwHighDateTime=0x1d5ebef, ftLastWriteTime.dwLowDateTime=0xfbe5cc30, ftLastWriteTime.dwHighDateTime=0x1d5ebef, nFileSizeHigh=0x0, nFileSizeLow=0x707f, dwReserved0=0x0, dwReserved1=0x0, cFileName="5CRpSexs288Od0cP5SHE.pdf", cAlternateFileName="5CRPSE~1.PDF")) returned 1 [0103.458] FindNextFileW (in: hFindFile=0x8150428, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9a3b3950, ftCreationTime.dwHighDateTime=0x1d5e48a, ftLastAccessTime.dwLowDateTime=0x9fb78c60, ftLastAccessTime.dwHighDateTime=0x1d5e2fc, ftLastWriteTime.dwLowDateTime=0x9fb78c60, ftLastWriteTime.dwHighDateTime=0x1d5e2fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="aFyYZcH", cAlternateFileName="")) returned 1 [0103.458] FindNextFileW (in: hFindFile=0x8150428, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3dbc890, ftCreationTime.dwHighDateTime=0x1d5e5be, ftLastAccessTime.dwLowDateTime=0xc422ea80, ftLastAccessTime.dwHighDateTime=0x1d5e573, ftLastWriteTime.dwLowDateTime=0xc422ea80, ftLastWriteTime.dwHighDateTime=0x1d5e573, nFileSizeHigh=0x0, nFileSizeLow=0x16eb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="gyTiPsjlZPe7kreU.ots", cAlternateFileName="GYTIPS~1.OTS")) returned 1 [0103.458] FindNextFileW (in: hFindFile=0x8150428, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x642b45c0, ftCreationTime.dwHighDateTime=0x1d5e256, ftLastAccessTime.dwLowDateTime=0x58a00290, ftLastAccessTime.dwHighDateTime=0x1d5e2bf, ftLastWriteTime.dwLowDateTime=0x58a00290, ftLastWriteTime.dwHighDateTime=0x1d5e2bf, nFileSizeHigh=0x0, nFileSizeLow=0x15e9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="j8kqy4BcTs1.odp", cAlternateFileName="J8KQY4~1.ODP")) returned 1 [0103.459] FindNextFileW (in: hFindFile=0x8150428, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f52500, ftCreationTime.dwHighDateTime=0x1d5ef27, ftLastAccessTime.dwLowDateTime=0x865b7d70, ftLastAccessTime.dwHighDateTime=0x1d5ed7f, ftLastWriteTime.dwLowDateTime=0x865b7d70, ftLastWriteTime.dwHighDateTime=0x1d5ed7f, nFileSizeHigh=0x0, nFileSizeLow=0x1426e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LxdHMV.pdf", cAlternateFileName="")) returned 1 [0103.459] FindNextFileW (in: hFindFile=0x8150428, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef0d74d0, ftCreationTime.dwHighDateTime=0x1d5f064, ftLastAccessTime.dwLowDateTime=0x67002c20, ftLastAccessTime.dwHighDateTime=0x1d5f106, ftLastWriteTime.dwLowDateTime=0x67002c20, ftLastWriteTime.dwHighDateTime=0x1d5f106, nFileSizeHigh=0x0, nFileSizeLow=0x79c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="M6HZIFQIm4S0tKzaytnN.doc", cAlternateFileName="M6HZIF~1.DOC")) returned 1 [0103.459] FindNextFileW (in: hFindFile=0x8150428, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3783a00, ftCreationTime.dwHighDateTime=0x1d5e6f7, ftLastAccessTime.dwLowDateTime=0x70fac390, ftLastAccessTime.dwHighDateTime=0x1d5e952, ftLastWriteTime.dwLowDateTime=0x70fac390, ftLastWriteTime.dwHighDateTime=0x1d5e952, nFileSizeHigh=0x0, nFileSizeLow=0xb208, dwReserved0=0x0, dwReserved1=0x0, cFileName="op_rvj.xls", cAlternateFileName="")) returned 1 [0103.459] FindNextFileW (in: hFindFile=0x8150428, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc47d70, ftCreationTime.dwHighDateTime=0x1d5ea49, ftLastAccessTime.dwLowDateTime=0x23cb8480, ftLastAccessTime.dwHighDateTime=0x1d5e5d6, ftLastWriteTime.dwLowDateTime=0x23cb8480, ftLastWriteTime.dwHighDateTime=0x1d5e5d6, nFileSizeHigh=0x0, nFileSizeLow=0x3c6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RjZQCFqkbwx5z rYrXh.xls", cAlternateFileName="RJZQCF~1.XLS")) returned 1 [0103.459] FindNextFileW (in: hFindFile=0x8150428, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d1a8f30, ftCreationTime.dwHighDateTime=0x1d5e54c, ftLastAccessTime.dwLowDateTime=0xf9b2f0, ftLastAccessTime.dwHighDateTime=0x1d5ef64, ftLastWriteTime.dwLowDateTime=0xf9b2f0, ftLastWriteTime.dwHighDateTime=0x1d5ef64, nFileSizeHigh=0x0, nFileSizeLow=0xd508, dwReserved0=0x0, dwReserved1=0x0, cFileName="vuxUSCOR3Z p3QB2vQ.odt", cAlternateFileName="VUXUSC~1.ODT")) returned 1 [0103.459] FindNextFileW (in: hFindFile=0x8150428, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30330170, ftCreationTime.dwHighDateTime=0x1d5e7df, ftLastAccessTime.dwLowDateTime=0xb917ddf0, ftLastAccessTime.dwHighDateTime=0x1d5e657, ftLastWriteTime.dwLowDateTime=0xb917ddf0, ftLastWriteTime.dwHighDateTime=0x1d5e657, nFileSizeHigh=0x0, nFileSizeLow=0xdad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="yquKKuMk_s.rtf", cAlternateFileName="YQUKKU~1.RTF")) returned 1 [0103.459] FindNextFileW (in: hFindFile=0x8150428, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30330170, ftCreationTime.dwHighDateTime=0x1d5e7df, ftLastAccessTime.dwLowDateTime=0xb917ddf0, ftLastAccessTime.dwHighDateTime=0x1d5e657, ftLastWriteTime.dwLowDateTime=0xb917ddf0, ftLastWriteTime.dwHighDateTime=0x1d5e657, nFileSizeHigh=0x0, nFileSizeLow=0xdad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="yquKKuMk_s.rtf", cAlternateFileName="YQUKKU~1.RTF")) returned 0 [0103.459] FindClose (in: hFindFile=0x8150428 | out: hFindFile=0x8150428) returned 1 [0103.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb50) returned 1 [0103.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb5c) returned 1 [0103.459] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\5CRpSexs288Od0cP5SHE.pdf", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\5CRpSexs288Od0cP5SHE.pdf", lpFilePart=0x0) returned 0x43 [0103.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0103.459] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\5CRpSexs288Od0cP5SHE.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\5crpsexs288od0cp5she.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0103.460] GetFileType (hFile=0x2e4) returned 0x1 [0103.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0103.460] GetFileType (hFile=0x2e4) returned 0x1 [0103.460] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0x707f [0103.460] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f9dd70, nNumberOfBytesToRead=0x707f, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x2f9dd70*, lpNumberOfBytesRead=0xefeae8*=0x707f, lpOverlapped=0x0) returned 1 [0103.461] CloseHandle (hObject=0x2e4) returned 1 [0103.487] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0103.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0103.487] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0103.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0103.487] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\5CRpSexs288Od0cP5SHE.pdf", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\5CRpSexs288Od0cP5SHE.pdf", lpFilePart=0x0) returned 0x43 [0103.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0103.488] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\5CRpSexs288Od0cP5SHE.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\5crpsexs288od0cp5she.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0103.489] GetFileType (hFile=0x2e4) returned 0x1 [0103.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0103.489] GetFileType (hFile=0x2e4) returned 0x1 [0103.489] WriteFile (in: hFile=0x2e4, lpBuffer=0x300ddd8*, nNumberOfBytesToWrite=0x7080, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x300ddd8*, lpNumberOfBytesWritten=0xefeadc*=0x7080, lpOverlapped=0x0) returned 1 [0103.491] CloseHandle (hObject=0x2e4) returned 1 [0103.496] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\5CRpSexs288Od0cP5SHE.pdf", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\5CRpSexs288Od0cP5SHE.pdf", lpFilePart=0x0) returned 0x43 [0103.496] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\5CRpSexs288Od0cP5SHE.pdf.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\5CRpSexs288Od0cP5SHE.pdf.UGMH", lpFilePart=0x0) returned 0x48 [0103.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0103.496] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\5CRpSexs288Od0cP5SHE.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\5crpsexs288od0cp5she.pdf"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99cea440, ftCreationTime.dwHighDateTime=0x1d5eabe, ftLastAccessTime.dwLowDateTime=0xfbe5cc30, ftLastAccessTime.dwHighDateTime=0x1d5ebef, ftLastWriteTime.dwLowDateTime=0xd3ca34f8, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x7080)) returned 1 [0103.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0103.497] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\5CRpSexs288Od0cP5SHE.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\5crpsexs288od0cp5she.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\5CRpSexs288Od0cP5SHE.pdf.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\5crpsexs288od0cp5she.pdf.ugmh")) returned 1 [0103.497] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\LxdHMV.pdf", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\LxdHMV.pdf", lpFilePart=0x0) returned 0x35 [0103.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0103.497] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\LxdHMV.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\lxdhmv.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0103.498] GetFileType (hFile=0x2e4) returned 0x1 [0103.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0103.498] GetFileType (hFile=0x2e4) returned 0x1 [0103.498] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0x1426e [0103.498] ReadFile (in: hFile=0x2e4, lpBuffer=0x3015394, nNumberOfBytesToRead=0x1426e, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x3015394*, lpNumberOfBytesRead=0xefeae8*=0x1426e, lpOverlapped=0x0) returned 1 [0103.499] CloseHandle (hObject=0x2e4) returned 1 [0103.531] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0103.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0103.531] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0103.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0103.531] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\LxdHMV.pdf", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\LxdHMV.pdf", lpFilePart=0x0) returned 0x35 [0103.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0103.531] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\LxdHMV.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\lxdhmv.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0103.533] GetFileType (hFile=0x2e4) returned 0x1 [0103.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0103.533] GetFileType (hFile=0x2e4) returned 0x1 [0103.533] WriteFile (in: hFile=0x2e4, lpBuffer=0x2eb02d8*, nNumberOfBytesToWrite=0x14270, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x2eb02d8*, lpNumberOfBytesWritten=0xefeadc*=0x14270, lpOverlapped=0x0) returned 1 [0103.536] CloseHandle (hObject=0x2e4) returned 1 [0103.539] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\LxdHMV.pdf", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\LxdHMV.pdf", lpFilePart=0x0) returned 0x35 [0103.539] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\LxdHMV.pdf.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\LxdHMV.pdf.UGMH", lpFilePart=0x0) returned 0x3a [0103.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0103.539] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\LxdHMV.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\lxdhmv.pdf"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f52500, ftCreationTime.dwHighDateTime=0x1d5ef27, ftLastAccessTime.dwLowDateTime=0x865b7d70, ftLastAccessTime.dwHighDateTime=0x1d5ed7f, ftLastWriteTime.dwLowDateTime=0xd3ced02f, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x14270)) returned 1 [0103.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0103.539] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\LxdHMV.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\lxdhmv.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\LxdHMV.pdf.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\lxdhmv.pdf.ugmh")) returned 1 [0103.625] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\M6HZIFQIm4S0tKzaytnN.doc", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\M6HZIFQIm4S0tKzaytnN.doc", lpFilePart=0x0) returned 0x43 [0103.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0103.625] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\M6HZIFQIm4S0tKzaytnN.doc" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\m6hzifqim4s0tkzaytnn.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0103.696] GetFileType (hFile=0x2e4) returned 0x1 [0103.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0103.696] GetFileType (hFile=0x2e4) returned 0x1 [0103.696] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0x79c1 [0103.696] ReadFile (in: hFile=0x2e4, lpBuffer=0x2ec4a00, nNumberOfBytesToRead=0x79c1, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x2ec4a00*, lpNumberOfBytesRead=0xefeae8*=0x79c1, lpOverlapped=0x0) returned 1 [0103.698] CloseHandle (hObject=0x2e4) returned 1 [0103.722] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0103.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0103.722] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0103.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0103.723] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\M6HZIFQIm4S0tKzaytnN.doc", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\M6HZIFQIm4S0tKzaytnN.doc", lpFilePart=0x0) returned 0x43 [0103.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0103.723] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\M6HZIFQIm4S0tKzaytnN.doc" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\m6hzifqim4s0tkzaytnn.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0103.724] GetFileType (hFile=0x2e4) returned 0x1 [0103.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0103.725] GetFileType (hFile=0x2e4) returned 0x1 [0103.725] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f37a54*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x2f37a54*, lpNumberOfBytesWritten=0xefeadc*=0x79d0, lpOverlapped=0x0) returned 1 [0103.726] CloseHandle (hObject=0x2e4) returned 1 [0103.868] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\M6HZIFQIm4S0tKzaytnN.doc", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\M6HZIFQIm4S0tKzaytnN.doc", lpFilePart=0x0) returned 0x43 [0103.868] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\M6HZIFQIm4S0tKzaytnN.doc.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\M6HZIFQIm4S0tKzaytnN.doc.UGMH", lpFilePart=0x0) returned 0x48 [0103.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0103.868] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\M6HZIFQIm4S0tKzaytnN.doc" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\m6hzifqim4s0tkzaytnn.doc"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef0d74d0, ftCreationTime.dwHighDateTime=0x1d5f064, ftLastAccessTime.dwLowDateTime=0x67002c20, ftLastAccessTime.dwHighDateTime=0x1d5f106, ftLastWriteTime.dwLowDateTime=0xd403206f, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x79d0)) returned 1 [0103.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0103.868] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\M6HZIFQIm4S0tKzaytnN.doc" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\m6hzifqim4s0tkzaytnn.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\M6HZIFQIm4S0tKzaytnN.doc.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\m6hzifqim4s0tkzaytnn.doc.ugmh")) returned 1 [0103.869] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\op_rvj.xls", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\op_rvj.xls", lpFilePart=0x0) returned 0x35 [0103.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0103.869] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\op_rvj.xls" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\op_rvj.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0103.869] GetFileType (hFile=0x2e4) returned 0x1 [0103.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0103.869] GetFileType (hFile=0x2e4) returned 0x1 [0103.869] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0xb208 [0103.870] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f3f930, nNumberOfBytesToRead=0xb208, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x2f3f930*, lpNumberOfBytesRead=0xefeae8*=0xb208, lpOverlapped=0x0) returned 1 [0103.871] CloseHandle (hObject=0x2e4) returned 1 [0103.890] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0103.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0103.890] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0103.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0103.890] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\op_rvj.xls", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\op_rvj.xls", lpFilePart=0x0) returned 0x35 [0103.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0103.890] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\op_rvj.xls" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\op_rvj.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0103.891] GetFileType (hFile=0x2e4) returned 0x1 [0103.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0103.891] GetFileType (hFile=0x2e4) returned 0x1 [0103.891] WriteFile (in: hFile=0x2e4, lpBuffer=0x2fadd58*, nNumberOfBytesToWrite=0xb210, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x2fadd58*, lpNumberOfBytesWritten=0xefeadc*=0xb210, lpOverlapped=0x0) returned 1 [0103.893] CloseHandle (hObject=0x2e4) returned 1 [0103.895] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\op_rvj.xls", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\op_rvj.xls", lpFilePart=0x0) returned 0x35 [0103.895] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\op_rvj.xls.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\op_rvj.xls.UGMH", lpFilePart=0x0) returned 0x3a [0103.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0103.895] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\op_rvj.xls" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\op_rvj.xls"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3783a00, ftCreationTime.dwHighDateTime=0x1d5e6f7, ftLastAccessTime.dwLowDateTime=0x70fac390, ftLastAccessTime.dwHighDateTime=0x1d5e952, ftLastWriteTime.dwLowDateTime=0xd4058357, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xb210)) returned 1 [0103.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0103.895] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\op_rvj.xls" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\op_rvj.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\op_rvj.xls.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\op_rvj.xls.ugmh")) returned 1 [0103.896] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\RjZQCFqkbwx5z rYrXh.xls", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\RjZQCFqkbwx5z rYrXh.xls", lpFilePart=0x0) returned 0x42 [0103.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0103.896] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\RjZQCFqkbwx5z rYrXh.xls" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\rjzqcfqkbwx5z ryrxh.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0103.896] GetFileType (hFile=0x2e4) returned 0x1 [0103.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0103.896] GetFileType (hFile=0x2e4) returned 0x1 [0103.896] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0x3c6e [0103.896] ReadFile (in: hFile=0x2e4, lpBuffer=0x2fb941c, nNumberOfBytesToRead=0x3c6e, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x2fb941c*, lpNumberOfBytesRead=0xefeae8*=0x3c6e, lpOverlapped=0x0) returned 1 [0103.897] CloseHandle (hObject=0x2e4) returned 1 [0103.956] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0103.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0103.956] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0103.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0103.956] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\RjZQCFqkbwx5z rYrXh.xls", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\RjZQCFqkbwx5z rYrXh.xls", lpFilePart=0x0) returned 0x42 [0103.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0103.956] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\RjZQCFqkbwx5z rYrXh.xls" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\rjzqcfqkbwx5z ryrxh.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0103.958] GetFileType (hFile=0x2e4) returned 0x1 [0103.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0103.958] GetFileType (hFile=0x2e4) returned 0x1 [0103.958] WriteFile (in: hFile=0x2e4, lpBuffer=0x3019034*, nNumberOfBytesToWrite=0x3c70, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x3019034*, lpNumberOfBytesWritten=0xefeadc*=0x3c70, lpOverlapped=0x0) returned 1 [0103.959] CloseHandle (hObject=0x2e4) returned 1 [0103.961] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\RjZQCFqkbwx5z rYrXh.xls", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\RjZQCFqkbwx5z rYrXh.xls", lpFilePart=0x0) returned 0x42 [0103.961] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\RjZQCFqkbwx5z rYrXh.xls.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\RjZQCFqkbwx5z rYrXh.xls.UGMH", lpFilePart=0x0) returned 0x47 [0103.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0103.961] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\RjZQCFqkbwx5z rYrXh.xls" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\rjzqcfqkbwx5z ryrxh.xls"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc47d70, ftCreationTime.dwHighDateTime=0x1d5ea49, ftLastAccessTime.dwLowDateTime=0x23cb8480, ftLastAccessTime.dwHighDateTime=0x1d5e5d6, ftLastWriteTime.dwLowDateTime=0xd4117a0d, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x3c70)) returned 1 [0103.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0103.961] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\RjZQCFqkbwx5z rYrXh.xls" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\rjzqcfqkbwx5z ryrxh.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\RjZQCFqkbwx5z rYrXh.xls.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\rjzqcfqkbwx5z ryrxh.xls.ugmh")) returned 1 [0103.962] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\vuxUSCOR3Z p3QB2vQ.odt", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\vuxUSCOR3Z p3QB2vQ.odt", lpFilePart=0x0) returned 0x41 [0103.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0103.962] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\vuxUSCOR3Z p3QB2vQ.odt" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\vuxuscor3z p3qb2vq.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0103.962] GetFileType (hFile=0x2e4) returned 0x1 [0103.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0103.962] GetFileType (hFile=0x2e4) returned 0x1 [0103.962] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0xd508 [0103.962] ReadFile (in: hFile=0x2e4, lpBuffer=0x301d1d4, nNumberOfBytesToRead=0xd508, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x301d1d4*, lpNumberOfBytesRead=0xefeae8*=0xd508, lpOverlapped=0x0) returned 1 [0103.963] CloseHandle (hObject=0x2e4) returned 1 [0103.986] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0103.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0103.986] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0103.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0103.986] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\vuxUSCOR3Z p3QB2vQ.odt", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\vuxUSCOR3Z p3QB2vQ.odt", lpFilePart=0x0) returned 0x41 [0103.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0103.986] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\vuxUSCOR3Z p3QB2vQ.odt" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\vuxuscor3z p3qb2vq.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0103.987] GetFileType (hFile=0x2e4) returned 0x1 [0103.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0103.987] GetFileType (hFile=0x2e4) returned 0x1 [0103.987] WriteFile (in: hFile=0x2e4, lpBuffer=0x2e8b18c*, nNumberOfBytesToWrite=0xd510, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x2e8b18c*, lpNumberOfBytesWritten=0xefeadc*=0xd510, lpOverlapped=0x0) returned 1 [0103.989] CloseHandle (hObject=0x2e4) returned 1 [0103.991] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\vuxUSCOR3Z p3QB2vQ.odt", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\vuxUSCOR3Z p3QB2vQ.odt", lpFilePart=0x0) returned 0x41 [0103.991] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\vuxUSCOR3Z p3QB2vQ.odt.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\vuxUSCOR3Z p3QB2vQ.odt.UGMH", lpFilePart=0x0) returned 0x46 [0103.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0103.991] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\vuxUSCOR3Z p3QB2vQ.odt" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\vuxuscor3z p3qb2vq.odt"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d1a8f30, ftCreationTime.dwHighDateTime=0x1d5e54c, ftLastAccessTime.dwLowDateTime=0xf9b2f0, ftLastAccessTime.dwHighDateTime=0x1d5ef64, ftLastWriteTime.dwLowDateTime=0xd414b28f, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xd510)) returned 1 [0103.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0103.991] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\vuxUSCOR3Z p3QB2vQ.odt" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\vuxuscor3z p3qb2vq.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\vuxUSCOR3Z p3QB2vQ.odt.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\vuxuscor3z p3qb2vq.odt.ugmh")) returned 1 [0103.992] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\yquKKuMk_s.rtf", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\yquKKuMk_s.rtf", lpFilePart=0x0) returned 0x39 [0103.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0103.992] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\yquKKuMk_s.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\yqukkumk_s.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0103.992] GetFileType (hFile=0x2e4) returned 0x1 [0103.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0103.992] GetFileType (hFile=0x2e4) returned 0x1 [0103.992] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0xdad1 [0103.993] ReadFile (in: hFile=0x2e4, lpBuffer=0x2e98ba4, nNumberOfBytesToRead=0xdad1, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x2e98ba4*, lpNumberOfBytesRead=0xefeae8*=0xdad1, lpOverlapped=0x0) returned 1 [0103.994] CloseHandle (hObject=0x2e4) returned 1 [0104.061] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0104.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0104.061] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0104.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0104.062] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\yquKKuMk_s.rtf", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\yquKKuMk_s.rtf", lpFilePart=0x0) returned 0x39 [0104.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0104.062] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\yquKKuMk_s.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\yqukkumk_s.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0104.063] GetFileType (hFile=0x2e4) returned 0x1 [0104.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0104.063] GetFileType (hFile=0x2e4) returned 0x1 [0104.063] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f0eb9c*, nNumberOfBytesToWrite=0xdae0, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x2f0eb9c*, lpNumberOfBytesWritten=0xefeadc*=0xdae0, lpOverlapped=0x0) returned 1 [0104.065] CloseHandle (hObject=0x2e4) returned 1 [0104.067] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\yquKKuMk_s.rtf", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\yquKKuMk_s.rtf", lpFilePart=0x0) returned 0x39 [0104.067] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\yquKKuMk_s.rtf.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\yquKKuMk_s.rtf.UGMH", lpFilePart=0x0) returned 0x3e [0104.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0104.067] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\yquKKuMk_s.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\yqukkumk_s.rtf"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30330170, ftCreationTime.dwHighDateTime=0x1d5e7df, ftLastAccessTime.dwLowDateTime=0xb917ddf0, ftLastAccessTime.dwHighDateTime=0x1d5e657, ftLastWriteTime.dwLowDateTime=0xd4209d97, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xdae0)) returned 1 [0104.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0104.067] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\yquKKuMk_s.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\yqukkumk_s.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\yquKKuMk_s.rtf.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\yqukkumk_s.rtf.ugmh")) returned 1 [0104.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb20) returned 1 [0104.068] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH", nBufferLength=0x105, lpBuffer=0xefe5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH", lpFilePart=0x0) returned 0x32 [0104.068] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\*", lpFindFileData=0xefe848 | out: lpFindFileData=0xefe848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9a3b3950, ftCreationTime.dwHighDateTime=0x1d5e48a, ftLastAccessTime.dwLowDateTime=0x9fb78c60, ftLastAccessTime.dwHighDateTime=0x1d5e2fc, ftLastWriteTime.dwLowDateTime=0x9fb78c60, ftLastWriteTime.dwHighDateTime=0x1d5e2fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x814ffe8 [0104.068] FindNextFileW (in: hFindFile=0x814ffe8, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9a3b3950, ftCreationTime.dwHighDateTime=0x1d5e48a, ftLastAccessTime.dwLowDateTime=0x9fb78c60, ftLastAccessTime.dwHighDateTime=0x1d5e2fc, ftLastWriteTime.dwLowDateTime=0x9fb78c60, ftLastWriteTime.dwHighDateTime=0x1d5e2fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.068] FindNextFileW (in: hFindFile=0x814ffe8, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59a694b0, ftCreationTime.dwHighDateTime=0x1d5efc6, ftLastAccessTime.dwLowDateTime=0xc09e80f0, ftLastAccessTime.dwHighDateTime=0x1d5e9a0, ftLastWriteTime.dwLowDateTime=0xc09e80f0, ftLastWriteTime.dwHighDateTime=0x1d5e9a0, nFileSizeHigh=0x0, nFileSizeLow=0x5aec, dwReserved0=0x0, dwReserved1=0x0, cFileName="3GVdelo.xlsx", cAlternateFileName="3GVDEL~1.XLS")) returned 1 [0104.068] FindNextFileW (in: hFindFile=0x814ffe8, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb04fb2f0, ftCreationTime.dwHighDateTime=0x1d5ec11, ftLastAccessTime.dwLowDateTime=0xb0fdfb50, ftLastAccessTime.dwHighDateTime=0x1d5e6e2, ftLastWriteTime.dwLowDateTime=0xb0fdfb50, ftLastWriteTime.dwHighDateTime=0x1d5e6e2, nFileSizeHigh=0x0, nFileSizeLow=0x185a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PuNS.xls", cAlternateFileName="")) returned 1 [0104.068] FindNextFileW (in: hFindFile=0x814ffe8, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd6f4150, ftCreationTime.dwHighDateTime=0x1d5e817, ftLastAccessTime.dwLowDateTime=0xccd041b0, ftLastAccessTime.dwHighDateTime=0x1d5e202, ftLastWriteTime.dwLowDateTime=0xccd041b0, ftLastWriteTime.dwHighDateTime=0x1d5e202, nFileSizeHigh=0x0, nFileSizeLow=0x7fd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="yFIH e.xlsx", cAlternateFileName="YFIHE~1.XLS")) returned 1 [0104.068] FindNextFileW (in: hFindFile=0x814ffe8, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0104.069] FindClose (in: hFindFile=0x814ffe8 | out: hFindFile=0x814ffe8) returned 1 [0104.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeadc) returned 1 [0104.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeae8) returned 1 [0104.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb20) returned 1 [0104.069] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH", nBufferLength=0x105, lpBuffer=0xefe5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH", lpFilePart=0x0) returned 0x32 [0104.069] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\*", lpFindFileData=0xefe848 | out: lpFindFileData=0xefe848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9a3b3950, ftCreationTime.dwHighDateTime=0x1d5e48a, ftLastAccessTime.dwLowDateTime=0x9fb78c60, ftLastAccessTime.dwHighDateTime=0x1d5e2fc, ftLastWriteTime.dwLowDateTime=0x9fb78c60, ftLastWriteTime.dwHighDateTime=0x1d5e2fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8150568 [0104.069] FindNextFileW (in: hFindFile=0x8150568, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9a3b3950, ftCreationTime.dwHighDateTime=0x1d5e48a, ftLastAccessTime.dwLowDateTime=0x9fb78c60, ftLastAccessTime.dwHighDateTime=0x1d5e2fc, ftLastWriteTime.dwLowDateTime=0x9fb78c60, ftLastWriteTime.dwHighDateTime=0x1d5e2fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.069] FindNextFileW (in: hFindFile=0x8150568, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59a694b0, ftCreationTime.dwHighDateTime=0x1d5efc6, ftLastAccessTime.dwLowDateTime=0xc09e80f0, ftLastAccessTime.dwHighDateTime=0x1d5e9a0, ftLastWriteTime.dwLowDateTime=0xc09e80f0, ftLastWriteTime.dwHighDateTime=0x1d5e9a0, nFileSizeHigh=0x0, nFileSizeLow=0x5aec, dwReserved0=0x0, dwReserved1=0x0, cFileName="3GVdelo.xlsx", cAlternateFileName="3GVDEL~1.XLS")) returned 1 [0104.069] FindNextFileW (in: hFindFile=0x8150568, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb04fb2f0, ftCreationTime.dwHighDateTime=0x1d5ec11, ftLastAccessTime.dwLowDateTime=0xb0fdfb50, ftLastAccessTime.dwHighDateTime=0x1d5e6e2, ftLastWriteTime.dwLowDateTime=0xb0fdfb50, ftLastWriteTime.dwHighDateTime=0x1d5e6e2, nFileSizeHigh=0x0, nFileSizeLow=0x185a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PuNS.xls", cAlternateFileName="")) returned 1 [0104.069] FindNextFileW (in: hFindFile=0x8150568, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd6f4150, ftCreationTime.dwHighDateTime=0x1d5e817, ftLastAccessTime.dwLowDateTime=0xccd041b0, ftLastAccessTime.dwHighDateTime=0x1d5e202, ftLastWriteTime.dwLowDateTime=0xccd041b0, ftLastWriteTime.dwHighDateTime=0x1d5e202, nFileSizeHigh=0x0, nFileSizeLow=0x7fd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="yFIH e.xlsx", cAlternateFileName="YFIHE~1.XLS")) returned 1 [0104.069] FindNextFileW (in: hFindFile=0x8150568, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd6f4150, ftCreationTime.dwHighDateTime=0x1d5e817, ftLastAccessTime.dwLowDateTime=0xccd041b0, ftLastAccessTime.dwHighDateTime=0x1d5e202, ftLastWriteTime.dwLowDateTime=0xccd041b0, ftLastWriteTime.dwHighDateTime=0x1d5e202, nFileSizeHigh=0x0, nFileSizeLow=0x7fd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="yFIH e.xlsx", cAlternateFileName="YFIHE~1.XLS")) returned 0 [0104.069] FindClose (in: hFindFile=0x8150568 | out: hFindFile=0x8150568) returned 1 [0104.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeadc) returned 1 [0104.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeae8) returned 1 [0104.069] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\3GVdelo.xlsx", nBufferLength=0x105, lpBuffer=0xefe488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\3GVdelo.xlsx", lpFilePart=0x0) returned 0x3f [0104.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9cc) returned 1 [0104.070] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\3GVdelo.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\afyyzch\\3gvdelo.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0104.070] GetFileType (hFile=0x2e4) returned 0x1 [0104.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9c8) returned 1 [0104.070] GetFileType (hFile=0x2e4) returned 0x1 [0104.070] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeac8 | out: lpFileSizeHigh=0xefeac8*=0x0) returned 0x5aec [0104.070] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f1e364, nNumberOfBytesToRead=0x5aec, lpNumberOfBytesRead=0xefea74, lpOverlapped=0x0 | out: lpBuffer=0x2f1e364*, lpNumberOfBytesRead=0xefea74*=0x5aec, lpOverlapped=0x0) returned 1 [0104.071] CloseHandle (hObject=0x2e4) returned 1 [0104.106] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe58c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0104.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0104.107] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeabc | out: lpFileInformation=0xefeabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0104.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0104.107] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\3GVdelo.xlsx", nBufferLength=0x105, lpBuffer=0xefe474, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\3GVdelo.xlsx", lpFilePart=0x0) returned 0x3f [0104.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9b8) returned 1 [0104.108] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\3GVdelo.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\afyyzch\\3gvdelo.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0104.109] GetFileType (hFile=0x2e4) returned 0x1 [0104.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9b4) returned 1 [0104.109] GetFileType (hFile=0x2e4) returned 0x1 [0104.109] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f877f8*, nNumberOfBytesToWrite=0x5af0, lpNumberOfBytesWritten=0xefea68, lpOverlapped=0x0 | out: lpBuffer=0x2f877f8*, lpNumberOfBytesWritten=0xefea68*=0x5af0, lpOverlapped=0x0) returned 1 [0104.136] CloseHandle (hObject=0x2e4) returned 1 [0104.137] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\3GVdelo.xlsx", nBufferLength=0x105, lpBuffer=0xefe598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\3GVdelo.xlsx", lpFilePart=0x0) returned 0x3f [0104.137] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\3GVdelo.xlsx.UGMH", nBufferLength=0x105, lpBuffer=0xefe598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\3GVdelo.xlsx.UGMH", lpFilePart=0x0) returned 0x44 [0104.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea4c) returned 1 [0104.137] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\3GVdelo.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\afyyzch\\3gvdelo.xlsx"), fInfoLevelId=0x0, lpFileInformation=0xefeac8 | out: lpFileInformation=0xefeac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59a694b0, ftCreationTime.dwHighDateTime=0x1d5efc6, ftLastAccessTime.dwLowDateTime=0xc09e80f0, ftLastAccessTime.dwHighDateTime=0x1d5e9a0, ftLastWriteTime.dwLowDateTime=0xd42a2577, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x5af0)) returned 1 [0104.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea48) returned 1 [0104.138] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\3GVdelo.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\afyyzch\\3gvdelo.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\3GVdelo.xlsx.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\afyyzch\\3gvdelo.xlsx.ugmh")) returned 1 [0104.141] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\PuNS.xls", nBufferLength=0x105, lpBuffer=0xefe488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\PuNS.xls", lpFilePart=0x0) returned 0x3b [0104.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9cc) returned 1 [0104.142] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\PuNS.xls" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\afyyzch\\puns.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0104.142] GetFileType (hFile=0x2e4) returned 0x1 [0104.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9c8) returned 1 [0104.142] GetFileType (hFile=0x2e4) returned 0x1 [0104.142] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeac8 | out: lpFileSizeHigh=0xefeac8*=0x0) returned 0x185a1 [0104.142] ReadFile (in: hFile=0x2e4, lpBuffer=0x40d1e38, nNumberOfBytesToRead=0x185a1, lpNumberOfBytesRead=0xefea74, lpOverlapped=0x0 | out: lpBuffer=0x40d1e38*, lpNumberOfBytesRead=0xefea74*=0x185a1, lpOverlapped=0x0) returned 1 [0104.145] CloseHandle (hObject=0x2e4) returned 1 [0104.193] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe58c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0104.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0104.193] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeabc | out: lpFileInformation=0xefeabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0104.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0104.193] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\PuNS.xls", nBufferLength=0x105, lpBuffer=0xefe474, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\PuNS.xls", lpFilePart=0x0) returned 0x3b [0104.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9b8) returned 1 [0104.193] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\PuNS.xls" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\afyyzch\\puns.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0104.195] GetFileType (hFile=0x2e4) returned 0x1 [0104.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9b4) returned 1 [0104.195] GetFileType (hFile=0x2e4) returned 0x1 [0104.195] WriteFile (in: hFile=0x2e4, lpBuffer=0x414bad8*, nNumberOfBytesToWrite=0x185b0, lpNumberOfBytesWritten=0xefea68, lpOverlapped=0x0 | out: lpBuffer=0x414bad8*, lpNumberOfBytesWritten=0xefea68*=0x185b0, lpOverlapped=0x0) returned 1 [0104.197] CloseHandle (hObject=0x2e4) returned 1 [0104.200] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\PuNS.xls", nBufferLength=0x105, lpBuffer=0xefe598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\PuNS.xls", lpFilePart=0x0) returned 0x3b [0104.200] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\PuNS.xls.UGMH", nBufferLength=0x105, lpBuffer=0xefe598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\PuNS.xls.UGMH", lpFilePart=0x0) returned 0x40 [0104.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea4c) returned 1 [0104.200] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\PuNS.xls" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\afyyzch\\puns.xls"), fInfoLevelId=0x0, lpFileInformation=0xefeac8 | out: lpFileInformation=0xefeac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb04fb2f0, ftCreationTime.dwHighDateTime=0x1d5ec11, ftLastAccessTime.dwLowDateTime=0xb0fdfb50, ftLastAccessTime.dwHighDateTime=0x1d5e6e2, ftLastWriteTime.dwLowDateTime=0xd433b0f7, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x185b0)) returned 1 [0104.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea48) returned 1 [0104.200] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\PuNS.xls" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\afyyzch\\puns.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\PuNS.xls.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\afyyzch\\puns.xls.ugmh")) returned 1 [0104.328] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\yFIH e.xlsx", nBufferLength=0x105, lpBuffer=0xefe488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\yFIH e.xlsx", lpFilePart=0x0) returned 0x3e [0104.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9cc) returned 1 [0104.329] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\yFIH e.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\afyyzch\\yfih e.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0104.329] GetFileType (hFile=0x2e4) returned 0x1 [0104.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9c8) returned 1 [0104.329] GetFileType (hFile=0x2e4) returned 0x1 [0104.329] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeac8 | out: lpFileSizeHigh=0xefeac8*=0x0) returned 0x7fd9 [0104.329] ReadFile (in: hFile=0x2e4, lpBuffer=0x2fdaa7c, nNumberOfBytesToRead=0x7fd9, lpNumberOfBytesRead=0xefea74, lpOverlapped=0x0 | out: lpBuffer=0x2fdaa7c*, lpNumberOfBytesRead=0xefea74*=0x7fd9, lpOverlapped=0x0) returned 1 [0104.330] CloseHandle (hObject=0x2e4) returned 1 [0104.348] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe58c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0104.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0104.348] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeabc | out: lpFileInformation=0xefeabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0104.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0104.348] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\yFIH e.xlsx", nBufferLength=0x105, lpBuffer=0xefe474, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\yFIH e.xlsx", lpFilePart=0x0) returned 0x3e [0104.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9b8) returned 1 [0104.348] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\yFIH e.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\afyyzch\\yfih e.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0104.350] GetFileType (hFile=0x2e4) returned 0x1 [0104.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9b4) returned 1 [0104.350] GetFileType (hFile=0x2e4) returned 0x1 [0104.350] WriteFile (in: hFile=0x2e4, lpBuffer=0x304f7c4*, nNumberOfBytesToWrite=0x7fe0, lpNumberOfBytesWritten=0xefea68, lpOverlapped=0x0 | out: lpBuffer=0x304f7c4*, lpNumberOfBytesWritten=0xefea68*=0x7fe0, lpOverlapped=0x0) returned 1 [0104.352] CloseHandle (hObject=0x2e4) returned 1 [0104.354] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\yFIH e.xlsx", nBufferLength=0x105, lpBuffer=0xefe598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\yFIH e.xlsx", lpFilePart=0x0) returned 0x3e [0104.354] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\yFIH e.xlsx.UGMH", nBufferLength=0x105, lpBuffer=0xefe598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\yFIH e.xlsx.UGMH", lpFilePart=0x0) returned 0x43 [0104.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea4c) returned 1 [0104.354] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\yFIH e.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\afyyzch\\yfih e.xlsx"), fInfoLevelId=0x0, lpFileInformation=0xefeac8 | out: lpFileInformation=0xefeac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd6f4150, ftCreationTime.dwHighDateTime=0x1d5e817, ftLastAccessTime.dwLowDateTime=0xccd041b0, ftLastAccessTime.dwHighDateTime=0x1d5e202, ftLastWriteTime.dwLowDateTime=0xd44b8695, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x7fe0)) returned 1 [0104.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea48) returned 1 [0104.354] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\yFIH e.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\afyyzch\\yfih e.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\fyf3ROce0MqAXxsy\\aFyYZcH\\yFIH e.xlsx.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\fyf3roce0mqaxxsy\\afyyzch\\yfih e.xlsx.ugmh")) returned 1 [0104.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb94) returned 1 [0104.355] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n", nBufferLength=0x105, lpBuffer=0xefe648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n", lpFilePart=0x0) returned 0x2c [0104.355] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\*", lpFindFileData=0xefe8bc | out: lpFindFileData=0xefe8bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8663410, ftCreationTime.dwHighDateTime=0x1d5e401, ftLastAccessTime.dwLowDateTime=0xd3b29c70, ftLastAccessTime.dwHighDateTime=0x1d5e17c, ftLastWriteTime.dwLowDateTime=0xd3b29c70, ftLastWriteTime.dwHighDateTime=0x1d5e17c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8150568 [0104.355] FindNextFileW (in: hFindFile=0x8150568, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8663410, ftCreationTime.dwHighDateTime=0x1d5e401, ftLastAccessTime.dwLowDateTime=0xd3b29c70, ftLastAccessTime.dwHighDateTime=0x1d5e17c, ftLastWriteTime.dwLowDateTime=0xd3b29c70, ftLastWriteTime.dwHighDateTime=0x1d5e17c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.355] FindNextFileW (in: hFindFile=0x8150568, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3938b40, ftCreationTime.dwHighDateTime=0x1d5e369, ftLastAccessTime.dwLowDateTime=0x90069b30, ftLastAccessTime.dwHighDateTime=0x1d5f0d5, ftLastWriteTime.dwLowDateTime=0x90069b30, ftLastWriteTime.dwHighDateTime=0x1d5f0d5, nFileSizeHigh=0x0, nFileSizeLow=0x5e8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="9Y1Vm7WQwJ.odp", cAlternateFileName="9Y1VM7~1.ODP")) returned 1 [0104.355] FindNextFileW (in: hFindFile=0x8150568, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa303b1a0, ftCreationTime.dwHighDateTime=0x1d5e171, ftLastAccessTime.dwLowDateTime=0x758cd8d0, ftLastAccessTime.dwHighDateTime=0x1d5e402, ftLastWriteTime.dwLowDateTime=0x758cd8d0, ftLastWriteTime.dwHighDateTime=0x1d5e402, nFileSizeHigh=0x0, nFileSizeLow=0x17e9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="A-MSuTAXuIfkK9JATMN.ppt", cAlternateFileName="A-MSUT~1.PPT")) returned 1 [0104.355] FindNextFileW (in: hFindFile=0x8150568, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc09614c0, ftCreationTime.dwHighDateTime=0x1d5e477, ftLastAccessTime.dwLowDateTime=0xf9ef6c70, ftLastAccessTime.dwHighDateTime=0x1d5eefa, ftLastWriteTime.dwLowDateTime=0xf9ef6c70, ftLastWriteTime.dwHighDateTime=0x1d5eefa, nFileSizeHigh=0x0, nFileSizeLow=0x1195d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GkpC1ABWiI.odt", cAlternateFileName="GKPC1A~1.ODT")) returned 1 [0104.356] FindNextFileW (in: hFindFile=0x8150568, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41851e0, ftCreationTime.dwHighDateTime=0x1d5e82e, ftLastAccessTime.dwLowDateTime=0x99c0d7a0, ftLastAccessTime.dwHighDateTime=0x1d5eb79, ftLastWriteTime.dwLowDateTime=0x99c0d7a0, ftLastWriteTime.dwHighDateTime=0x1d5eb79, nFileSizeHigh=0x0, nFileSizeLow=0x4597, dwReserved0=0x0, dwReserved1=0x0, cFileName="oH6IT.xlsx", cAlternateFileName="OH6IT~1.XLS")) returned 1 [0104.356] FindNextFileW (in: hFindFile=0x8150568, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63fb63e0, ftCreationTime.dwHighDateTime=0x1d5e29d, ftLastAccessTime.dwLowDateTime=0x14bd2fd0, ftLastAccessTime.dwHighDateTime=0x1d5e715, ftLastWriteTime.dwLowDateTime=0x14bd2fd0, ftLastWriteTime.dwHighDateTime=0x1d5e715, nFileSizeHigh=0x0, nFileSizeLow=0x16901, dwReserved0=0x0, dwReserved1=0x0, cFileName="rncd2pZINg5w.doc", cAlternateFileName="RNCD2P~1.DOC")) returned 1 [0104.356] FindNextFileW (in: hFindFile=0x8150568, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbb8c770, ftCreationTime.dwHighDateTime=0x1d5e399, ftLastAccessTime.dwLowDateTime=0xe8d21590, ftLastAccessTime.dwHighDateTime=0x1d5e9f1, ftLastWriteTime.dwLowDateTime=0xe8d21590, ftLastWriteTime.dwHighDateTime=0x1d5e9f1, nFileSizeHigh=0x0, nFileSizeLow=0x2731, dwReserved0=0x0, dwReserved1=0x0, cFileName="scrVqEg59wDdW.xls", cAlternateFileName="SCRVQE~1.XLS")) returned 1 [0104.356] FindNextFileW (in: hFindFile=0x8150568, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccbbf530, ftCreationTime.dwHighDateTime=0x1d5ee1d, ftLastAccessTime.dwLowDateTime=0x9aa418e0, ftLastAccessTime.dwHighDateTime=0x1d5eff1, ftLastWriteTime.dwLowDateTime=0x9aa418e0, ftLastWriteTime.dwHighDateTime=0x1d5eff1, nFileSizeHigh=0x0, nFileSizeLow=0x1384f, dwReserved0=0x0, dwReserved1=0x0, cFileName="U2cLoBYj5C0tADEd.ppt", cAlternateFileName="U2CLOB~1.PPT")) returned 1 [0104.356] FindNextFileW (in: hFindFile=0x8150568, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c9438f0, ftCreationTime.dwHighDateTime=0x1d5eaaf, ftLastAccessTime.dwLowDateTime=0x6c370190, ftLastAccessTime.dwHighDateTime=0x1d5ed92, ftLastWriteTime.dwLowDateTime=0x6c370190, ftLastWriteTime.dwHighDateTime=0x1d5ed92, nFileSizeHigh=0x0, nFileSizeLow=0x1091, dwReserved0=0x0, dwReserved1=0x0, cFileName="wYM-HGBYInWaw02.ots", cAlternateFileName="WYM-HG~1.OTS")) returned 1 [0104.356] FindNextFileW (in: hFindFile=0x8150568, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedbcc330, ftCreationTime.dwHighDateTime=0x1d5f0b7, ftLastAccessTime.dwLowDateTime=0x7ddf1390, ftLastAccessTime.dwHighDateTime=0x1d5ec09, ftLastWriteTime.dwLowDateTime=0x7ddf1390, ftLastWriteTime.dwHighDateTime=0x1d5ec09, nFileSizeHigh=0x0, nFileSizeLow=0x86c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="_ooMGcKju2rrUaD0DU.odt", cAlternateFileName="_OOMGC~1.ODT")) returned 1 [0104.356] FindNextFileW (in: hFindFile=0x8150568, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0104.356] FindClose (in: hFindFile=0x8150568 | out: hFindFile=0x8150568) returned 1 [0104.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb50) returned 1 [0104.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb5c) returned 1 [0104.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb94) returned 1 [0104.356] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n", nBufferLength=0x105, lpBuffer=0xefe648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n", lpFilePart=0x0) returned 0x2c [0104.356] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\*", lpFindFileData=0xefe8bc | out: lpFindFileData=0xefe8bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8663410, ftCreationTime.dwHighDateTime=0x1d5e401, ftLastAccessTime.dwLowDateTime=0xd3b29c70, ftLastAccessTime.dwHighDateTime=0x1d5e17c, ftLastWriteTime.dwLowDateTime=0xd3b29c70, ftLastWriteTime.dwHighDateTime=0x1d5e17c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x81501e8 [0104.361] FindNextFileW (in: hFindFile=0x81501e8, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8663410, ftCreationTime.dwHighDateTime=0x1d5e401, ftLastAccessTime.dwLowDateTime=0xd3b29c70, ftLastAccessTime.dwHighDateTime=0x1d5e17c, ftLastWriteTime.dwLowDateTime=0xd3b29c70, ftLastWriteTime.dwHighDateTime=0x1d5e17c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.361] FindNextFileW (in: hFindFile=0x81501e8, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3938b40, ftCreationTime.dwHighDateTime=0x1d5e369, ftLastAccessTime.dwLowDateTime=0x90069b30, ftLastAccessTime.dwHighDateTime=0x1d5f0d5, ftLastWriteTime.dwLowDateTime=0x90069b30, ftLastWriteTime.dwHighDateTime=0x1d5f0d5, nFileSizeHigh=0x0, nFileSizeLow=0x5e8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="9Y1Vm7WQwJ.odp", cAlternateFileName="9Y1VM7~1.ODP")) returned 1 [0104.361] FindNextFileW (in: hFindFile=0x81501e8, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa303b1a0, ftCreationTime.dwHighDateTime=0x1d5e171, ftLastAccessTime.dwLowDateTime=0x758cd8d0, ftLastAccessTime.dwHighDateTime=0x1d5e402, ftLastWriteTime.dwLowDateTime=0x758cd8d0, ftLastWriteTime.dwHighDateTime=0x1d5e402, nFileSizeHigh=0x0, nFileSizeLow=0x17e9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="A-MSuTAXuIfkK9JATMN.ppt", cAlternateFileName="A-MSUT~1.PPT")) returned 1 [0104.361] FindNextFileW (in: hFindFile=0x81501e8, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc09614c0, ftCreationTime.dwHighDateTime=0x1d5e477, ftLastAccessTime.dwLowDateTime=0xf9ef6c70, ftLastAccessTime.dwHighDateTime=0x1d5eefa, ftLastWriteTime.dwLowDateTime=0xf9ef6c70, ftLastWriteTime.dwHighDateTime=0x1d5eefa, nFileSizeHigh=0x0, nFileSizeLow=0x1195d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GkpC1ABWiI.odt", cAlternateFileName="GKPC1A~1.ODT")) returned 1 [0104.361] FindNextFileW (in: hFindFile=0x81501e8, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41851e0, ftCreationTime.dwHighDateTime=0x1d5e82e, ftLastAccessTime.dwLowDateTime=0x99c0d7a0, ftLastAccessTime.dwHighDateTime=0x1d5eb79, ftLastWriteTime.dwLowDateTime=0x99c0d7a0, ftLastWriteTime.dwHighDateTime=0x1d5eb79, nFileSizeHigh=0x0, nFileSizeLow=0x4597, dwReserved0=0x0, dwReserved1=0x0, cFileName="oH6IT.xlsx", cAlternateFileName="OH6IT~1.XLS")) returned 1 [0104.361] FindNextFileW (in: hFindFile=0x81501e8, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63fb63e0, ftCreationTime.dwHighDateTime=0x1d5e29d, ftLastAccessTime.dwLowDateTime=0x14bd2fd0, ftLastAccessTime.dwHighDateTime=0x1d5e715, ftLastWriteTime.dwLowDateTime=0x14bd2fd0, ftLastWriteTime.dwHighDateTime=0x1d5e715, nFileSizeHigh=0x0, nFileSizeLow=0x16901, dwReserved0=0x0, dwReserved1=0x0, cFileName="rncd2pZINg5w.doc", cAlternateFileName="RNCD2P~1.DOC")) returned 1 [0104.362] FindNextFileW (in: hFindFile=0x81501e8, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbb8c770, ftCreationTime.dwHighDateTime=0x1d5e399, ftLastAccessTime.dwLowDateTime=0xe8d21590, ftLastAccessTime.dwHighDateTime=0x1d5e9f1, ftLastWriteTime.dwLowDateTime=0xe8d21590, ftLastWriteTime.dwHighDateTime=0x1d5e9f1, nFileSizeHigh=0x0, nFileSizeLow=0x2731, dwReserved0=0x0, dwReserved1=0x0, cFileName="scrVqEg59wDdW.xls", cAlternateFileName="SCRVQE~1.XLS")) returned 1 [0104.362] FindNextFileW (in: hFindFile=0x81501e8, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccbbf530, ftCreationTime.dwHighDateTime=0x1d5ee1d, ftLastAccessTime.dwLowDateTime=0x9aa418e0, ftLastAccessTime.dwHighDateTime=0x1d5eff1, ftLastWriteTime.dwLowDateTime=0x9aa418e0, ftLastWriteTime.dwHighDateTime=0x1d5eff1, nFileSizeHigh=0x0, nFileSizeLow=0x1384f, dwReserved0=0x0, dwReserved1=0x0, cFileName="U2cLoBYj5C0tADEd.ppt", cAlternateFileName="U2CLOB~1.PPT")) returned 1 [0104.362] FindNextFileW (in: hFindFile=0x81501e8, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c9438f0, ftCreationTime.dwHighDateTime=0x1d5eaaf, ftLastAccessTime.dwLowDateTime=0x6c370190, ftLastAccessTime.dwHighDateTime=0x1d5ed92, ftLastWriteTime.dwLowDateTime=0x6c370190, ftLastWriteTime.dwHighDateTime=0x1d5ed92, nFileSizeHigh=0x0, nFileSizeLow=0x1091, dwReserved0=0x0, dwReserved1=0x0, cFileName="wYM-HGBYInWaw02.ots", cAlternateFileName="WYM-HG~1.OTS")) returned 1 [0104.362] FindNextFileW (in: hFindFile=0x81501e8, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedbcc330, ftCreationTime.dwHighDateTime=0x1d5f0b7, ftLastAccessTime.dwLowDateTime=0x7ddf1390, ftLastAccessTime.dwHighDateTime=0x1d5ec09, ftLastWriteTime.dwLowDateTime=0x7ddf1390, ftLastWriteTime.dwHighDateTime=0x1d5ec09, nFileSizeHigh=0x0, nFileSizeLow=0x86c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="_ooMGcKju2rrUaD0DU.odt", cAlternateFileName="_OOMGC~1.ODT")) returned 1 [0104.362] FindNextFileW (in: hFindFile=0x81501e8, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedbcc330, ftCreationTime.dwHighDateTime=0x1d5f0b7, ftLastAccessTime.dwLowDateTime=0x7ddf1390, ftLastAccessTime.dwHighDateTime=0x1d5ec09, ftLastWriteTime.dwLowDateTime=0x7ddf1390, ftLastWriteTime.dwHighDateTime=0x1d5ec09, nFileSizeHigh=0x0, nFileSizeLow=0x86c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="_ooMGcKju2rrUaD0DU.odt", cAlternateFileName="_OOMGC~1.ODT")) returned 0 [0104.362] FindClose (in: hFindFile=0x81501e8 | out: hFindFile=0x81501e8) returned 1 [0104.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb50) returned 1 [0104.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb5c) returned 1 [0104.362] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\A-MSuTAXuIfkK9JATMN.ppt", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\A-MSuTAXuIfkK9JATMN.ppt", lpFilePart=0x0) returned 0x44 [0104.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0104.362] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\A-MSuTAXuIfkK9JATMN.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\a-msutaxuifkk9jatmn.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0104.362] GetFileType (hFile=0x2e4) returned 0x1 [0104.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0104.362] GetFileType (hFile=0x2e4) returned 0x1 [0104.362] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0x17e9f [0104.508] ReadFile (in: hFile=0x2e4, lpBuffer=0x3e31a48, nNumberOfBytesToRead=0x17e9f, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x3e31a48*, lpNumberOfBytesRead=0xefeae8*=0x17e9f, lpOverlapped=0x0) returned 1 [0104.510] CloseHandle (hObject=0x2e4) returned 1 [0104.552] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0104.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0104.552] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0104.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0104.552] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\A-MSuTAXuIfkK9JATMN.ppt", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\A-MSuTAXuIfkK9JATMN.ppt", lpFilePart=0x0) returned 0x44 [0104.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0104.552] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\A-MSuTAXuIfkK9JATMN.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\a-msutaxuifkk9jatmn.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0104.554] GetFileType (hFile=0x2e4) returned 0x1 [0104.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0104.554] GetFileType (hFile=0x2e4) returned 0x1 [0104.554] WriteFile (in: hFile=0x2e4, lpBuffer=0x3ed8a40*, nNumberOfBytesToWrite=0x17ea0, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x3ed8a40*, lpNumberOfBytesWritten=0xefeadc*=0x17ea0, lpOverlapped=0x0) returned 1 [0104.556] CloseHandle (hObject=0x2e4) returned 1 [0104.559] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\A-MSuTAXuIfkK9JATMN.ppt", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\A-MSuTAXuIfkK9JATMN.ppt", lpFilePart=0x0) returned 0x44 [0104.559] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\A-MSuTAXuIfkK9JATMN.ppt.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\A-MSuTAXuIfkK9JATMN.ppt.UGMH", lpFilePart=0x0) returned 0x49 [0104.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0104.559] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\A-MSuTAXuIfkK9JATMN.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\a-msutaxuifkk9jatmn.ppt"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa303b1a0, ftCreationTime.dwHighDateTime=0x1d5e171, ftLastAccessTime.dwLowDateTime=0x758cd8d0, ftLastAccessTime.dwHighDateTime=0x1d5e402, ftLastWriteTime.dwLowDateTime=0xd46a8779, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x17ea0)) returned 1 [0104.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0104.559] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\A-MSuTAXuIfkK9JATMN.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\a-msutaxuifkk9jatmn.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\A-MSuTAXuIfkK9JATMN.ppt.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\a-msutaxuifkk9jatmn.ppt.ugmh")) returned 1 [0104.624] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\GkpC1ABWiI.odt", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\GkpC1ABWiI.odt", lpFilePart=0x0) returned 0x3b [0104.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0104.624] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\GkpC1ABWiI.odt" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\gkpc1abwii.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0104.624] GetFileType (hFile=0x2e4) returned 0x1 [0104.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0104.625] GetFileType (hFile=0x2e4) returned 0x1 [0104.625] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0x1195d [0104.625] ReadFile (in: hFile=0x2e4, lpBuffer=0x2e89424, nNumberOfBytesToRead=0x1195d, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x2e89424*, lpNumberOfBytesRead=0xefeae8*=0x1195d, lpOverlapped=0x0) returned 1 [0104.626] CloseHandle (hObject=0x2e4) returned 1 [0104.655] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0104.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0104.656] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0104.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0104.656] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\GkpC1ABWiI.odt", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\GkpC1ABWiI.odt", lpFilePart=0x0) returned 0x3b [0104.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0104.656] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\GkpC1ABWiI.odt" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\gkpc1abwii.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0104.658] GetFileType (hFile=0x2e4) returned 0x1 [0104.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0104.658] GetFileType (hFile=0x2e4) returned 0x1 [0104.658] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f0ae40*, nNumberOfBytesToWrite=0x11960, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x2f0ae40*, lpNumberOfBytesWritten=0xefeadc*=0x11960, lpOverlapped=0x0) returned 1 [0104.660] CloseHandle (hObject=0x2e4) returned 1 [0104.663] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\GkpC1ABWiI.odt", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\GkpC1ABWiI.odt", lpFilePart=0x0) returned 0x3b [0104.663] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\GkpC1ABWiI.odt.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\GkpC1ABWiI.odt.UGMH", lpFilePart=0x0) returned 0x40 [0104.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0104.663] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\GkpC1ABWiI.odt" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\gkpc1abwii.odt"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc09614c0, ftCreationTime.dwHighDateTime=0x1d5e477, ftLastAccessTime.dwLowDateTime=0xf9ef6c70, ftLastAccessTime.dwHighDateTime=0x1d5eefa, ftLastWriteTime.dwLowDateTime=0xd47b3f65, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x11960)) returned 1 [0104.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0104.664] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\GkpC1ABWiI.odt" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\gkpc1abwii.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\GkpC1ABWiI.odt.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\gkpc1abwii.odt.ugmh")) returned 1 [0104.664] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\oH6IT.xlsx", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\oH6IT.xlsx", lpFilePart=0x0) returned 0x37 [0104.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0104.665] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\oH6IT.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\oh6it.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0104.665] GetFileType (hFile=0x2e4) returned 0x1 [0104.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0104.665] GetFileType (hFile=0x2e4) returned 0x1 [0104.665] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0x4597 [0104.665] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f1cc5c, nNumberOfBytesToRead=0x4597, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x2f1cc5c*, lpNumberOfBytesRead=0xefeae8*=0x4597, lpOverlapped=0x0) returned 1 [0104.666] CloseHandle (hObject=0x2e4) returned 1 [0104.716] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0104.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0104.716] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0104.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0104.716] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\oH6IT.xlsx", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\oH6IT.xlsx", lpFilePart=0x0) returned 0x37 [0104.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0104.716] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\oH6IT.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\oh6it.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0104.717] GetFileType (hFile=0x2e4) returned 0x1 [0104.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0104.717] GetFileType (hFile=0x2e4) returned 0x1 [0104.717] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f7f664*, nNumberOfBytesToWrite=0x45a0, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x2f7f664*, lpNumberOfBytesWritten=0xefeadc*=0x45a0, lpOverlapped=0x0) returned 1 [0104.718] CloseHandle (hObject=0x2e4) returned 1 [0104.719] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\oH6IT.xlsx", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\oH6IT.xlsx", lpFilePart=0x0) returned 0x37 [0104.719] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\oH6IT.xlsx.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\oH6IT.xlsx.UGMH", lpFilePart=0x0) returned 0x3c [0104.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0104.719] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\oH6IT.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\oh6it.xlsx"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41851e0, ftCreationTime.dwHighDateTime=0x1d5e82e, ftLastAccessTime.dwLowDateTime=0x99c0d7a0, ftLastAccessTime.dwHighDateTime=0x1d5eb79, ftLastWriteTime.dwLowDateTime=0xd484c05e, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x45a0)) returned 1 [0104.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0104.720] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\oH6IT.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\oh6it.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\oH6IT.xlsx.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\oh6it.xlsx.ugmh")) returned 1 [0104.720] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\rncd2pZINg5w.doc", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\rncd2pZINg5w.doc", lpFilePart=0x0) returned 0x3d [0104.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0104.720] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\rncd2pZINg5w.doc" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\rncd2pzing5w.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0104.720] GetFileType (hFile=0x2e4) returned 0x1 [0104.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0104.720] GetFileType (hFile=0x2e4) returned 0x1 [0104.720] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0x16901 [0104.721] ReadFile (in: hFile=0x2e4, lpBuffer=0x3f13bc0, nNumberOfBytesToRead=0x16901, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x3f13bc0*, lpNumberOfBytesRead=0xefeae8*=0x16901, lpOverlapped=0x0) returned 1 [0104.724] CloseHandle (hObject=0x2e4) returned 1 [0104.777] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0104.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0104.777] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0104.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0104.778] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\rncd2pZINg5w.doc", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\rncd2pZINg5w.doc", lpFilePart=0x0) returned 0x3d [0104.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0104.778] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\rncd2pZINg5w.doc" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\rncd2pzing5w.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0104.780] GetFileType (hFile=0x2e4) returned 0x1 [0104.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0104.780] GetFileType (hFile=0x2e4) returned 0x1 [0104.780] WriteFile (in: hFile=0x2e4, lpBuffer=0x3f84940*, nNumberOfBytesToWrite=0x16910, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x3f84940*, lpNumberOfBytesWritten=0xefeadc*=0x16910, lpOverlapped=0x0) returned 1 [0104.783] CloseHandle (hObject=0x2e4) returned 1 [0104.811] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\rncd2pZINg5w.doc", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\rncd2pZINg5w.doc", lpFilePart=0x0) returned 0x3d [0104.811] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\rncd2pZINg5w.doc.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\rncd2pZINg5w.doc.UGMH", lpFilePart=0x0) returned 0x42 [0104.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0104.811] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\rncd2pZINg5w.doc" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\rncd2pzing5w.doc"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63fb63e0, ftCreationTime.dwHighDateTime=0x1d5e29d, ftLastAccessTime.dwLowDateTime=0x14bd2fd0, ftLastAccessTime.dwHighDateTime=0x1d5e715, ftLastWriteTime.dwLowDateTime=0xd4930e15, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x16910)) returned 1 [0104.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0104.811] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\rncd2pZINg5w.doc" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\rncd2pzing5w.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\rncd2pZINg5w.doc.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\rncd2pzing5w.doc.ugmh")) returned 1 [0104.812] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\scrVqEg59wDdW.xls", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\scrVqEg59wDdW.xls", lpFilePart=0x0) returned 0x3e [0104.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0104.813] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\scrVqEg59wDdW.xls" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\scrvqeg59wddw.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0104.813] GetFileType (hFile=0x2e4) returned 0x1 [0104.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0104.813] GetFileType (hFile=0x2e4) returned 0x1 [0104.813] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0x2731 [0104.813] ReadFile (in: hFile=0x2e4, lpBuffer=0x2fd1394, nNumberOfBytesToRead=0x2731, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x2fd1394*, lpNumberOfBytesRead=0xefeae8*=0x2731, lpOverlapped=0x0) returned 1 [0104.814] CloseHandle (hObject=0x2e4) returned 1 [0104.855] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0104.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0104.855] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0104.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0104.855] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\scrVqEg59wDdW.xls", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\scrVqEg59wDdW.xls", lpFilePart=0x0) returned 0x3e [0104.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0104.855] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\scrVqEg59wDdW.xls" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\scrvqeg59wddw.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0104.857] GetFileType (hFile=0x2e4) returned 0x1 [0104.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0104.857] GetFileType (hFile=0x2e4) returned 0x1 [0104.857] WriteFile (in: hFile=0x2e4, lpBuffer=0x302a5bc*, nNumberOfBytesToWrite=0x2740, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x302a5bc*, lpNumberOfBytesWritten=0xefeadc*=0x2740, lpOverlapped=0x0) returned 1 [0104.872] CloseHandle (hObject=0x2e4) returned 1 [0104.874] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\scrVqEg59wDdW.xls", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\scrVqEg59wDdW.xls", lpFilePart=0x0) returned 0x3e [0104.874] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\scrVqEg59wDdW.xls.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\scrVqEg59wDdW.xls.UGMH", lpFilePart=0x0) returned 0x43 [0104.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0104.874] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\scrVqEg59wDdW.xls" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\scrvqeg59wddw.xls"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbb8c770, ftCreationTime.dwHighDateTime=0x1d5e399, ftLastAccessTime.dwLowDateTime=0xe8d21590, ftLastAccessTime.dwHighDateTime=0x1d5e9f1, ftLastWriteTime.dwLowDateTime=0xd49cc96d, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x2740)) returned 1 [0104.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0104.874] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\scrVqEg59wDdW.xls" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\scrvqeg59wddw.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\scrVqEg59wDdW.xls.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\scrvqeg59wddw.xls.ugmh")) returned 1 [0104.888] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\U2cLoBYj5C0tADEd.ppt", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\U2cLoBYj5C0tADEd.ppt", lpFilePart=0x0) returned 0x41 [0104.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0104.888] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\U2cLoBYj5C0tADEd.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\u2clobyj5c0taded.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0104.888] GetFileType (hFile=0x2e4) returned 0x1 [0104.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0104.888] GetFileType (hFile=0x2e4) returned 0x1 [0104.888] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0x1384f [0104.888] ReadFile (in: hFile=0x2e4, lpBuffer=0x302d1fc, nNumberOfBytesToRead=0x1384f, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x302d1fc*, lpNumberOfBytesRead=0xefeae8*=0x1384f, lpOverlapped=0x0) returned 1 [0104.890] CloseHandle (hObject=0x2e4) returned 1 [0104.958] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0104.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0104.958] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0104.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0104.959] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\U2cLoBYj5C0tADEd.ppt", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\U2cLoBYj5C0tADEd.ppt", lpFilePart=0x0) returned 0x41 [0104.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0104.959] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\U2cLoBYj5C0tADEd.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\u2clobyj5c0taded.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0104.961] GetFileType (hFile=0x2e4) returned 0x1 [0104.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0104.961] GetFileType (hFile=0x2e4) returned 0x1 [0104.961] WriteFile (in: hFile=0x2e4, lpBuffer=0x2ec3738*, nNumberOfBytesToWrite=0x13850, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x2ec3738*, lpNumberOfBytesWritten=0xefeadc*=0x13850, lpOverlapped=0x0) returned 1 [0104.963] CloseHandle (hObject=0x2e4) returned 1 [0104.970] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\U2cLoBYj5C0tADEd.ppt", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\U2cLoBYj5C0tADEd.ppt", lpFilePart=0x0) returned 0x41 [0104.971] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\U2cLoBYj5C0tADEd.ppt.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\U2cLoBYj5C0tADEd.ppt.UGMH", lpFilePart=0x0) returned 0x46 [0104.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0104.971] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\U2cLoBYj5C0tADEd.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\u2clobyj5c0taded.ppt"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccbbf530, ftCreationTime.dwHighDateTime=0x1d5ee1d, ftLastAccessTime.dwLowDateTime=0x9aa418e0, ftLastAccessTime.dwHighDateTime=0x1d5eff1, ftLastWriteTime.dwLowDateTime=0xd4ab8577, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x13850)) returned 1 [0104.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0104.971] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\U2cLoBYj5C0tADEd.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\u2clobyj5c0taded.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\U2cLoBYj5C0tADEd.ppt.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\u2clobyj5c0taded.ppt.ugmh")) returned 1 [0104.972] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\_ooMGcKju2rrUaD0DU.odt", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\_ooMGcKju2rrUaD0DU.odt", lpFilePart=0x0) returned 0x43 [0104.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0104.972] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\_ooMGcKju2rrUaD0DU.odt" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\_oomgckju2rruad0du.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0104.972] GetFileType (hFile=0x2e4) returned 0x1 [0104.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0104.972] GetFileType (hFile=0x2e4) returned 0x1 [0104.972] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0x86c9 [0104.972] ReadFile (in: hFile=0x2e4, lpBuffer=0x2ed74c8, nNumberOfBytesToRead=0x86c9, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x2ed74c8*, lpNumberOfBytesRead=0xefeae8*=0x86c9, lpOverlapped=0x0) returned 1 [0104.974] CloseHandle (hObject=0x2e4) returned 1 [0105.079] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0105.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0105.079] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0105.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0105.079] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\_ooMGcKju2rrUaD0DU.odt", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\_ooMGcKju2rrUaD0DU.odt", lpFilePart=0x0) returned 0x43 [0105.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0105.079] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\_ooMGcKju2rrUaD0DU.odt" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\_oomgckju2rruad0du.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0105.081] GetFileType (hFile=0x2e4) returned 0x1 [0105.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0105.081] GetFileType (hFile=0x2e4) returned 0x1 [0105.081] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f4e61c*, nNumberOfBytesToWrite=0x86d0, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x2f4e61c*, lpNumberOfBytesWritten=0xefeadc*=0x86d0, lpOverlapped=0x0) returned 1 [0105.083] CloseHandle (hObject=0x2e4) returned 1 [0105.085] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\_ooMGcKju2rrUaD0DU.odt", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\_ooMGcKju2rrUaD0DU.odt", lpFilePart=0x0) returned 0x43 [0105.085] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\_ooMGcKju2rrUaD0DU.odt.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\_ooMGcKju2rrUaD0DU.odt.UGMH", lpFilePart=0x0) returned 0x48 [0105.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0105.085] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\_ooMGcKju2rrUaD0DU.odt" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\_oomgckju2rruad0du.odt"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedbcc330, ftCreationTime.dwHighDateTime=0x1d5f0b7, ftLastAccessTime.dwLowDateTime=0x7ddf1390, ftLastAccessTime.dwHighDateTime=0x1d5ec09, ftLastWriteTime.dwLowDateTime=0xd4bb9734, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x86d0)) returned 1 [0105.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0105.086] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\_ooMGcKju2rrUaD0DU.odt" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\_oomgckju2rruad0du.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\gtt6jcr9z38XE35b3n\\_ooMGcKju2rrUaD0DU.odt.UGMH" (normalized: "c:\\users\\fd1hvy\\documents\\gtt6jcr9z38xe35b3n\\_oomgckju2rruad0du.odt.ugmh")) returned 1 [0105.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb94) returned 1 [0105.086] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0xefe648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Music", lpFilePart=0x0) returned 0x22 [0105.086] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Music\\*", lpFindFileData=0xefe8bc | out: lpFindFileData=0xefe8bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0105.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb58) returned 1 [0105.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb94) returned 1 [0105.130] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0xefe648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Pictures", lpFilePart=0x0) returned 0x25 [0105.130] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Pictures\\*", lpFindFileData=0xefe8bc | out: lpFindFileData=0xefe8bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0105.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb58) returned 1 [0105.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb94) returned 1 [0105.132] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0xefe648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes", lpFilePart=0x0) returned 0x23 [0105.132] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*", lpFindFileData=0xefe8bc | out: lpFindFileData=0xefe8bc*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104df70 [0105.162] FindNextFileW (in: hFindFile=0x104df70, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.162] FindNextFileW (in: hFindFile=0x104df70, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0105.162] FindNextFileW (in: hFindFile=0x104df70, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1a0f60e, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1a0f60e, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites.vssx", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0105.162] FindNextFileW (in: hFindFile=0x104df70, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0105.162] FindNextFileW (in: hFindFile=0x104df70, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0 [0105.163] FindClose (in: hFindFile=0x104df70 | out: hFindFile=0x104df70) returned 1 [0105.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb50) returned 1 [0105.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb5c) returned 1 [0105.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb94) returned 1 [0105.163] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0xefe648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes", lpFilePart=0x0) returned 0x23 [0105.163] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*", lpFindFileData=0xefe8bc | out: lpFindFileData=0xefe8bc*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104e4b0 [0105.163] FindNextFileW (in: hFindFile=0x104e4b0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.164] FindNextFileW (in: hFindFile=0x104e4b0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0105.164] FindNextFileW (in: hFindFile=0x104e4b0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1a0f60e, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1a0f60e, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites.vssx", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0105.164] FindNextFileW (in: hFindFile=0x104e4b0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0105.164] FindNextFileW (in: hFindFile=0x104e4b0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0105.164] FindClose (in: hFindFile=0x104e4b0 | out: hFindFile=0x104e4b0) returned 1 [0105.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb50) returned 1 [0105.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb5c) returned 1 [0105.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb20) returned 1 [0105.165] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0xefe5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x2c [0105.165] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*", lpFindFileData=0xefe848 | out: lpFindFileData=0xefe848*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104ddf0 [0105.166] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.166] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0105.167] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0105.167] FindClose (in: hFindFile=0x104ddf0 | out: hFindFile=0x104ddf0) returned 1 [0105.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeadc) returned 1 [0105.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeae8) returned 1 [0105.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb20) returned 1 [0105.167] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0xefe5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x2c [0105.167] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*", lpFindFileData=0xefe848 | out: lpFindFileData=0xefe848*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104deb0 [0105.167] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.168] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0105.168] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0105.168] FindClose (in: hFindFile=0x104deb0 | out: hFindFile=0x104deb0) returned 1 [0105.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeadc) returned 1 [0105.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeae8) returned 1 [0105.168] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", nBufferLength=0x105, lpBuffer=0xefe488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", lpFilePart=0x0) returned 0x37 [0105.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9cc) returned 1 [0105.168] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0105.169] GetFileType (hFile=0x2e4) returned 0x1 [0105.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9c8) returned 1 [0105.169] GetFileType (hFile=0x2e4) returned 0x1 [0105.169] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeac8 | out: lpFileSizeHigh=0xefeac8*=0x0) returned 0x74e6 [0105.169] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f5bf9c, nNumberOfBytesToRead=0x74e6, lpNumberOfBytesRead=0xefea74, lpOverlapped=0x0 | out: lpBuffer=0x2f5bf9c*, lpNumberOfBytesRead=0xefea74*=0x74e6, lpOverlapped=0x0) returned 1 [0105.171] CloseHandle (hObject=0x2e4) returned 1 [0105.293] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe58c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0105.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0105.293] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeabc | out: lpFileInformation=0xefeabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0105.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0105.293] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", nBufferLength=0x105, lpBuffer=0xefe474, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", lpFilePart=0x0) returned 0x37 [0105.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9b8) returned 1 [0105.293] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0105.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefcd50) returned 1 [0105.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb94) returned 1 [0105.464] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0xefe648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Videos", lpFilePart=0x0) returned 0x23 [0105.464] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Videos\\*", lpFindFileData=0xefe8bc | out: lpFindFileData=0xefe8bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0105.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb58) returned 1 [0105.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb94) returned 1 [0105.466] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0xefe648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x27 [0105.466] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*", lpFindFileData=0xefe8bc | out: lpFindFileData=0xefe8bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104e3f0 [0105.467] FindNextFileW (in: hFindFile=0x104e3f0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.467] FindNextFileW (in: hFindFile=0x104e3f0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 1 [0105.467] FindNextFileW (in: hFindFile=0x104e3f0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0105.467] FindClose (in: hFindFile=0x104e3f0 | out: hFindFile=0x104e3f0) returned 1 [0105.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb50) returned 1 [0105.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb5c) returned 1 [0105.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb94) returned 1 [0105.468] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0xefe648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x27 [0105.468] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*", lpFindFileData=0xefe8bc | out: lpFindFileData=0xefe8bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104e3b0 [0105.468] FindNextFileW (in: hFindFile=0x104e3b0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.468] FindNextFileW (in: hFindFile=0x104e3b0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 1 [0105.469] FindNextFileW (in: hFindFile=0x104e3b0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 0 [0105.469] FindClose (in: hFindFile=0x104e3b0 | out: hFindFile=0x104e3b0) returned 1 [0105.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb50) returned 1 [0105.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb5c) returned 1 [0105.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec08) returned 1 [0105.469] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads", nBufferLength=0x105, lpBuffer=0xefe6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads", lpFilePart=0x0) returned 0x19 [0105.469] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\*", lpFindFileData=0xefe930 | out: lpFindFileData=0xefe930*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104e4b0 [0105.470] FindNextFileW (in: hFindFile=0x104e4b0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.470] FindNextFileW (in: hFindFile=0x104e4b0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0105.470] FindNextFileW (in: hFindFile=0x104e4b0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0105.470] FindClose (in: hFindFile=0x104e4b0 | out: hFindFile=0x104e4b0) returned 1 [0105.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebc4) returned 1 [0105.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebd0) returned 1 [0105.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec08) returned 1 [0105.470] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads", nBufferLength=0x105, lpBuffer=0xefe6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads", lpFilePart=0x0) returned 0x19 [0105.471] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\*", lpFindFileData=0xefe930 | out: lpFindFileData=0xefe930*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104e2f0 [0105.471] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.471] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0105.471] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0105.471] FindClose (in: hFindFile=0x104e2f0 | out: hFindFile=0x104e2f0) returned 1 [0105.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebc4) returned 1 [0105.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebd0) returned 1 [0105.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec08) returned 1 [0105.472] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", nBufferLength=0x105, lpBuffer=0xefe6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures", lpFilePart=0x0) returned 0x18 [0105.472] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\*", lpFindFileData=0xefe930 | out: lpFindFileData=0xefe930*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe61fce79, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe61fce79, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104e2f0 [0105.472] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe61fce79, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe61fce79, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.472] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b1e0440, ftCreationTime.dwHighDateTime=0x1d5e984, ftLastAccessTime.dwLowDateTime=0x93ddd4b0, ftLastAccessTime.dwHighDateTime=0x1d5eab0, ftLastWriteTime.dwLowDateTime=0x93ddd4b0, ftLastWriteTime.dwHighDateTime=0x1d5eab0, nFileSizeHigh=0x0, nFileSizeLow=0x9baf, dwReserved0=0x0, dwReserved1=0x0, cFileName="6Nn11Y0e.bmp", cAlternateFileName="")) returned 1 [0105.472] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfd66080, ftCreationTime.dwHighDateTime=0x1d5f0a7, ftLastAccessTime.dwLowDateTime=0x7f7db360, ftLastAccessTime.dwHighDateTime=0x1d5e43d, ftLastWriteTime.dwLowDateTime=0x7f7db360, ftLastWriteTime.dwHighDateTime=0x1d5e43d, nFileSizeHigh=0x0, nFileSizeLow=0x36fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="7V4AVib8x4wyo.png", cAlternateFileName="7V4AVI~1.PNG")) returned 1 [0105.473] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x701681d0, ftCreationTime.dwHighDateTime=0x1d5e754, ftLastAccessTime.dwLowDateTime=0xbefcbab0, ftLastAccessTime.dwHighDateTime=0x1d5efe9, ftLastWriteTime.dwLowDateTime=0xbefcbab0, ftLastWriteTime.dwHighDateTime=0x1d5efe9, nFileSizeHigh=0x0, nFileSizeLow=0x760, dwReserved0=0x0, dwReserved1=0x0, cFileName="8dVDG076G.gif", cAlternateFileName="8DVDG0~1.GIF")) returned 1 [0105.473] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0105.473] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44053085, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44053085, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0105.473] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c7cb3f0, ftCreationTime.dwHighDateTime=0x1d5ed5b, ftLastAccessTime.dwLowDateTime=0xfdda6050, ftLastAccessTime.dwHighDateTime=0x1d5e96a, ftLastWriteTime.dwLowDateTime=0xfdda6050, ftLastWriteTime.dwHighDateTime=0x1d5e96a, nFileSizeHigh=0x0, nFileSizeLow=0x7e6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="dNa9.gif", cAlternateFileName="")) returned 1 [0105.473] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5948c80, ftCreationTime.dwHighDateTime=0x1d5ec5e, ftLastAccessTime.dwLowDateTime=0x889dfa60, ftLastAccessTime.dwHighDateTime=0x1d5e850, ftLastWriteTime.dwLowDateTime=0x889dfa60, ftLastWriteTime.dwHighDateTime=0x1d5e850, nFileSizeHigh=0x0, nFileSizeLow=0x7096, dwReserved0=0x0, dwReserved1=0x0, cFileName="FIvyMa.gif", cAlternateFileName="")) returned 1 [0105.473] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f2168c0, ftCreationTime.dwHighDateTime=0x1d5e866, ftLastAccessTime.dwLowDateTime=0x36b89af0, ftLastAccessTime.dwHighDateTime=0x1d5e2df, ftLastWriteTime.dwLowDateTime=0x36b89af0, ftLastWriteTime.dwHighDateTime=0x1d5e2df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Jxc7y0", cAlternateFileName="")) returned 1 [0105.474] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ce7fd0, ftCreationTime.dwHighDateTime=0x1d5e213, ftLastAccessTime.dwLowDateTime=0xc98b3c0, ftLastAccessTime.dwHighDateTime=0x1d5e9ee, ftLastWriteTime.dwLowDateTime=0xc98b3c0, ftLastWriteTime.dwHighDateTime=0x1d5e9ee, nFileSizeHigh=0x0, nFileSizeLow=0x90dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="L72Z5-ELuJcj.bmp", cAlternateFileName="L72Z5-~1.BMP")) returned 1 [0105.474] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7820d540, ftCreationTime.dwHighDateTime=0x1d5f0a7, ftLastAccessTime.dwLowDateTime=0xb3294590, ftLastAccessTime.dwHighDateTime=0x1d5e199, ftLastWriteTime.dwLowDateTime=0xb3294590, ftLastWriteTime.dwHighDateTime=0x1d5e199, nFileSizeHigh=0x0, nFileSizeLow=0x140b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="m7BL5a.jpg", cAlternateFileName="")) returned 1 [0105.474] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11e4c640, ftCreationTime.dwHighDateTime=0x1d5edca, ftLastAccessTime.dwLowDateTime=0xbce49e70, ftLastAccessTime.dwHighDateTime=0x1d5ea6a, ftLastWriteTime.dwLowDateTime=0xbce49e70, ftLastWriteTime.dwHighDateTime=0x1d5ea6a, nFileSizeHigh=0x0, nFileSizeLow=0xb264, dwReserved0=0x0, dwReserved1=0x0, cFileName="mcl_Tb5XJ1-ZBM.gif", cAlternateFileName="MCL_TB~1.GIF")) returned 1 [0105.474] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a32ee60, ftCreationTime.dwHighDateTime=0x1d5e19d, ftLastAccessTime.dwLowDateTime=0xa555bc00, ftLastAccessTime.dwHighDateTime=0x1d5ef27, ftLastWriteTime.dwLowDateTime=0xa555bc00, ftLastWriteTime.dwHighDateTime=0x1d5ef27, nFileSizeHigh=0x0, nFileSizeLow=0x3913, dwReserved0=0x0, dwReserved1=0x0, cFileName="MjhsPG2iTtDmzmYBCz.bmp", cAlternateFileName="MJHSPG~1.BMP")) returned 1 [0105.474] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2364a270, ftCreationTime.dwHighDateTime=0x1d5ef44, ftLastAccessTime.dwLowDateTime=0x3b50650, ftLastAccessTime.dwHighDateTime=0x1d5e8a9, ftLastWriteTime.dwLowDateTime=0x3b50650, ftLastWriteTime.dwHighDateTime=0x1d5e8a9, nFileSizeHigh=0x0, nFileSizeLow=0x10d4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="n9HDluM7l1UPl_dq.gif", cAlternateFileName="N9HDLU~1.GIF")) returned 1 [0105.475] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd5dc0b0, ftCreationTime.dwHighDateTime=0x1d5e0ba, ftLastAccessTime.dwLowDateTime=0x4747eb00, ftLastAccessTime.dwHighDateTime=0x1d5e7da, ftLastWriteTime.dwLowDateTime=0x4747eb00, ftLastWriteTime.dwHighDateTime=0x1d5e7da, nFileSizeHigh=0x0, nFileSizeLow=0x18dc9, dwReserved0=0x0, dwReserved1=0x0, cFileName="nOVQ.gif", cAlternateFileName="")) returned 1 [0105.475] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9e4ae40, ftCreationTime.dwHighDateTime=0x1d5e2fe, ftLastAccessTime.dwLowDateTime=0xcd802f70, ftLastAccessTime.dwHighDateTime=0x1d5eac3, ftLastWriteTime.dwLowDateTime=0xcd802f70, ftLastWriteTime.dwHighDateTime=0x1d5eac3, nFileSizeHigh=0x0, nFileSizeLow=0xf0f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="P6_5eBLDYdwC8I6a4_.gif", cAlternateFileName="P6_5EB~1.GIF")) returned 1 [0105.475] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x548594b0, ftCreationTime.dwHighDateTime=0x1d5e817, ftLastAccessTime.dwLowDateTime=0xfd18c1b0, ftLastAccessTime.dwHighDateTime=0x1d5eaa1, ftLastWriteTime.dwLowDateTime=0xfd18c1b0, ftLastWriteTime.dwHighDateTime=0x1d5eaa1, nFileSizeHigh=0x0, nFileSizeLow=0xebd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="phmTCJUAc7iJYkpmC2.png", cAlternateFileName="PHMTCJ~1.PNG")) returned 1 [0105.475] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0105.475] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60970c50, ftCreationTime.dwHighDateTime=0x1d5ef58, ftLastAccessTime.dwLowDateTime=0xfaa36d00, ftLastAccessTime.dwHighDateTime=0x1d5ecf3, ftLastWriteTime.dwLowDateTime=0xfaa36d00, ftLastWriteTime.dwHighDateTime=0x1d5ecf3, nFileSizeHigh=0x0, nFileSizeLow=0x7d40, dwReserved0=0x0, dwReserved1=0x0, cFileName="TkzD3OseFc2R13.gif", cAlternateFileName="TKZD3O~1.GIF")) returned 1 [0105.475] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a55d680, ftCreationTime.dwHighDateTime=0x1d5eb9f, ftLastAccessTime.dwLowDateTime=0xb56e5a60, ftLastAccessTime.dwHighDateTime=0x1d5e127, ftLastWriteTime.dwLowDateTime=0xb56e5a60, ftLastWriteTime.dwHighDateTime=0x1d5e127, nFileSizeHigh=0x0, nFileSizeLow=0x160b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="tOdORiRv.gif", cAlternateFileName="")) returned 1 [0105.476] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc492c1b0, ftCreationTime.dwHighDateTime=0x1d5ef97, ftLastAccessTime.dwLowDateTime=0x3d820b70, ftLastAccessTime.dwHighDateTime=0x1d5e878, ftLastWriteTime.dwLowDateTime=0x3d820b70, ftLastWriteTime.dwHighDateTime=0x1d5e878, nFileSizeHigh=0x0, nFileSizeLow=0xbf43, dwReserved0=0x0, dwReserved1=0x0, cFileName="uG4TT2SFNmM7Jrnq Vw.png", cAlternateFileName="UG4TT2~1.PNG")) returned 1 [0105.476] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3797f070, ftCreationTime.dwHighDateTime=0x1d5ed3d, ftLastAccessTime.dwLowDateTime=0x9d49aa00, ftLastAccessTime.dwHighDateTime=0x1d5ec5a, ftLastWriteTime.dwLowDateTime=0x9d49aa00, ftLastWriteTime.dwHighDateTime=0x1d5ec5a, nFileSizeHigh=0x0, nFileSizeLow=0xaaf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="v766XG5EArmit.bmp", cAlternateFileName="V766XG~1.BMP")) returned 1 [0105.476] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a521210, ftCreationTime.dwHighDateTime=0x1d5ebdd, ftLastAccessTime.dwLowDateTime=0x5f66e200, ftLastAccessTime.dwHighDateTime=0x1d5eced, ftLastWriteTime.dwLowDateTime=0x5f66e200, ftLastWriteTime.dwHighDateTime=0x1d5eced, nFileSizeHigh=0x0, nFileSizeLow=0x3f74, dwReserved0=0x0, dwReserved1=0x0, cFileName="xkVuTsOTDp.png", cAlternateFileName="XKVUTS~1.PNG")) returned 1 [0105.476] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa09e790, ftCreationTime.dwHighDateTime=0x1d5e49a, ftLastAccessTime.dwLowDateTime=0x6febe2a0, ftLastAccessTime.dwHighDateTime=0x1d5e744, ftLastWriteTime.dwLowDateTime=0x6febe2a0, ftLastWriteTime.dwHighDateTime=0x1d5e744, nFileSizeHigh=0x0, nFileSizeLow=0x1967, dwReserved0=0x0, dwReserved1=0x0, cFileName="xUW3FKRmScAl_pqs.bmp", cAlternateFileName="XUW3FK~1.BMP")) returned 1 [0105.476] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd94c5330, ftCreationTime.dwHighDateTime=0x1d5eeef, ftLastAccessTime.dwLowDateTime=0x565a1f90, ftLastAccessTime.dwHighDateTime=0x1d5e975, ftLastWriteTime.dwLowDateTime=0x565a1f90, ftLastWriteTime.dwHighDateTime=0x1d5e975, nFileSizeHigh=0x0, nFileSizeLow=0xd16e, dwReserved0=0x0, dwReserved1=0x0, cFileName="xZIm85GJGQXcYDHmW.gif", cAlternateFileName="XZIM85~1.GIF")) returned 1 [0105.476] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0105.477] FindClose (in: hFindFile=0x104e2f0 | out: hFindFile=0x104e2f0) returned 1 [0105.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebc4) returned 1 [0105.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebd0) returned 1 [0105.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec08) returned 1 [0105.477] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", nBufferLength=0x105, lpBuffer=0xefe6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures", lpFilePart=0x0) returned 0x18 [0105.477] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\*", lpFindFileData=0xefe930 | out: lpFindFileData=0xefe930*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe61fce79, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe61fce79, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104ddf0 [0105.477] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe61fce79, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe61fce79, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.478] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b1e0440, ftCreationTime.dwHighDateTime=0x1d5e984, ftLastAccessTime.dwLowDateTime=0x93ddd4b0, ftLastAccessTime.dwHighDateTime=0x1d5eab0, ftLastWriteTime.dwLowDateTime=0x93ddd4b0, ftLastWriteTime.dwHighDateTime=0x1d5eab0, nFileSizeHigh=0x0, nFileSizeLow=0x9baf, dwReserved0=0x0, dwReserved1=0x0, cFileName="6Nn11Y0e.bmp", cAlternateFileName="")) returned 1 [0105.478] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfd66080, ftCreationTime.dwHighDateTime=0x1d5f0a7, ftLastAccessTime.dwLowDateTime=0x7f7db360, ftLastAccessTime.dwHighDateTime=0x1d5e43d, ftLastWriteTime.dwLowDateTime=0x7f7db360, ftLastWriteTime.dwHighDateTime=0x1d5e43d, nFileSizeHigh=0x0, nFileSizeLow=0x36fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="7V4AVib8x4wyo.png", cAlternateFileName="7V4AVI~1.PNG")) returned 1 [0105.478] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x701681d0, ftCreationTime.dwHighDateTime=0x1d5e754, ftLastAccessTime.dwLowDateTime=0xbefcbab0, ftLastAccessTime.dwHighDateTime=0x1d5efe9, ftLastWriteTime.dwLowDateTime=0xbefcbab0, ftLastWriteTime.dwHighDateTime=0x1d5efe9, nFileSizeHigh=0x0, nFileSizeLow=0x760, dwReserved0=0x0, dwReserved1=0x0, cFileName="8dVDG076G.gif", cAlternateFileName="8DVDG0~1.GIF")) returned 1 [0105.478] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0105.478] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44053085, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44053085, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0105.479] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c7cb3f0, ftCreationTime.dwHighDateTime=0x1d5ed5b, ftLastAccessTime.dwLowDateTime=0xfdda6050, ftLastAccessTime.dwHighDateTime=0x1d5e96a, ftLastWriteTime.dwLowDateTime=0xfdda6050, ftLastWriteTime.dwHighDateTime=0x1d5e96a, nFileSizeHigh=0x0, nFileSizeLow=0x7e6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="dNa9.gif", cAlternateFileName="")) returned 1 [0105.479] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5948c80, ftCreationTime.dwHighDateTime=0x1d5ec5e, ftLastAccessTime.dwLowDateTime=0x889dfa60, ftLastAccessTime.dwHighDateTime=0x1d5e850, ftLastWriteTime.dwLowDateTime=0x889dfa60, ftLastWriteTime.dwHighDateTime=0x1d5e850, nFileSizeHigh=0x0, nFileSizeLow=0x7096, dwReserved0=0x0, dwReserved1=0x0, cFileName="FIvyMa.gif", cAlternateFileName="")) returned 1 [0105.479] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f2168c0, ftCreationTime.dwHighDateTime=0x1d5e866, ftLastAccessTime.dwLowDateTime=0x36b89af0, ftLastAccessTime.dwHighDateTime=0x1d5e2df, ftLastWriteTime.dwLowDateTime=0x36b89af0, ftLastWriteTime.dwHighDateTime=0x1d5e2df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Jxc7y0", cAlternateFileName="")) returned 1 [0105.479] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ce7fd0, ftCreationTime.dwHighDateTime=0x1d5e213, ftLastAccessTime.dwLowDateTime=0xc98b3c0, ftLastAccessTime.dwHighDateTime=0x1d5e9ee, ftLastWriteTime.dwLowDateTime=0xc98b3c0, ftLastWriteTime.dwHighDateTime=0x1d5e9ee, nFileSizeHigh=0x0, nFileSizeLow=0x90dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="L72Z5-ELuJcj.bmp", cAlternateFileName="L72Z5-~1.BMP")) returned 1 [0105.479] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7820d540, ftCreationTime.dwHighDateTime=0x1d5f0a7, ftLastAccessTime.dwLowDateTime=0xb3294590, ftLastAccessTime.dwHighDateTime=0x1d5e199, ftLastWriteTime.dwLowDateTime=0xb3294590, ftLastWriteTime.dwHighDateTime=0x1d5e199, nFileSizeHigh=0x0, nFileSizeLow=0x140b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="m7BL5a.jpg", cAlternateFileName="")) returned 1 [0105.479] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11e4c640, ftCreationTime.dwHighDateTime=0x1d5edca, ftLastAccessTime.dwLowDateTime=0xbce49e70, ftLastAccessTime.dwHighDateTime=0x1d5ea6a, ftLastWriteTime.dwLowDateTime=0xbce49e70, ftLastWriteTime.dwHighDateTime=0x1d5ea6a, nFileSizeHigh=0x0, nFileSizeLow=0xb264, dwReserved0=0x0, dwReserved1=0x0, cFileName="mcl_Tb5XJ1-ZBM.gif", cAlternateFileName="MCL_TB~1.GIF")) returned 1 [0105.480] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a32ee60, ftCreationTime.dwHighDateTime=0x1d5e19d, ftLastAccessTime.dwLowDateTime=0xa555bc00, ftLastAccessTime.dwHighDateTime=0x1d5ef27, ftLastWriteTime.dwLowDateTime=0xa555bc00, ftLastWriteTime.dwHighDateTime=0x1d5ef27, nFileSizeHigh=0x0, nFileSizeLow=0x3913, dwReserved0=0x0, dwReserved1=0x0, cFileName="MjhsPG2iTtDmzmYBCz.bmp", cAlternateFileName="MJHSPG~1.BMP")) returned 1 [0105.480] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2364a270, ftCreationTime.dwHighDateTime=0x1d5ef44, ftLastAccessTime.dwLowDateTime=0x3b50650, ftLastAccessTime.dwHighDateTime=0x1d5e8a9, ftLastWriteTime.dwLowDateTime=0x3b50650, ftLastWriteTime.dwHighDateTime=0x1d5e8a9, nFileSizeHigh=0x0, nFileSizeLow=0x10d4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="n9HDluM7l1UPl_dq.gif", cAlternateFileName="N9HDLU~1.GIF")) returned 1 [0105.480] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd5dc0b0, ftCreationTime.dwHighDateTime=0x1d5e0ba, ftLastAccessTime.dwLowDateTime=0x4747eb00, ftLastAccessTime.dwHighDateTime=0x1d5e7da, ftLastWriteTime.dwLowDateTime=0x4747eb00, ftLastWriteTime.dwHighDateTime=0x1d5e7da, nFileSizeHigh=0x0, nFileSizeLow=0x18dc9, dwReserved0=0x0, dwReserved1=0x0, cFileName="nOVQ.gif", cAlternateFileName="")) returned 1 [0105.480] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9e4ae40, ftCreationTime.dwHighDateTime=0x1d5e2fe, ftLastAccessTime.dwLowDateTime=0xcd802f70, ftLastAccessTime.dwHighDateTime=0x1d5eac3, ftLastWriteTime.dwLowDateTime=0xcd802f70, ftLastWriteTime.dwHighDateTime=0x1d5eac3, nFileSizeHigh=0x0, nFileSizeLow=0xf0f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="P6_5eBLDYdwC8I6a4_.gif", cAlternateFileName="P6_5EB~1.GIF")) returned 1 [0105.481] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x548594b0, ftCreationTime.dwHighDateTime=0x1d5e817, ftLastAccessTime.dwLowDateTime=0xfd18c1b0, ftLastAccessTime.dwHighDateTime=0x1d5eaa1, ftLastWriteTime.dwLowDateTime=0xfd18c1b0, ftLastWriteTime.dwHighDateTime=0x1d5eaa1, nFileSizeHigh=0x0, nFileSizeLow=0xebd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="phmTCJUAc7iJYkpmC2.png", cAlternateFileName="PHMTCJ~1.PNG")) returned 1 [0105.481] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0105.481] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60970c50, ftCreationTime.dwHighDateTime=0x1d5ef58, ftLastAccessTime.dwLowDateTime=0xfaa36d00, ftLastAccessTime.dwHighDateTime=0x1d5ecf3, ftLastWriteTime.dwLowDateTime=0xfaa36d00, ftLastWriteTime.dwHighDateTime=0x1d5ecf3, nFileSizeHigh=0x0, nFileSizeLow=0x7d40, dwReserved0=0x0, dwReserved1=0x0, cFileName="TkzD3OseFc2R13.gif", cAlternateFileName="TKZD3O~1.GIF")) returned 1 [0105.481] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a55d680, ftCreationTime.dwHighDateTime=0x1d5eb9f, ftLastAccessTime.dwLowDateTime=0xb56e5a60, ftLastAccessTime.dwHighDateTime=0x1d5e127, ftLastWriteTime.dwLowDateTime=0xb56e5a60, ftLastWriteTime.dwHighDateTime=0x1d5e127, nFileSizeHigh=0x0, nFileSizeLow=0x160b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="tOdORiRv.gif", cAlternateFileName="")) returned 1 [0105.481] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc492c1b0, ftCreationTime.dwHighDateTime=0x1d5ef97, ftLastAccessTime.dwLowDateTime=0x3d820b70, ftLastAccessTime.dwHighDateTime=0x1d5e878, ftLastWriteTime.dwLowDateTime=0x3d820b70, ftLastWriteTime.dwHighDateTime=0x1d5e878, nFileSizeHigh=0x0, nFileSizeLow=0xbf43, dwReserved0=0x0, dwReserved1=0x0, cFileName="uG4TT2SFNmM7Jrnq Vw.png", cAlternateFileName="UG4TT2~1.PNG")) returned 1 [0105.482] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3797f070, ftCreationTime.dwHighDateTime=0x1d5ed3d, ftLastAccessTime.dwLowDateTime=0x9d49aa00, ftLastAccessTime.dwHighDateTime=0x1d5ec5a, ftLastWriteTime.dwLowDateTime=0x9d49aa00, ftLastWriteTime.dwHighDateTime=0x1d5ec5a, nFileSizeHigh=0x0, nFileSizeLow=0xaaf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="v766XG5EArmit.bmp", cAlternateFileName="V766XG~1.BMP")) returned 1 [0105.482] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a521210, ftCreationTime.dwHighDateTime=0x1d5ebdd, ftLastAccessTime.dwLowDateTime=0x5f66e200, ftLastAccessTime.dwHighDateTime=0x1d5eced, ftLastWriteTime.dwLowDateTime=0x5f66e200, ftLastWriteTime.dwHighDateTime=0x1d5eced, nFileSizeHigh=0x0, nFileSizeLow=0x3f74, dwReserved0=0x0, dwReserved1=0x0, cFileName="xkVuTsOTDp.png", cAlternateFileName="XKVUTS~1.PNG")) returned 1 [0105.483] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa09e790, ftCreationTime.dwHighDateTime=0x1d5e49a, ftLastAccessTime.dwLowDateTime=0x6febe2a0, ftLastAccessTime.dwHighDateTime=0x1d5e744, ftLastWriteTime.dwLowDateTime=0x6febe2a0, ftLastWriteTime.dwHighDateTime=0x1d5e744, nFileSizeHigh=0x0, nFileSizeLow=0x1967, dwReserved0=0x0, dwReserved1=0x0, cFileName="xUW3FKRmScAl_pqs.bmp", cAlternateFileName="XUW3FK~1.BMP")) returned 1 [0105.483] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd94c5330, ftCreationTime.dwHighDateTime=0x1d5eeef, ftLastAccessTime.dwLowDateTime=0x565a1f90, ftLastAccessTime.dwHighDateTime=0x1d5e975, ftLastWriteTime.dwLowDateTime=0x565a1f90, ftLastWriteTime.dwHighDateTime=0x1d5e975, nFileSizeHigh=0x0, nFileSizeLow=0xd16e, dwReserved0=0x0, dwReserved1=0x0, cFileName="xZIm85GJGQXcYDHmW.gif", cAlternateFileName="XZIM85~1.GIF")) returned 1 [0105.483] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd94c5330, ftCreationTime.dwHighDateTime=0x1d5eeef, ftLastAccessTime.dwLowDateTime=0x565a1f90, ftLastAccessTime.dwHighDateTime=0x1d5e975, ftLastWriteTime.dwLowDateTime=0x565a1f90, ftLastWriteTime.dwHighDateTime=0x1d5e975, nFileSizeHigh=0x0, nFileSizeLow=0xd16e, dwReserved0=0x0, dwReserved1=0x0, cFileName="xZIm85GJGQXcYDHmW.gif", cAlternateFileName="XZIM85~1.GIF")) returned 0 [0105.483] FindClose (in: hFindFile=0x104ddf0 | out: hFindFile=0x104ddf0) returned 1 [0105.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebc4) returned 1 [0105.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebd0) returned 1 [0105.484] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\6Nn11Y0e.bmp", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\6Nn11Y0e.bmp", lpFilePart=0x0) returned 0x25 [0105.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0105.484] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\6Nn11Y0e.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\6nn11y0e.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0105.484] GetFileType (hFile=0x2e4) returned 0x1 [0105.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0105.484] GetFileType (hFile=0x2e4) returned 0x1 [0105.484] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x9baf [0105.484] ReadFile (in: hFile=0x2e4, lpBuffer=0x2fdbb94, nNumberOfBytesToRead=0x9baf, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2fdbb94*, lpNumberOfBytesRead=0xefeb5c*=0x9baf, lpOverlapped=0x0) returned 1 [0105.486] CloseHandle (hObject=0x2e4) returned 1 [0105.576] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0105.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0105.576] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0105.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0105.577] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\6Nn11Y0e.bmp", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\6Nn11Y0e.bmp", lpFilePart=0x0) returned 0x25 [0105.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0105.577] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\6Nn11Y0e.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\6nn11y0e.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0105.579] GetFileType (hFile=0x2e4) returned 0x1 [0105.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0105.579] GetFileType (hFile=0x2e4) returned 0x1 [0105.579] WriteFile (in: hFile=0x2e4, lpBuffer=0x2e6f0b4*, nNumberOfBytesToWrite=0x9bb0, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2e6f0b4*, lpNumberOfBytesWritten=0xefeb50*=0x9bb0, lpOverlapped=0x0) returned 1 [0105.580] CloseHandle (hObject=0x2e4) returned 1 [0105.590] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\6Nn11Y0e.bmp", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\6Nn11Y0e.bmp", lpFilePart=0x0) returned 0x25 [0105.590] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\6Nn11Y0e.bmp.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\6Nn11Y0e.bmp.UGMH", lpFilePart=0x0) returned 0x2a [0105.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0105.591] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\6Nn11Y0e.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\6nn11y0e.bmp"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b1e0440, ftCreationTime.dwHighDateTime=0x1d5e984, ftLastAccessTime.dwLowDateTime=0x93ddd4b0, ftLastAccessTime.dwHighDateTime=0x1d5eab0, ftLastWriteTime.dwLowDateTime=0xd507e6d7, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x9bb0)) returned 1 [0105.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0105.673] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\6Nn11Y0e.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\6nn11y0e.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\6Nn11Y0e.bmp.UGMH" (normalized: "c:\\users\\fd1hvy\\pictures\\6nn11y0e.bmp.ugmh")) returned 1 [0105.674] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\7V4AVib8x4wyo.png", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\7V4AVib8x4wyo.png", lpFilePart=0x0) returned 0x2a [0105.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0105.674] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\7V4AVib8x4wyo.png" (normalized: "c:\\users\\fd1hvy\\pictures\\7v4avib8x4wyo.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0105.674] GetFileType (hFile=0x2e4) returned 0x1 [0105.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0105.674] GetFileType (hFile=0x2e4) returned 0x1 [0105.674] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x36fb [0105.675] ReadFile (in: hFile=0x2e4, lpBuffer=0x2e79060, nNumberOfBytesToRead=0x36fb, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2e79060*, lpNumberOfBytesRead=0xefeb5c*=0x36fb, lpOverlapped=0x0) returned 1 [0105.676] CloseHandle (hObject=0x2e4) returned 1 [0105.804] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0105.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0105.805] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0105.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0105.805] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\7V4AVib8x4wyo.png", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\7V4AVib8x4wyo.png", lpFilePart=0x0) returned 0x2a [0105.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0105.805] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\7V4AVib8x4wyo.png" (normalized: "c:\\users\\fd1hvy\\pictures\\7v4avib8x4wyo.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0105.806] GetFileType (hFile=0x2e4) returned 0x1 [0105.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0105.807] GetFileType (hFile=0x2e4) returned 0x1 [0105.807] WriteFile (in: hFile=0x2e4, lpBuffer=0x2ed72a4*, nNumberOfBytesToWrite=0x3700, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2ed72a4*, lpNumberOfBytesWritten=0xefeb50*=0x3700, lpOverlapped=0x0) returned 1 [0105.808] CloseHandle (hObject=0x2e4) returned 1 [0105.814] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\7V4AVib8x4wyo.png", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\7V4AVib8x4wyo.png", lpFilePart=0x0) returned 0x2a [0105.814] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\7V4AVib8x4wyo.png.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\7V4AVib8x4wyo.png.UGMH", lpFilePart=0x0) returned 0x2f [0105.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0105.815] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\7V4AVib8x4wyo.png" (normalized: "c:\\users\\fd1hvy\\pictures\\7v4avib8x4wyo.png"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfd66080, ftCreationTime.dwHighDateTime=0x1d5f0a7, ftLastAccessTime.dwLowDateTime=0x7f7db360, ftLastAccessTime.dwHighDateTime=0x1d5e43d, ftLastWriteTime.dwLowDateTime=0xd52c4c12, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x3700)) returned 1 [0105.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0105.815] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\7V4AVib8x4wyo.png" (normalized: "c:\\users\\fd1hvy\\pictures\\7v4avib8x4wyo.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\7V4AVib8x4wyo.png.UGMH" (normalized: "c:\\users\\fd1hvy\\pictures\\7v4avib8x4wyo.png.ugmh")) returned 1 [0105.816] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\L72Z5-ELuJcj.bmp", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\L72Z5-ELuJcj.bmp", lpFilePart=0x0) returned 0x29 [0105.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0105.816] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\L72Z5-ELuJcj.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\l72z5-elujcj.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0105.816] GetFileType (hFile=0x2e4) returned 0x1 [0105.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0105.816] GetFileType (hFile=0x2e4) returned 0x1 [0105.816] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x90dc [0105.816] ReadFile (in: hFile=0x2e4, lpBuffer=0x2edae2c, nNumberOfBytesToRead=0x90dc, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2edae2c*, lpNumberOfBytesRead=0xefeb5c*=0x90dc, lpOverlapped=0x0) returned 1 [0105.818] CloseHandle (hObject=0x2e4) returned 1 [0105.896] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0105.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0105.897] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0105.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0105.897] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\L72Z5-ELuJcj.bmp", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\L72Z5-ELuJcj.bmp", lpFilePart=0x0) returned 0x29 [0105.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0105.897] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\L72Z5-ELuJcj.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\l72z5-elujcj.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0105.898] GetFileType (hFile=0x2e4) returned 0x1 [0105.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0105.898] GetFileType (hFile=0x2e4) returned 0x1 [0105.898] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f55070*, nNumberOfBytesToWrite=0x90e0, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2f55070*, lpNumberOfBytesWritten=0xefeb50*=0x90e0, lpOverlapped=0x0) returned 1 [0105.900] CloseHandle (hObject=0x2e4) returned 1 [0105.902] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\L72Z5-ELuJcj.bmp", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\L72Z5-ELuJcj.bmp", lpFilePart=0x0) returned 0x29 [0105.902] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\L72Z5-ELuJcj.bmp.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\L72Z5-ELuJcj.bmp.UGMH", lpFilePart=0x0) returned 0x2e [0105.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0105.902] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\L72Z5-ELuJcj.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\l72z5-elujcj.bmp"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ce7fd0, ftCreationTime.dwHighDateTime=0x1d5e213, ftLastAccessTime.dwLowDateTime=0xc98b3c0, ftLastAccessTime.dwHighDateTime=0x1d5e9ee, ftLastWriteTime.dwLowDateTime=0xd5379371, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x90e0)) returned 1 [0105.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0105.902] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\L72Z5-ELuJcj.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\l72z5-elujcj.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\L72Z5-ELuJcj.bmp.UGMH" (normalized: "c:\\users\\fd1hvy\\pictures\\l72z5-elujcj.bmp.ugmh")) returned 1 [0105.903] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\m7BL5a.jpg", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\m7BL5a.jpg", lpFilePart=0x0) returned 0x23 [0105.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0105.903] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\m7BL5a.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\m7bl5a.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0105.903] GetFileType (hFile=0x2e4) returned 0x1 [0105.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0105.903] GetFileType (hFile=0x2e4) returned 0x1 [0105.903] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x140b2 [0105.903] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f5e558, nNumberOfBytesToRead=0x140b2, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2f5e558*, lpNumberOfBytesRead=0xefeb5c*=0x140b2, lpOverlapped=0x0) returned 1 [0105.905] CloseHandle (hObject=0x2e4) returned 1 [0105.978] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0105.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0105.978] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0105.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0105.978] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\m7BL5a.jpg", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\m7BL5a.jpg", lpFilePart=0x0) returned 0x23 [0105.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0105.978] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\m7BL5a.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\m7bl5a.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0105.980] GetFileType (hFile=0x2e4) returned 0x1 [0105.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0105.980] GetFileType (hFile=0x2e4) returned 0x1 [0105.980] WriteFile (in: hFile=0x2e4, lpBuffer=0x2fe7594*, nNumberOfBytesToWrite=0x140c0, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2fe7594*, lpNumberOfBytesWritten=0xefeb50*=0x140c0, lpOverlapped=0x0) returned 1 [0105.982] CloseHandle (hObject=0x2e4) returned 1 [0105.986] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\m7BL5a.jpg", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\m7BL5a.jpg", lpFilePart=0x0) returned 0x23 [0105.986] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\m7BL5a.jpg.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\m7BL5a.jpg.UGMH", lpFilePart=0x0) returned 0x28 [0105.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0105.986] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\m7BL5a.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\m7bl5a.jpg"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7820d540, ftCreationTime.dwHighDateTime=0x1d5f0a7, ftLastAccessTime.dwLowDateTime=0xb3294590, ftLastAccessTime.dwHighDateTime=0x1d5e199, ftLastWriteTime.dwLowDateTime=0xd545ded8, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x140c0)) returned 1 [0105.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0105.986] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\m7BL5a.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\m7bl5a.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\m7BL5a.jpg.UGMH" (normalized: "c:\\users\\fd1hvy\\pictures\\m7bl5a.jpg.ugmh")) returned 1 [0105.987] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\MjhsPG2iTtDmzmYBCz.bmp", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\MjhsPG2iTtDmzmYBCz.bmp", lpFilePart=0x0) returned 0x2f [0105.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0105.987] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\MjhsPG2iTtDmzmYBCz.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\mjhspg2ittdmzmybcz.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0105.987] GetFileType (hFile=0x2e4) returned 0x1 [0105.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0105.987] GetFileType (hFile=0x2e4) returned 0x1 [0105.987] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x3913 [0105.987] ReadFile (in: hFile=0x2e4, lpBuffer=0x2ffba68, nNumberOfBytesToRead=0x3913, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2ffba68*, lpNumberOfBytesRead=0xefeb5c*=0x3913, lpOverlapped=0x0) returned 1 [0105.988] CloseHandle (hObject=0x2e4) returned 1 [0106.046] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0106.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0106.046] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0106.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0106.047] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\MjhsPG2iTtDmzmYBCz.bmp", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\MjhsPG2iTtDmzmYBCz.bmp", lpFilePart=0x0) returned 0x2f [0106.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0106.047] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\MjhsPG2iTtDmzmYBCz.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\mjhspg2ittdmzmybcz.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0106.048] GetFileType (hFile=0x2e4) returned 0x1 [0106.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0106.048] GetFileType (hFile=0x2e4) returned 0x1 [0106.048] WriteFile (in: hFile=0x2e4, lpBuffer=0x305a5f0*, nNumberOfBytesToWrite=0x3920, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x305a5f0*, lpNumberOfBytesWritten=0xefeb50*=0x3920, lpOverlapped=0x0) returned 1 [0106.049] CloseHandle (hObject=0x2e4) returned 1 [0106.054] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\MjhsPG2iTtDmzmYBCz.bmp", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\MjhsPG2iTtDmzmYBCz.bmp", lpFilePart=0x0) returned 0x2f [0106.054] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\MjhsPG2iTtDmzmYBCz.bmp.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\MjhsPG2iTtDmzmYBCz.bmp.UGMH", lpFilePart=0x0) returned 0x34 [0106.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0106.054] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\MjhsPG2iTtDmzmYBCz.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\mjhspg2ittdmzmybcz.bmp"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a32ee60, ftCreationTime.dwHighDateTime=0x1d5e19d, ftLastAccessTime.dwLowDateTime=0xa555bc00, ftLastAccessTime.dwHighDateTime=0x1d5ef27, ftLastWriteTime.dwLowDateTime=0xd54f67f3, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x3920)) returned 1 [0106.054] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0106.054] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\MjhsPG2iTtDmzmYBCz.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\mjhspg2ittdmzmybcz.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\MjhsPG2iTtDmzmYBCz.bmp.UGMH" (normalized: "c:\\users\\fd1hvy\\pictures\\mjhspg2ittdmzmybcz.bmp.ugmh")) returned 1 [0106.055] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\phmTCJUAc7iJYkpmC2.png", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\phmTCJUAc7iJYkpmC2.png", lpFilePart=0x0) returned 0x2f [0106.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0106.055] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\phmTCJUAc7iJYkpmC2.png" (normalized: "c:\\users\\fd1hvy\\pictures\\phmtcjuac7ijykpmc2.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0106.055] GetFileType (hFile=0x2e4) returned 0x1 [0106.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0106.055] GetFileType (hFile=0x2e4) returned 0x1 [0106.055] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0xebd6 [0106.056] ReadFile (in: hFile=0x2e4, lpBuffer=0x305e3cc, nNumberOfBytesToRead=0xebd6, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x305e3cc*, lpNumberOfBytesRead=0xefeb5c*=0xebd6, lpOverlapped=0x0) returned 1 [0106.057] CloseHandle (hObject=0x2e4) returned 1 [0106.152] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0106.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0106.152] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0106.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0106.153] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\phmTCJUAc7iJYkpmC2.png", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\phmTCJUAc7iJYkpmC2.png", lpFilePart=0x0) returned 0x2f [0106.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0106.153] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\phmTCJUAc7iJYkpmC2.png" (normalized: "c:\\users\\fd1hvy\\pictures\\phmtcjuac7ijykpmc2.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0106.154] GetFileType (hFile=0x2e4) returned 0x1 [0106.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0106.154] GetFileType (hFile=0x2e4) returned 0x1 [0106.154] WriteFile (in: hFile=0x2e4, lpBuffer=0x2ea566c*, nNumberOfBytesToWrite=0xebe0, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2ea566c*, lpNumberOfBytesWritten=0xefeb50*=0xebe0, lpOverlapped=0x0) returned 1 [0106.158] CloseHandle (hObject=0x2e4) returned 1 [0106.162] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\phmTCJUAc7iJYkpmC2.png", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\phmTCJUAc7iJYkpmC2.png", lpFilePart=0x0) returned 0x2f [0106.162] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\phmTCJUAc7iJYkpmC2.png.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\phmTCJUAc7iJYkpmC2.png.UGMH", lpFilePart=0x0) returned 0x34 [0106.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0106.163] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\phmTCJUAc7iJYkpmC2.png" (normalized: "c:\\users\\fd1hvy\\pictures\\phmtcjuac7ijykpmc2.png"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x548594b0, ftCreationTime.dwHighDateTime=0x1d5e817, ftLastAccessTime.dwLowDateTime=0xfd18c1b0, ftLastAccessTime.dwHighDateTime=0x1d5eaa1, ftLastWriteTime.dwLowDateTime=0xd5602339, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xebe0)) returned 1 [0106.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0106.163] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\phmTCJUAc7iJYkpmC2.png" (normalized: "c:\\users\\fd1hvy\\pictures\\phmtcjuac7ijykpmc2.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\phmTCJUAc7iJYkpmC2.png.UGMH" (normalized: "c:\\users\\fd1hvy\\pictures\\phmtcjuac7ijykpmc2.png.ugmh")) returned 1 [0106.164] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\uG4TT2SFNmM7Jrnq Vw.png", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\uG4TT2SFNmM7Jrnq Vw.png", lpFilePart=0x0) returned 0x30 [0106.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0106.164] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\uG4TT2SFNmM7Jrnq Vw.png" (normalized: "c:\\users\\fd1hvy\\pictures\\ug4tt2sfnmm7jrnq vw.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0106.164] GetFileType (hFile=0x2e4) returned 0x1 [0106.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0106.164] GetFileType (hFile=0x2e4) returned 0x1 [0106.164] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0xbf43 [0106.164] ReadFile (in: hFile=0x2e4, lpBuffer=0x2eb46f4, nNumberOfBytesToRead=0xbf43, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2eb46f4*, lpNumberOfBytesRead=0xefeb5c*=0xbf43, lpOverlapped=0x0) returned 1 [0106.166] CloseHandle (hObject=0x2e4) returned 1 [0106.248] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0106.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0106.248] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0106.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0106.249] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\uG4TT2SFNmM7Jrnq Vw.png", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\uG4TT2SFNmM7Jrnq Vw.png", lpFilePart=0x0) returned 0x30 [0106.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0106.249] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\uG4TT2SFNmM7Jrnq Vw.png" (normalized: "c:\\users\\fd1hvy\\pictures\\ug4tt2sfnmm7jrnq vw.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0106.250] GetFileType (hFile=0x2e4) returned 0x1 [0106.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0106.250] GetFileType (hFile=0x2e4) returned 0x1 [0106.251] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f2543c*, nNumberOfBytesToWrite=0xbf50, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2f2543c*, lpNumberOfBytesWritten=0xefeb50*=0xbf50, lpOverlapped=0x0) returned 1 [0106.253] CloseHandle (hObject=0x2e4) returned 1 [0106.255] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\uG4TT2SFNmM7Jrnq Vw.png", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\uG4TT2SFNmM7Jrnq Vw.png", lpFilePart=0x0) returned 0x30 [0106.255] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\uG4TT2SFNmM7Jrnq Vw.png.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\uG4TT2SFNmM7Jrnq Vw.png.UGMH", lpFilePart=0x0) returned 0x35 [0106.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0106.255] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\uG4TT2SFNmM7Jrnq Vw.png" (normalized: "c:\\users\\fd1hvy\\pictures\\ug4tt2sfnmm7jrnq vw.png"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc492c1b0, ftCreationTime.dwHighDateTime=0x1d5ef97, ftLastAccessTime.dwLowDateTime=0x3d820b70, ftLastAccessTime.dwHighDateTime=0x1d5e878, ftLastWriteTime.dwLowDateTime=0xd56e69d9, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xbf50)) returned 1 [0106.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0106.255] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\uG4TT2SFNmM7Jrnq Vw.png" (normalized: "c:\\users\\fd1hvy\\pictures\\ug4tt2sfnmm7jrnq vw.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\uG4TT2SFNmM7Jrnq Vw.png.UGMH" (normalized: "c:\\users\\fd1hvy\\pictures\\ug4tt2sfnmm7jrnq vw.png.ugmh")) returned 1 [0106.256] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\v766XG5EArmit.bmp", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\v766XG5EArmit.bmp", lpFilePart=0x0) returned 0x2a [0106.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0106.256] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\v766XG5EArmit.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\v766xg5earmit.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0106.256] GetFileType (hFile=0x2e4) returned 0x1 [0106.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0106.257] GetFileType (hFile=0x2e4) returned 0x1 [0106.257] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0xaaf7 [0106.257] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f317f4, nNumberOfBytesToRead=0xaaf7, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2f317f4*, lpNumberOfBytesRead=0xefeb5c*=0xaaf7, lpOverlapped=0x0) returned 1 [0106.258] CloseHandle (hObject=0x2e4) returned 1 [0106.338] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0106.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0106.339] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0106.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0106.339] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\v766XG5EArmit.bmp", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\v766XG5EArmit.bmp", lpFilePart=0x0) returned 0x2a [0106.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0106.339] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\v766XG5EArmit.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\v766xg5earmit.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0106.340] GetFileType (hFile=0x2e4) returned 0x1 [0106.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0106.341] GetFileType (hFile=0x2e4) returned 0x1 [0106.341] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f9e6f0*, nNumberOfBytesToWrite=0xab00, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2f9e6f0*, lpNumberOfBytesWritten=0xefeb50*=0xab00, lpOverlapped=0x0) returned 1 [0106.343] CloseHandle (hObject=0x2e4) returned 1 [0106.345] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\v766XG5EArmit.bmp", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\v766XG5EArmit.bmp", lpFilePart=0x0) returned 0x2a [0106.345] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\v766XG5EArmit.bmp.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\v766XG5EArmit.bmp.UGMH", lpFilePart=0x0) returned 0x2f [0106.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0106.345] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\v766XG5EArmit.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\v766xg5earmit.bmp"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3797f070, ftCreationTime.dwHighDateTime=0x1d5ed3d, ftLastAccessTime.dwLowDateTime=0x9d49aa00, ftLastAccessTime.dwHighDateTime=0x1d5ec5a, ftLastWriteTime.dwLowDateTime=0xd57cb59d, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xab00)) returned 1 [0106.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0106.346] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\v766XG5EArmit.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\v766xg5earmit.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\v766XG5EArmit.bmp.UGMH" (normalized: "c:\\users\\fd1hvy\\pictures\\v766xg5earmit.bmp.ugmh")) returned 1 [0106.347] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\xkVuTsOTDp.png", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\xkVuTsOTDp.png", lpFilePart=0x0) returned 0x27 [0106.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0106.347] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\xkVuTsOTDp.png" (normalized: "c:\\users\\fd1hvy\\pictures\\xkvutsotdp.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0106.347] GetFileType (hFile=0x2e4) returned 0x1 [0106.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0106.347] GetFileType (hFile=0x2e4) returned 0x1 [0106.347] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x3f74 [0106.347] ReadFile (in: hFile=0x2e4, lpBuffer=0x2fa9610, nNumberOfBytesToRead=0x3f74, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2fa9610*, lpNumberOfBytesRead=0xefeb5c*=0x3f74, lpOverlapped=0x0) returned 1 [0106.348] CloseHandle (hObject=0x2e4) returned 1 [0106.433] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0106.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0106.433] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0106.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0106.434] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\xkVuTsOTDp.png", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\xkVuTsOTDp.png", lpFilePart=0x0) returned 0x27 [0106.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0106.434] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\xkVuTsOTDp.png" (normalized: "c:\\users\\fd1hvy\\pictures\\xkvutsotdp.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0106.437] GetFileType (hFile=0x2e4) returned 0x1 [0106.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0106.437] GetFileType (hFile=0x2e4) returned 0x1 [0106.437] WriteFile (in: hFile=0x2e4, lpBuffer=0x300a174*, nNumberOfBytesToWrite=0x3f80, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x300a174*, lpNumberOfBytesWritten=0xefeb50*=0x3f80, lpOverlapped=0x0) returned 1 [0106.438] CloseHandle (hObject=0x2e4) returned 1 [0106.440] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\xkVuTsOTDp.png", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\xkVuTsOTDp.png", lpFilePart=0x0) returned 0x27 [0106.440] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\xkVuTsOTDp.png.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\xkVuTsOTDp.png.UGMH", lpFilePart=0x0) returned 0x2c [0106.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0106.440] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\xkVuTsOTDp.png" (normalized: "c:\\users\\fd1hvy\\pictures\\xkvutsotdp.png"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a521210, ftCreationTime.dwHighDateTime=0x1d5ebdd, ftLastAccessTime.dwLowDateTime=0x5f66e200, ftLastAccessTime.dwHighDateTime=0x1d5eced, ftLastWriteTime.dwLowDateTime=0xd58b035e, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x3f80)) returned 1 [0106.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0106.440] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\xkVuTsOTDp.png" (normalized: "c:\\users\\fd1hvy\\pictures\\xkvutsotdp.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\xkVuTsOTDp.png.UGMH" (normalized: "c:\\users\\fd1hvy\\pictures\\xkvutsotdp.png.ugmh")) returned 1 [0106.441] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\xUW3FKRmScAl_pqs.bmp", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\xUW3FKRmScAl_pqs.bmp", lpFilePart=0x0) returned 0x2d [0106.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0106.441] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\xUW3FKRmScAl_pqs.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\xuw3fkrmscal_pqs.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0106.441] GetFileType (hFile=0x2e4) returned 0x1 [0106.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0106.442] GetFileType (hFile=0x2e4) returned 0x1 [0106.442] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x1967 [0106.442] ReadFile (in: hFile=0x2e4, lpBuffer=0x300e510, nNumberOfBytesToRead=0x1967, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x300e510*, lpNumberOfBytesRead=0xefeb5c*=0x1967, lpOverlapped=0x0) returned 1 [0106.443] CloseHandle (hObject=0x2e4) returned 1 [0106.525] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0106.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0106.525] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0106.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0106.525] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\xUW3FKRmScAl_pqs.bmp", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\xUW3FKRmScAl_pqs.bmp", lpFilePart=0x0) returned 0x2d [0106.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0106.526] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\xUW3FKRmScAl_pqs.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\xuw3fkrmscal_pqs.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0106.527] GetFileType (hFile=0x2e4) returned 0x1 [0106.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0106.527] GetFileType (hFile=0x2e4) returned 0x1 [0106.527] WriteFile (in: hFile=0x2e4, lpBuffer=0x3063228*, nNumberOfBytesToWrite=0x1970, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x3063228*, lpNumberOfBytesWritten=0xefeb50*=0x1970, lpOverlapped=0x0) returned 1 [0106.528] CloseHandle (hObject=0x2e4) returned 1 [0106.530] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\xUW3FKRmScAl_pqs.bmp", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\xUW3FKRmScAl_pqs.bmp", lpFilePart=0x0) returned 0x2d [0106.530] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\xUW3FKRmScAl_pqs.bmp.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\xUW3FKRmScAl_pqs.bmp.UGMH", lpFilePart=0x0) returned 0x32 [0106.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0106.530] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\xUW3FKRmScAl_pqs.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\xuw3fkrmscal_pqs.bmp"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa09e790, ftCreationTime.dwHighDateTime=0x1d5e49a, ftLastAccessTime.dwLowDateTime=0x6febe2a0, ftLastAccessTime.dwHighDateTime=0x1d5e744, ftLastWriteTime.dwLowDateTime=0xd5995163, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x1970)) returned 1 [0106.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0106.530] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\xUW3FKRmScAl_pqs.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\xuw3fkrmscal_pqs.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\xUW3FKRmScAl_pqs.bmp.UGMH" (normalized: "c:\\users\\fd1hvy\\pictures\\xuw3fkrmscal_pqs.bmp.ugmh")) returned 1 [0106.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb94) returned 1 [0106.531] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", nBufferLength=0x105, lpBuffer=0xefe648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", lpFilePart=0x0) returned 0x24 [0106.531] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*", lpFindFileData=0xefe8bc | out: lpFindFileData=0xefe8bc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104e330 [0106.532] FindNextFileW (in: hFindFile=0x104e330, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.532] FindNextFileW (in: hFindFile=0x104e330, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0106.533] FindNextFileW (in: hFindFile=0x104e330, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0106.533] FindClose (in: hFindFile=0x104e330 | out: hFindFile=0x104e330) returned 1 [0106.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb50) returned 1 [0106.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb5c) returned 1 [0106.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb94) returned 1 [0106.533] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", nBufferLength=0x105, lpBuffer=0xefe648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", lpFilePart=0x0) returned 0x24 [0106.533] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*", lpFindFileData=0xefe8bc | out: lpFindFileData=0xefe8bc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104e330 [0106.533] FindNextFileW (in: hFindFile=0x104e330, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.534] FindNextFileW (in: hFindFile=0x104e330, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0106.534] FindNextFileW (in: hFindFile=0x104e330, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0106.534] FindClose (in: hFindFile=0x104e330 | out: hFindFile=0x104e330) returned 1 [0106.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb50) returned 1 [0106.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb5c) returned 1 [0106.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb94) returned 1 [0106.534] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0", nBufferLength=0x105, lpBuffer=0xefe648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0", lpFilePart=0x0) returned 0x1f [0106.534] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\*", lpFindFileData=0xefe8bc | out: lpFindFileData=0xefe8bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f2168c0, ftCreationTime.dwHighDateTime=0x1d5e866, ftLastAccessTime.dwLowDateTime=0x36b89af0, ftLastAccessTime.dwHighDateTime=0x1d5e2df, ftLastWriteTime.dwLowDateTime=0x36b89af0, ftLastWriteTime.dwHighDateTime=0x1d5e2df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104e330 [0106.535] FindNextFileW (in: hFindFile=0x104e330, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f2168c0, ftCreationTime.dwHighDateTime=0x1d5e866, ftLastAccessTime.dwLowDateTime=0x36b89af0, ftLastAccessTime.dwHighDateTime=0x1d5e2df, ftLastWriteTime.dwLowDateTime=0x36b89af0, ftLastWriteTime.dwHighDateTime=0x1d5e2df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.535] FindNextFileW (in: hFindFile=0x104e330, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfabbc160, ftCreationTime.dwHighDateTime=0x1d5e6dc, ftLastAccessTime.dwLowDateTime=0xc87d4150, ftLastAccessTime.dwHighDateTime=0x1d5e5de, ftLastWriteTime.dwLowDateTime=0xc87d4150, ftLastWriteTime.dwHighDateTime=0x1d5e5de, nFileSizeHigh=0x0, nFileSizeLow=0x9eee, dwReserved0=0x0, dwReserved1=0x0, cFileName="6MqB.gif", cAlternateFileName="")) returned 1 [0106.535] FindNextFileW (in: hFindFile=0x104e330, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9f220, ftCreationTime.dwHighDateTime=0x1d5e5e2, ftLastAccessTime.dwLowDateTime=0x77225aa0, ftLastAccessTime.dwHighDateTime=0x1d5e89c, ftLastWriteTime.dwLowDateTime=0x77225aa0, ftLastWriteTime.dwHighDateTime=0x1d5e89c, nFileSizeHigh=0x0, nFileSizeLow=0xd70a, dwReserved0=0x0, dwReserved1=0x0, cFileName="aQtwo6a.gif", cAlternateFileName="")) returned 1 [0106.535] FindNextFileW (in: hFindFile=0x104e330, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e5ef000, ftCreationTime.dwHighDateTime=0x1d5e408, ftLastAccessTime.dwLowDateTime=0xf62f18f0, ftLastAccessTime.dwHighDateTime=0x1d5efd2, ftLastWriteTime.dwLowDateTime=0xf62f18f0, ftLastWriteTime.dwHighDateTime=0x1d5efd2, nFileSizeHigh=0x0, nFileSizeLow=0xe808, dwReserved0=0x0, dwReserved1=0x0, cFileName="D6OUDRvTgb.bmp", cAlternateFileName="D6OUDR~1.BMP")) returned 1 [0106.535] FindNextFileW (in: hFindFile=0x104e330, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1295bbf0, ftCreationTime.dwHighDateTime=0x1d5e986, ftLastAccessTime.dwLowDateTime=0x63a37ee0, ftLastAccessTime.dwHighDateTime=0x1d5e78a, ftLastWriteTime.dwLowDateTime=0x63a37ee0, ftLastWriteTime.dwHighDateTime=0x1d5e78a, nFileSizeHigh=0x0, nFileSizeLow=0x12c60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Glrt9tOqhqJl.gif", cAlternateFileName="GLRT9T~1.GIF")) returned 1 [0106.535] FindNextFileW (in: hFindFile=0x104e330, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc35f12d0, ftCreationTime.dwHighDateTime=0x1d5e506, ftLastAccessTime.dwLowDateTime=0xebf1da0, ftLastAccessTime.dwHighDateTime=0x1d5ee09, ftLastWriteTime.dwLowDateTime=0xebf1da0, ftLastWriteTime.dwHighDateTime=0x1d5ee09, nFileSizeHigh=0x0, nFileSizeLow=0xb9f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="i8b9f.png", cAlternateFileName="")) returned 1 [0106.536] FindNextFileW (in: hFindFile=0x104e330, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d665c40, ftCreationTime.dwHighDateTime=0x1d5ed50, ftLastAccessTime.dwLowDateTime=0x8e0156c0, ftLastAccessTime.dwHighDateTime=0x1d5e68c, ftLastWriteTime.dwLowDateTime=0x8e0156c0, ftLastWriteTime.dwHighDateTime=0x1d5e68c, nFileSizeHigh=0x0, nFileSizeLow=0x57ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="pCa06Rdzr0.png", cAlternateFileName="PCA06R~1.PNG")) returned 1 [0106.536] FindNextFileW (in: hFindFile=0x104e330, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4f80890, ftCreationTime.dwHighDateTime=0x1d5ebc6, ftLastAccessTime.dwLowDateTime=0xecc46dc0, ftLastAccessTime.dwHighDateTime=0x1d5ee78, ftLastWriteTime.dwLowDateTime=0xecc46dc0, ftLastWriteTime.dwHighDateTime=0x1d5ee78, nFileSizeHigh=0x0, nFileSizeLow=0x9b81, dwReserved0=0x0, dwReserved1=0x0, cFileName="qDpCSLL3FojV8hhFk.gif", cAlternateFileName="QDPCSL~1.GIF")) returned 1 [0106.536] FindNextFileW (in: hFindFile=0x104e330, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad72c4e0, ftCreationTime.dwHighDateTime=0x1d5ed89, ftLastAccessTime.dwLowDateTime=0xfd9c9900, ftLastAccessTime.dwHighDateTime=0x1d5e6c2, ftLastWriteTime.dwLowDateTime=0xfd9c9900, ftLastWriteTime.dwHighDateTime=0x1d5e6c2, nFileSizeHigh=0x0, nFileSizeLow=0x1d33, dwReserved0=0x0, dwReserved1=0x0, cFileName="qjcs8zuSx.jpg", cAlternateFileName="QJCS8Z~1.JPG")) returned 1 [0106.536] FindNextFileW (in: hFindFile=0x104e330, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb17eb430, ftCreationTime.dwHighDateTime=0x1d5e128, ftLastAccessTime.dwLowDateTime=0xf961cec0, ftLastAccessTime.dwHighDateTime=0x1d5eb52, ftLastWriteTime.dwLowDateTime=0xf961cec0, ftLastWriteTime.dwHighDateTime=0x1d5eb52, nFileSizeHigh=0x0, nFileSizeLow=0x7986, dwReserved0=0x0, dwReserved1=0x0, cFileName="RjNASMUryXOapBb74Vr.png", cAlternateFileName="RJNASM~1.PNG")) returned 1 [0106.536] FindNextFileW (in: hFindFile=0x104e330, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4bd390, ftCreationTime.dwHighDateTime=0x1d5e4be, ftLastAccessTime.dwLowDateTime=0x9ca4ee20, ftLastAccessTime.dwHighDateTime=0x1d5e40d, ftLastWriteTime.dwLowDateTime=0x9ca4ee20, ftLastWriteTime.dwHighDateTime=0x1d5e40d, nFileSizeHigh=0x0, nFileSizeLow=0x3347, dwReserved0=0x0, dwReserved1=0x0, cFileName="s8O40VOQJ_Qf-hBfIY.png", cAlternateFileName="S8O40V~1.PNG")) returned 1 [0106.536] FindNextFileW (in: hFindFile=0x104e330, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33deea70, ftCreationTime.dwHighDateTime=0x1d5eaa8, ftLastAccessTime.dwLowDateTime=0x5e2a0880, ftLastAccessTime.dwHighDateTime=0x1d5eab9, ftLastWriteTime.dwLowDateTime=0x5e2a0880, ftLastWriteTime.dwHighDateTime=0x1d5eab9, nFileSizeHigh=0x0, nFileSizeLow=0x3640, dwReserved0=0x0, dwReserved1=0x0, cFileName="V92B-iZNhN.png", cAlternateFileName="V92B-I~1.PNG")) returned 1 [0106.537] FindNextFileW (in: hFindFile=0x104e330, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd51a7f40, ftCreationTime.dwHighDateTime=0x1d5e9df, ftLastAccessTime.dwLowDateTime=0x891b9a70, ftLastAccessTime.dwHighDateTime=0x1d5e511, ftLastWriteTime.dwLowDateTime=0x891b9a70, ftLastWriteTime.dwHighDateTime=0x1d5e511, nFileSizeHigh=0x0, nFileSizeLow=0x2da9, dwReserved0=0x0, dwReserved1=0x0, cFileName="wD1uq4FVnLSeN.gif", cAlternateFileName="WD1UQ4~1.GIF")) returned 1 [0106.537] FindNextFileW (in: hFindFile=0x104e330, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0106.537] FindClose (in: hFindFile=0x104e330 | out: hFindFile=0x104e330) returned 1 [0106.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb50) returned 1 [0106.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb5c) returned 1 [0106.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb94) returned 1 [0106.537] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0", nBufferLength=0x105, lpBuffer=0xefe648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0", lpFilePart=0x0) returned 0x1f [0106.537] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\*", lpFindFileData=0xefe8bc | out: lpFindFileData=0xefe8bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f2168c0, ftCreationTime.dwHighDateTime=0x1d5e866, ftLastAccessTime.dwLowDateTime=0x36b89af0, ftLastAccessTime.dwHighDateTime=0x1d5e2df, ftLastWriteTime.dwLowDateTime=0x36b89af0, ftLastWriteTime.dwHighDateTime=0x1d5e2df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104deb0 [0106.538] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f2168c0, ftCreationTime.dwHighDateTime=0x1d5e866, ftLastAccessTime.dwLowDateTime=0x36b89af0, ftLastAccessTime.dwHighDateTime=0x1d5e2df, ftLastWriteTime.dwLowDateTime=0x36b89af0, ftLastWriteTime.dwHighDateTime=0x1d5e2df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.538] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfabbc160, ftCreationTime.dwHighDateTime=0x1d5e6dc, ftLastAccessTime.dwLowDateTime=0xc87d4150, ftLastAccessTime.dwHighDateTime=0x1d5e5de, ftLastWriteTime.dwLowDateTime=0xc87d4150, ftLastWriteTime.dwHighDateTime=0x1d5e5de, nFileSizeHigh=0x0, nFileSizeLow=0x9eee, dwReserved0=0x0, dwReserved1=0x0, cFileName="6MqB.gif", cAlternateFileName="")) returned 1 [0106.538] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9f220, ftCreationTime.dwHighDateTime=0x1d5e5e2, ftLastAccessTime.dwLowDateTime=0x77225aa0, ftLastAccessTime.dwHighDateTime=0x1d5e89c, ftLastWriteTime.dwLowDateTime=0x77225aa0, ftLastWriteTime.dwHighDateTime=0x1d5e89c, nFileSizeHigh=0x0, nFileSizeLow=0xd70a, dwReserved0=0x0, dwReserved1=0x0, cFileName="aQtwo6a.gif", cAlternateFileName="")) returned 1 [0106.538] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e5ef000, ftCreationTime.dwHighDateTime=0x1d5e408, ftLastAccessTime.dwLowDateTime=0xf62f18f0, ftLastAccessTime.dwHighDateTime=0x1d5efd2, ftLastWriteTime.dwLowDateTime=0xf62f18f0, ftLastWriteTime.dwHighDateTime=0x1d5efd2, nFileSizeHigh=0x0, nFileSizeLow=0xe808, dwReserved0=0x0, dwReserved1=0x0, cFileName="D6OUDRvTgb.bmp", cAlternateFileName="D6OUDR~1.BMP")) returned 1 [0106.538] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1295bbf0, ftCreationTime.dwHighDateTime=0x1d5e986, ftLastAccessTime.dwLowDateTime=0x63a37ee0, ftLastAccessTime.dwHighDateTime=0x1d5e78a, ftLastWriteTime.dwLowDateTime=0x63a37ee0, ftLastWriteTime.dwHighDateTime=0x1d5e78a, nFileSizeHigh=0x0, nFileSizeLow=0x12c60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Glrt9tOqhqJl.gif", cAlternateFileName="GLRT9T~1.GIF")) returned 1 [0106.539] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc35f12d0, ftCreationTime.dwHighDateTime=0x1d5e506, ftLastAccessTime.dwLowDateTime=0xebf1da0, ftLastAccessTime.dwHighDateTime=0x1d5ee09, ftLastWriteTime.dwLowDateTime=0xebf1da0, ftLastWriteTime.dwHighDateTime=0x1d5ee09, nFileSizeHigh=0x0, nFileSizeLow=0xb9f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="i8b9f.png", cAlternateFileName="")) returned 1 [0106.539] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d665c40, ftCreationTime.dwHighDateTime=0x1d5ed50, ftLastAccessTime.dwLowDateTime=0x8e0156c0, ftLastAccessTime.dwHighDateTime=0x1d5e68c, ftLastWriteTime.dwLowDateTime=0x8e0156c0, ftLastWriteTime.dwHighDateTime=0x1d5e68c, nFileSizeHigh=0x0, nFileSizeLow=0x57ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="pCa06Rdzr0.png", cAlternateFileName="PCA06R~1.PNG")) returned 1 [0106.539] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4f80890, ftCreationTime.dwHighDateTime=0x1d5ebc6, ftLastAccessTime.dwLowDateTime=0xecc46dc0, ftLastAccessTime.dwHighDateTime=0x1d5ee78, ftLastWriteTime.dwLowDateTime=0xecc46dc0, ftLastWriteTime.dwHighDateTime=0x1d5ee78, nFileSizeHigh=0x0, nFileSizeLow=0x9b81, dwReserved0=0x0, dwReserved1=0x0, cFileName="qDpCSLL3FojV8hhFk.gif", cAlternateFileName="QDPCSL~1.GIF")) returned 1 [0106.539] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad72c4e0, ftCreationTime.dwHighDateTime=0x1d5ed89, ftLastAccessTime.dwLowDateTime=0xfd9c9900, ftLastAccessTime.dwHighDateTime=0x1d5e6c2, ftLastWriteTime.dwLowDateTime=0xfd9c9900, ftLastWriteTime.dwHighDateTime=0x1d5e6c2, nFileSizeHigh=0x0, nFileSizeLow=0x1d33, dwReserved0=0x0, dwReserved1=0x0, cFileName="qjcs8zuSx.jpg", cAlternateFileName="QJCS8Z~1.JPG")) returned 1 [0106.539] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb17eb430, ftCreationTime.dwHighDateTime=0x1d5e128, ftLastAccessTime.dwLowDateTime=0xf961cec0, ftLastAccessTime.dwHighDateTime=0x1d5eb52, ftLastWriteTime.dwLowDateTime=0xf961cec0, ftLastWriteTime.dwHighDateTime=0x1d5eb52, nFileSizeHigh=0x0, nFileSizeLow=0x7986, dwReserved0=0x0, dwReserved1=0x0, cFileName="RjNASMUryXOapBb74Vr.png", cAlternateFileName="RJNASM~1.PNG")) returned 1 [0106.540] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4bd390, ftCreationTime.dwHighDateTime=0x1d5e4be, ftLastAccessTime.dwLowDateTime=0x9ca4ee20, ftLastAccessTime.dwHighDateTime=0x1d5e40d, ftLastWriteTime.dwLowDateTime=0x9ca4ee20, ftLastWriteTime.dwHighDateTime=0x1d5e40d, nFileSizeHigh=0x0, nFileSizeLow=0x3347, dwReserved0=0x0, dwReserved1=0x0, cFileName="s8O40VOQJ_Qf-hBfIY.png", cAlternateFileName="S8O40V~1.PNG")) returned 1 [0106.540] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33deea70, ftCreationTime.dwHighDateTime=0x1d5eaa8, ftLastAccessTime.dwLowDateTime=0x5e2a0880, ftLastAccessTime.dwHighDateTime=0x1d5eab9, ftLastWriteTime.dwLowDateTime=0x5e2a0880, ftLastWriteTime.dwHighDateTime=0x1d5eab9, nFileSizeHigh=0x0, nFileSizeLow=0x3640, dwReserved0=0x0, dwReserved1=0x0, cFileName="V92B-iZNhN.png", cAlternateFileName="V92B-I~1.PNG")) returned 1 [0106.540] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd51a7f40, ftCreationTime.dwHighDateTime=0x1d5e9df, ftLastAccessTime.dwLowDateTime=0x891b9a70, ftLastAccessTime.dwHighDateTime=0x1d5e511, ftLastWriteTime.dwLowDateTime=0x891b9a70, ftLastWriteTime.dwHighDateTime=0x1d5e511, nFileSizeHigh=0x0, nFileSizeLow=0x2da9, dwReserved0=0x0, dwReserved1=0x0, cFileName="wD1uq4FVnLSeN.gif", cAlternateFileName="WD1UQ4~1.GIF")) returned 1 [0106.540] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd51a7f40, ftCreationTime.dwHighDateTime=0x1d5e9df, ftLastAccessTime.dwLowDateTime=0x891b9a70, ftLastAccessTime.dwHighDateTime=0x1d5e511, ftLastWriteTime.dwLowDateTime=0x891b9a70, ftLastWriteTime.dwHighDateTime=0x1d5e511, nFileSizeHigh=0x0, nFileSizeLow=0x2da9, dwReserved0=0x0, dwReserved1=0x0, cFileName="wD1uq4FVnLSeN.gif", cAlternateFileName="WD1UQ4~1.GIF")) returned 0 [0106.540] FindClose (in: hFindFile=0x104deb0 | out: hFindFile=0x104deb0) returned 1 [0106.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb50) returned 1 [0106.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb5c) returned 1 [0106.541] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\D6OUDRvTgb.bmp", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\D6OUDRvTgb.bmp", lpFilePart=0x0) returned 0x2e [0106.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0106.541] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\D6OUDRvTgb.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\d6oudrvtgb.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0106.541] GetFileType (hFile=0x2e4) returned 0x1 [0106.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0106.541] GetFileType (hFile=0x2e4) returned 0x1 [0106.541] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0xe808 [0106.541] ReadFile (in: hFile=0x2e4, lpBuffer=0x3068be4, nNumberOfBytesToRead=0xe808, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x3068be4*, lpNumberOfBytesRead=0xefeae8*=0xe808, lpOverlapped=0x0) returned 1 [0106.543] CloseHandle (hObject=0x2e4) returned 1 [0106.625] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0106.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0106.626] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0106.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0106.626] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\D6OUDRvTgb.bmp", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\D6OUDRvTgb.bmp", lpFilePart=0x0) returned 0x2e [0106.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0106.626] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\D6OUDRvTgb.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\d6oudrvtgb.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0106.628] GetFileType (hFile=0x2e4) returned 0x1 [0106.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0106.628] GetFileType (hFile=0x2e4) returned 0x1 [0106.628] WriteFile (in: hFile=0x2e4, lpBuffer=0x2ee14c8*, nNumberOfBytesToWrite=0xe810, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x2ee14c8*, lpNumberOfBytesWritten=0xefeadc*=0xe810, lpOverlapped=0x0) returned 1 [0106.631] CloseHandle (hObject=0x2e4) returned 1 [0106.633] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\D6OUDRvTgb.bmp", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\D6OUDRvTgb.bmp", lpFilePart=0x0) returned 0x2e [0106.633] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\D6OUDRvTgb.bmp.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\D6OUDRvTgb.bmp.UGMH", lpFilePart=0x0) returned 0x33 [0106.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0106.633] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\D6OUDRvTgb.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\d6oudrvtgb.bmp"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e5ef000, ftCreationTime.dwHighDateTime=0x1d5e408, ftLastAccessTime.dwLowDateTime=0xf62f18f0, ftLastAccessTime.dwHighDateTime=0x1d5efd2, ftLastWriteTime.dwLowDateTime=0xd5a7a02e, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xe810)) returned 1 [0106.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0106.634] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\D6OUDRvTgb.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\d6oudrvtgb.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\D6OUDRvTgb.bmp.UGMH" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\d6oudrvtgb.bmp.ugmh")) returned 1 [0106.634] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\i8b9f.png", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\i8b9f.png", lpFilePart=0x0) returned 0x29 [0106.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0106.635] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\i8b9f.png" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\i8b9f.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0106.635] GetFileType (hFile=0x2e4) returned 0x1 [0106.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0106.635] GetFileType (hFile=0x2e4) returned 0x1 [0106.635] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0xb9f7 [0106.635] ReadFile (in: hFile=0x2e4, lpBuffer=0x2ef0124, nNumberOfBytesToRead=0xb9f7, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x2ef0124*, lpNumberOfBytesRead=0xefeae8*=0xb9f7, lpOverlapped=0x0) returned 1 [0106.636] CloseHandle (hObject=0x2e4) returned 1 [0106.744] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0106.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0106.744] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0106.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0106.744] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\i8b9f.png", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\i8b9f.png", lpFilePart=0x0) returned 0x29 [0106.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0106.745] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\i8b9f.png" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\i8b9f.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0106.746] GetFileType (hFile=0x2e4) returned 0x1 [0106.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0106.746] GetFileType (hFile=0x2e4) returned 0x1 [0106.746] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f5fe7c*, nNumberOfBytesToWrite=0xba00, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x2f5fe7c*, lpNumberOfBytesWritten=0xefeadc*=0xba00, lpOverlapped=0x0) returned 1 [0106.749] CloseHandle (hObject=0x2e4) returned 1 [0106.751] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\i8b9f.png", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\i8b9f.png", lpFilePart=0x0) returned 0x29 [0106.751] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\i8b9f.png.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\i8b9f.png.UGMH", lpFilePart=0x0) returned 0x2e [0106.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0106.751] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\i8b9f.png" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\i8b9f.png"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc35f12d0, ftCreationTime.dwHighDateTime=0x1d5e506, ftLastAccessTime.dwLowDateTime=0xebf1da0, ftLastAccessTime.dwHighDateTime=0x1d5ee09, ftLastWriteTime.dwLowDateTime=0xd5bab28a, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xba00)) returned 1 [0106.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0106.751] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\i8b9f.png" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\i8b9f.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\i8b9f.png.UGMH" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\i8b9f.png.ugmh")) returned 1 [0106.752] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\pCa06Rdzr0.png", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\pCa06Rdzr0.png", lpFilePart=0x0) returned 0x2e [0106.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0106.752] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\pCa06Rdzr0.png" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\pca06rdzr0.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0106.752] GetFileType (hFile=0x2e4) returned 0x1 [0106.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0106.753] GetFileType (hFile=0x2e4) returned 0x1 [0106.753] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0x57ce [0106.753] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f6bc94, nNumberOfBytesToRead=0x57ce, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x2f6bc94*, lpNumberOfBytesRead=0xefeae8*=0x57ce, lpOverlapped=0x0) returned 1 [0106.754] CloseHandle (hObject=0x2e4) returned 1 [0106.844] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0106.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0106.844] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0106.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0106.844] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\pCa06Rdzr0.png", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\pCa06Rdzr0.png", lpFilePart=0x0) returned 0x2e [0106.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0106.844] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\pCa06Rdzr0.png" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\pca06rdzr0.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0106.846] GetFileType (hFile=0x2e4) returned 0x1 [0106.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0106.846] GetFileType (hFile=0x2e4) returned 0x1 [0106.846] WriteFile (in: hFile=0x2e4, lpBuffer=0x2fd418c*, nNumberOfBytesToWrite=0x57d0, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x2fd418c*, lpNumberOfBytesWritten=0xefeadc*=0x57d0, lpOverlapped=0x0) returned 1 [0106.847] CloseHandle (hObject=0x2e4) returned 1 [0106.850] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\pCa06Rdzr0.png", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\pCa06Rdzr0.png", lpFilePart=0x0) returned 0x2e [0106.850] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\pCa06Rdzr0.png.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\pCa06Rdzr0.png.UGMH", lpFilePart=0x0) returned 0x33 [0106.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0106.850] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\pCa06Rdzr0.png" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\pca06rdzr0.png"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d665c40, ftCreationTime.dwHighDateTime=0x1d5ed50, ftLastAccessTime.dwLowDateTime=0x8e0156c0, ftLastAccessTime.dwHighDateTime=0x1d5e68c, ftLastWriteTime.dwLowDateTime=0xd5c90106, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x57d0)) returned 1 [0106.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0106.850] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\pCa06Rdzr0.png" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\pca06rdzr0.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\pCa06Rdzr0.png.UGMH" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\pca06rdzr0.png.ugmh")) returned 1 [0106.851] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\qjcs8zuSx.jpg", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\qjcs8zuSx.jpg", lpFilePart=0x0) returned 0x2d [0106.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0106.851] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\qjcs8zuSx.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\qjcs8zusx.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0106.851] GetFileType (hFile=0x2e4) returned 0x1 [0106.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0106.851] GetFileType (hFile=0x2e4) returned 0x1 [0106.852] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0x1d33 [0106.852] ReadFile (in: hFile=0x2e4, lpBuffer=0x2fd9db8, nNumberOfBytesToRead=0x1d33, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x2fd9db8*, lpNumberOfBytesRead=0xefeae8*=0x1d33, lpOverlapped=0x0) returned 1 [0106.853] CloseHandle (hObject=0x2e4) returned 1 [0106.877] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0106.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0106.877] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0106.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0106.877] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\qjcs8zuSx.jpg", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\qjcs8zuSx.jpg", lpFilePart=0x0) returned 0x2d [0106.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0106.877] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\qjcs8zuSx.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\qjcs8zusx.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0106.879] GetFileType (hFile=0x2e4) returned 0x1 [0106.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0106.879] GetFileType (hFile=0x2e4) returned 0x1 [0106.879] WriteFile (in: hFile=0x2e4, lpBuffer=0x302fde0*, nNumberOfBytesToWrite=0x1d40, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x302fde0*, lpNumberOfBytesWritten=0xefeadc*=0x1d40, lpOverlapped=0x0) returned 1 [0106.880] CloseHandle (hObject=0x2e4) returned 1 [0106.884] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\qjcs8zuSx.jpg", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\qjcs8zuSx.jpg", lpFilePart=0x0) returned 0x2d [0106.884] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\qjcs8zuSx.jpg.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\qjcs8zuSx.jpg.UGMH", lpFilePart=0x0) returned 0x32 [0106.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0106.884] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\qjcs8zuSx.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\qjcs8zusx.jpg"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad72c4e0, ftCreationTime.dwHighDateTime=0x1d5ed89, ftLastAccessTime.dwLowDateTime=0xfd9c9900, ftLastAccessTime.dwHighDateTime=0x1d5e6c2, ftLastWriteTime.dwLowDateTime=0xd5cdc605, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x1d40)) returned 1 [0106.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0106.885] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\qjcs8zuSx.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\qjcs8zusx.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\qjcs8zuSx.jpg.UGMH" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\qjcs8zusx.jpg.ugmh")) returned 1 [0106.885] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\RjNASMUryXOapBb74Vr.png", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\RjNASMUryXOapBb74Vr.png", lpFilePart=0x0) returned 0x37 [0106.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0106.886] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\RjNASMUryXOapBb74Vr.png" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\rjnasmuryxoapbb74vr.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0106.886] GetFileType (hFile=0x2e4) returned 0x1 [0106.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0106.886] GetFileType (hFile=0x2e4) returned 0x1 [0106.886] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0x7986 [0106.886] ReadFile (in: hFile=0x2e4, lpBuffer=0x3031f80, nNumberOfBytesToRead=0x7986, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x3031f80*, lpNumberOfBytesRead=0xefeae8*=0x7986, lpOverlapped=0x0) returned 1 [0106.887] CloseHandle (hObject=0x2e4) returned 1 [0106.980] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0106.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0106.980] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0106.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0106.980] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\RjNASMUryXOapBb74Vr.png", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\RjNASMUryXOapBb74Vr.png", lpFilePart=0x0) returned 0x37 [0106.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0106.980] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\RjNASMUryXOapBb74Vr.png" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\rjnasmuryxoapbb74vr.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0106.982] GetFileType (hFile=0x2e4) returned 0x1 [0106.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0106.983] GetFileType (hFile=0x2e4) returned 0x1 [0106.983] WriteFile (in: hFile=0x2e4, lpBuffer=0x2e9dec8*, nNumberOfBytesToWrite=0x7990, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x2e9dec8*, lpNumberOfBytesWritten=0xefeadc*=0x7990, lpOverlapped=0x0) returned 1 [0106.984] CloseHandle (hObject=0x2e4) returned 1 [0106.986] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\RjNASMUryXOapBb74Vr.png", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\RjNASMUryXOapBb74Vr.png", lpFilePart=0x0) returned 0x37 [0106.986] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\RjNASMUryXOapBb74Vr.png.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\RjNASMUryXOapBb74Vr.png.UGMH", lpFilePart=0x0) returned 0x3c [0106.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0106.987] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\RjNASMUryXOapBb74Vr.png" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\rjnasmuryxoapbb74vr.png"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb17eb430, ftCreationTime.dwHighDateTime=0x1d5e128, ftLastAccessTime.dwLowDateTime=0xf961cec0, ftLastAccessTime.dwHighDateTime=0x1d5eb52, ftLastWriteTime.dwLowDateTime=0xd5de7655, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x7990)) returned 1 [0106.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0106.987] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\RjNASMUryXOapBb74Vr.png" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\rjnasmuryxoapbb74vr.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\RjNASMUryXOapBb74Vr.png.UGMH" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\rjnasmuryxoapbb74vr.png.ugmh")) returned 1 [0106.988] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\s8O40VOQJ_Qf-hBfIY.png", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\s8O40VOQJ_Qf-hBfIY.png", lpFilePart=0x0) returned 0x36 [0106.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0106.988] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\s8O40VOQJ_Qf-hBfIY.png" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\s8o40voqj_qf-hbfiy.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0106.988] GetFileType (hFile=0x2e4) returned 0x1 [0106.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0106.988] GetFileType (hFile=0x2e4) returned 0x1 [0106.988] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0x3347 [0106.988] ReadFile (in: hFile=0x2e4, lpBuffer=0x2ea5d1c, nNumberOfBytesToRead=0x3347, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x2ea5d1c*, lpNumberOfBytesRead=0xefeae8*=0x3347, lpOverlapped=0x0) returned 1 [0106.989] CloseHandle (hObject=0x2e4) returned 1 [0107.123] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0107.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0107.123] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0107.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0107.123] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\s8O40VOQJ_Qf-hBfIY.png", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\s8O40VOQJ_Qf-hBfIY.png", lpFilePart=0x0) returned 0x36 [0107.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0107.124] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\s8O40VOQJ_Qf-hBfIY.png" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\s8o40voqj_qf-hbfiy.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0107.125] GetFileType (hFile=0x2e4) returned 0x1 [0107.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0107.125] GetFileType (hFile=0x2e4) returned 0x1 [0107.125] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f02cf0*, nNumberOfBytesToWrite=0x3350, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x2f02cf0*, lpNumberOfBytesWritten=0xefeadc*=0x3350, lpOverlapped=0x0) returned 1 [0107.127] CloseHandle (hObject=0x2e4) returned 1 [0107.128] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\s8O40VOQJ_Qf-hBfIY.png", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\s8O40VOQJ_Qf-hBfIY.png", lpFilePart=0x0) returned 0x36 [0107.128] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\s8O40VOQJ_Qf-hBfIY.png.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\s8O40VOQJ_Qf-hBfIY.png.UGMH", lpFilePart=0x0) returned 0x3b [0107.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0107.129] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\s8O40VOQJ_Qf-hBfIY.png" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\s8o40voqj_qf-hbfiy.png"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4bd390, ftCreationTime.dwHighDateTime=0x1d5e4be, ftLastAccessTime.dwLowDateTime=0x9ca4ee20, ftLastAccessTime.dwHighDateTime=0x1d5e40d, ftLastWriteTime.dwLowDateTime=0xd5f3ebaa, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x3350)) returned 1 [0107.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0107.129] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\s8O40VOQJ_Qf-hBfIY.png" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\s8o40voqj_qf-hbfiy.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\s8O40VOQJ_Qf-hBfIY.png.UGMH" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\s8o40voqj_qf-hbfiy.png.ugmh")) returned 1 [0107.130] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\V92B-iZNhN.png", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\V92B-iZNhN.png", lpFilePart=0x0) returned 0x2e [0107.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0107.130] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\V92B-iZNhN.png" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\v92b-iznhn.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0107.130] GetFileType (hFile=0x2e4) returned 0x1 [0107.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0107.130] GetFileType (hFile=0x2e4) returned 0x1 [0107.130] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0x3640 [0107.130] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f064dc, nNumberOfBytesToRead=0x3640, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x2f064dc*, lpNumberOfBytesRead=0xefeae8*=0x3640, lpOverlapped=0x0) returned 1 [0107.131] CloseHandle (hObject=0x2e4) returned 1 [0107.213] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0107.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0107.213] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0107.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0107.213] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\V92B-iZNhN.png", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\V92B-iZNhN.png", lpFilePart=0x0) returned 0x2e [0107.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0107.213] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\V92B-iZNhN.png" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\v92b-iznhn.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0107.215] GetFileType (hFile=0x2e4) returned 0x1 [0107.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0107.215] GetFileType (hFile=0x2e4) returned 0x1 [0107.215] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f64250*, nNumberOfBytesToWrite=0x3650, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x2f64250*, lpNumberOfBytesWritten=0xefeadc*=0x3650, lpOverlapped=0x0) returned 1 [0107.217] CloseHandle (hObject=0x2e4) returned 1 [0107.219] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\V92B-iZNhN.png", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\V92B-iZNhN.png", lpFilePart=0x0) returned 0x2e [0107.219] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\V92B-iZNhN.png.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\V92B-iZNhN.png.UGMH", lpFilePart=0x0) returned 0x33 [0107.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0107.220] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\V92B-iZNhN.png" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\v92b-iznhn.png"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33deea70, ftCreationTime.dwHighDateTime=0x1d5eaa8, ftLastAccessTime.dwLowDateTime=0x5e2a0880, ftLastAccessTime.dwHighDateTime=0x1d5eab9, ftLastWriteTime.dwLowDateTime=0xd60238f7, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x3650)) returned 1 [0107.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0107.220] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\V92B-iZNhN.png" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\v92b-iznhn.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Jxc7y0\\V92B-iZNhN.png.UGMH" (normalized: "c:\\users\\fd1hvy\\pictures\\jxc7y0\\v92b-iznhn.png.ugmh")) returned 1 [0107.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb94) returned 1 [0107.221] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", nBufferLength=0x105, lpBuffer=0xefe648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", lpFilePart=0x0) returned 0x27 [0107.221] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*", lpFindFileData=0xefe8bc | out: lpFindFileData=0xefe8bc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104e2f0 [0107.222] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.222] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0107.222] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0107.222] FindClose (in: hFindFile=0x104e2f0 | out: hFindFile=0x104e2f0) returned 1 [0107.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb50) returned 1 [0107.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb5c) returned 1 [0107.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb94) returned 1 [0107.223] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", nBufferLength=0x105, lpBuffer=0xefe648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", lpFilePart=0x0) returned 0x27 [0107.223] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*", lpFindFileData=0xefe8bc | out: lpFindFileData=0xefe8bc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104e4b0 [0107.223] FindNextFileW (in: hFindFile=0x104e4b0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.223] FindNextFileW (in: hFindFile=0x104e4b0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0107.224] FindNextFileW (in: hFindFile=0x104e4b0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0107.224] FindClose (in: hFindFile=0x104e4b0 | out: hFindFile=0x104e4b0) returned 1 [0107.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb50) returned 1 [0107.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb5c) returned 1 [0107.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec08) returned 1 [0107.224] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music", nBufferLength=0x105, lpBuffer=0xefe6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music", lpFilePart=0x0) returned 0x15 [0107.224] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\*", lpFindFileData=0xefe930 | out: lpFindFileData=0xefe930*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe60594d7, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe60594d7, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104df30 [0107.224] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe60594d7, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe60594d7, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.225] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa792abd0, ftCreationTime.dwHighDateTime=0x1d5e1c2, ftLastAccessTime.dwLowDateTime=0xf2ee7cc0, ftLastAccessTime.dwHighDateTime=0x1d5e475, ftLastWriteTime.dwLowDateTime=0xf2ee7cc0, ftLastWriteTime.dwHighDateTime=0x1d5e475, nFileSizeHigh=0x0, nFileSizeLow=0x12897, dwReserved0=0x0, dwReserved1=0x0, cFileName="-H eaU6f.mp3", cAlternateFileName="-HEAU6~1.MP3")) returned 1 [0107.225] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723815b0, ftCreationTime.dwHighDateTime=0x1d5ed5c, ftLastAccessTime.dwLowDateTime=0xeb4b9200, ftLastAccessTime.dwHighDateTime=0x1d5edcb, ftLastWriteTime.dwLowDateTime=0xeb4b9200, ftLastWriteTime.dwHighDateTime=0x1d5edcb, nFileSizeHigh=0x0, nFileSizeLow=0x1330f, dwReserved0=0x0, dwReserved1=0x0, cFileName="2I4jII cw28e6za.m4a", cAlternateFileName="2I4JII~1.M4A")) returned 1 [0107.225] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4409f518, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4409f518, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0107.225] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32db6340, ftCreationTime.dwHighDateTime=0x1d5e3fc, ftLastAccessTime.dwLowDateTime=0xf54cb20, ftLastAccessTime.dwHighDateTime=0x1d5e6fc, ftLastWriteTime.dwLowDateTime=0xf54cb20, ftLastWriteTime.dwHighDateTime=0x1d5e6fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="F3HJ", cAlternateFileName="")) returned 1 [0107.225] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9541470, ftCreationTime.dwHighDateTime=0x1d5e4b4, ftLastAccessTime.dwLowDateTime=0x8cac7310, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x8cac7310, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LePxLflso 1buBvQm K", cAlternateFileName="LEPXLF~1")) returned 1 [0107.225] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9953f8e0, ftCreationTime.dwHighDateTime=0x1d5ee96, ftLastAccessTime.dwLowDateTime=0x6c5f0f80, ftLastAccessTime.dwHighDateTime=0x1d5ed30, ftLastWriteTime.dwLowDateTime=0x6c5f0f80, ftLastWriteTime.dwHighDateTime=0x1d5ed30, nFileSizeHigh=0x0, nFileSizeLow=0x1802, dwReserved0=0x0, dwReserved1=0x0, cFileName="pDdn3on3G_2s9DFz3.mp3", cAlternateFileName="PDDN3O~1.MP3")) returned 1 [0107.226] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0107.226] FindClose (in: hFindFile=0x104df30 | out: hFindFile=0x104df30) returned 1 [0107.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebc4) returned 1 [0107.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebd0) returned 1 [0107.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec08) returned 1 [0107.226] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music", nBufferLength=0x105, lpBuffer=0xefe6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music", lpFilePart=0x0) returned 0x15 [0107.226] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\*", lpFindFileData=0xefe930 | out: lpFindFileData=0xefe930*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe60594d7, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe60594d7, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104df30 [0107.226] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe60594d7, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe60594d7, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.227] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa792abd0, ftCreationTime.dwHighDateTime=0x1d5e1c2, ftLastAccessTime.dwLowDateTime=0xf2ee7cc0, ftLastAccessTime.dwHighDateTime=0x1d5e475, ftLastWriteTime.dwLowDateTime=0xf2ee7cc0, ftLastWriteTime.dwHighDateTime=0x1d5e475, nFileSizeHigh=0x0, nFileSizeLow=0x12897, dwReserved0=0x0, dwReserved1=0x0, cFileName="-H eaU6f.mp3", cAlternateFileName="-HEAU6~1.MP3")) returned 1 [0107.227] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723815b0, ftCreationTime.dwHighDateTime=0x1d5ed5c, ftLastAccessTime.dwLowDateTime=0xeb4b9200, ftLastAccessTime.dwHighDateTime=0x1d5edcb, ftLastWriteTime.dwLowDateTime=0xeb4b9200, ftLastWriteTime.dwHighDateTime=0x1d5edcb, nFileSizeHigh=0x0, nFileSizeLow=0x1330f, dwReserved0=0x0, dwReserved1=0x0, cFileName="2I4jII cw28e6za.m4a", cAlternateFileName="2I4JII~1.M4A")) returned 1 [0107.227] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4409f518, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4409f518, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0107.227] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32db6340, ftCreationTime.dwHighDateTime=0x1d5e3fc, ftLastAccessTime.dwLowDateTime=0xf54cb20, ftLastAccessTime.dwHighDateTime=0x1d5e6fc, ftLastWriteTime.dwLowDateTime=0xf54cb20, ftLastWriteTime.dwHighDateTime=0x1d5e6fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="F3HJ", cAlternateFileName="")) returned 1 [0107.227] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9541470, ftCreationTime.dwHighDateTime=0x1d5e4b4, ftLastAccessTime.dwLowDateTime=0x8cac7310, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x8cac7310, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LePxLflso 1buBvQm K", cAlternateFileName="LEPXLF~1")) returned 1 [0107.228] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9953f8e0, ftCreationTime.dwHighDateTime=0x1d5ee96, ftLastAccessTime.dwLowDateTime=0x6c5f0f80, ftLastAccessTime.dwHighDateTime=0x1d5ed30, ftLastWriteTime.dwLowDateTime=0x6c5f0f80, ftLastWriteTime.dwHighDateTime=0x1d5ed30, nFileSizeHigh=0x0, nFileSizeLow=0x1802, dwReserved0=0x0, dwReserved1=0x0, cFileName="pDdn3on3G_2s9DFz3.mp3", cAlternateFileName="PDDN3O~1.MP3")) returned 1 [0107.228] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9953f8e0, ftCreationTime.dwHighDateTime=0x1d5ee96, ftLastAccessTime.dwLowDateTime=0x6c5f0f80, ftLastAccessTime.dwHighDateTime=0x1d5ed30, ftLastWriteTime.dwLowDateTime=0x6c5f0f80, ftLastWriteTime.dwHighDateTime=0x1d5ed30, nFileSizeHigh=0x0, nFileSizeLow=0x1802, dwReserved0=0x0, dwReserved1=0x0, cFileName="pDdn3on3G_2s9DFz3.mp3", cAlternateFileName="PDDN3O~1.MP3")) returned 0 [0107.228] FindClose (in: hFindFile=0x104df30 | out: hFindFile=0x104df30) returned 1 [0107.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebc4) returned 1 [0107.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebd0) returned 1 [0107.228] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\-H eaU6f.mp3", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\-H eaU6f.mp3", lpFilePart=0x0) returned 0x22 [0107.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0107.228] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-H eaU6f.mp3" (normalized: "c:\\users\\fd1hvy\\music\\-h eau6f.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0107.229] GetFileType (hFile=0x2e4) returned 0x1 [0107.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0107.229] GetFileType (hFile=0x2e4) returned 0x1 [0107.229] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x12897 [0107.229] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f6a470, nNumberOfBytesToRead=0x12897, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a470*, lpNumberOfBytesRead=0xefeb5c*=0x12897, lpOverlapped=0x0) returned 1 [0107.230] CloseHandle (hObject=0x2e4) returned 1 [0107.270] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0107.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0107.270] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0107.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0107.270] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\-H eaU6f.mp3", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\-H eaU6f.mp3", lpFilePart=0x0) returned 0x22 [0107.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0107.271] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-H eaU6f.mp3" (normalized: "c:\\users\\fd1hvy\\music\\-h eau6f.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0107.273] GetFileType (hFile=0x2e4) returned 0x1 [0107.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0107.273] GetFileType (hFile=0x2e4) returned 0x1 [0107.273] WriteFile (in: hFile=0x2e4, lpBuffer=0x2feec4c*, nNumberOfBytesToWrite=0x128a0, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2feec4c*, lpNumberOfBytesWritten=0xefeb50*=0x128a0, lpOverlapped=0x0) returned 1 [0107.276] CloseHandle (hObject=0x2e4) returned 1 [0107.279] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\-H eaU6f.mp3", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\-H eaU6f.mp3", lpFilePart=0x0) returned 0x22 [0107.280] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\-H eaU6f.mp3.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\-H eaU6f.mp3.UGMH", lpFilePart=0x0) returned 0x27 [0107.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0107.280] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\-H eaU6f.mp3" (normalized: "c:\\users\\fd1hvy\\music\\-h eau6f.mp3"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa792abd0, ftCreationTime.dwHighDateTime=0x1d5e1c2, ftLastAccessTime.dwLowDateTime=0xf2ee7cc0, ftLastAccessTime.dwHighDateTime=0x1d5e475, ftLastWriteTime.dwLowDateTime=0xd60bd7b5, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x128a0)) returned 1 [0107.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0107.280] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\-H eaU6f.mp3" (normalized: "c:\\users\\fd1hvy\\music\\-h eau6f.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\-H eaU6f.mp3.UGMH" (normalized: "c:\\users\\fd1hvy\\music\\-h eau6f.mp3.ugmh")) returned 1 [0107.281] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\pDdn3on3G_2s9DFz3.mp3", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\pDdn3on3G_2s9DFz3.mp3", lpFilePart=0x0) returned 0x2b [0107.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0107.281] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\pDdn3on3G_2s9DFz3.mp3" (normalized: "c:\\users\\fd1hvy\\music\\pddn3on3g_2s9dfz3.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0107.281] GetFileType (hFile=0x2e4) returned 0x1 [0107.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0107.281] GetFileType (hFile=0x2e4) returned 0x1 [0107.281] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x1802 [0107.281] ReadFile (in: hFile=0x2e4, lpBuffer=0x3001908, nNumberOfBytesToRead=0x1802, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x3001908*, lpNumberOfBytesRead=0xefeb5c*=0x1802, lpOverlapped=0x0) returned 1 [0107.282] CloseHandle (hObject=0x2e4) returned 1 [0107.378] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0107.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0107.378] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0107.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0107.378] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\pDdn3on3G_2s9DFz3.mp3", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\pDdn3on3G_2s9DFz3.mp3", lpFilePart=0x0) returned 0x2b [0107.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0107.378] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\pDdn3on3G_2s9DFz3.mp3" (normalized: "c:\\users\\fd1hvy\\music\\pddn3on3g_2s9dfz3.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0107.380] GetFileType (hFile=0x2e4) returned 0x1 [0107.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0107.380] GetFileType (hFile=0x2e4) returned 0x1 [0107.380] WriteFile (in: hFile=0x2e4, lpBuffer=0x3055f40*, nNumberOfBytesToWrite=0x1810, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x3055f40*, lpNumberOfBytesWritten=0xefeb50*=0x1810, lpOverlapped=0x0) returned 1 [0107.381] CloseHandle (hObject=0x2e4) returned 1 [0107.382] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\pDdn3on3G_2s9DFz3.mp3", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\pDdn3on3G_2s9DFz3.mp3", lpFilePart=0x0) returned 0x2b [0107.383] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\pDdn3on3G_2s9DFz3.mp3.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\pDdn3on3G_2s9DFz3.mp3.UGMH", lpFilePart=0x0) returned 0x30 [0107.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0107.383] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\pDdn3on3G_2s9DFz3.mp3" (normalized: "c:\\users\\fd1hvy\\music\\pddn3on3g_2s9dfz3.mp3"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9953f8e0, ftCreationTime.dwHighDateTime=0x1d5ee96, ftLastAccessTime.dwLowDateTime=0x6c5f0f80, ftLastAccessTime.dwHighDateTime=0x1d5ed30, ftLastWriteTime.dwLowDateTime=0xd61a0f94, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x1810)) returned 1 [0107.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0107.383] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\pDdn3on3G_2s9DFz3.mp3" (normalized: "c:\\users\\fd1hvy\\music\\pddn3on3g_2s9dfz3.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\pDdn3on3G_2s9DFz3.mp3.UGMH" (normalized: "c:\\users\\fd1hvy\\music\\pddn3on3g_2s9dfz3.mp3.ugmh")) returned 1 [0107.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb94) returned 1 [0107.384] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ", nBufferLength=0x105, lpBuffer=0xefe648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\F3HJ", lpFilePart=0x0) returned 0x1a [0107.384] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\*", lpFindFileData=0xefe8bc | out: lpFindFileData=0xefe8bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32db6340, ftCreationTime.dwHighDateTime=0x1d5e3fc, ftLastAccessTime.dwLowDateTime=0xf54cb20, ftLastAccessTime.dwHighDateTime=0x1d5e6fc, ftLastWriteTime.dwLowDateTime=0xf54cb20, ftLastWriteTime.dwHighDateTime=0x1d5e6fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104dff0 [0107.384] FindNextFileW (in: hFindFile=0x104dff0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32db6340, ftCreationTime.dwHighDateTime=0x1d5e3fc, ftLastAccessTime.dwLowDateTime=0xf54cb20, ftLastAccessTime.dwHighDateTime=0x1d5e6fc, ftLastWriteTime.dwLowDateTime=0xf54cb20, ftLastWriteTime.dwHighDateTime=0x1d5e6fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.385] FindNextFileW (in: hFindFile=0x104dff0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15f68fe0, ftCreationTime.dwHighDateTime=0x1d5e8e6, ftLastAccessTime.dwLowDateTime=0x76623050, ftLastAccessTime.dwHighDateTime=0x1d5e98b, ftLastWriteTime.dwLowDateTime=0x76623050, ftLastWriteTime.dwHighDateTime=0x1d5e98b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9F_Hvoyl", cAlternateFileName="")) returned 1 [0107.385] FindNextFileW (in: hFindFile=0x104dff0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ab33f0, ftCreationTime.dwHighDateTime=0x1d5ec0d, ftLastAccessTime.dwLowDateTime=0x8569d0, ftLastAccessTime.dwHighDateTime=0x1d5ebe1, ftLastWriteTime.dwLowDateTime=0x8569d0, ftLastWriteTime.dwHighDateTime=0x1d5ebe1, nFileSizeHigh=0x0, nFileSizeLow=0x1b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="DHC6ulV_H-A.m4a", cAlternateFileName="DHC6UL~1.M4A")) returned 1 [0107.385] FindNextFileW (in: hFindFile=0x104dff0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86550b20, ftCreationTime.dwHighDateTime=0x1d5ec8a, ftLastAccessTime.dwLowDateTime=0x690b9d70, ftLastAccessTime.dwHighDateTime=0x1d5ee9e, ftLastWriteTime.dwLowDateTime=0x690b9d70, ftLastWriteTime.dwHighDateTime=0x1d5ee9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GhMaO25CyRMLjzks-X3f", cAlternateFileName="GHMAO2~1")) returned 1 [0107.385] FindNextFileW (in: hFindFile=0x104dff0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa9bb500, ftCreationTime.dwHighDateTime=0x1d5e2a4, ftLastAccessTime.dwLowDateTime=0x4b1e7420, ftLastAccessTime.dwHighDateTime=0x1d5e1a8, ftLastWriteTime.dwLowDateTime=0x4b1e7420, ftLastWriteTime.dwHighDateTime=0x1d5e1a8, nFileSizeHigh=0x0, nFileSizeLow=0x8e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="i-6hBfY4N.wav", cAlternateFileName="I-6HBF~1.WAV")) returned 1 [0107.385] FindNextFileW (in: hFindFile=0x104dff0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3df7740, ftCreationTime.dwHighDateTime=0x1d5e3b0, ftLastAccessTime.dwLowDateTime=0xcf45a800, ftLastAccessTime.dwHighDateTime=0x1d5e864, ftLastWriteTime.dwLowDateTime=0xcf45a800, ftLastWriteTime.dwHighDateTime=0x1d5e864, nFileSizeHigh=0x0, nFileSizeLow=0x10a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="nK lqN2FWkU.m4a", cAlternateFileName="NKLQN2~1.M4A")) returned 1 [0107.386] FindNextFileW (in: hFindFile=0x104dff0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6378060, ftCreationTime.dwHighDateTime=0x1d5ef63, ftLastAccessTime.dwLowDateTime=0xbd8d11c0, ftLastAccessTime.dwHighDateTime=0x1d5edff, ftLastWriteTime.dwLowDateTime=0xbd8d11c0, ftLastWriteTime.dwHighDateTime=0x1d5edff, nFileSizeHigh=0x0, nFileSizeLow=0xd1c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UjMo6G97Oll3hlaPAP9K.m4a", cAlternateFileName="UJMO6G~1.M4A")) returned 1 [0107.386] FindNextFileW (in: hFindFile=0x104dff0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28da26c0, ftCreationTime.dwHighDateTime=0x1d5e76b, ftLastAccessTime.dwLowDateTime=0xa501670, ftLastAccessTime.dwHighDateTime=0x1d5e684, ftLastWriteTime.dwLowDateTime=0xa501670, ftLastWriteTime.dwHighDateTime=0x1d5e684, nFileSizeHigh=0x0, nFileSizeLow=0x17492, dwReserved0=0x0, dwReserved1=0x0, cFileName="vkglhDdjIbfs32I6qo.m4a", cAlternateFileName="VKGLHD~1.M4A")) returned 1 [0107.386] FindNextFileW (in: hFindFile=0x104dff0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba56ac00, ftCreationTime.dwHighDateTime=0x1d5e224, ftLastAccessTime.dwLowDateTime=0xffecaa90, ftLastAccessTime.dwHighDateTime=0x1d5ef75, ftLastWriteTime.dwLowDateTime=0xffecaa90, ftLastWriteTime.dwHighDateTime=0x1d5ef75, nFileSizeHigh=0x0, nFileSizeLow=0x7dcb, dwReserved0=0x0, dwReserved1=0x0, cFileName="VVXwFsguq.mp3", cAlternateFileName="VVXWFS~1.MP3")) returned 1 [0107.386] FindNextFileW (in: hFindFile=0x104dff0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bc6410, ftCreationTime.dwHighDateTime=0x1d5edd3, ftLastAccessTime.dwLowDateTime=0x6896a970, ftLastAccessTime.dwHighDateTime=0x1d5e246, ftLastWriteTime.dwLowDateTime=0x6896a970, ftLastWriteTime.dwHighDateTime=0x1d5e246, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wpLSB1AzRr0C", cAlternateFileName="WPLSB1~1")) returned 1 [0107.386] FindNextFileW (in: hFindFile=0x104dff0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bc6410, ftCreationTime.dwHighDateTime=0x1d5edd3, ftLastAccessTime.dwLowDateTime=0x6896a970, ftLastAccessTime.dwHighDateTime=0x1d5e246, ftLastWriteTime.dwLowDateTime=0x6896a970, ftLastWriteTime.dwHighDateTime=0x1d5e246, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wpLSB1AzRr0C", cAlternateFileName="WPLSB1~1")) returned 0 [0107.387] FindClose (in: hFindFile=0x104dff0 | out: hFindFile=0x104dff0) returned 1 [0107.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb50) returned 1 [0107.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb5c) returned 1 [0107.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb94) returned 1 [0107.387] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ", nBufferLength=0x105, lpBuffer=0xefe648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\F3HJ", lpFilePart=0x0) returned 0x1a [0107.387] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\*", lpFindFileData=0xefe8bc | out: lpFindFileData=0xefe8bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32db6340, ftCreationTime.dwHighDateTime=0x1d5e3fc, ftLastAccessTime.dwLowDateTime=0xf54cb20, ftLastAccessTime.dwHighDateTime=0x1d5e6fc, ftLastWriteTime.dwLowDateTime=0xf54cb20, ftLastWriteTime.dwHighDateTime=0x1d5e6fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104df30 [0107.387] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32db6340, ftCreationTime.dwHighDateTime=0x1d5e3fc, ftLastAccessTime.dwLowDateTime=0xf54cb20, ftLastAccessTime.dwHighDateTime=0x1d5e6fc, ftLastWriteTime.dwLowDateTime=0xf54cb20, ftLastWriteTime.dwHighDateTime=0x1d5e6fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.387] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15f68fe0, ftCreationTime.dwHighDateTime=0x1d5e8e6, ftLastAccessTime.dwLowDateTime=0x76623050, ftLastAccessTime.dwHighDateTime=0x1d5e98b, ftLastWriteTime.dwLowDateTime=0x76623050, ftLastWriteTime.dwHighDateTime=0x1d5e98b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9F_Hvoyl", cAlternateFileName="")) returned 1 [0107.388] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ab33f0, ftCreationTime.dwHighDateTime=0x1d5ec0d, ftLastAccessTime.dwLowDateTime=0x8569d0, ftLastAccessTime.dwHighDateTime=0x1d5ebe1, ftLastWriteTime.dwLowDateTime=0x8569d0, ftLastWriteTime.dwHighDateTime=0x1d5ebe1, nFileSizeHigh=0x0, nFileSizeLow=0x1b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="DHC6ulV_H-A.m4a", cAlternateFileName="DHC6UL~1.M4A")) returned 1 [0107.389] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86550b20, ftCreationTime.dwHighDateTime=0x1d5ec8a, ftLastAccessTime.dwLowDateTime=0x690b9d70, ftLastAccessTime.dwHighDateTime=0x1d5ee9e, ftLastWriteTime.dwLowDateTime=0x690b9d70, ftLastWriteTime.dwHighDateTime=0x1d5ee9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GhMaO25CyRMLjzks-X3f", cAlternateFileName="GHMAO2~1")) returned 1 [0107.389] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa9bb500, ftCreationTime.dwHighDateTime=0x1d5e2a4, ftLastAccessTime.dwLowDateTime=0x4b1e7420, ftLastAccessTime.dwHighDateTime=0x1d5e1a8, ftLastWriteTime.dwLowDateTime=0x4b1e7420, ftLastWriteTime.dwHighDateTime=0x1d5e1a8, nFileSizeHigh=0x0, nFileSizeLow=0x8e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="i-6hBfY4N.wav", cAlternateFileName="I-6HBF~1.WAV")) returned 1 [0107.389] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3df7740, ftCreationTime.dwHighDateTime=0x1d5e3b0, ftLastAccessTime.dwLowDateTime=0xcf45a800, ftLastAccessTime.dwHighDateTime=0x1d5e864, ftLastWriteTime.dwLowDateTime=0xcf45a800, ftLastWriteTime.dwHighDateTime=0x1d5e864, nFileSizeHigh=0x0, nFileSizeLow=0x10a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="nK lqN2FWkU.m4a", cAlternateFileName="NKLQN2~1.M4A")) returned 1 [0107.389] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6378060, ftCreationTime.dwHighDateTime=0x1d5ef63, ftLastAccessTime.dwLowDateTime=0xbd8d11c0, ftLastAccessTime.dwHighDateTime=0x1d5edff, ftLastWriteTime.dwLowDateTime=0xbd8d11c0, ftLastWriteTime.dwHighDateTime=0x1d5edff, nFileSizeHigh=0x0, nFileSizeLow=0xd1c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UjMo6G97Oll3hlaPAP9K.m4a", cAlternateFileName="UJMO6G~1.M4A")) returned 1 [0107.389] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28da26c0, ftCreationTime.dwHighDateTime=0x1d5e76b, ftLastAccessTime.dwLowDateTime=0xa501670, ftLastAccessTime.dwHighDateTime=0x1d5e684, ftLastWriteTime.dwLowDateTime=0xa501670, ftLastWriteTime.dwHighDateTime=0x1d5e684, nFileSizeHigh=0x0, nFileSizeLow=0x17492, dwReserved0=0x0, dwReserved1=0x0, cFileName="vkglhDdjIbfs32I6qo.m4a", cAlternateFileName="VKGLHD~1.M4A")) returned 1 [0107.390] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba56ac00, ftCreationTime.dwHighDateTime=0x1d5e224, ftLastAccessTime.dwLowDateTime=0xffecaa90, ftLastAccessTime.dwHighDateTime=0x1d5ef75, ftLastWriteTime.dwLowDateTime=0xffecaa90, ftLastWriteTime.dwHighDateTime=0x1d5ef75, nFileSizeHigh=0x0, nFileSizeLow=0x7dcb, dwReserved0=0x0, dwReserved1=0x0, cFileName="VVXwFsguq.mp3", cAlternateFileName="VVXWFS~1.MP3")) returned 1 [0107.390] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bc6410, ftCreationTime.dwHighDateTime=0x1d5edd3, ftLastAccessTime.dwLowDateTime=0x6896a970, ftLastAccessTime.dwHighDateTime=0x1d5e246, ftLastWriteTime.dwLowDateTime=0x6896a970, ftLastWriteTime.dwHighDateTime=0x1d5e246, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wpLSB1AzRr0C", cAlternateFileName="WPLSB1~1")) returned 1 [0107.390] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0107.390] FindClose (in: hFindFile=0x104df30 | out: hFindFile=0x104df30) returned 1 [0107.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb50) returned 1 [0107.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb5c) returned 1 [0107.391] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\VVXwFsguq.mp3", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\F3HJ\\VVXwFsguq.mp3", lpFilePart=0x0) returned 0x28 [0107.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0107.391] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\VVXwFsguq.mp3" (normalized: "c:\\users\\fd1hvy\\music\\f3hj\\vvxwfsguq.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0107.391] GetFileType (hFile=0x2e4) returned 0x1 [0107.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0107.391] GetFileType (hFile=0x2e4) returned 0x1 [0107.391] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0x7dcb [0107.391] ReadFile (in: hFile=0x2e4, lpBuffer=0x3059ea0, nNumberOfBytesToRead=0x7dcb, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x3059ea0*, lpNumberOfBytesRead=0xefeae8*=0x7dcb, lpOverlapped=0x0) returned 1 [0107.393] CloseHandle (hObject=0x2e4) returned 1 [0107.481] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0107.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0107.482] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0107.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0107.482] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\VVXwFsguq.mp3", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\F3HJ\\VVXwFsguq.mp3", lpFilePart=0x0) returned 0x28 [0107.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0107.482] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\VVXwFsguq.mp3" (normalized: "c:\\users\\fd1hvy\\music\\f3hj\\vvxwfsguq.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0107.483] GetFileType (hFile=0x2e4) returned 0x1 [0107.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0107.483] GetFileType (hFile=0x2e4) returned 0x1 [0107.483] WriteFile (in: hFile=0x2e4, lpBuffer=0x2ece764*, nNumberOfBytesToWrite=0x7dd0, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x2ece764*, lpNumberOfBytesWritten=0xefeadc*=0x7dd0, lpOverlapped=0x0) returned 1 [0107.485] CloseHandle (hObject=0x2e4) returned 1 [0107.488] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\VVXwFsguq.mp3", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\F3HJ\\VVXwFsguq.mp3", lpFilePart=0x0) returned 0x28 [0107.488] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\VVXwFsguq.mp3.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\F3HJ\\VVXwFsguq.mp3.UGMH", lpFilePart=0x0) returned 0x2d [0107.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0107.488] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\VVXwFsguq.mp3" (normalized: "c:\\users\\fd1hvy\\music\\f3hj\\vvxwfsguq.mp3"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba56ac00, ftCreationTime.dwHighDateTime=0x1d5e224, ftLastAccessTime.dwLowDateTime=0xffecaa90, ftLastAccessTime.dwHighDateTime=0x1d5ef75, ftLastWriteTime.dwLowDateTime=0xd62b0cde, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x7dd0)) returned 1 [0107.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0107.488] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\VVXwFsguq.mp3" (normalized: "c:\\users\\fd1hvy\\music\\f3hj\\vvxwfsguq.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\VVXwFsguq.mp3.UGMH" (normalized: "c:\\users\\fd1hvy\\music\\f3hj\\vvxwfsguq.mp3.ugmh")) returned 1 [0107.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb20) returned 1 [0107.489] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\9F_Hvoyl", nBufferLength=0x105, lpBuffer=0xefe5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\F3HJ\\9F_Hvoyl", lpFilePart=0x0) returned 0x23 [0107.489] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\9F_Hvoyl\\*", lpFindFileData=0xefe848 | out: lpFindFileData=0xefe848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15f68fe0, ftCreationTime.dwHighDateTime=0x1d5e8e6, ftLastAccessTime.dwLowDateTime=0x76623050, ftLastAccessTime.dwHighDateTime=0x1d5e98b, ftLastWriteTime.dwLowDateTime=0x76623050, ftLastWriteTime.dwHighDateTime=0x1d5e98b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104e2f0 [0107.490] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15f68fe0, ftCreationTime.dwHighDateTime=0x1d5e8e6, ftLastAccessTime.dwLowDateTime=0x76623050, ftLastAccessTime.dwHighDateTime=0x1d5e98b, ftLastWriteTime.dwLowDateTime=0x76623050, ftLastWriteTime.dwHighDateTime=0x1d5e98b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.490] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf6c5880, ftCreationTime.dwHighDateTime=0x1d5e182, ftLastAccessTime.dwLowDateTime=0x5c354b70, ftLastAccessTime.dwHighDateTime=0x1d5e479, ftLastWriteTime.dwLowDateTime=0x5c354b70, ftLastWriteTime.dwHighDateTime=0x1d5e479, nFileSizeHigh=0x0, nFileSizeLow=0xcfbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="l5J8jlUGxEs0GnFtYh7.m4a", cAlternateFileName="L5J8JL~1.M4A")) returned 1 [0107.490] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1b17380, ftCreationTime.dwHighDateTime=0x1d5ed01, ftLastAccessTime.dwLowDateTime=0xfefd3860, ftLastAccessTime.dwHighDateTime=0x1d5e52b, ftLastWriteTime.dwLowDateTime=0xfefd3860, ftLastWriteTime.dwHighDateTime=0x1d5e52b, nFileSizeHigh=0x0, nFileSizeLow=0x186d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="q-iOeaRdT H6sQWLoLI.wav", cAlternateFileName="Q-IOEA~1.WAV")) returned 1 [0107.490] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53658210, ftCreationTime.dwHighDateTime=0x1d5e5cf, ftLastAccessTime.dwLowDateTime=0xb5b31c30, ftLastAccessTime.dwHighDateTime=0x1d5e182, ftLastWriteTime.dwLowDateTime=0xb5b31c30, ftLastWriteTime.dwHighDateTime=0x1d5e182, nFileSizeHigh=0x0, nFileSizeLow=0x99d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vNJbdDayL.m4a", cAlternateFileName="VNJBDD~1.M4A")) returned 1 [0107.490] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0107.490] FindClose (in: hFindFile=0x104e2f0 | out: hFindFile=0x104e2f0) returned 1 [0107.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeadc) returned 1 [0107.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeae8) returned 1 [0107.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb20) returned 1 [0107.491] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\9F_Hvoyl", nBufferLength=0x105, lpBuffer=0xefe5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\F3HJ\\9F_Hvoyl", lpFilePart=0x0) returned 0x23 [0107.491] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\9F_Hvoyl\\*", lpFindFileData=0xefe848 | out: lpFindFileData=0xefe848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15f68fe0, ftCreationTime.dwHighDateTime=0x1d5e8e6, ftLastAccessTime.dwLowDateTime=0x76623050, ftLastAccessTime.dwHighDateTime=0x1d5e98b, ftLastWriteTime.dwLowDateTime=0x76623050, ftLastWriteTime.dwHighDateTime=0x1d5e98b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104df30 [0107.491] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15f68fe0, ftCreationTime.dwHighDateTime=0x1d5e8e6, ftLastAccessTime.dwLowDateTime=0x76623050, ftLastAccessTime.dwHighDateTime=0x1d5e98b, ftLastWriteTime.dwLowDateTime=0x76623050, ftLastWriteTime.dwHighDateTime=0x1d5e98b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.491] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf6c5880, ftCreationTime.dwHighDateTime=0x1d5e182, ftLastAccessTime.dwLowDateTime=0x5c354b70, ftLastAccessTime.dwHighDateTime=0x1d5e479, ftLastWriteTime.dwLowDateTime=0x5c354b70, ftLastWriteTime.dwHighDateTime=0x1d5e479, nFileSizeHigh=0x0, nFileSizeLow=0xcfbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="l5J8jlUGxEs0GnFtYh7.m4a", cAlternateFileName="L5J8JL~1.M4A")) returned 1 [0107.491] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1b17380, ftCreationTime.dwHighDateTime=0x1d5ed01, ftLastAccessTime.dwLowDateTime=0xfefd3860, ftLastAccessTime.dwHighDateTime=0x1d5e52b, ftLastWriteTime.dwLowDateTime=0xfefd3860, ftLastWriteTime.dwHighDateTime=0x1d5e52b, nFileSizeHigh=0x0, nFileSizeLow=0x186d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="q-iOeaRdT H6sQWLoLI.wav", cAlternateFileName="Q-IOEA~1.WAV")) returned 1 [0107.491] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53658210, ftCreationTime.dwHighDateTime=0x1d5e5cf, ftLastAccessTime.dwLowDateTime=0xb5b31c30, ftLastAccessTime.dwHighDateTime=0x1d5e182, ftLastWriteTime.dwLowDateTime=0xb5b31c30, ftLastWriteTime.dwHighDateTime=0x1d5e182, nFileSizeHigh=0x0, nFileSizeLow=0x99d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vNJbdDayL.m4a", cAlternateFileName="VNJBDD~1.M4A")) returned 1 [0107.492] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53658210, ftCreationTime.dwHighDateTime=0x1d5e5cf, ftLastAccessTime.dwLowDateTime=0xb5b31c30, ftLastAccessTime.dwHighDateTime=0x1d5e182, ftLastWriteTime.dwLowDateTime=0xb5b31c30, ftLastWriteTime.dwHighDateTime=0x1d5e182, nFileSizeHigh=0x0, nFileSizeLow=0x99d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vNJbdDayL.m4a", cAlternateFileName="VNJBDD~1.M4A")) returned 0 [0107.492] FindClose (in: hFindFile=0x104df30 | out: hFindFile=0x104df30) returned 1 [0107.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeadc) returned 1 [0107.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeae8) returned 1 [0107.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb20) returned 1 [0107.492] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f", nBufferLength=0x105, lpBuffer=0xefe5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f", lpFilePart=0x0) returned 0x2f [0107.492] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\*", lpFindFileData=0xefe848 | out: lpFindFileData=0xefe848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86550b20, ftCreationTime.dwHighDateTime=0x1d5ec8a, ftLastAccessTime.dwLowDateTime=0x690b9d70, ftLastAccessTime.dwHighDateTime=0x1d5ee9e, ftLastWriteTime.dwLowDateTime=0x690b9d70, ftLastWriteTime.dwHighDateTime=0x1d5ee9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104e2b0 [0107.492] FindNextFileW (in: hFindFile=0x104e2b0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86550b20, ftCreationTime.dwHighDateTime=0x1d5ec8a, ftLastAccessTime.dwLowDateTime=0x690b9d70, ftLastAccessTime.dwHighDateTime=0x1d5ee9e, ftLastWriteTime.dwLowDateTime=0x690b9d70, ftLastWriteTime.dwHighDateTime=0x1d5ee9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.492] FindNextFileW (in: hFindFile=0x104e2b0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47e451f0, ftCreationTime.dwHighDateTime=0x1d5f0b5, ftLastAccessTime.dwLowDateTime=0xd81e1370, ftLastAccessTime.dwHighDateTime=0x1d5eb6d, ftLastWriteTime.dwLowDateTime=0xd81e1370, ftLastWriteTime.dwHighDateTime=0x1d5eb6d, nFileSizeHigh=0x0, nFileSizeLow=0x7bcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="eq-V303YCybpPwLo_R6.wav", cAlternateFileName="EQ-V30~1.WAV")) returned 1 [0107.493] FindNextFileW (in: hFindFile=0x104e2b0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fcdcd90, ftCreationTime.dwHighDateTime=0x1d5e205, ftLastAccessTime.dwLowDateTime=0xc05ad940, ftLastAccessTime.dwHighDateTime=0x1d5e563, ftLastWriteTime.dwLowDateTime=0xc05ad940, ftLastWriteTime.dwHighDateTime=0x1d5e563, nFileSizeHigh=0x0, nFileSizeLow=0x5e82, dwReserved0=0x0, dwReserved1=0x0, cFileName="ij9xGWa__Lkq.mp3", cAlternateFileName="IJ9XGW~1.MP3")) returned 1 [0107.493] FindNextFileW (in: hFindFile=0x104e2b0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x326b2170, ftCreationTime.dwHighDateTime=0x1d5e12c, ftLastAccessTime.dwLowDateTime=0xf7c53380, ftLastAccessTime.dwHighDateTime=0x1d5e996, ftLastWriteTime.dwLowDateTime=0xf7c53380, ftLastWriteTime.dwHighDateTime=0x1d5e996, nFileSizeHigh=0x0, nFileSizeLow=0x71ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPrHDw2grT4f.m4a", cAlternateFileName="JPRHDW~1.M4A")) returned 1 [0107.493] FindNextFileW (in: hFindFile=0x104e2b0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54200af0, ftCreationTime.dwHighDateTime=0x1d5e8ad, ftLastAccessTime.dwLowDateTime=0x5983fdb0, ftLastAccessTime.dwHighDateTime=0x1d5e5a3, ftLastWriteTime.dwLowDateTime=0x5983fdb0, ftLastWriteTime.dwHighDateTime=0x1d5e5a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MBulO", cAlternateFileName="")) returned 1 [0107.493] FindNextFileW (in: hFindFile=0x104e2b0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x702ef160, ftCreationTime.dwHighDateTime=0x1d5e2aa, ftLastAccessTime.dwLowDateTime=0xd8a369a0, ftLastAccessTime.dwHighDateTime=0x1d5f10b, ftLastWriteTime.dwLowDateTime=0xd8a369a0, ftLastWriteTime.dwHighDateTime=0x1d5f10b, nFileSizeHigh=0x0, nFileSizeLow=0x9778, dwReserved0=0x0, dwReserved1=0x0, cFileName="rsdGv.m4a", cAlternateFileName="")) returned 1 [0107.493] FindNextFileW (in: hFindFile=0x104e2b0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85231ed0, ftCreationTime.dwHighDateTime=0x1d5e77c, ftLastAccessTime.dwLowDateTime=0x75ef9ed0, ftLastAccessTime.dwHighDateTime=0x1d5e65e, ftLastWriteTime.dwLowDateTime=0x75ef9ed0, ftLastWriteTime.dwHighDateTime=0x1d5e65e, nFileSizeHigh=0x0, nFileSizeLow=0xa157, dwReserved0=0x0, dwReserved1=0x0, cFileName="tg7bxEAyNMhmuBNWucsW.wav", cAlternateFileName="TG7BXE~1.WAV")) returned 1 [0107.493] FindNextFileW (in: hFindFile=0x104e2b0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1bac67c0, ftCreationTime.dwHighDateTime=0x1d5f093, ftLastAccessTime.dwLowDateTime=0x2b57e400, ftLastAccessTime.dwHighDateTime=0x1d5e5d6, ftLastWriteTime.dwLowDateTime=0x2b57e400, ftLastWriteTime.dwHighDateTime=0x1d5e5d6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YHU6Gam KNmlDIBWU", cAlternateFileName="YHU6GA~1")) returned 1 [0107.493] FindNextFileW (in: hFindFile=0x104e2b0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1bac67c0, ftCreationTime.dwHighDateTime=0x1d5f093, ftLastAccessTime.dwLowDateTime=0x2b57e400, ftLastAccessTime.dwHighDateTime=0x1d5e5d6, ftLastWriteTime.dwLowDateTime=0x2b57e400, ftLastWriteTime.dwHighDateTime=0x1d5e5d6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YHU6Gam KNmlDIBWU", cAlternateFileName="YHU6GA~1")) returned 0 [0107.494] FindClose (in: hFindFile=0x104e2b0 | out: hFindFile=0x104e2b0) returned 1 [0107.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeadc) returned 1 [0107.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeae8) returned 1 [0107.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb20) returned 1 [0107.494] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f", nBufferLength=0x105, lpBuffer=0xefe5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f", lpFilePart=0x0) returned 0x2f [0107.494] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\*", lpFindFileData=0xefe848 | out: lpFindFileData=0xefe848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86550b20, ftCreationTime.dwHighDateTime=0x1d5ec8a, ftLastAccessTime.dwLowDateTime=0x690b9d70, ftLastAccessTime.dwHighDateTime=0x1d5ee9e, ftLastWriteTime.dwLowDateTime=0x690b9d70, ftLastWriteTime.dwHighDateTime=0x1d5ee9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104e2b0 [0107.494] FindNextFileW (in: hFindFile=0x104e2b0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86550b20, ftCreationTime.dwHighDateTime=0x1d5ec8a, ftLastAccessTime.dwLowDateTime=0x690b9d70, ftLastAccessTime.dwHighDateTime=0x1d5ee9e, ftLastWriteTime.dwLowDateTime=0x690b9d70, ftLastWriteTime.dwHighDateTime=0x1d5ee9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.494] FindNextFileW (in: hFindFile=0x104e2b0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47e451f0, ftCreationTime.dwHighDateTime=0x1d5f0b5, ftLastAccessTime.dwLowDateTime=0xd81e1370, ftLastAccessTime.dwHighDateTime=0x1d5eb6d, ftLastWriteTime.dwLowDateTime=0xd81e1370, ftLastWriteTime.dwHighDateTime=0x1d5eb6d, nFileSizeHigh=0x0, nFileSizeLow=0x7bcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="eq-V303YCybpPwLo_R6.wav", cAlternateFileName="EQ-V30~1.WAV")) returned 1 [0107.494] FindNextFileW (in: hFindFile=0x104e2b0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fcdcd90, ftCreationTime.dwHighDateTime=0x1d5e205, ftLastAccessTime.dwLowDateTime=0xc05ad940, ftLastAccessTime.dwHighDateTime=0x1d5e563, ftLastWriteTime.dwLowDateTime=0xc05ad940, ftLastWriteTime.dwHighDateTime=0x1d5e563, nFileSizeHigh=0x0, nFileSizeLow=0x5e82, dwReserved0=0x0, dwReserved1=0x0, cFileName="ij9xGWa__Lkq.mp3", cAlternateFileName="IJ9XGW~1.MP3")) returned 1 [0107.495] FindNextFileW (in: hFindFile=0x104e2b0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x326b2170, ftCreationTime.dwHighDateTime=0x1d5e12c, ftLastAccessTime.dwLowDateTime=0xf7c53380, ftLastAccessTime.dwHighDateTime=0x1d5e996, ftLastWriteTime.dwLowDateTime=0xf7c53380, ftLastWriteTime.dwHighDateTime=0x1d5e996, nFileSizeHigh=0x0, nFileSizeLow=0x71ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPrHDw2grT4f.m4a", cAlternateFileName="JPRHDW~1.M4A")) returned 1 [0107.495] FindNextFileW (in: hFindFile=0x104e2b0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54200af0, ftCreationTime.dwHighDateTime=0x1d5e8ad, ftLastAccessTime.dwLowDateTime=0x5983fdb0, ftLastAccessTime.dwHighDateTime=0x1d5e5a3, ftLastWriteTime.dwLowDateTime=0x5983fdb0, ftLastWriteTime.dwHighDateTime=0x1d5e5a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MBulO", cAlternateFileName="")) returned 1 [0107.495] FindNextFileW (in: hFindFile=0x104e2b0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x702ef160, ftCreationTime.dwHighDateTime=0x1d5e2aa, ftLastAccessTime.dwLowDateTime=0xd8a369a0, ftLastAccessTime.dwHighDateTime=0x1d5f10b, ftLastWriteTime.dwLowDateTime=0xd8a369a0, ftLastWriteTime.dwHighDateTime=0x1d5f10b, nFileSizeHigh=0x0, nFileSizeLow=0x9778, dwReserved0=0x0, dwReserved1=0x0, cFileName="rsdGv.m4a", cAlternateFileName="")) returned 1 [0107.495] FindNextFileW (in: hFindFile=0x104e2b0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85231ed0, ftCreationTime.dwHighDateTime=0x1d5e77c, ftLastAccessTime.dwLowDateTime=0x75ef9ed0, ftLastAccessTime.dwHighDateTime=0x1d5e65e, ftLastWriteTime.dwLowDateTime=0x75ef9ed0, ftLastWriteTime.dwHighDateTime=0x1d5e65e, nFileSizeHigh=0x0, nFileSizeLow=0xa157, dwReserved0=0x0, dwReserved1=0x0, cFileName="tg7bxEAyNMhmuBNWucsW.wav", cAlternateFileName="TG7BXE~1.WAV")) returned 1 [0107.495] FindNextFileW (in: hFindFile=0x104e2b0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1bac67c0, ftCreationTime.dwHighDateTime=0x1d5f093, ftLastAccessTime.dwLowDateTime=0x2b57e400, ftLastAccessTime.dwHighDateTime=0x1d5e5d6, ftLastWriteTime.dwLowDateTime=0x2b57e400, ftLastWriteTime.dwHighDateTime=0x1d5e5d6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YHU6Gam KNmlDIBWU", cAlternateFileName="YHU6GA~1")) returned 1 [0107.495] FindNextFileW (in: hFindFile=0x104e2b0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0107.496] FindClose (in: hFindFile=0x104e2b0 | out: hFindFile=0x104e2b0) returned 1 [0107.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeadc) returned 1 [0107.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeae8) returned 1 [0107.496] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\ij9xGWa__Lkq.mp3", nBufferLength=0x105, lpBuffer=0xefe488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\ij9xGWa__Lkq.mp3", lpFilePart=0x0) returned 0x40 [0107.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9cc) returned 1 [0107.496] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\ij9xGWa__Lkq.mp3" (normalized: "c:\\users\\fd1hvy\\music\\f3hj\\ghmao25cyrmljzks-x3f\\ij9xgwa__lkq.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0107.496] GetFileType (hFile=0x2e4) returned 0x1 [0107.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9c8) returned 1 [0107.496] GetFileType (hFile=0x2e4) returned 0x1 [0107.496] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeac8 | out: lpFileSizeHigh=0xefeac8*=0x0) returned 0x5e82 [0107.496] ReadFile (in: hFile=0x2e4, lpBuffer=0x2eda4b4, nNumberOfBytesToRead=0x5e82, lpNumberOfBytesRead=0xefea74, lpOverlapped=0x0 | out: lpBuffer=0x2eda4b4*, lpNumberOfBytesRead=0xefea74*=0x5e82, lpOverlapped=0x0) returned 1 [0107.497] CloseHandle (hObject=0x2e4) returned 1 [0107.659] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe58c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0107.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0107.659] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeabc | out: lpFileInformation=0xefeabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0107.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0107.659] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\ij9xGWa__Lkq.mp3", nBufferLength=0x105, lpBuffer=0xefe474, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\ij9xGWa__Lkq.mp3", lpFilePart=0x0) returned 0x40 [0107.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9b8) returned 1 [0107.659] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\ij9xGWa__Lkq.mp3" (normalized: "c:\\users\\fd1hvy\\music\\f3hj\\ghmao25cyrmljzks-x3f\\ij9xgwa__lkq.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0107.660] GetFileType (hFile=0x2e4) returned 0x1 [0107.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9b4) returned 1 [0107.660] GetFileType (hFile=0x2e4) returned 0x1 [0107.660] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f44cc8*, nNumberOfBytesToWrite=0x5e90, lpNumberOfBytesWritten=0xefea68, lpOverlapped=0x0 | out: lpBuffer=0x2f44cc8*, lpNumberOfBytesWritten=0xefea68*=0x5e90, lpOverlapped=0x0) returned 1 [0107.661] CloseHandle (hObject=0x2e4) returned 1 [0107.666] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\ij9xGWa__Lkq.mp3", nBufferLength=0x105, lpBuffer=0xefe598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\ij9xGWa__Lkq.mp3", lpFilePart=0x0) returned 0x40 [0107.666] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\ij9xGWa__Lkq.mp3.UGMH", nBufferLength=0x105, lpBuffer=0xefe598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\ij9xGWa__Lkq.mp3.UGMH", lpFilePart=0x0) returned 0x45 [0107.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea4c) returned 1 [0107.666] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\ij9xGWa__Lkq.mp3" (normalized: "c:\\users\\fd1hvy\\music\\f3hj\\ghmao25cyrmljzks-x3f\\ij9xgwa__lkq.mp3"), fInfoLevelId=0x0, lpFileInformation=0xefeac8 | out: lpFileInformation=0xefeac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fcdcd90, ftCreationTime.dwHighDateTime=0x1d5e205, ftLastAccessTime.dwLowDateTime=0xc05ad940, ftLastAccessTime.dwHighDateTime=0x1d5e563, ftLastWriteTime.dwLowDateTime=0xd6454795, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x5e90)) returned 1 [0107.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea48) returned 1 [0107.666] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\ij9xGWa__Lkq.mp3" (normalized: "c:\\users\\fd1hvy\\music\\f3hj\\ghmao25cyrmljzks-x3f\\ij9xgwa__lkq.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\ij9xGWa__Lkq.mp3.UGMH" (normalized: "c:\\users\\fd1hvy\\music\\f3hj\\ghmao25cyrmljzks-x3f\\ij9xgwa__lkq.mp3.ugmh")) returned 1 [0107.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaac) returned 1 [0107.667] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\MBulO", nBufferLength=0x105, lpBuffer=0xefe560, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\MBulO", lpFilePart=0x0) returned 0x35 [0107.667] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\MBulO\\*", lpFindFileData=0xefe7d4 | out: lpFindFileData=0xefe7d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54200af0, ftCreationTime.dwHighDateTime=0x1d5e8ad, ftLastAccessTime.dwLowDateTime=0x5983fdb0, ftLastAccessTime.dwHighDateTime=0x1d5e5a3, ftLastWriteTime.dwLowDateTime=0x5983fdb0, ftLastWriteTime.dwHighDateTime=0x1d5e5a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104ddf0 [0107.667] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54200af0, ftCreationTime.dwHighDateTime=0x1d5e8ad, ftLastAccessTime.dwLowDateTime=0x5983fdb0, ftLastAccessTime.dwHighDateTime=0x1d5e5a3, ftLastWriteTime.dwLowDateTime=0x5983fdb0, ftLastWriteTime.dwHighDateTime=0x1d5e5a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.668] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ee839a0, ftCreationTime.dwHighDateTime=0x1d5f03d, ftLastAccessTime.dwLowDateTime=0xe8e49ad0, ftLastAccessTime.dwHighDateTime=0x1d5e83e, ftLastWriteTime.dwLowDateTime=0xe8e49ad0, ftLastWriteTime.dwHighDateTime=0x1d5e83e, nFileSizeHigh=0x0, nFileSizeLow=0x11aec, dwReserved0=0x0, dwReserved1=0x0, cFileName="-QgjmfXb7JvY8N h0BP.m4a", cAlternateFileName="-QGJMF~1.M4A")) returned 1 [0107.668] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18debed0, ftCreationTime.dwHighDateTime=0x1d5e9ae, ftLastAccessTime.dwLowDateTime=0x7e4d5db0, ftLastAccessTime.dwHighDateTime=0x1d5e843, ftLastWriteTime.dwLowDateTime=0x7e4d5db0, ftLastWriteTime.dwHighDateTime=0x1d5e843, nFileSizeHigh=0x0, nFileSizeLow=0x61b, dwReserved0=0x0, dwReserved1=0x0, cFileName="0A LtTlCkE9FLMj3KF.wav", cAlternateFileName="0ALTTL~1.WAV")) returned 1 [0107.668] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d012b10, ftCreationTime.dwHighDateTime=0x1d5eeac, ftLastAccessTime.dwLowDateTime=0xfc67e090, ftLastAccessTime.dwHighDateTime=0x1d5ee78, ftLastWriteTime.dwLowDateTime=0xfc67e090, ftLastWriteTime.dwHighDateTime=0x1d5ee78, nFileSizeHigh=0x0, nFileSizeLow=0x14783, dwReserved0=0x0, dwReserved1=0x0, cFileName="DaLT4B6kRiRbr9iiH.mp3", cAlternateFileName="DALT4B~1.MP3")) returned 1 [0107.668] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb59a4920, ftCreationTime.dwHighDateTime=0x1d5e93a, ftLastAccessTime.dwLowDateTime=0xb5160ff0, ftLastAccessTime.dwHighDateTime=0x1d5e392, ftLastWriteTime.dwLowDateTime=0xb5160ff0, ftLastWriteTime.dwHighDateTime=0x1d5e392, nFileSizeHigh=0x0, nFileSizeLow=0x518a, dwReserved0=0x0, dwReserved1=0x0, cFileName="nGotYF4e3cI.wav", cAlternateFileName="NGOTYF~1.WAV")) returned 1 [0107.668] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ee5ed0, ftCreationTime.dwHighDateTime=0x1d5e1ff, ftLastAccessTime.dwLowDateTime=0xfcbc750, ftLastAccessTime.dwHighDateTime=0x1d5ee38, ftLastWriteTime.dwLowDateTime=0xfcbc750, ftLastWriteTime.dwHighDateTime=0x1d5ee38, nFileSizeHigh=0x0, nFileSizeLow=0x2f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnNI82Oh.wav", cAlternateFileName="")) returned 1 [0107.668] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0107.668] FindClose (in: hFindFile=0x104ddf0 | out: hFindFile=0x104ddf0) returned 1 [0107.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea68) returned 1 [0107.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea74) returned 1 [0107.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaac) returned 1 [0107.669] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\MBulO", nBufferLength=0x105, lpBuffer=0xefe560, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\MBulO", lpFilePart=0x0) returned 0x35 [0107.669] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\MBulO\\*", lpFindFileData=0xefe7d4 | out: lpFindFileData=0xefe7d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54200af0, ftCreationTime.dwHighDateTime=0x1d5e8ad, ftLastAccessTime.dwLowDateTime=0x5983fdb0, ftLastAccessTime.dwHighDateTime=0x1d5e5a3, ftLastWriteTime.dwLowDateTime=0x5983fdb0, ftLastWriteTime.dwHighDateTime=0x1d5e5a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104dfb0 [0107.669] FindNextFileW (in: hFindFile=0x104dfb0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54200af0, ftCreationTime.dwHighDateTime=0x1d5e8ad, ftLastAccessTime.dwLowDateTime=0x5983fdb0, ftLastAccessTime.dwHighDateTime=0x1d5e5a3, ftLastWriteTime.dwLowDateTime=0x5983fdb0, ftLastWriteTime.dwHighDateTime=0x1d5e5a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.669] FindNextFileW (in: hFindFile=0x104dfb0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ee839a0, ftCreationTime.dwHighDateTime=0x1d5f03d, ftLastAccessTime.dwLowDateTime=0xe8e49ad0, ftLastAccessTime.dwHighDateTime=0x1d5e83e, ftLastWriteTime.dwLowDateTime=0xe8e49ad0, ftLastWriteTime.dwHighDateTime=0x1d5e83e, nFileSizeHigh=0x0, nFileSizeLow=0x11aec, dwReserved0=0x0, dwReserved1=0x0, cFileName="-QgjmfXb7JvY8N h0BP.m4a", cAlternateFileName="-QGJMF~1.M4A")) returned 1 [0107.669] FindNextFileW (in: hFindFile=0x104dfb0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18debed0, ftCreationTime.dwHighDateTime=0x1d5e9ae, ftLastAccessTime.dwLowDateTime=0x7e4d5db0, ftLastAccessTime.dwHighDateTime=0x1d5e843, ftLastWriteTime.dwLowDateTime=0x7e4d5db0, ftLastWriteTime.dwHighDateTime=0x1d5e843, nFileSizeHigh=0x0, nFileSizeLow=0x61b, dwReserved0=0x0, dwReserved1=0x0, cFileName="0A LtTlCkE9FLMj3KF.wav", cAlternateFileName="0ALTTL~1.WAV")) returned 1 [0107.670] FindNextFileW (in: hFindFile=0x104dfb0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d012b10, ftCreationTime.dwHighDateTime=0x1d5eeac, ftLastAccessTime.dwLowDateTime=0xfc67e090, ftLastAccessTime.dwHighDateTime=0x1d5ee78, ftLastWriteTime.dwLowDateTime=0xfc67e090, ftLastWriteTime.dwHighDateTime=0x1d5ee78, nFileSizeHigh=0x0, nFileSizeLow=0x14783, dwReserved0=0x0, dwReserved1=0x0, cFileName="DaLT4B6kRiRbr9iiH.mp3", cAlternateFileName="DALT4B~1.MP3")) returned 1 [0107.670] FindNextFileW (in: hFindFile=0x104dfb0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb59a4920, ftCreationTime.dwHighDateTime=0x1d5e93a, ftLastAccessTime.dwLowDateTime=0xb5160ff0, ftLastAccessTime.dwHighDateTime=0x1d5e392, ftLastWriteTime.dwLowDateTime=0xb5160ff0, ftLastWriteTime.dwHighDateTime=0x1d5e392, nFileSizeHigh=0x0, nFileSizeLow=0x518a, dwReserved0=0x0, dwReserved1=0x0, cFileName="nGotYF4e3cI.wav", cAlternateFileName="NGOTYF~1.WAV")) returned 1 [0107.670] FindNextFileW (in: hFindFile=0x104dfb0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ee5ed0, ftCreationTime.dwHighDateTime=0x1d5e1ff, ftLastAccessTime.dwLowDateTime=0xfcbc750, ftLastAccessTime.dwHighDateTime=0x1d5ee38, ftLastWriteTime.dwLowDateTime=0xfcbc750, ftLastWriteTime.dwHighDateTime=0x1d5ee38, nFileSizeHigh=0x0, nFileSizeLow=0x2f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnNI82Oh.wav", cAlternateFileName="")) returned 1 [0107.670] FindNextFileW (in: hFindFile=0x104dfb0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ee5ed0, ftCreationTime.dwHighDateTime=0x1d5e1ff, ftLastAccessTime.dwLowDateTime=0xfcbc750, ftLastAccessTime.dwHighDateTime=0x1d5ee38, ftLastWriteTime.dwLowDateTime=0xfcbc750, ftLastWriteTime.dwHighDateTime=0x1d5ee38, nFileSizeHigh=0x0, nFileSizeLow=0x2f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnNI82Oh.wav", cAlternateFileName="")) returned 0 [0107.670] FindClose (in: hFindFile=0x104dfb0 | out: hFindFile=0x104dfb0) returned 1 [0107.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea68) returned 1 [0107.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea74) returned 1 [0107.670] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\MBulO\\DaLT4B6kRiRbr9iiH.mp3", nBufferLength=0x105, lpBuffer=0xefe414, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\MBulO\\DaLT4B6kRiRbr9iiH.mp3", lpFilePart=0x0) returned 0x4b [0107.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe958) returned 1 [0107.670] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\MBulO\\DaLT4B6kRiRbr9iiH.mp3" (normalized: "c:\\users\\fd1hvy\\music\\f3hj\\ghmao25cyrmljzks-x3f\\mbulo\\dalt4b6krirbr9iih.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0107.671] GetFileType (hFile=0x2e4) returned 0x1 [0107.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe954) returned 1 [0107.671] GetFileType (hFile=0x2e4) returned 0x1 [0107.671] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefea54 | out: lpFileSizeHigh=0xefea54*=0x0) returned 0x14783 [0107.671] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f4d248, nNumberOfBytesToRead=0x14783, lpNumberOfBytesRead=0xefea00, lpOverlapped=0x0 | out: lpBuffer=0x2f4d248*, lpNumberOfBytesRead=0xefea00*=0x14783, lpOverlapped=0x0) returned 1 [0107.678] CloseHandle (hObject=0x2e4) returned 1 [0107.699] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0107.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9cc) returned 1 [0107.699] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefea48 | out: lpFileInformation=0xefea48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0107.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9c8) returned 1 [0107.699] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\MBulO\\DaLT4B6kRiRbr9iiH.mp3", nBufferLength=0x105, lpBuffer=0xefe400, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\MBulO\\DaLT4B6kRiRbr9iiH.mp3", lpFilePart=0x0) returned 0x4b [0107.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe944) returned 1 [0107.699] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\MBulO\\DaLT4B6kRiRbr9iiH.mp3" (normalized: "c:\\users\\fd1hvy\\music\\f3hj\\ghmao25cyrmljzks-x3f\\mbulo\\dalt4b6krirbr9iih.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0107.701] GetFileType (hFile=0x2e4) returned 0x1 [0107.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe940) returned 1 [0107.701] GetFileType (hFile=0x2e4) returned 0x1 [0107.701] WriteFile (in: hFile=0x2e4, lpBuffer=0x2fd76f4*, nNumberOfBytesToWrite=0x14790, lpNumberOfBytesWritten=0xefe9f4, lpOverlapped=0x0 | out: lpBuffer=0x2fd76f4*, lpNumberOfBytesWritten=0xefe9f4*=0x14790, lpOverlapped=0x0) returned 1 [0107.704] CloseHandle (hObject=0x2e4) returned 1 [0107.707] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\MBulO\\DaLT4B6kRiRbr9iiH.mp3", nBufferLength=0x105, lpBuffer=0xefe524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\MBulO\\DaLT4B6kRiRbr9iiH.mp3", lpFilePart=0x0) returned 0x4b [0107.707] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\MBulO\\DaLT4B6kRiRbr9iiH.mp3.UGMH", nBufferLength=0x105, lpBuffer=0xefe524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\MBulO\\DaLT4B6kRiRbr9iiH.mp3.UGMH", lpFilePart=0x0) returned 0x50 [0107.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9d8) returned 1 [0107.708] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\MBulO\\DaLT4B6kRiRbr9iiH.mp3" (normalized: "c:\\users\\fd1hvy\\music\\f3hj\\ghmao25cyrmljzks-x3f\\mbulo\\dalt4b6krirbr9iih.mp3"), fInfoLevelId=0x0, lpFileInformation=0xefea54 | out: lpFileInformation=0xefea54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d012b10, ftCreationTime.dwHighDateTime=0x1d5eeac, ftLastAccessTime.dwLowDateTime=0xfc67e090, ftLastAccessTime.dwHighDateTime=0x1d5ee78, ftLastWriteTime.dwLowDateTime=0xd64c6f61, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x14790)) returned 1 [0107.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9d4) returned 1 [0107.708] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\MBulO\\DaLT4B6kRiRbr9iiH.mp3" (normalized: "c:\\users\\fd1hvy\\music\\f3hj\\ghmao25cyrmljzks-x3f\\mbulo\\dalt4b6krirbr9iih.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\MBulO\\DaLT4B6kRiRbr9iiH.mp3.UGMH" (normalized: "c:\\users\\fd1hvy\\music\\f3hj\\ghmao25cyrmljzks-x3f\\mbulo\\dalt4b6krirbr9iih.mp3.ugmh")) returned 1 [0107.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaac) returned 1 [0107.709] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\YHU6Gam KNmlDIBWU", nBufferLength=0x105, lpBuffer=0xefe560, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\YHU6Gam KNmlDIBWU", lpFilePart=0x0) returned 0x41 [0107.709] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\YHU6Gam KNmlDIBWU\\*", lpFindFileData=0xefe7d4 | out: lpFindFileData=0xefe7d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1bac67c0, ftCreationTime.dwHighDateTime=0x1d5f093, ftLastAccessTime.dwLowDateTime=0x2b57e400, ftLastAccessTime.dwHighDateTime=0x1d5e5d6, ftLastWriteTime.dwLowDateTime=0x2b57e400, ftLastWriteTime.dwHighDateTime=0x1d5e5d6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104e2f0 [0107.709] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1bac67c0, ftCreationTime.dwHighDateTime=0x1d5f093, ftLastAccessTime.dwLowDateTime=0x2b57e400, ftLastAccessTime.dwHighDateTime=0x1d5e5d6, ftLastWriteTime.dwLowDateTime=0x2b57e400, ftLastWriteTime.dwHighDateTime=0x1d5e5d6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.709] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1bac67c0, ftCreationTime.dwHighDateTime=0x1d5f093, ftLastAccessTime.dwLowDateTime=0x2b57e400, ftLastAccessTime.dwHighDateTime=0x1d5e5d6, ftLastWriteTime.dwLowDateTime=0x2b57e400, ftLastWriteTime.dwHighDateTime=0x1d5e5d6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0107.710] FindClose (in: hFindFile=0x104e2f0 | out: hFindFile=0x104e2f0) returned 1 [0107.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea68) returned 1 [0107.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea74) returned 1 [0107.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaac) returned 1 [0107.710] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\YHU6Gam KNmlDIBWU", nBufferLength=0x105, lpBuffer=0xefe560, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\YHU6Gam KNmlDIBWU", lpFilePart=0x0) returned 0x41 [0107.710] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\GhMaO25CyRMLjzks-X3f\\YHU6Gam KNmlDIBWU\\*", lpFindFileData=0xefe7d4 | out: lpFindFileData=0xefe7d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1bac67c0, ftCreationTime.dwHighDateTime=0x1d5f093, ftLastAccessTime.dwLowDateTime=0x2b57e400, ftLastAccessTime.dwHighDateTime=0x1d5e5d6, ftLastWriteTime.dwLowDateTime=0x2b57e400, ftLastWriteTime.dwHighDateTime=0x1d5e5d6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104ddf0 [0107.710] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1bac67c0, ftCreationTime.dwHighDateTime=0x1d5f093, ftLastAccessTime.dwLowDateTime=0x2b57e400, ftLastAccessTime.dwHighDateTime=0x1d5e5d6, ftLastWriteTime.dwLowDateTime=0x2b57e400, ftLastWriteTime.dwHighDateTime=0x1d5e5d6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.711] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1bac67c0, ftCreationTime.dwHighDateTime=0x1d5f093, ftLastAccessTime.dwLowDateTime=0x2b57e400, ftLastAccessTime.dwHighDateTime=0x1d5e5d6, ftLastWriteTime.dwLowDateTime=0x2b57e400, ftLastWriteTime.dwHighDateTime=0x1d5e5d6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0107.711] FindClose (in: hFindFile=0x104ddf0 | out: hFindFile=0x104ddf0) returned 1 [0107.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea68) returned 1 [0107.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea74) returned 1 [0107.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb20) returned 1 [0107.711] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\wpLSB1AzRr0C", nBufferLength=0x105, lpBuffer=0xefe5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\F3HJ\\wpLSB1AzRr0C", lpFilePart=0x0) returned 0x27 [0107.711] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\wpLSB1AzRr0C\\*", lpFindFileData=0xefe848 | out: lpFindFileData=0xefe848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bc6410, ftCreationTime.dwHighDateTime=0x1d5edd3, ftLastAccessTime.dwLowDateTime=0x6896a970, ftLastAccessTime.dwHighDateTime=0x1d5e246, ftLastWriteTime.dwLowDateTime=0x6896a970, ftLastWriteTime.dwHighDateTime=0x1d5e246, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104dd70 [0107.711] FindNextFileW (in: hFindFile=0x104dd70, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bc6410, ftCreationTime.dwHighDateTime=0x1d5edd3, ftLastAccessTime.dwLowDateTime=0x6896a970, ftLastAccessTime.dwHighDateTime=0x1d5e246, ftLastWriteTime.dwLowDateTime=0x6896a970, ftLastWriteTime.dwHighDateTime=0x1d5e246, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.712] FindNextFileW (in: hFindFile=0x104dd70, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4a72550, ftCreationTime.dwHighDateTime=0x1d5e5b2, ftLastAccessTime.dwLowDateTime=0x7d4e1770, ftLastAccessTime.dwHighDateTime=0x1d5e1f3, ftLastWriteTime.dwLowDateTime=0x7d4e1770, ftLastWriteTime.dwHighDateTime=0x1d5e1f3, nFileSizeHigh=0x0, nFileSizeLow=0x2195, dwReserved0=0x0, dwReserved1=0x0, cFileName="CTie-xR.wav", cAlternateFileName="")) returned 1 [0107.712] FindNextFileW (in: hFindFile=0x104dd70, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5476da80, ftCreationTime.dwHighDateTime=0x1d5eb3f, ftLastAccessTime.dwLowDateTime=0x21131550, ftLastAccessTime.dwHighDateTime=0x1d5ef18, ftLastWriteTime.dwLowDateTime=0x21131550, ftLastWriteTime.dwHighDateTime=0x1d5ef18, nFileSizeHigh=0x0, nFileSizeLow=0x9ed4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lr8W.m4a", cAlternateFileName="")) returned 1 [0107.712] FindNextFileW (in: hFindFile=0x104dd70, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0107.712] FindClose (in: hFindFile=0x104dd70 | out: hFindFile=0x104dd70) returned 1 [0107.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeadc) returned 1 [0107.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeae8) returned 1 [0107.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb20) returned 1 [0107.712] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\wpLSB1AzRr0C", nBufferLength=0x105, lpBuffer=0xefe5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\F3HJ\\wpLSB1AzRr0C", lpFilePart=0x0) returned 0x27 [0107.712] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\F3HJ\\wpLSB1AzRr0C\\*", lpFindFileData=0xefe848 | out: lpFindFileData=0xefe848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bc6410, ftCreationTime.dwHighDateTime=0x1d5edd3, ftLastAccessTime.dwLowDateTime=0x6896a970, ftLastAccessTime.dwHighDateTime=0x1d5e246, ftLastWriteTime.dwLowDateTime=0x6896a970, ftLastWriteTime.dwHighDateTime=0x1d5e246, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104df30 [0107.713] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bc6410, ftCreationTime.dwHighDateTime=0x1d5edd3, ftLastAccessTime.dwLowDateTime=0x6896a970, ftLastAccessTime.dwHighDateTime=0x1d5e246, ftLastWriteTime.dwLowDateTime=0x6896a970, ftLastWriteTime.dwHighDateTime=0x1d5e246, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.713] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4a72550, ftCreationTime.dwHighDateTime=0x1d5e5b2, ftLastAccessTime.dwLowDateTime=0x7d4e1770, ftLastAccessTime.dwHighDateTime=0x1d5e1f3, ftLastWriteTime.dwLowDateTime=0x7d4e1770, ftLastWriteTime.dwHighDateTime=0x1d5e1f3, nFileSizeHigh=0x0, nFileSizeLow=0x2195, dwReserved0=0x0, dwReserved1=0x0, cFileName="CTie-xR.wav", cAlternateFileName="")) returned 1 [0107.713] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5476da80, ftCreationTime.dwHighDateTime=0x1d5eb3f, ftLastAccessTime.dwLowDateTime=0x21131550, ftLastAccessTime.dwHighDateTime=0x1d5ef18, ftLastWriteTime.dwLowDateTime=0x21131550, ftLastWriteTime.dwHighDateTime=0x1d5ef18, nFileSizeHigh=0x0, nFileSizeLow=0x9ed4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lr8W.m4a", cAlternateFileName="")) returned 1 [0107.713] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5476da80, ftCreationTime.dwHighDateTime=0x1d5eb3f, ftLastAccessTime.dwLowDateTime=0x21131550, ftLastAccessTime.dwHighDateTime=0x1d5ef18, ftLastWriteTime.dwLowDateTime=0x21131550, ftLastWriteTime.dwHighDateTime=0x1d5ef18, nFileSizeHigh=0x0, nFileSizeLow=0x9ed4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lr8W.m4a", cAlternateFileName="")) returned 0 [0107.713] FindClose (in: hFindFile=0x104df30 | out: hFindFile=0x104df30) returned 1 [0107.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeadc) returned 1 [0107.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeae8) returned 1 [0107.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb94) returned 1 [0107.714] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K", nBufferLength=0x105, lpBuffer=0xefe648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K", lpFilePart=0x0) returned 0x29 [0107.714] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\*", lpFindFileData=0xefe8bc | out: lpFindFileData=0xefe8bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9541470, ftCreationTime.dwHighDateTime=0x1d5e4b4, ftLastAccessTime.dwLowDateTime=0x8cac7310, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x8cac7310, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104df30 [0107.714] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9541470, ftCreationTime.dwHighDateTime=0x1d5e4b4, ftLastAccessTime.dwLowDateTime=0x8cac7310, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x8cac7310, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.714] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb567990, ftCreationTime.dwHighDateTime=0x1d5e897, ftLastAccessTime.dwLowDateTime=0xdbd05740, ftLastAccessTime.dwHighDateTime=0x1d5ec84, ftLastWriteTime.dwLowDateTime=0xdbd05740, ftLastWriteTime.dwHighDateTime=0x1d5ec84, nFileSizeHigh=0x0, nFileSizeLow=0x16ff6, dwReserved0=0x0, dwReserved1=0x0, cFileName="09rreVyx.mp3", cAlternateFileName="")) returned 1 [0107.714] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2007cc60, ftCreationTime.dwHighDateTime=0x1d5ef03, ftLastAccessTime.dwLowDateTime=0x8769da70, ftLastAccessTime.dwHighDateTime=0x1d5ed22, ftLastWriteTime.dwLowDateTime=0x8769da70, ftLastWriteTime.dwHighDateTime=0x1d5ed22, nFileSizeHigh=0x0, nFileSizeLow=0x13024, dwReserved0=0x0, dwReserved1=0x0, cFileName="8RpqCPMx1ojPwm.mp3", cAlternateFileName="8RPQCP~1.MP3")) returned 1 [0107.715] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d174f50, ftCreationTime.dwHighDateTime=0x1d5e493, ftLastAccessTime.dwLowDateTime=0xa5bad3d0, ftLastAccessTime.dwHighDateTime=0x1d5e67e, ftLastWriteTime.dwLowDateTime=0xa5bad3d0, ftLastWriteTime.dwHighDateTime=0x1d5e67e, nFileSizeHigh=0x0, nFileSizeLow=0x1085b, dwReserved0=0x0, dwReserved1=0x0, cFileName="XmQvUV2kuLuEty2.wav", cAlternateFileName="XMQVUV~1.WAV")) returned 1 [0107.715] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa08f4ff0, ftCreationTime.dwHighDateTime=0x1d5e316, ftLastAccessTime.dwLowDateTime=0x16ed4c80, ftLastAccessTime.dwHighDateTime=0x1d5f0a8, ftLastWriteTime.dwLowDateTime=0x16ed4c80, ftLastWriteTime.dwHighDateTime=0x1d5f0a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="xT6CFKfiZA1Ue_bNKO5", cAlternateFileName="XT6CFK~1")) returned 1 [0107.715] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa08f4ff0, ftCreationTime.dwHighDateTime=0x1d5e316, ftLastAccessTime.dwLowDateTime=0x16ed4c80, ftLastAccessTime.dwHighDateTime=0x1d5f0a8, ftLastWriteTime.dwLowDateTime=0x16ed4c80, ftLastWriteTime.dwHighDateTime=0x1d5f0a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="xT6CFKfiZA1Ue_bNKO5", cAlternateFileName="XT6CFK~1")) returned 0 [0107.715] FindClose (in: hFindFile=0x104df30 | out: hFindFile=0x104df30) returned 1 [0107.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb50) returned 1 [0107.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb5c) returned 1 [0107.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb94) returned 1 [0107.716] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K", nBufferLength=0x105, lpBuffer=0xefe648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K", lpFilePart=0x0) returned 0x29 [0107.716] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\*", lpFindFileData=0xefe8bc | out: lpFindFileData=0xefe8bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9541470, ftCreationTime.dwHighDateTime=0x1d5e4b4, ftLastAccessTime.dwLowDateTime=0x8cac7310, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x8cac7310, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104e2f0 [0107.716] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9541470, ftCreationTime.dwHighDateTime=0x1d5e4b4, ftLastAccessTime.dwLowDateTime=0x8cac7310, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x8cac7310, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.716] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb567990, ftCreationTime.dwHighDateTime=0x1d5e897, ftLastAccessTime.dwLowDateTime=0xdbd05740, ftLastAccessTime.dwHighDateTime=0x1d5ec84, ftLastWriteTime.dwLowDateTime=0xdbd05740, ftLastWriteTime.dwHighDateTime=0x1d5ec84, nFileSizeHigh=0x0, nFileSizeLow=0x16ff6, dwReserved0=0x0, dwReserved1=0x0, cFileName="09rreVyx.mp3", cAlternateFileName="")) returned 1 [0107.716] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2007cc60, ftCreationTime.dwHighDateTime=0x1d5ef03, ftLastAccessTime.dwLowDateTime=0x8769da70, ftLastAccessTime.dwHighDateTime=0x1d5ed22, ftLastWriteTime.dwLowDateTime=0x8769da70, ftLastWriteTime.dwHighDateTime=0x1d5ed22, nFileSizeHigh=0x0, nFileSizeLow=0x13024, dwReserved0=0x0, dwReserved1=0x0, cFileName="8RpqCPMx1ojPwm.mp3", cAlternateFileName="8RPQCP~1.MP3")) returned 1 [0107.716] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d174f50, ftCreationTime.dwHighDateTime=0x1d5e493, ftLastAccessTime.dwLowDateTime=0xa5bad3d0, ftLastAccessTime.dwHighDateTime=0x1d5e67e, ftLastWriteTime.dwLowDateTime=0xa5bad3d0, ftLastWriteTime.dwHighDateTime=0x1d5e67e, nFileSizeHigh=0x0, nFileSizeLow=0x1085b, dwReserved0=0x0, dwReserved1=0x0, cFileName="XmQvUV2kuLuEty2.wav", cAlternateFileName="XMQVUV~1.WAV")) returned 1 [0107.717] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa08f4ff0, ftCreationTime.dwHighDateTime=0x1d5e316, ftLastAccessTime.dwLowDateTime=0x16ed4c80, ftLastAccessTime.dwHighDateTime=0x1d5f0a8, ftLastWriteTime.dwLowDateTime=0x16ed4c80, ftLastWriteTime.dwHighDateTime=0x1d5f0a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="xT6CFKfiZA1Ue_bNKO5", cAlternateFileName="XT6CFK~1")) returned 1 [0107.717] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0107.717] FindClose (in: hFindFile=0x104e2f0 | out: hFindFile=0x104e2f0) returned 1 [0107.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb50) returned 1 [0107.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb5c) returned 1 [0107.717] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\09rreVyx.mp3", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\09rreVyx.mp3", lpFilePart=0x0) returned 0x36 [0107.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0107.717] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\09rreVyx.mp3" (normalized: "c:\\users\\fd1hvy\\music\\lepxlflso 1bubvqm k\\09rrevyx.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0107.718] GetFileType (hFile=0x2e4) returned 0x1 [0107.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0107.718] GetFileType (hFile=0x2e4) returned 0x1 [0107.718] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0x16ff6 [0107.726] ReadFile (in: hFile=0x2e4, lpBuffer=0x40b7570, nNumberOfBytesToRead=0x16ff6, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x40b7570*, lpNumberOfBytesRead=0xefeae8*=0x16ff6, lpOverlapped=0x0) returned 1 [0107.729] CloseHandle (hObject=0x2e4) returned 1 [0107.804] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0107.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0107.805] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0107.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0107.805] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\09rreVyx.mp3", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\09rreVyx.mp3", lpFilePart=0x0) returned 0x36 [0107.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0107.805] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\09rreVyx.mp3" (normalized: "c:\\users\\fd1hvy\\music\\lepxlflso 1bubvqm k\\09rrevyx.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0107.807] GetFileType (hFile=0x2e4) returned 0x1 [0107.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0107.807] GetFileType (hFile=0x2e4) returned 0x1 [0107.807] WriteFile (in: hFile=0x2e4, lpBuffer=0x412a5a8*, nNumberOfBytesToWrite=0x17000, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x412a5a8*, lpNumberOfBytesWritten=0xefeadc*=0x17000, lpOverlapped=0x0) returned 1 [0107.810] CloseHandle (hObject=0x2e4) returned 1 [0107.818] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\09rreVyx.mp3", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\09rreVyx.mp3", lpFilePart=0x0) returned 0x36 [0107.818] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\09rreVyx.mp3.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\09rreVyx.mp3.UGMH", lpFilePart=0x0) returned 0x3b [0107.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0107.818] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\09rreVyx.mp3" (normalized: "c:\\users\\fd1hvy\\music\\lepxlflso 1bubvqm k\\09rrevyx.mp3"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb567990, ftCreationTime.dwHighDateTime=0x1d5e897, ftLastAccessTime.dwLowDateTime=0xdbd05740, ftLastAccessTime.dwHighDateTime=0x1d5ec84, ftLastWriteTime.dwLowDateTime=0xd65d1fd4, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x17000)) returned 1 [0107.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0107.819] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\09rreVyx.mp3" (normalized: "c:\\users\\fd1hvy\\music\\lepxlflso 1bubvqm k\\09rrevyx.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\09rreVyx.mp3.UGMH" (normalized: "c:\\users\\fd1hvy\\music\\lepxlflso 1bubvqm k\\09rrevyx.mp3.ugmh")) returned 1 [0107.820] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\8RpqCPMx1ojPwm.mp3", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\8RpqCPMx1ojPwm.mp3", lpFilePart=0x0) returned 0x3c [0107.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0107.820] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\8RpqCPMx1ojPwm.mp3" (normalized: "c:\\users\\fd1hvy\\music\\lepxlflso 1bubvqm k\\8rpqcpmx1ojpwm.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0107.820] GetFileType (hFile=0x2e4) returned 0x1 [0107.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0107.820] GetFileType (hFile=0x2e4) returned 0x1 [0107.820] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0x13024 [0107.820] ReadFile (in: hFile=0x2e4, lpBuffer=0x303d3d4, nNumberOfBytesToRead=0x13024, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x303d3d4*, lpNumberOfBytesRead=0xefeae8*=0x13024, lpOverlapped=0x0) returned 1 [0107.822] CloseHandle (hObject=0x2e4) returned 1 [0107.936] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0107.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0107.937] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0107.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0107.937] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\8RpqCPMx1ojPwm.mp3", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\8RpqCPMx1ojPwm.mp3", lpFilePart=0x0) returned 0x3c [0107.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0107.937] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\8RpqCPMx1ojPwm.mp3" (normalized: "c:\\users\\fd1hvy\\music\\lepxlflso 1bubvqm k\\8rpqcpmx1ojpwm.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0107.939] GetFileType (hFile=0x2e4) returned 0x1 [0107.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0107.939] GetFileType (hFile=0x2e4) returned 0x1 [0107.939] WriteFile (in: hFile=0x2e4, lpBuffer=0x2ece2f4*, nNumberOfBytesToWrite=0x13030, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x2ece2f4*, lpNumberOfBytesWritten=0xefeadc*=0x13030, lpOverlapped=0x0) returned 1 [0107.942] CloseHandle (hObject=0x2e4) returned 1 [0107.945] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\8RpqCPMx1ojPwm.mp3", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\8RpqCPMx1ojPwm.mp3", lpFilePart=0x0) returned 0x3c [0107.946] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\8RpqCPMx1ojPwm.mp3.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\8RpqCPMx1ojPwm.mp3.UGMH", lpFilePart=0x0) returned 0x41 [0107.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0107.946] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\8RpqCPMx1ojPwm.mp3" (normalized: "c:\\users\\fd1hvy\\music\\lepxlflso 1bubvqm k\\8rpqcpmx1ojpwm.mp3"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2007cc60, ftCreationTime.dwHighDateTime=0x1d5ef03, ftLastAccessTime.dwLowDateTime=0x8769da70, ftLastAccessTime.dwHighDateTime=0x1d5ed22, ftLastWriteTime.dwLowDateTime=0xd67033b3, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x13030)) returned 1 [0107.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0107.946] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\8RpqCPMx1ojPwm.mp3" (normalized: "c:\\users\\fd1hvy\\music\\lepxlflso 1bubvqm k\\8rpqcpmx1ojpwm.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\8RpqCPMx1ojPwm.mp3.UGMH" (normalized: "c:\\users\\fd1hvy\\music\\lepxlflso 1bubvqm k\\8rpqcpmx1ojpwm.mp3.ugmh")) returned 1 [0107.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb20) returned 1 [0107.947] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5", nBufferLength=0x105, lpBuffer=0xefe5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5", lpFilePart=0x0) returned 0x3d [0107.947] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\*", lpFindFileData=0xefe848 | out: lpFindFileData=0xefe848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa08f4ff0, ftCreationTime.dwHighDateTime=0x1d5e316, ftLastAccessTime.dwLowDateTime=0x16ed4c80, ftLastAccessTime.dwHighDateTime=0x1d5f0a8, ftLastWriteTime.dwLowDateTime=0x16ed4c80, ftLastWriteTime.dwHighDateTime=0x1d5f0a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104deb0 [0107.947] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa08f4ff0, ftCreationTime.dwHighDateTime=0x1d5e316, ftLastAccessTime.dwLowDateTime=0x16ed4c80, ftLastAccessTime.dwHighDateTime=0x1d5f0a8, ftLastWriteTime.dwLowDateTime=0x16ed4c80, ftLastWriteTime.dwHighDateTime=0x1d5f0a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.948] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x378f94e0, ftCreationTime.dwHighDateTime=0x1d5e22d, ftLastAccessTime.dwLowDateTime=0xf1ed060, ftLastAccessTime.dwHighDateTime=0x1d5e201, ftLastWriteTime.dwLowDateTime=0xf1ed060, ftLastWriteTime.dwHighDateTime=0x1d5e201, nFileSizeHigh=0x0, nFileSizeLow=0x16a5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="j-cqq.mp3", cAlternateFileName="")) returned 1 [0107.948] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ab71ca0, ftCreationTime.dwHighDateTime=0x1d5e17c, ftLastAccessTime.dwLowDateTime=0x94b6f6e0, ftLastAccessTime.dwHighDateTime=0x1d5eef3, ftLastWriteTime.dwLowDateTime=0x94b6f6e0, ftLastWriteTime.dwHighDateTime=0x1d5eef3, nFileSizeHigh=0x0, nFileSizeLow=0x13c5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="nn29h-Uw1.m4a", cAlternateFileName="NN29H-~1.M4A")) returned 1 [0107.948] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3343bb0, ftCreationTime.dwHighDateTime=0x1d5e932, ftLastAccessTime.dwLowDateTime=0xe103fb80, ftLastAccessTime.dwHighDateTime=0x1d5e285, ftLastWriteTime.dwLowDateTime=0xe103fb80, ftLastWriteTime.dwHighDateTime=0x1d5e285, nFileSizeHigh=0x0, nFileSizeLow=0x1256, dwReserved0=0x0, dwReserved1=0x0, cFileName="phK3Wky39cda3ZUE0.mp3", cAlternateFileName="PHK3WK~1.MP3")) returned 1 [0107.948] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3055bed0, ftCreationTime.dwHighDateTime=0x1d5e6e6, ftLastAccessTime.dwLowDateTime=0x80d85bb0, ftLastAccessTime.dwHighDateTime=0x1d5ece0, ftLastWriteTime.dwLowDateTime=0x80d85bb0, ftLastWriteTime.dwHighDateTime=0x1d5ece0, nFileSizeHigh=0x0, nFileSizeLow=0x6785, dwReserved0=0x0, dwReserved1=0x0, cFileName="S ARWdZH7syt.wav", cAlternateFileName="SARWDZ~1.WAV")) returned 1 [0107.948] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6e6b110, ftCreationTime.dwHighDateTime=0x1d5ed58, ftLastAccessTime.dwLowDateTime=0x84623a20, ftLastAccessTime.dwHighDateTime=0x1d5f01f, ftLastWriteTime.dwLowDateTime=0x84623a20, ftLastWriteTime.dwHighDateTime=0x1d5f01f, nFileSizeHigh=0x0, nFileSizeLow=0x1090b, dwReserved0=0x0, dwReserved1=0x0, cFileName="XffLqyVGZsxclhsBc5.mp3", cAlternateFileName="XFFLQY~1.MP3")) returned 1 [0107.948] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0107.948] FindClose (in: hFindFile=0x104deb0 | out: hFindFile=0x104deb0) returned 1 [0107.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeadc) returned 1 [0107.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeae8) returned 1 [0107.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb20) returned 1 [0107.949] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5", nBufferLength=0x105, lpBuffer=0xefe5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5", lpFilePart=0x0) returned 0x3d [0107.949] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\*", lpFindFileData=0xefe848 | out: lpFindFileData=0xefe848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa08f4ff0, ftCreationTime.dwHighDateTime=0x1d5e316, ftLastAccessTime.dwLowDateTime=0x16ed4c80, ftLastAccessTime.dwHighDateTime=0x1d5f0a8, ftLastWriteTime.dwLowDateTime=0x16ed4c80, ftLastWriteTime.dwHighDateTime=0x1d5f0a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104dd70 [0107.949] FindNextFileW (in: hFindFile=0x104dd70, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa08f4ff0, ftCreationTime.dwHighDateTime=0x1d5e316, ftLastAccessTime.dwLowDateTime=0x16ed4c80, ftLastAccessTime.dwHighDateTime=0x1d5f0a8, ftLastWriteTime.dwLowDateTime=0x16ed4c80, ftLastWriteTime.dwHighDateTime=0x1d5f0a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.949] FindNextFileW (in: hFindFile=0x104dd70, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x378f94e0, ftCreationTime.dwHighDateTime=0x1d5e22d, ftLastAccessTime.dwLowDateTime=0xf1ed060, ftLastAccessTime.dwHighDateTime=0x1d5e201, ftLastWriteTime.dwLowDateTime=0xf1ed060, ftLastWriteTime.dwHighDateTime=0x1d5e201, nFileSizeHigh=0x0, nFileSizeLow=0x16a5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="j-cqq.mp3", cAlternateFileName="")) returned 1 [0107.950] FindNextFileW (in: hFindFile=0x104dd70, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ab71ca0, ftCreationTime.dwHighDateTime=0x1d5e17c, ftLastAccessTime.dwLowDateTime=0x94b6f6e0, ftLastAccessTime.dwHighDateTime=0x1d5eef3, ftLastWriteTime.dwLowDateTime=0x94b6f6e0, ftLastWriteTime.dwHighDateTime=0x1d5eef3, nFileSizeHigh=0x0, nFileSizeLow=0x13c5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="nn29h-Uw1.m4a", cAlternateFileName="NN29H-~1.M4A")) returned 1 [0107.950] FindNextFileW (in: hFindFile=0x104dd70, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3343bb0, ftCreationTime.dwHighDateTime=0x1d5e932, ftLastAccessTime.dwLowDateTime=0xe103fb80, ftLastAccessTime.dwHighDateTime=0x1d5e285, ftLastWriteTime.dwLowDateTime=0xe103fb80, ftLastWriteTime.dwHighDateTime=0x1d5e285, nFileSizeHigh=0x0, nFileSizeLow=0x1256, dwReserved0=0x0, dwReserved1=0x0, cFileName="phK3Wky39cda3ZUE0.mp3", cAlternateFileName="PHK3WK~1.MP3")) returned 1 [0107.950] FindNextFileW (in: hFindFile=0x104dd70, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3055bed0, ftCreationTime.dwHighDateTime=0x1d5e6e6, ftLastAccessTime.dwLowDateTime=0x80d85bb0, ftLastAccessTime.dwHighDateTime=0x1d5ece0, ftLastWriteTime.dwLowDateTime=0x80d85bb0, ftLastWriteTime.dwHighDateTime=0x1d5ece0, nFileSizeHigh=0x0, nFileSizeLow=0x6785, dwReserved0=0x0, dwReserved1=0x0, cFileName="S ARWdZH7syt.wav", cAlternateFileName="SARWDZ~1.WAV")) returned 1 [0107.950] FindNextFileW (in: hFindFile=0x104dd70, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6e6b110, ftCreationTime.dwHighDateTime=0x1d5ed58, ftLastAccessTime.dwLowDateTime=0x84623a20, ftLastAccessTime.dwHighDateTime=0x1d5f01f, ftLastWriteTime.dwLowDateTime=0x84623a20, ftLastWriteTime.dwHighDateTime=0x1d5f01f, nFileSizeHigh=0x0, nFileSizeLow=0x1090b, dwReserved0=0x0, dwReserved1=0x0, cFileName="XffLqyVGZsxclhsBc5.mp3", cAlternateFileName="XFFLQY~1.MP3")) returned 1 [0107.950] FindNextFileW (in: hFindFile=0x104dd70, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6e6b110, ftCreationTime.dwHighDateTime=0x1d5ed58, ftLastAccessTime.dwLowDateTime=0x84623a20, ftLastAccessTime.dwHighDateTime=0x1d5f01f, ftLastWriteTime.dwLowDateTime=0x84623a20, ftLastWriteTime.dwHighDateTime=0x1d5f01f, nFileSizeHigh=0x0, nFileSizeLow=0x1090b, dwReserved0=0x0, dwReserved1=0x0, cFileName="XffLqyVGZsxclhsBc5.mp3", cAlternateFileName="XFFLQY~1.MP3")) returned 0 [0107.951] FindClose (in: hFindFile=0x104dd70 | out: hFindFile=0x104dd70) returned 1 [0107.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeadc) returned 1 [0107.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeae8) returned 1 [0107.951] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\j-cqq.mp3", nBufferLength=0x105, lpBuffer=0xefe488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\j-cqq.mp3", lpFilePart=0x0) returned 0x47 [0107.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9cc) returned 1 [0107.951] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\j-cqq.mp3" (normalized: "c:\\users\\fd1hvy\\music\\lepxlflso 1bubvqm k\\xt6cfkfiza1ue_bnko5\\j-cqq.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0107.951] GetFileType (hFile=0x2e4) returned 0x1 [0107.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9c8) returned 1 [0107.951] GetFileType (hFile=0x2e4) returned 0x1 [0107.951] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeac8 | out: lpFileSizeHigh=0xefeac8*=0x0) returned 0x16a5d [0108.064] ReadFile (in: hFile=0x2e4, lpBuffer=0x3e31a48, nNumberOfBytesToRead=0x16a5d, lpNumberOfBytesRead=0xefea74, lpOverlapped=0x0 | out: lpBuffer=0x3e31a48*, lpNumberOfBytesRead=0xefea74*=0x16a5d, lpOverlapped=0x0) returned 1 [0108.066] CloseHandle (hObject=0x2e4) returned 1 [0108.092] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe58c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0108.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0108.092] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeabc | out: lpFileInformation=0xefeabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0108.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0108.092] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\j-cqq.mp3", nBufferLength=0x105, lpBuffer=0xefe474, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\j-cqq.mp3", lpFilePart=0x0) returned 0x47 [0108.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9b8) returned 1 [0108.092] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\j-cqq.mp3" (normalized: "c:\\users\\fd1hvy\\music\\lepxlflso 1bubvqm k\\xt6cfkfiza1ue_bnko5\\j-cqq.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0108.141] GetFileType (hFile=0x2e4) returned 0x1 [0108.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9b4) returned 1 [0108.141] GetFileType (hFile=0x2e4) returned 0x1 [0108.141] WriteFile (in: hFile=0x2e4, lpBuffer=0x3ed3940*, nNumberOfBytesToWrite=0x16a60, lpNumberOfBytesWritten=0xefea68, lpOverlapped=0x0 | out: lpBuffer=0x3ed3940*, lpNumberOfBytesWritten=0xefea68*=0x16a60, lpOverlapped=0x0) returned 1 [0108.143] CloseHandle (hObject=0x2e4) returned 1 [0108.150] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\j-cqq.mp3", nBufferLength=0x105, lpBuffer=0xefe598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\j-cqq.mp3", lpFilePart=0x0) returned 0x47 [0108.150] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\j-cqq.mp3.UGMH", nBufferLength=0x105, lpBuffer=0xefe598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\j-cqq.mp3.UGMH", lpFilePart=0x0) returned 0x4c [0108.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea4c) returned 1 [0108.150] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\j-cqq.mp3" (normalized: "c:\\users\\fd1hvy\\music\\lepxlflso 1bubvqm k\\xt6cfkfiza1ue_bnko5\\j-cqq.mp3"), fInfoLevelId=0x0, lpFileInformation=0xefeac8 | out: lpFileInformation=0xefeac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x378f94e0, ftCreationTime.dwHighDateTime=0x1d5e22d, ftLastAccessTime.dwLowDateTime=0xf1ed060, ftLastAccessTime.dwHighDateTime=0x1d5e201, ftLastWriteTime.dwLowDateTime=0xd68f3018, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x16a60)) returned 1 [0108.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea48) returned 1 [0108.150] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\j-cqq.mp3" (normalized: "c:\\users\\fd1hvy\\music\\lepxlflso 1bubvqm k\\xt6cfkfiza1ue_bnko5\\j-cqq.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\j-cqq.mp3.UGMH" (normalized: "c:\\users\\fd1hvy\\music\\lepxlflso 1bubvqm k\\xt6cfkfiza1ue_bnko5\\j-cqq.mp3.ugmh")) returned 1 [0108.151] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\phK3Wky39cda3ZUE0.mp3", nBufferLength=0x105, lpBuffer=0xefe488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\phK3Wky39cda3ZUE0.mp3", lpFilePart=0x0) returned 0x53 [0108.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9cc) returned 1 [0108.151] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\phK3Wky39cda3ZUE0.mp3" (normalized: "c:\\users\\fd1hvy\\music\\lepxlflso 1bubvqm k\\xt6cfkfiza1ue_bnko5\\phk3wky39cda3zue0.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0108.151] GetFileType (hFile=0x2e4) returned 0x1 [0108.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9c8) returned 1 [0108.151] GetFileType (hFile=0x2e4) returned 0x1 [0108.151] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeac8 | out: lpFileSizeHigh=0xefeac8*=0x0) returned 0x1256 [0108.151] ReadFile (in: hFile=0x2e4, lpBuffer=0x2e89874, nNumberOfBytesToRead=0x1256, lpNumberOfBytesRead=0xefea74, lpOverlapped=0x0 | out: lpBuffer=0x2e89874*, lpNumberOfBytesRead=0xefea74*=0x1256, lpOverlapped=0x0) returned 1 [0108.152] CloseHandle (hObject=0x2e4) returned 1 [0108.174] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe58c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0108.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0108.174] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeabc | out: lpFileInformation=0xefeabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0108.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0108.174] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\phK3Wky39cda3ZUE0.mp3", nBufferLength=0x105, lpBuffer=0xefe474, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\phK3Wky39cda3ZUE0.mp3", lpFilePart=0x0) returned 0x53 [0108.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9b8) returned 1 [0108.174] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\phK3Wky39cda3ZUE0.mp3" (normalized: "c:\\users\\fd1hvy\\music\\lepxlflso 1bubvqm k\\xt6cfkfiza1ue_bnko5\\phk3wky39cda3zue0.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0108.175] GetFileType (hFile=0x2e4) returned 0x1 [0108.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9b4) returned 1 [0108.176] GetFileType (hFile=0x2e4) returned 0x1 [0108.176] WriteFile (in: hFile=0x2e4, lpBuffer=0x2edc23c*, nNumberOfBytesToWrite=0x1260, lpNumberOfBytesWritten=0xefea68, lpOverlapped=0x0 | out: lpBuffer=0x2edc23c*, lpNumberOfBytesWritten=0xefea68*=0x1260, lpOverlapped=0x0) returned 1 [0108.177] CloseHandle (hObject=0x2e4) returned 1 [0108.178] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\phK3Wky39cda3ZUE0.mp3", nBufferLength=0x105, lpBuffer=0xefe598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\phK3Wky39cda3ZUE0.mp3", lpFilePart=0x0) returned 0x53 [0108.178] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\phK3Wky39cda3ZUE0.mp3.UGMH", nBufferLength=0x105, lpBuffer=0xefe598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\phK3Wky39cda3ZUE0.mp3.UGMH", lpFilePart=0x0) returned 0x58 [0108.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea4c) returned 1 [0108.178] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\phK3Wky39cda3ZUE0.mp3" (normalized: "c:\\users\\fd1hvy\\music\\lepxlflso 1bubvqm k\\xt6cfkfiza1ue_bnko5\\phk3wky39cda3zue0.mp3"), fInfoLevelId=0x0, lpFileInformation=0xefeac8 | out: lpFileInformation=0xefeac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3343bb0, ftCreationTime.dwHighDateTime=0x1d5e932, ftLastAccessTime.dwLowDateTime=0xe103fb80, ftLastAccessTime.dwHighDateTime=0x1d5e285, ftLastWriteTime.dwLowDateTime=0xd693f58a, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x1260)) returned 1 [0108.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea48) returned 1 [0108.179] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\phK3Wky39cda3ZUE0.mp3" (normalized: "c:\\users\\fd1hvy\\music\\lepxlflso 1bubvqm k\\xt6cfkfiza1ue_bnko5\\phk3wky39cda3zue0.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\phK3Wky39cda3ZUE0.mp3.UGMH" (normalized: "c:\\users\\fd1hvy\\music\\lepxlflso 1bubvqm k\\xt6cfkfiza1ue_bnko5\\phk3wky39cda3zue0.mp3.ugmh")) returned 1 [0108.180] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\XffLqyVGZsxclhsBc5.mp3", nBufferLength=0x105, lpBuffer=0xefe488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\XffLqyVGZsxclhsBc5.mp3", lpFilePart=0x0) returned 0x54 [0108.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9cc) returned 1 [0108.180] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\XffLqyVGZsxclhsBc5.mp3" (normalized: "c:\\users\\fd1hvy\\music\\lepxlflso 1bubvqm k\\xt6cfkfiza1ue_bnko5\\xfflqyvgzsxclhsbc5.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0108.180] GetFileType (hFile=0x2e4) returned 0x1 [0108.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9c8) returned 1 [0108.180] GetFileType (hFile=0x2e4) returned 0x1 [0108.180] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeac8 | out: lpFileSizeHigh=0xefeac8*=0x0) returned 0x1090b [0108.180] ReadFile (in: hFile=0x2e4, lpBuffer=0x2edda90, nNumberOfBytesToRead=0x1090b, lpNumberOfBytesRead=0xefea74, lpOverlapped=0x0 | out: lpBuffer=0x2edda90*, lpNumberOfBytesRead=0xefea74*=0x1090b, lpOverlapped=0x0) returned 1 [0108.182] CloseHandle (hObject=0x2e4) returned 1 [0108.223] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe58c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0108.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0108.223] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeabc | out: lpFileInformation=0xefeabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0108.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0108.224] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\XffLqyVGZsxclhsBc5.mp3", nBufferLength=0x105, lpBuffer=0xefe474, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\XffLqyVGZsxclhsBc5.mp3", lpFilePart=0x0) returned 0x54 [0108.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9b8) returned 1 [0108.224] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\XffLqyVGZsxclhsBc5.mp3" (normalized: "c:\\users\\fd1hvy\\music\\lepxlflso 1bubvqm k\\xt6cfkfiza1ue_bnko5\\xfflqyvgzsxclhsbc5.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0108.226] GetFileType (hFile=0x2e4) returned 0x1 [0108.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9b4) returned 1 [0108.226] GetFileType (hFile=0x2e4) returned 0x1 [0108.226] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f5c3bc*, nNumberOfBytesToWrite=0x10910, lpNumberOfBytesWritten=0xefea68, lpOverlapped=0x0 | out: lpBuffer=0x2f5c3bc*, lpNumberOfBytesWritten=0xefea68*=0x10910, lpOverlapped=0x0) returned 1 [0108.228] CloseHandle (hObject=0x2e4) returned 1 [0108.233] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\XffLqyVGZsxclhsBc5.mp3", nBufferLength=0x105, lpBuffer=0xefe598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\XffLqyVGZsxclhsBc5.mp3", lpFilePart=0x0) returned 0x54 [0108.233] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\XffLqyVGZsxclhsBc5.mp3.UGMH", nBufferLength=0x105, lpBuffer=0xefe598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\XffLqyVGZsxclhsBc5.mp3.UGMH", lpFilePart=0x0) returned 0x59 [0108.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea4c) returned 1 [0108.233] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\XffLqyVGZsxclhsBc5.mp3" (normalized: "c:\\users\\fd1hvy\\music\\lepxlflso 1bubvqm k\\xt6cfkfiza1ue_bnko5\\xfflqyvgzsxclhsbc5.mp3"), fInfoLevelId=0x0, lpFileInformation=0xefeac8 | out: lpFileInformation=0xefeac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6e6b110, ftCreationTime.dwHighDateTime=0x1d5ed58, ftLastAccessTime.dwLowDateTime=0x84623a20, ftLastAccessTime.dwHighDateTime=0x1d5f01f, ftLastWriteTime.dwLowDateTime=0xd69b1c9b, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x10910)) returned 1 [0108.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea48) returned 1 [0108.233] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\XffLqyVGZsxclhsBc5.mp3" (normalized: "c:\\users\\fd1hvy\\music\\lepxlflso 1bubvqm k\\xt6cfkfiza1ue_bnko5\\xfflqyvgzsxclhsbc5.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\LePxLflso 1buBvQm K\\xT6CFKfiZA1Ue_bNKO5\\XffLqyVGZsxclhsBc5.mp3.UGMH" (normalized: "c:\\users\\fd1hvy\\music\\lepxlflso 1bubvqm k\\xt6cfkfiza1ue_bnko5\\xfflqyvgzsxclhsbc5.mp3.ugmh")) returned 1 [0108.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec08) returned 1 [0108.278] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive", nBufferLength=0x105, lpBuffer=0xefe6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\OneDrive", lpFilePart=0x0) returned 0x18 [0108.278] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive\\*", lpFindFileData=0xefe930 | out: lpFindFileData=0xefe930*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104e470 [0108.283] FindNextFileW (in: hFindFile=0x104e470, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.284] FindNextFileW (in: hFindFile=0x104e470, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0108.284] FindNextFileW (in: hFindFile=0x104e470, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0108.284] FindClose (in: hFindFile=0x104e470 | out: hFindFile=0x104e470) returned 1 [0108.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebc4) returned 1 [0108.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebd0) returned 1 [0108.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec08) returned 1 [0108.285] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive", nBufferLength=0x105, lpBuffer=0xefe6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\OneDrive", lpFilePart=0x0) returned 0x18 [0108.285] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive\\*", lpFindFileData=0xefe930 | out: lpFindFileData=0xefe930*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104df70 [0108.285] FindNextFileW (in: hFindFile=0x104df70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.286] FindNextFileW (in: hFindFile=0x104df70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0108.286] FindNextFileW (in: hFindFile=0x104df70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0108.286] FindClose (in: hFindFile=0x104df70 | out: hFindFile=0x104df70) returned 1 [0108.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebc4) returned 1 [0108.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebd0) returned 1 [0108.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec08) returned 1 [0108.286] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games", nBufferLength=0x105, lpBuffer=0xefe6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Saved Games", lpFilePart=0x0) returned 0x1b [0108.287] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games\\*", lpFindFileData=0xefe930 | out: lpFindFileData=0xefe930*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104e370 [0108.287] FindNextFileW (in: hFindFile=0x104e370, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.287] FindNextFileW (in: hFindFile=0x104e370, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0108.287] FindNextFileW (in: hFindFile=0x104e370, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0108.288] FindClose (in: hFindFile=0x104e370 | out: hFindFile=0x104e370) returned 1 [0108.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebc4) returned 1 [0108.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebd0) returned 1 [0108.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec08) returned 1 [0108.288] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games", nBufferLength=0x105, lpBuffer=0xefe6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Saved Games", lpFilePart=0x0) returned 0x1b [0108.288] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games\\*", lpFindFileData=0xefe930 | out: lpFindFileData=0xefe930*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104e370 [0108.288] FindNextFileW (in: hFindFile=0x104e370, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.288] FindNextFileW (in: hFindFile=0x104e370, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0108.289] FindNextFileW (in: hFindFile=0x104e370, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0108.289] FindClose (in: hFindFile=0x104e370 | out: hFindFile=0x104e370) returned 1 [0108.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebc4) returned 1 [0108.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebd0) returned 1 [0108.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec08) returned 1 [0108.289] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites", nBufferLength=0x105, lpBuffer=0xefe6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites", lpFilePart=0x0) returned 0x19 [0108.289] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\*", lpFindFileData=0xefe930 | out: lpFindFileData=0xefe930*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104df30 [0108.289] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.290] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43598c8e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43b9f870, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x43b9f870, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bing.url", cAlternateFileName="")) returned 1 [0108.290] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0108.290] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0108.290] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 0 [0108.290] FindClose (in: hFindFile=0x104df30 | out: hFindFile=0x104df30) returned 1 [0108.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebc4) returned 1 [0108.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebd0) returned 1 [0108.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec08) returned 1 [0108.291] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites", nBufferLength=0x105, lpBuffer=0xefe6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites", lpFilePart=0x0) returned 0x19 [0108.291] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\*", lpFindFileData=0xefe930 | out: lpFindFileData=0xefe930*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104dd70 [0108.291] FindNextFileW (in: hFindFile=0x104dd70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.291] FindNextFileW (in: hFindFile=0x104dd70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43598c8e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43b9f870, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x43b9f870, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bing.url", cAlternateFileName="")) returned 1 [0108.292] FindNextFileW (in: hFindFile=0x104dd70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0108.292] FindNextFileW (in: hFindFile=0x104dd70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0108.292] FindNextFileW (in: hFindFile=0x104dd70, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0108.292] FindClose (in: hFindFile=0x104dd70 | out: hFindFile=0x104dd70) returned 1 [0108.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebc4) returned 1 [0108.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebd0) returned 1 [0108.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb94) returned 1 [0108.292] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0xefe648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites\\Links", lpFilePart=0x0) returned 0x1f [0108.292] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\*", lpFindFileData=0xefe8bc | out: lpFindFileData=0xefe8bc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104e2f0 [0108.293] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.293] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0108.293] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0108.293] FindClose (in: hFindFile=0x104e2f0 | out: hFindFile=0x104e2f0) returned 1 [0108.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb50) returned 1 [0108.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb5c) returned 1 [0108.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb94) returned 1 [0108.294] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0xefe648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites\\Links", lpFilePart=0x0) returned 0x1f [0108.294] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\*", lpFindFileData=0xefe8bc | out: lpFindFileData=0xefe8bc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104e370 [0108.294] FindNextFileW (in: hFindFile=0x104e370, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.294] FindNextFileW (in: hFindFile=0x104e370, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0108.295] FindNextFileW (in: hFindFile=0x104e370, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0108.295] FindClose (in: hFindFile=0x104e370 | out: hFindFile=0x104e370) returned 1 [0108.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb50) returned 1 [0108.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb5c) returned 1 [0108.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec08) returned 1 [0108.295] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Searches", nBufferLength=0x105, lpBuffer=0xefe6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Searches", lpFilePart=0x0) returned 0x18 [0108.295] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\*", lpFindFileData=0xefe930 | out: lpFindFileData=0xefe930*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104ddf0 [0108.295] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.296] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0108.296] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44269063, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44269063, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44269063, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0108.297] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44242e24, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44242e24, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44242e24, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0108.297] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 1 [0108.297] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0108.297] FindClose (in: hFindFile=0x104ddf0 | out: hFindFile=0x104ddf0) returned 1 [0108.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebc4) returned 1 [0108.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebd0) returned 1 [0108.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec08) returned 1 [0108.298] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Searches", nBufferLength=0x105, lpBuffer=0xefe6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Searches", lpFilePart=0x0) returned 0x18 [0108.298] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\*", lpFindFileData=0xefe930 | out: lpFindFileData=0xefe930*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104dff0 [0108.298] FindNextFileW (in: hFindFile=0x104dff0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.298] FindNextFileW (in: hFindFile=0x104dff0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0108.299] FindNextFileW (in: hFindFile=0x104dff0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44269063, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44269063, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44269063, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0108.299] FindNextFileW (in: hFindFile=0x104dff0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44242e24, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44242e24, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44242e24, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0108.299] FindNextFileW (in: hFindFile=0x104dff0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 1 [0108.299] FindNextFileW (in: hFindFile=0x104dff0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 0 [0108.299] FindClose (in: hFindFile=0x104dff0 | out: hFindFile=0x104dff0) returned 1 [0108.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebc4) returned 1 [0108.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebd0) returned 1 [0108.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec08) returned 1 [0108.300] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos", nBufferLength=0x105, lpBuffer=0xefe6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos", lpFilePart=0x0) returned 0x16 [0108.300] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\*", lpFindFileData=0xefe930 | out: lpFindFileData=0xefe930*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe61b0995, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe61b0995, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104e2f0 [0108.300] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe61b0995, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe61b0995, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.300] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43f94523, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43f94523, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0108.300] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd869cef0, ftCreationTime.dwHighDateTime=0x1d5e73a, ftLastAccessTime.dwLowDateTime=0xd19f4c80, ftLastAccessTime.dwHighDateTime=0x1d5e2df, ftLastWriteTime.dwLowDateTime=0xd19f4c80, ftLastWriteTime.dwHighDateTime=0x1d5e2df, nFileSizeHigh=0x0, nFileSizeLow=0x161d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EwfjwTAjtZRlCL8G1qZ.flv", cAlternateFileName="EWFJWT~1.FLV")) returned 1 [0108.301] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcab7d7f0, ftCreationTime.dwHighDateTime=0x1d5e381, ftLastAccessTime.dwLowDateTime=0x62a818d0, ftLastAccessTime.dwHighDateTime=0x1d5e2b1, ftLastWriteTime.dwLowDateTime=0x62a818d0, ftLastWriteTime.dwHighDateTime=0x1d5e2b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="k32VUR", cAlternateFileName="")) returned 1 [0108.301] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5289a70, ftCreationTime.dwHighDateTime=0x1d5e3c8, ftLastAccessTime.dwLowDateTime=0x2f1df600, ftLastAccessTime.dwHighDateTime=0x1d5eb63, ftLastWriteTime.dwLowDateTime=0x2f1df600, ftLastWriteTime.dwHighDateTime=0x1d5eb63, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LrqG45 pQjyr9v", cAlternateFileName="LRQG45~1")) returned 1 [0108.301] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcef33140, ftCreationTime.dwHighDateTime=0x1d5e91f, ftLastAccessTime.dwLowDateTime=0x6be988f0, ftLastAccessTime.dwHighDateTime=0x1d5e1cd, ftLastWriteTime.dwLowDateTime=0x6be988f0, ftLastWriteTime.dwHighDateTime=0x1d5e1cd, nFileSizeHigh=0x0, nFileSizeLow=0x10a72, dwReserved0=0x0, dwReserved1=0x0, cFileName="ocTz4.flv", cAlternateFileName="")) returned 1 [0108.301] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97707110, ftCreationTime.dwHighDateTime=0x1d5edc0, ftLastAccessTime.dwLowDateTime=0xfd4bad30, ftLastAccessTime.dwHighDateTime=0x1d5e10c, ftLastWriteTime.dwLowDateTime=0xfd4bad30, ftLastWriteTime.dwHighDateTime=0x1d5e10c, nFileSizeHigh=0x0, nFileSizeLow=0x17aa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="QG_9YyDapkokR15.swf", cAlternateFileName="QG_9YY~1.SWF")) returned 1 [0108.301] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b862620, ftCreationTime.dwHighDateTime=0x1d5eff2, ftLastAccessTime.dwLowDateTime=0xb7088780, ftLastAccessTime.dwHighDateTime=0x1d5ee0e, ftLastWriteTime.dwLowDateTime=0xb7088780, ftLastWriteTime.dwHighDateTime=0x1d5ee0e, nFileSizeHigh=0x0, nFileSizeLow=0x151f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="t8DrfXp.swf", cAlternateFileName="")) returned 1 [0108.302] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x731f6610, ftCreationTime.dwHighDateTime=0x1d5e364, ftLastAccessTime.dwLowDateTime=0x19d559b0, ftLastAccessTime.dwHighDateTime=0x1d5e3a1, ftLastWriteTime.dwLowDateTime=0x19d559b0, ftLastWriteTime.dwHighDateTime=0x1d5e3a1, nFileSizeHigh=0x0, nFileSizeLow=0x3b3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="T_Q-w.avi", cAlternateFileName="")) returned 1 [0108.302] FindNextFileW (in: hFindFile=0x104e2f0, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0108.302] FindClose (in: hFindFile=0x104e2f0 | out: hFindFile=0x104e2f0) returned 1 [0108.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebc4) returned 1 [0108.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebd0) returned 1 [0108.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec08) returned 1 [0108.302] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos", nBufferLength=0x105, lpBuffer=0xefe6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos", lpFilePart=0x0) returned 0x16 [0108.302] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\*", lpFindFileData=0xefe930 | out: lpFindFileData=0xefe930*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe61b0995, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe61b0995, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104e470 [0108.302] FindNextFileW (in: hFindFile=0x104e470, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe61b0995, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe61b0995, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.303] FindNextFileW (in: hFindFile=0x104e470, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43f94523, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43f94523, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0108.303] FindNextFileW (in: hFindFile=0x104e470, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd869cef0, ftCreationTime.dwHighDateTime=0x1d5e73a, ftLastAccessTime.dwLowDateTime=0xd19f4c80, ftLastAccessTime.dwHighDateTime=0x1d5e2df, ftLastWriteTime.dwLowDateTime=0xd19f4c80, ftLastWriteTime.dwHighDateTime=0x1d5e2df, nFileSizeHigh=0x0, nFileSizeLow=0x161d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EwfjwTAjtZRlCL8G1qZ.flv", cAlternateFileName="EWFJWT~1.FLV")) returned 1 [0108.303] FindNextFileW (in: hFindFile=0x104e470, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcab7d7f0, ftCreationTime.dwHighDateTime=0x1d5e381, ftLastAccessTime.dwLowDateTime=0x62a818d0, ftLastAccessTime.dwHighDateTime=0x1d5e2b1, ftLastWriteTime.dwLowDateTime=0x62a818d0, ftLastWriteTime.dwHighDateTime=0x1d5e2b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="k32VUR", cAlternateFileName="")) returned 1 [0108.303] FindNextFileW (in: hFindFile=0x104e470, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5289a70, ftCreationTime.dwHighDateTime=0x1d5e3c8, ftLastAccessTime.dwLowDateTime=0x2f1df600, ftLastAccessTime.dwHighDateTime=0x1d5eb63, ftLastWriteTime.dwLowDateTime=0x2f1df600, ftLastWriteTime.dwHighDateTime=0x1d5eb63, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LrqG45 pQjyr9v", cAlternateFileName="LRQG45~1")) returned 1 [0108.303] FindNextFileW (in: hFindFile=0x104e470, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcef33140, ftCreationTime.dwHighDateTime=0x1d5e91f, ftLastAccessTime.dwLowDateTime=0x6be988f0, ftLastAccessTime.dwHighDateTime=0x1d5e1cd, ftLastWriteTime.dwLowDateTime=0x6be988f0, ftLastWriteTime.dwHighDateTime=0x1d5e1cd, nFileSizeHigh=0x0, nFileSizeLow=0x10a72, dwReserved0=0x0, dwReserved1=0x0, cFileName="ocTz4.flv", cAlternateFileName="")) returned 1 [0108.303] FindNextFileW (in: hFindFile=0x104e470, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97707110, ftCreationTime.dwHighDateTime=0x1d5edc0, ftLastAccessTime.dwLowDateTime=0xfd4bad30, ftLastAccessTime.dwHighDateTime=0x1d5e10c, ftLastWriteTime.dwLowDateTime=0xfd4bad30, ftLastWriteTime.dwHighDateTime=0x1d5e10c, nFileSizeHigh=0x0, nFileSizeLow=0x17aa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="QG_9YyDapkokR15.swf", cAlternateFileName="QG_9YY~1.SWF")) returned 1 [0108.303] FindNextFileW (in: hFindFile=0x104e470, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b862620, ftCreationTime.dwHighDateTime=0x1d5eff2, ftLastAccessTime.dwLowDateTime=0xb7088780, ftLastAccessTime.dwHighDateTime=0x1d5ee0e, ftLastWriteTime.dwLowDateTime=0xb7088780, ftLastWriteTime.dwHighDateTime=0x1d5ee0e, nFileSizeHigh=0x0, nFileSizeLow=0x151f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="t8DrfXp.swf", cAlternateFileName="")) returned 1 [0108.303] FindNextFileW (in: hFindFile=0x104e470, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x731f6610, ftCreationTime.dwHighDateTime=0x1d5e364, ftLastAccessTime.dwLowDateTime=0x19d559b0, ftLastAccessTime.dwHighDateTime=0x1d5e3a1, ftLastWriteTime.dwLowDateTime=0x19d559b0, ftLastWriteTime.dwHighDateTime=0x1d5e3a1, nFileSizeHigh=0x0, nFileSizeLow=0x3b3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="T_Q-w.avi", cAlternateFileName="")) returned 1 [0108.303] FindNextFileW (in: hFindFile=0x104e470, lpFindFileData=0xefe93c | out: lpFindFileData=0xefe93c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x731f6610, ftCreationTime.dwHighDateTime=0x1d5e364, ftLastAccessTime.dwLowDateTime=0x19d559b0, ftLastAccessTime.dwHighDateTime=0x1d5e3a1, ftLastWriteTime.dwLowDateTime=0x19d559b0, ftLastWriteTime.dwHighDateTime=0x1d5e3a1, nFileSizeHigh=0x0, nFileSizeLow=0x3b3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="T_Q-w.avi", cAlternateFileName="")) returned 0 [0108.303] FindClose (in: hFindFile=0x104e470 | out: hFindFile=0x104e470) returned 1 [0108.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebc4) returned 1 [0108.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebd0) returned 1 [0108.303] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\T_Q-w.avi", nBufferLength=0x105, lpBuffer=0xefe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\T_Q-w.avi", lpFilePart=0x0) returned 0x20 [0108.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0108.304] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\T_Q-w.avi" (normalized: "c:\\users\\fd1hvy\\videos\\t_q-w.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0108.304] GetFileType (hFile=0x2e4) returned 0x1 [0108.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0108.304] GetFileType (hFile=0x2e4) returned 0x1 [0108.304] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefebb0 | out: lpFileSizeHigh=0xefebb0*=0x0) returned 0x3b3a [0108.304] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f73fa8, nNumberOfBytesToRead=0x3b3a, lpNumberOfBytesRead=0xefeb5c, lpOverlapped=0x0 | out: lpBuffer=0x2f73fa8*, lpNumberOfBytesRead=0xefeb5c*=0x3b3a, lpOverlapped=0x0) returned 1 [0108.305] CloseHandle (hObject=0x2e4) returned 1 [0108.343] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0108.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0108.343] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0108.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0108.348] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\T_Q-w.avi", nBufferLength=0x105, lpBuffer=0xefe55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\T_Q-w.avi", lpFilePart=0x0) returned 0x20 [0108.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa0) returned 1 [0108.348] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\T_Q-w.avi" (normalized: "c:\\users\\fd1hvy\\videos\\t_q-w.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0108.350] GetFileType (hFile=0x2e4) returned 0x1 [0108.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea9c) returned 1 [0108.350] GetFileType (hFile=0x2e4) returned 0x1 [0108.350] WriteFile (in: hFile=0x2e4, lpBuffer=0x2fd35d0*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2fd35d0*, lpNumberOfBytesWritten=0xefeb50*=0x3b40, lpOverlapped=0x0) returned 1 [0108.351] CloseHandle (hObject=0x2e4) returned 1 [0108.353] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\T_Q-w.avi", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\T_Q-w.avi", lpFilePart=0x0) returned 0x20 [0108.353] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\T_Q-w.avi.UGMH", nBufferLength=0x105, lpBuffer=0xefe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\T_Q-w.avi.UGMH", lpFilePart=0x0) returned 0x25 [0108.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb34) returned 1 [0108.353] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\T_Q-w.avi" (normalized: "c:\\users\\fd1hvy\\videos\\t_q-w.avi"), fInfoLevelId=0x0, lpFileInformation=0xefebb0 | out: lpFileInformation=0xefebb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x731f6610, ftCreationTime.dwHighDateTime=0x1d5e364, ftLastAccessTime.dwLowDateTime=0x19d559b0, ftLastAccessTime.dwHighDateTime=0x1d5e3a1, ftLastWriteTime.dwLowDateTime=0xd6ae2fd9, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x3b40)) returned 1 [0108.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb30) returned 1 [0108.353] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\T_Q-w.avi" (normalized: "c:\\users\\fd1hvy\\videos\\t_q-w.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\T_Q-w.avi.UGMH" (normalized: "c:\\users\\fd1hvy\\videos\\t_q-w.avi.ugmh")) returned 1 [0108.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb94) returned 1 [0108.354] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\k32VUR", nBufferLength=0x105, lpBuffer=0xefe648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\k32VUR", lpFilePart=0x0) returned 0x1d [0108.354] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\k32VUR\\*", lpFindFileData=0xefe8bc | out: lpFindFileData=0xefe8bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcab7d7f0, ftCreationTime.dwHighDateTime=0x1d5e381, ftLastAccessTime.dwLowDateTime=0x62a818d0, ftLastAccessTime.dwHighDateTime=0x1d5e2b1, ftLastWriteTime.dwLowDateTime=0x62a818d0, ftLastWriteTime.dwHighDateTime=0x1d5e2b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104dff0 [0108.355] FindNextFileW (in: hFindFile=0x104dff0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcab7d7f0, ftCreationTime.dwHighDateTime=0x1d5e381, ftLastAccessTime.dwLowDateTime=0x62a818d0, ftLastAccessTime.dwHighDateTime=0x1d5e2b1, ftLastWriteTime.dwLowDateTime=0x62a818d0, ftLastWriteTime.dwHighDateTime=0x1d5e2b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.355] FindNextFileW (in: hFindFile=0x104dff0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6b468b0, ftCreationTime.dwHighDateTime=0x1d5ec1a, ftLastAccessTime.dwLowDateTime=0x1ce1c810, ftLastAccessTime.dwHighDateTime=0x1d5ea80, ftLastWriteTime.dwLowDateTime=0x1ce1c810, ftLastWriteTime.dwHighDateTime=0x1d5ea80, nFileSizeHigh=0x0, nFileSizeLow=0x14d2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="0KNIuMeFfMCBO.mkv", cAlternateFileName="0KNIUM~1.MKV")) returned 1 [0108.355] FindNextFileW (in: hFindFile=0x104dff0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac8e3d00, ftCreationTime.dwHighDateTime=0x1d5e8c2, ftLastAccessTime.dwLowDateTime=0xa99e8720, ftLastAccessTime.dwHighDateTime=0x1d5e21f, ftLastWriteTime.dwLowDateTime=0xa99e8720, ftLastWriteTime.dwHighDateTime=0x1d5e21f, nFileSizeHigh=0x0, nFileSizeLow=0x2d02, dwReserved0=0x0, dwReserved1=0x0, cFileName="7QwzXjh.avi", cAlternateFileName="")) returned 1 [0108.355] FindNextFileW (in: hFindFile=0x104dff0, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0108.355] FindClose (in: hFindFile=0x104dff0 | out: hFindFile=0x104dff0) returned 1 [0108.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb50) returned 1 [0108.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb5c) returned 1 [0108.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb94) returned 1 [0108.355] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\k32VUR", nBufferLength=0x105, lpBuffer=0xefe648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\k32VUR", lpFilePart=0x0) returned 0x1d [0108.355] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\k32VUR\\*", lpFindFileData=0xefe8bc | out: lpFindFileData=0xefe8bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcab7d7f0, ftCreationTime.dwHighDateTime=0x1d5e381, ftLastAccessTime.dwLowDateTime=0x62a818d0, ftLastAccessTime.dwHighDateTime=0x1d5e2b1, ftLastWriteTime.dwLowDateTime=0x62a818d0, ftLastWriteTime.dwHighDateTime=0x1d5e2b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104df30 [0108.356] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcab7d7f0, ftCreationTime.dwHighDateTime=0x1d5e381, ftLastAccessTime.dwLowDateTime=0x62a818d0, ftLastAccessTime.dwHighDateTime=0x1d5e2b1, ftLastWriteTime.dwLowDateTime=0x62a818d0, ftLastWriteTime.dwHighDateTime=0x1d5e2b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.356] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6b468b0, ftCreationTime.dwHighDateTime=0x1d5ec1a, ftLastAccessTime.dwLowDateTime=0x1ce1c810, ftLastAccessTime.dwHighDateTime=0x1d5ea80, ftLastWriteTime.dwLowDateTime=0x1ce1c810, ftLastWriteTime.dwHighDateTime=0x1d5ea80, nFileSizeHigh=0x0, nFileSizeLow=0x14d2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="0KNIuMeFfMCBO.mkv", cAlternateFileName="0KNIUM~1.MKV")) returned 1 [0108.356] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac8e3d00, ftCreationTime.dwHighDateTime=0x1d5e8c2, ftLastAccessTime.dwLowDateTime=0xa99e8720, ftLastAccessTime.dwHighDateTime=0x1d5e21f, ftLastWriteTime.dwLowDateTime=0xa99e8720, ftLastWriteTime.dwHighDateTime=0x1d5e21f, nFileSizeHigh=0x0, nFileSizeLow=0x2d02, dwReserved0=0x0, dwReserved1=0x0, cFileName="7QwzXjh.avi", cAlternateFileName="")) returned 1 [0108.356] FindNextFileW (in: hFindFile=0x104df30, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac8e3d00, ftCreationTime.dwHighDateTime=0x1d5e8c2, ftLastAccessTime.dwLowDateTime=0xa99e8720, ftLastAccessTime.dwHighDateTime=0x1d5e21f, ftLastWriteTime.dwLowDateTime=0xa99e8720, ftLastWriteTime.dwHighDateTime=0x1d5e21f, nFileSizeHigh=0x0, nFileSizeLow=0x2d02, dwReserved0=0x0, dwReserved1=0x0, cFileName="7QwzXjh.avi", cAlternateFileName="")) returned 0 [0108.356] FindClose (in: hFindFile=0x104df30 | out: hFindFile=0x104df30) returned 1 [0108.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb50) returned 1 [0108.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb5c) returned 1 [0108.356] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\k32VUR\\0KNIuMeFfMCBO.mkv", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\k32VUR\\0KNIuMeFfMCBO.mkv", lpFilePart=0x0) returned 0x2f [0108.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0108.356] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\k32VUR\\0KNIuMeFfMCBO.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\k32vur\\0kniumeffmcbo.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0108.356] GetFileType (hFile=0x2e4) returned 0x1 [0108.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0108.356] GetFileType (hFile=0x2e4) returned 0x1 [0108.357] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0x14d2e [0108.358] ReadFile (in: hFile=0x2e4, lpBuffer=0x3f0b5e0, nNumberOfBytesToRead=0x14d2e, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x3f0b5e0*, lpNumberOfBytesRead=0xefeae8*=0x14d2e, lpOverlapped=0x0) returned 1 [0108.361] CloseHandle (hObject=0x2e4) returned 1 [0108.415] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0108.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0108.416] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0108.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0108.416] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\k32VUR\\0KNIuMeFfMCBO.mkv", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\k32VUR\\0KNIuMeFfMCBO.mkv", lpFilePart=0x0) returned 0x2f [0108.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0108.416] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\k32VUR\\0KNIuMeFfMCBO.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\k32vur\\0kniumeffmcbo.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0108.418] GetFileType (hFile=0x2e4) returned 0x1 [0108.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0108.418] GetFileType (hFile=0x2e4) returned 0x1 [0108.418] WriteFile (in: hFile=0x2e4, lpBuffer=0x3f73810*, nNumberOfBytesToWrite=0x14d30, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x3f73810*, lpNumberOfBytesWritten=0xefeadc*=0x14d30, lpOverlapped=0x0) returned 1 [0108.421] CloseHandle (hObject=0x2e4) returned 1 [0108.441] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\k32VUR\\0KNIuMeFfMCBO.mkv", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\k32VUR\\0KNIuMeFfMCBO.mkv", lpFilePart=0x0) returned 0x2f [0108.441] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\k32VUR\\0KNIuMeFfMCBO.mkv.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\k32VUR\\0KNIuMeFfMCBO.mkv.UGMH", lpFilePart=0x0) returned 0x34 [0108.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0108.441] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\k32VUR\\0KNIuMeFfMCBO.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\k32vur\\0kniumeffmcbo.mkv"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6b468b0, ftCreationTime.dwHighDateTime=0x1d5ec1a, ftLastAccessTime.dwLowDateTime=0x1ce1c810, ftLastAccessTime.dwHighDateTime=0x1d5ea80, ftLastWriteTime.dwLowDateTime=0xd6bc7c88, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x14d30)) returned 1 [0108.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0108.441] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\k32VUR\\0KNIuMeFfMCBO.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\k32vur\\0kniumeffmcbo.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\k32VUR\\0KNIuMeFfMCBO.mkv.UGMH" (normalized: "c:\\users\\fd1hvy\\videos\\k32vur\\0kniumeffmcbo.mkv.ugmh")) returned 1 [0108.442] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\k32VUR\\7QwzXjh.avi", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\k32VUR\\7QwzXjh.avi", lpFilePart=0x0) returned 0x29 [0108.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0108.442] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\k32VUR\\7QwzXjh.avi" (normalized: "c:\\users\\fd1hvy\\videos\\k32vur\\7qwzxjh.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0108.442] GetFileType (hFile=0x2e4) returned 0x1 [0108.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0108.442] GetFileType (hFile=0x2e4) returned 0x1 [0108.442] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0x2d02 [0108.442] ReadFile (in: hFile=0x2e4, lpBuffer=0x3025740, nNumberOfBytesToRead=0x2d02, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x3025740*, lpNumberOfBytesRead=0xefeae8*=0x2d02, lpOverlapped=0x0) returned 1 [0108.443] CloseHandle (hObject=0x2e4) returned 1 [0108.475] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0108.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0108.475] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0108.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0108.475] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\k32VUR\\7QwzXjh.avi", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\k32VUR\\7QwzXjh.avi", lpFilePart=0x0) returned 0x29 [0108.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0108.476] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\k32VUR\\7QwzXjh.avi" (normalized: "c:\\users\\fd1hvy\\videos\\k32vur\\7qwzxjh.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0108.477] GetFileType (hFile=0x2e4) returned 0x1 [0108.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0108.477] GetFileType (hFile=0x2e4) returned 0x1 [0108.477] WriteFile (in: hFile=0x2e4, lpBuffer=0x2e83ff0*, nNumberOfBytesToWrite=0x2d10, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x2e83ff0*, lpNumberOfBytesWritten=0xefeadc*=0x2d10, lpOverlapped=0x0) returned 1 [0108.478] CloseHandle (hObject=0x2e4) returned 1 [0108.480] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\k32VUR\\7QwzXjh.avi", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\k32VUR\\7QwzXjh.avi", lpFilePart=0x0) returned 0x29 [0108.480] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\k32VUR\\7QwzXjh.avi.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\k32VUR\\7QwzXjh.avi.UGMH", lpFilePart=0x0) returned 0x2e [0108.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0108.480] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\k32VUR\\7QwzXjh.avi" (normalized: "c:\\users\\fd1hvy\\videos\\k32vur\\7qwzxjh.avi"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac8e3d00, ftCreationTime.dwHighDateTime=0x1d5e8c2, ftLastAccessTime.dwLowDateTime=0xa99e8720, ftLastAccessTime.dwHighDateTime=0x1d5e21f, ftLastWriteTime.dwLowDateTime=0xd6c14211, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x2d10)) returned 1 [0108.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0108.480] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\k32VUR\\7QwzXjh.avi" (normalized: "c:\\users\\fd1hvy\\videos\\k32vur\\7qwzxjh.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\k32VUR\\7QwzXjh.avi.UGMH" (normalized: "c:\\users\\fd1hvy\\videos\\k32vur\\7qwzxjh.avi.ugmh")) returned 1 [0108.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb94) returned 1 [0108.481] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v", nBufferLength=0x105, lpBuffer=0xefe648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v", lpFilePart=0x0) returned 0x25 [0108.481] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\*", lpFindFileData=0xefe8bc | out: lpFindFileData=0xefe8bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5289a70, ftCreationTime.dwHighDateTime=0x1d5e3c8, ftLastAccessTime.dwLowDateTime=0x2f1df600, ftLastAccessTime.dwHighDateTime=0x1d5eb63, ftLastWriteTime.dwLowDateTime=0x2f1df600, ftLastWriteTime.dwHighDateTime=0x1d5eb63, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104e330 [0108.481] FindNextFileW (in: hFindFile=0x104e330, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5289a70, ftCreationTime.dwHighDateTime=0x1d5e3c8, ftLastAccessTime.dwLowDateTime=0x2f1df600, ftLastAccessTime.dwHighDateTime=0x1d5eb63, ftLastWriteTime.dwLowDateTime=0x2f1df600, ftLastWriteTime.dwHighDateTime=0x1d5eb63, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.481] FindNextFileW (in: hFindFile=0x104e330, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1136c0, ftCreationTime.dwHighDateTime=0x1d5e9a9, ftLastAccessTime.dwLowDateTime=0x202f880, ftLastAccessTime.dwHighDateTime=0x1d5e322, ftLastWriteTime.dwLowDateTime=0x202f880, ftLastWriteTime.dwHighDateTime=0x1d5e322, nFileSizeHigh=0x0, nFileSizeLow=0x1239, dwReserved0=0x0, dwReserved1=0x0, cFileName="1HZNBATI9d37t3BgpT.mp4", cAlternateFileName="1HZNBA~1.MP4")) returned 1 [0108.481] FindNextFileW (in: hFindFile=0x104e330, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb17539b0, ftCreationTime.dwHighDateTime=0x1d5eb6d, ftLastAccessTime.dwLowDateTime=0xb46a0a50, ftLastAccessTime.dwHighDateTime=0x1d5e678, ftLastWriteTime.dwLowDateTime=0xb46a0a50, ftLastWriteTime.dwHighDateTime=0x1d5e678, nFileSizeHigh=0x0, nFileSizeLow=0xfd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="D2RtRM6UaLLjbcK3xC.mp4", cAlternateFileName="D2RTRM~1.MP4")) returned 1 [0108.481] FindNextFileW (in: hFindFile=0x104e330, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe17b20f0, ftCreationTime.dwHighDateTime=0x1d5eeb2, ftLastAccessTime.dwLowDateTime=0xeaf718d0, ftLastAccessTime.dwHighDateTime=0x1d5e559, ftLastWriteTime.dwLowDateTime=0xeaf718d0, ftLastWriteTime.dwHighDateTime=0x1d5e559, nFileSizeHigh=0x0, nFileSizeLow=0x75d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ebkz.swf", cAlternateFileName="")) returned 1 [0108.481] FindNextFileW (in: hFindFile=0x104e330, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55fca9b0, ftCreationTime.dwHighDateTime=0x1d5ef7d, ftLastAccessTime.dwLowDateTime=0x2bde6d20, ftLastAccessTime.dwHighDateTime=0x1d5e178, ftLastWriteTime.dwLowDateTime=0x2bde6d20, ftLastWriteTime.dwHighDateTime=0x1d5e178, nFileSizeHigh=0x0, nFileSizeLow=0xff07, dwReserved0=0x0, dwReserved1=0x0, cFileName="F LdJDjH.mkv", cAlternateFileName="FLDJDJ~1.MKV")) returned 1 [0108.481] FindNextFileW (in: hFindFile=0x104e330, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ffee420, ftCreationTime.dwHighDateTime=0x1d5e20f, ftLastAccessTime.dwLowDateTime=0xdc330180, ftLastAccessTime.dwHighDateTime=0x1d5e822, ftLastWriteTime.dwLowDateTime=0xdc330180, ftLastWriteTime.dwHighDateTime=0x1d5e822, nFileSizeHigh=0x0, nFileSizeLow=0xb0c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="kMazQ6.flv", cAlternateFileName="")) returned 1 [0108.482] FindNextFileW (in: hFindFile=0x104e330, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6b3f890, ftCreationTime.dwHighDateTime=0x1d5e616, ftLastAccessTime.dwLowDateTime=0x79684620, ftLastAccessTime.dwHighDateTime=0x1d5e532, ftLastWriteTime.dwLowDateTime=0x79684620, ftLastWriteTime.dwHighDateTime=0x1d5e532, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfsPu 8NUy7mO1n", cAlternateFileName="OFSPU8~1")) returned 1 [0108.482] FindNextFileW (in: hFindFile=0x104e330, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ebdba0, ftCreationTime.dwHighDateTime=0x1d5e33d, ftLastAccessTime.dwLowDateTime=0x86978680, ftLastAccessTime.dwHighDateTime=0x1d5f068, ftLastWriteTime.dwLowDateTime=0x86978680, ftLastWriteTime.dwHighDateTime=0x1d5f068, nFileSizeHigh=0x0, nFileSizeLow=0x84aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="RarvuTpM3bbHYvDgB.avi", cAlternateFileName="RARVUT~1.AVI")) returned 1 [0108.482] FindNextFileW (in: hFindFile=0x104e330, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f98d820, ftCreationTime.dwHighDateTime=0x1d5e61b, ftLastAccessTime.dwLowDateTime=0xa1f80790, ftLastAccessTime.dwHighDateTime=0x1d5e980, ftLastWriteTime.dwLowDateTime=0xa1f80790, ftLastWriteTime.dwHighDateTime=0x1d5e980, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uha8", cAlternateFileName="")) returned 1 [0108.482] FindNextFileW (in: hFindFile=0x104e330, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9cf3440, ftCreationTime.dwHighDateTime=0x1d5eea0, ftLastAccessTime.dwLowDateTime=0x9ac0e40, ftLastAccessTime.dwHighDateTime=0x1d5e684, ftLastWriteTime.dwLowDateTime=0x9ac0e40, ftLastWriteTime.dwHighDateTime=0x1d5e684, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yio0J", cAlternateFileName="")) returned 1 [0108.482] FindNextFileW (in: hFindFile=0x104e330, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9cf3440, ftCreationTime.dwHighDateTime=0x1d5eea0, ftLastAccessTime.dwLowDateTime=0x9ac0e40, ftLastAccessTime.dwHighDateTime=0x1d5e684, ftLastWriteTime.dwLowDateTime=0x9ac0e40, ftLastWriteTime.dwHighDateTime=0x1d5e684, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yio0J", cAlternateFileName="")) returned 0 [0108.482] FindClose (in: hFindFile=0x104e330 | out: hFindFile=0x104e330) returned 1 [0108.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb50) returned 1 [0108.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb5c) returned 1 [0108.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb94) returned 1 [0108.482] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v", nBufferLength=0x105, lpBuffer=0xefe648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v", lpFilePart=0x0) returned 0x25 [0108.482] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\*", lpFindFileData=0xefe8bc | out: lpFindFileData=0xefe8bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5289a70, ftCreationTime.dwHighDateTime=0x1d5e3c8, ftLastAccessTime.dwLowDateTime=0x2f1df600, ftLastAccessTime.dwHighDateTime=0x1d5eb63, ftLastWriteTime.dwLowDateTime=0x2f1df600, ftLastWriteTime.dwHighDateTime=0x1d5eb63, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104e470 [0108.482] FindNextFileW (in: hFindFile=0x104e470, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5289a70, ftCreationTime.dwHighDateTime=0x1d5e3c8, ftLastAccessTime.dwLowDateTime=0x2f1df600, ftLastAccessTime.dwHighDateTime=0x1d5eb63, ftLastWriteTime.dwLowDateTime=0x2f1df600, ftLastWriteTime.dwHighDateTime=0x1d5eb63, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.482] FindNextFileW (in: hFindFile=0x104e470, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1136c0, ftCreationTime.dwHighDateTime=0x1d5e9a9, ftLastAccessTime.dwLowDateTime=0x202f880, ftLastAccessTime.dwHighDateTime=0x1d5e322, ftLastWriteTime.dwLowDateTime=0x202f880, ftLastWriteTime.dwHighDateTime=0x1d5e322, nFileSizeHigh=0x0, nFileSizeLow=0x1239, dwReserved0=0x0, dwReserved1=0x0, cFileName="1HZNBATI9d37t3BgpT.mp4", cAlternateFileName="1HZNBA~1.MP4")) returned 1 [0108.483] FindNextFileW (in: hFindFile=0x104e470, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb17539b0, ftCreationTime.dwHighDateTime=0x1d5eb6d, ftLastAccessTime.dwLowDateTime=0xb46a0a50, ftLastAccessTime.dwHighDateTime=0x1d5e678, ftLastWriteTime.dwLowDateTime=0xb46a0a50, ftLastWriteTime.dwHighDateTime=0x1d5e678, nFileSizeHigh=0x0, nFileSizeLow=0xfd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="D2RtRM6UaLLjbcK3xC.mp4", cAlternateFileName="D2RTRM~1.MP4")) returned 1 [0108.483] FindNextFileW (in: hFindFile=0x104e470, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe17b20f0, ftCreationTime.dwHighDateTime=0x1d5eeb2, ftLastAccessTime.dwLowDateTime=0xeaf718d0, ftLastAccessTime.dwHighDateTime=0x1d5e559, ftLastWriteTime.dwLowDateTime=0xeaf718d0, ftLastWriteTime.dwHighDateTime=0x1d5e559, nFileSizeHigh=0x0, nFileSizeLow=0x75d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ebkz.swf", cAlternateFileName="")) returned 1 [0108.483] FindNextFileW (in: hFindFile=0x104e470, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55fca9b0, ftCreationTime.dwHighDateTime=0x1d5ef7d, ftLastAccessTime.dwLowDateTime=0x2bde6d20, ftLastAccessTime.dwHighDateTime=0x1d5e178, ftLastWriteTime.dwLowDateTime=0x2bde6d20, ftLastWriteTime.dwHighDateTime=0x1d5e178, nFileSizeHigh=0x0, nFileSizeLow=0xff07, dwReserved0=0x0, dwReserved1=0x0, cFileName="F LdJDjH.mkv", cAlternateFileName="FLDJDJ~1.MKV")) returned 1 [0108.483] FindNextFileW (in: hFindFile=0x104e470, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ffee420, ftCreationTime.dwHighDateTime=0x1d5e20f, ftLastAccessTime.dwLowDateTime=0xdc330180, ftLastAccessTime.dwHighDateTime=0x1d5e822, ftLastWriteTime.dwLowDateTime=0xdc330180, ftLastWriteTime.dwHighDateTime=0x1d5e822, nFileSizeHigh=0x0, nFileSizeLow=0xb0c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="kMazQ6.flv", cAlternateFileName="")) returned 1 [0108.483] FindNextFileW (in: hFindFile=0x104e470, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6b3f890, ftCreationTime.dwHighDateTime=0x1d5e616, ftLastAccessTime.dwLowDateTime=0x79684620, ftLastAccessTime.dwHighDateTime=0x1d5e532, ftLastWriteTime.dwLowDateTime=0x79684620, ftLastWriteTime.dwHighDateTime=0x1d5e532, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfsPu 8NUy7mO1n", cAlternateFileName="OFSPU8~1")) returned 1 [0108.483] FindNextFileW (in: hFindFile=0x104e470, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ebdba0, ftCreationTime.dwHighDateTime=0x1d5e33d, ftLastAccessTime.dwLowDateTime=0x86978680, ftLastAccessTime.dwHighDateTime=0x1d5f068, ftLastWriteTime.dwLowDateTime=0x86978680, ftLastWriteTime.dwHighDateTime=0x1d5f068, nFileSizeHigh=0x0, nFileSizeLow=0x84aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="RarvuTpM3bbHYvDgB.avi", cAlternateFileName="RARVUT~1.AVI")) returned 1 [0108.483] FindNextFileW (in: hFindFile=0x104e470, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f98d820, ftCreationTime.dwHighDateTime=0x1d5e61b, ftLastAccessTime.dwLowDateTime=0xa1f80790, ftLastAccessTime.dwHighDateTime=0x1d5e980, ftLastWriteTime.dwLowDateTime=0xa1f80790, ftLastWriteTime.dwHighDateTime=0x1d5e980, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uha8", cAlternateFileName="")) returned 1 [0108.483] FindNextFileW (in: hFindFile=0x104e470, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9cf3440, ftCreationTime.dwHighDateTime=0x1d5eea0, ftLastAccessTime.dwLowDateTime=0x9ac0e40, ftLastAccessTime.dwHighDateTime=0x1d5e684, ftLastWriteTime.dwLowDateTime=0x9ac0e40, ftLastWriteTime.dwHighDateTime=0x1d5e684, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yio0J", cAlternateFileName="")) returned 1 [0108.483] FindNextFileW (in: hFindFile=0x104e470, lpFindFileData=0xefe8c8 | out: lpFindFileData=0xefe8c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0108.483] FindClose (in: hFindFile=0x104e470 | out: hFindFile=0x104e470) returned 1 [0108.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb50) returned 1 [0108.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb5c) returned 1 [0108.483] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\1HZNBATI9d37t3BgpT.mp4", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\1HZNBATI9d37t3BgpT.mp4", lpFilePart=0x0) returned 0x3c [0108.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0108.499] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\1HZNBATI9d37t3BgpT.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\1hznbati9d37t3bgpt.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0108.500] GetFileType (hFile=0x2e4) returned 0x1 [0108.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0108.500] GetFileType (hFile=0x2e4) returned 0x1 [0108.500] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0x1239 [0108.500] ReadFile (in: hFile=0x2e4, lpBuffer=0x2e896c0, nNumberOfBytesToRead=0x1239, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x2e896c0*, lpNumberOfBytesRead=0xefeae8*=0x1239, lpOverlapped=0x0) returned 1 [0108.501] CloseHandle (hObject=0x2e4) returned 1 [0108.527] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0108.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0108.527] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0108.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0108.527] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\1HZNBATI9d37t3BgpT.mp4", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\1HZNBATI9d37t3BgpT.mp4", lpFilePart=0x0) returned 0x3c [0108.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0108.527] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\1HZNBATI9d37t3BgpT.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\1hznbati9d37t3bgpt.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0108.529] GetFileType (hFile=0x2e4) returned 0x1 [0108.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0108.529] GetFileType (hFile=0x2e4) returned 0x1 [0108.529] WriteFile (in: hFile=0x2e4, lpBuffer=0x2edc144*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x2edc144*, lpNumberOfBytesWritten=0xefeadc*=0x1240, lpOverlapped=0x0) returned 1 [0108.530] CloseHandle (hObject=0x2e4) returned 1 [0108.532] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\1HZNBATI9d37t3BgpT.mp4", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\1HZNBATI9d37t3BgpT.mp4", lpFilePart=0x0) returned 0x3c [0108.532] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\1HZNBATI9d37t3BgpT.mp4.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\1HZNBATI9d37t3BgpT.mp4.UGMH", lpFilePart=0x0) returned 0x41 [0108.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0108.532] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\1HZNBATI9d37t3BgpT.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\1hznbati9d37t3bgpt.mp4"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1136c0, ftCreationTime.dwHighDateTime=0x1d5e9a9, ftLastAccessTime.dwLowDateTime=0x202f880, ftLastAccessTime.dwHighDateTime=0x1d5e322, ftLastWriteTime.dwLowDateTime=0xd6cacaca, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x1240)) returned 1 [0108.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0108.532] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\1HZNBATI9d37t3BgpT.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\1hznbati9d37t3bgpt.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\1HZNBATI9d37t3BgpT.mp4.UGMH" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\1hznbati9d37t3bgpt.mp4.ugmh")) returned 1 [0108.533] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\D2RtRM6UaLLjbcK3xC.mp4", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\D2RtRM6UaLLjbcK3xC.mp4", lpFilePart=0x0) returned 0x3c [0108.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0108.533] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\D2RtRM6UaLLjbcK3xC.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\d2rtrm6ualljbck3xc.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0108.534] GetFileType (hFile=0x2e4) returned 0x1 [0108.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0108.534] GetFileType (hFile=0x2e4) returned 0x1 [0108.534] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0xfd1 [0108.534] ReadFile (in: hFile=0x2e4, lpBuffer=0x2ede85c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x2ede85c*, lpNumberOfBytesRead=0xefeae8*=0xfd1, lpOverlapped=0x0) returned 1 [0108.535] CloseHandle (hObject=0x2e4) returned 1 [0108.558] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0108.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0108.558] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0108.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0108.558] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\D2RtRM6UaLLjbcK3xC.mp4", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\D2RtRM6UaLLjbcK3xC.mp4", lpFilePart=0x0) returned 0x3c [0108.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0108.558] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\D2RtRM6UaLLjbcK3xC.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\d2rtrm6ualljbck3xc.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0108.559] GetFileType (hFile=0x2e4) returned 0x1 [0108.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0108.559] GetFileType (hFile=0x2e4) returned 0x1 [0108.560] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f317c8*, nNumberOfBytesToWrite=0xfe0, lpNumberOfBytesWritten=0xefeab0, lpOverlapped=0x0 | out: lpBuffer=0x2f317c8*, lpNumberOfBytesWritten=0xefeab0*=0xfe0, lpOverlapped=0x0) returned 1 [0108.560] CloseHandle (hObject=0x2e4) returned 1 [0108.575] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\D2RtRM6UaLLjbcK3xC.mp4", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\D2RtRM6UaLLjbcK3xC.mp4", lpFilePart=0x0) returned 0x3c [0108.575] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\D2RtRM6UaLLjbcK3xC.mp4.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\D2RtRM6UaLLjbcK3xC.mp4.UGMH", lpFilePart=0x0) returned 0x41 [0108.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0108.576] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\D2RtRM6UaLLjbcK3xC.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\d2rtrm6ualljbck3xc.mp4"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb17539b0, ftCreationTime.dwHighDateTime=0x1d5eb6d, ftLastAccessTime.dwLowDateTime=0xb46a0a50, ftLastAccessTime.dwHighDateTime=0x1d5e678, ftLastWriteTime.dwLowDateTime=0xd6cfb172, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xfe0)) returned 1 [0108.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0108.576] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\D2RtRM6UaLLjbcK3xC.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\d2rtrm6ualljbck3xc.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\D2RtRM6UaLLjbcK3xC.mp4.UGMH" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\d2rtrm6ualljbck3xc.mp4.ugmh")) returned 1 [0108.577] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\F LdJDjH.mkv", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\F LdJDjH.mkv", lpFilePart=0x0) returned 0x32 [0108.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0108.577] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\F LdJDjH.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\f ldjdjh.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0108.577] GetFileType (hFile=0x2e4) returned 0x1 [0108.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0108.577] GetFileType (hFile=0x2e4) returned 0x1 [0108.577] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0xff07 [0108.577] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f32aa4, nNumberOfBytesToRead=0xff07, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x2f32aa4*, lpNumberOfBytesRead=0xefeae8*=0xff07, lpOverlapped=0x0) returned 1 [0108.578] CloseHandle (hObject=0x2e4) returned 1 [0108.622] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0108.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0108.623] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0108.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0108.623] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\F LdJDjH.mkv", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\F LdJDjH.mkv", lpFilePart=0x0) returned 0x32 [0108.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0108.623] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\F LdJDjH.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\f ldjdjh.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0108.625] GetFileType (hFile=0x2e4) returned 0x1 [0108.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0108.626] GetFileType (hFile=0x2e4) returned 0x1 [0108.626] WriteFile (in: hFile=0x2e4, lpBuffer=0x2faf5d0*, nNumberOfBytesToWrite=0xff10, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x2faf5d0*, lpNumberOfBytesWritten=0xefeadc*=0xff10, lpOverlapped=0x0) returned 1 [0108.628] CloseHandle (hObject=0x2e4) returned 1 [0108.633] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\F LdJDjH.mkv", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\F LdJDjH.mkv", lpFilePart=0x0) returned 0x32 [0108.633] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\F LdJDjH.mkv.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\F LdJDjH.mkv.UGMH", lpFilePart=0x0) returned 0x37 [0108.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0108.633] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\F LdJDjH.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\f ldjdjh.mkv"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55fca9b0, ftCreationTime.dwHighDateTime=0x1d5ef7d, ftLastAccessTime.dwLowDateTime=0x2bde6d20, ftLastAccessTime.dwHighDateTime=0x1d5e178, ftLastWriteTime.dwLowDateTime=0xd6d91962, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xff10)) returned 1 [0108.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0108.633] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\F LdJDjH.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\f ldjdjh.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\F LdJDjH.mkv.UGMH" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\f ldjdjh.mkv.ugmh")) returned 1 [0108.634] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\RarvuTpM3bbHYvDgB.avi", nBufferLength=0x105, lpBuffer=0xefe4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\RarvuTpM3bbHYvDgB.avi", lpFilePart=0x0) returned 0x3b [0108.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0108.635] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\RarvuTpM3bbHYvDgB.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\rarvutpm3bbhyvdgb.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0108.635] GetFileType (hFile=0x2e4) returned 0x1 [0108.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0108.635] GetFileType (hFile=0x2e4) returned 0x1 [0108.635] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeb3c | out: lpFileSizeHigh=0xefeb3c*=0x0) returned 0x84aa [0108.635] ReadFile (in: hFile=0x2e4, lpBuffer=0x2fbf984, nNumberOfBytesToRead=0x84aa, lpNumberOfBytesRead=0xefeae8, lpOverlapped=0x0 | out: lpBuffer=0x2fbf984*, lpNumberOfBytesRead=0xefeae8*=0x84aa, lpOverlapped=0x0) returned 1 [0108.636] CloseHandle (hObject=0x2e4) returned 1 [0108.730] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0108.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeab4) returned 1 [0108.730] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeb30 | out: lpFileInformation=0xefeb30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0108.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeab0) returned 1 [0108.730] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\RarvuTpM3bbHYvDgB.avi", nBufferLength=0x105, lpBuffer=0xefe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\RarvuTpM3bbHYvDgB.avi", lpFilePart=0x0) returned 0x3b [0108.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea2c) returned 1 [0108.730] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\RarvuTpM3bbHYvDgB.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\rarvutpm3bbhyvdgb.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0108.732] GetFileType (hFile=0x2e4) returned 0x1 [0108.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea28) returned 1 [0108.732] GetFileType (hFile=0x2e4) returned 0x1 [0108.732] WriteFile (in: hFile=0x2e4, lpBuffer=0x3035edc*, nNumberOfBytesToWrite=0x84b0, lpNumberOfBytesWritten=0xefeadc, lpOverlapped=0x0 | out: lpBuffer=0x3035edc*, lpNumberOfBytesWritten=0xefeadc*=0x84b0, lpOverlapped=0x0) returned 1 [0108.734] CloseHandle (hObject=0x2e4) returned 1 [0108.736] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\RarvuTpM3bbHYvDgB.avi", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\RarvuTpM3bbHYvDgB.avi", lpFilePart=0x0) returned 0x3b [0108.736] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\RarvuTpM3bbHYvDgB.avi.UGMH", nBufferLength=0x105, lpBuffer=0xefe60c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\RarvuTpM3bbHYvDgB.avi.UGMH", lpFilePart=0x0) returned 0x40 [0108.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeac0) returned 1 [0108.736] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\RarvuTpM3bbHYvDgB.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\rarvutpm3bbhyvdgb.avi"), fInfoLevelId=0x0, lpFileInformation=0xefeb3c | out: lpFileInformation=0xefeb3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ebdba0, ftCreationTime.dwHighDateTime=0x1d5e33d, ftLastAccessTime.dwLowDateTime=0x86978680, ftLastAccessTime.dwHighDateTime=0x1d5f068, ftLastWriteTime.dwLowDateTime=0xd6e9cab9, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x84b0)) returned 1 [0108.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeabc) returned 1 [0108.736] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\RarvuTpM3bbHYvDgB.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\rarvutpm3bbhyvdgb.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\RarvuTpM3bbHYvDgB.avi.UGMH" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\rarvutpm3bbhyvdgb.avi.ugmh")) returned 1 [0108.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb20) returned 1 [0108.737] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n", nBufferLength=0x105, lpBuffer=0xefe5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n", lpFilePart=0x0) returned 0x35 [0108.737] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\*", lpFindFileData=0xefe848 | out: lpFindFileData=0xefe848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6b3f890, ftCreationTime.dwHighDateTime=0x1d5e616, ftLastAccessTime.dwLowDateTime=0x79684620, ftLastAccessTime.dwHighDateTime=0x1d5e532, ftLastWriteTime.dwLowDateTime=0x79684620, ftLastWriteTime.dwHighDateTime=0x1d5e532, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104dfb0 [0108.737] FindNextFileW (in: hFindFile=0x104dfb0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6b3f890, ftCreationTime.dwHighDateTime=0x1d5e616, ftLastAccessTime.dwLowDateTime=0x79684620, ftLastAccessTime.dwHighDateTime=0x1d5e532, ftLastWriteTime.dwLowDateTime=0x79684620, ftLastWriteTime.dwHighDateTime=0x1d5e532, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.737] FindNextFileW (in: hFindFile=0x104dfb0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x433a5a20, ftCreationTime.dwHighDateTime=0x1d5ed4d, ftLastAccessTime.dwLowDateTime=0x737e3a20, ftLastAccessTime.dwHighDateTime=0x1d5ebc3, ftLastWriteTime.dwLowDateTime=0x737e3a20, ftLastWriteTime.dwHighDateTime=0x1d5ebc3, nFileSizeHigh=0x0, nFileSizeLow=0x22fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dpl0o9E rhhHO0DOYALh.mp4", cAlternateFileName="DPL0O9~1.MP4")) returned 1 [0108.738] FindNextFileW (in: hFindFile=0x104dfb0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6f1a110, ftCreationTime.dwHighDateTime=0x1d5e5cb, ftLastAccessTime.dwLowDateTime=0x589cef40, ftLastAccessTime.dwHighDateTime=0x1d5e636, ftLastWriteTime.dwLowDateTime=0x589cef40, ftLastWriteTime.dwHighDateTime=0x1d5e636, nFileSizeHigh=0x0, nFileSizeLow=0x12d76, dwReserved0=0x0, dwReserved1=0x0, cFileName="pUouyTxP.avi", cAlternateFileName="")) returned 1 [0108.738] FindNextFileW (in: hFindFile=0x104dfb0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31a10a10, ftCreationTime.dwHighDateTime=0x1d5e4a2, ftLastAccessTime.dwLowDateTime=0x81434200, ftLastAccessTime.dwHighDateTime=0x1d5eece, ftLastWriteTime.dwLowDateTime=0x81434200, ftLastWriteTime.dwHighDateTime=0x1d5eece, nFileSizeHigh=0x0, nFileSizeLow=0x30c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="S725Tj.avi", cAlternateFileName="")) returned 1 [0108.738] FindNextFileW (in: hFindFile=0x104dfb0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0108.738] FindClose (in: hFindFile=0x104dfb0 | out: hFindFile=0x104dfb0) returned 1 [0108.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeadc) returned 1 [0108.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeae8) returned 1 [0108.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb20) returned 1 [0108.738] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n", nBufferLength=0x105, lpBuffer=0xefe5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n", lpFilePart=0x0) returned 0x35 [0108.738] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\*", lpFindFileData=0xefe848 | out: lpFindFileData=0xefe848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6b3f890, ftCreationTime.dwHighDateTime=0x1d5e616, ftLastAccessTime.dwLowDateTime=0x79684620, ftLastAccessTime.dwHighDateTime=0x1d5e532, ftLastWriteTime.dwLowDateTime=0x79684620, ftLastWriteTime.dwHighDateTime=0x1d5e532, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104ddf0 [0108.738] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6b3f890, ftCreationTime.dwHighDateTime=0x1d5e616, ftLastAccessTime.dwLowDateTime=0x79684620, ftLastAccessTime.dwHighDateTime=0x1d5e532, ftLastWriteTime.dwLowDateTime=0x79684620, ftLastWriteTime.dwHighDateTime=0x1d5e532, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.738] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x433a5a20, ftCreationTime.dwHighDateTime=0x1d5ed4d, ftLastAccessTime.dwLowDateTime=0x737e3a20, ftLastAccessTime.dwHighDateTime=0x1d5ebc3, ftLastWriteTime.dwLowDateTime=0x737e3a20, ftLastWriteTime.dwHighDateTime=0x1d5ebc3, nFileSizeHigh=0x0, nFileSizeLow=0x22fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dpl0o9E rhhHO0DOYALh.mp4", cAlternateFileName="DPL0O9~1.MP4")) returned 1 [0108.738] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6f1a110, ftCreationTime.dwHighDateTime=0x1d5e5cb, ftLastAccessTime.dwLowDateTime=0x589cef40, ftLastAccessTime.dwHighDateTime=0x1d5e636, ftLastWriteTime.dwLowDateTime=0x589cef40, ftLastWriteTime.dwHighDateTime=0x1d5e636, nFileSizeHigh=0x0, nFileSizeLow=0x12d76, dwReserved0=0x0, dwReserved1=0x0, cFileName="pUouyTxP.avi", cAlternateFileName="")) returned 1 [0108.741] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31a10a10, ftCreationTime.dwHighDateTime=0x1d5e4a2, ftLastAccessTime.dwLowDateTime=0x81434200, ftLastAccessTime.dwHighDateTime=0x1d5eece, ftLastWriteTime.dwLowDateTime=0x81434200, ftLastWriteTime.dwHighDateTime=0x1d5eece, nFileSizeHigh=0x0, nFileSizeLow=0x30c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="S725Tj.avi", cAlternateFileName="")) returned 1 [0108.741] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31a10a10, ftCreationTime.dwHighDateTime=0x1d5e4a2, ftLastAccessTime.dwLowDateTime=0x81434200, ftLastAccessTime.dwHighDateTime=0x1d5eece, ftLastWriteTime.dwLowDateTime=0x81434200, ftLastWriteTime.dwHighDateTime=0x1d5eece, nFileSizeHigh=0x0, nFileSizeLow=0x30c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="S725Tj.avi", cAlternateFileName="")) returned 0 [0108.741] FindClose (in: hFindFile=0x104ddf0 | out: hFindFile=0x104ddf0) returned 1 [0108.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeadc) returned 1 [0108.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeae8) returned 1 [0108.741] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\Dpl0o9E rhhHO0DOYALh.mp4", nBufferLength=0x105, lpBuffer=0xefe488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\Dpl0o9E rhhHO0DOYALh.mp4", lpFilePart=0x0) returned 0x4e [0108.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9cc) returned 1 [0108.741] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\Dpl0o9E rhhHO0DOYALh.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\ofspu 8nuy7mo1n\\dpl0o9e rhhho0doyalh.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0108.742] GetFileType (hFile=0x2e4) returned 0x1 [0108.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9c8) returned 1 [0108.742] GetFileType (hFile=0x2e4) returned 0x1 [0108.742] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeac8 | out: lpFileSizeHigh=0xefeac8*=0x0) returned 0x22fc [0108.742] ReadFile (in: hFile=0x2e4, lpBuffer=0x2e466cc, nNumberOfBytesToRead=0x22fc, lpNumberOfBytesRead=0xefea74, lpOverlapped=0x0 | out: lpBuffer=0x2e466cc*, lpNumberOfBytesRead=0xefea74*=0x22fc, lpOverlapped=0x0) returned 1 [0108.743] CloseHandle (hObject=0x2e4) returned 1 [0108.760] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe58c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0108.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0108.760] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeabc | out: lpFileInformation=0xefeabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0108.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0108.760] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\Dpl0o9E rhhHO0DOYALh.mp4", nBufferLength=0x105, lpBuffer=0xefe474, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\Dpl0o9E rhhHO0DOYALh.mp4", lpFilePart=0x0) returned 0x4e [0108.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9b8) returned 1 [0108.760] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\Dpl0o9E rhhHO0DOYALh.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\ofspu 8nuy7mo1n\\dpl0o9e rhhho0doyalh.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0108.791] GetFileType (hFile=0x2e4) returned 0x1 [0108.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9b4) returned 1 [0108.792] GetFileType (hFile=0x2e4) returned 0x1 [0108.792] WriteFile (in: hFile=0x2e4, lpBuffer=0x2e9e50c*, nNumberOfBytesToWrite=0x2300, lpNumberOfBytesWritten=0xefea68, lpOverlapped=0x0 | out: lpBuffer=0x2e9e50c*, lpNumberOfBytesWritten=0xefea68*=0x2300, lpOverlapped=0x0) returned 1 [0108.793] CloseHandle (hObject=0x2e4) returned 1 [0108.794] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\Dpl0o9E rhhHO0DOYALh.mp4", nBufferLength=0x105, lpBuffer=0xefe598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\Dpl0o9E rhhHO0DOYALh.mp4", lpFilePart=0x0) returned 0x4e [0108.794] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\Dpl0o9E rhhHO0DOYALh.mp4.UGMH", nBufferLength=0x105, lpBuffer=0xefe598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\Dpl0o9E rhhHO0DOYALh.mp4.UGMH", lpFilePart=0x0) returned 0x53 [0108.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea4c) returned 1 [0108.794] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\Dpl0o9E rhhHO0DOYALh.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\ofspu 8nuy7mo1n\\dpl0o9e rhhho0doyalh.mp4"), fInfoLevelId=0x0, lpFileInformation=0xefeac8 | out: lpFileInformation=0xefeac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x433a5a20, ftCreationTime.dwHighDateTime=0x1d5ed4d, ftLastAccessTime.dwLowDateTime=0x737e3a20, ftLastAccessTime.dwHighDateTime=0x1d5ebc3, ftLastWriteTime.dwLowDateTime=0xd6f0f0a8, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x2300)) returned 1 [0108.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea48) returned 1 [0108.794] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\Dpl0o9E rhhHO0DOYALh.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\ofspu 8nuy7mo1n\\dpl0o9e rhhho0doyalh.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\Dpl0o9E rhhHO0DOYALh.mp4.UGMH" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\ofspu 8nuy7mo1n\\dpl0o9e rhhho0doyalh.mp4.ugmh")) returned 1 [0108.795] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\pUouyTxP.avi", nBufferLength=0x105, lpBuffer=0xefe488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\pUouyTxP.avi", lpFilePart=0x0) returned 0x42 [0108.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9cc) returned 1 [0108.795] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\pUouyTxP.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\ofspu 8nuy7mo1n\\puouytxp.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0108.795] GetFileType (hFile=0x2e4) returned 0x1 [0108.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9c8) returned 1 [0108.795] GetFileType (hFile=0x2e4) returned 0x1 [0108.795] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeac8 | out: lpFileSizeHigh=0xefeac8*=0x0) returned 0x12d76 [0108.795] ReadFile (in: hFile=0x2e4, lpBuffer=0x2ea0d90, nNumberOfBytesToRead=0x12d76, lpNumberOfBytesRead=0xefea74, lpOverlapped=0x0 | out: lpBuffer=0x2ea0d90*, lpNumberOfBytesRead=0xefea74*=0x12d76, lpOverlapped=0x0) returned 1 [0108.797] CloseHandle (hObject=0x2e4) returned 1 [0108.817] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe58c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0108.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0108.817] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeabc | out: lpFileInformation=0xefeabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0108.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0108.817] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\pUouyTxP.avi", nBufferLength=0x105, lpBuffer=0xefe474, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\pUouyTxP.avi", lpFilePart=0x0) returned 0x42 [0108.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9b8) returned 1 [0108.817] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\pUouyTxP.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\ofspu 8nuy7mo1n\\puouytxp.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0108.819] GetFileType (hFile=0x2e4) returned 0x1 [0108.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9b4) returned 1 [0108.819] GetFileType (hFile=0x2e4) returned 0x1 [0108.819] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f2640c*, nNumberOfBytesToWrite=0x12d80, lpNumberOfBytesWritten=0xefea68, lpOverlapped=0x0 | out: lpBuffer=0x2f2640c*, lpNumberOfBytesWritten=0xefea68*=0x12d80, lpOverlapped=0x0) returned 1 [0108.821] CloseHandle (hObject=0x2e4) returned 1 [0108.824] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\pUouyTxP.avi", nBufferLength=0x105, lpBuffer=0xefe598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\pUouyTxP.avi", lpFilePart=0x0) returned 0x42 [0108.824] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\pUouyTxP.avi.UGMH", nBufferLength=0x105, lpBuffer=0xefe598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\pUouyTxP.avi.UGMH", lpFilePart=0x0) returned 0x47 [0108.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea4c) returned 1 [0108.824] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\pUouyTxP.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\ofspu 8nuy7mo1n\\puouytxp.avi"), fInfoLevelId=0x0, lpFileInformation=0xefeac8 | out: lpFileInformation=0xefeac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6f1a110, ftCreationTime.dwHighDateTime=0x1d5e5cb, ftLastAccessTime.dwLowDateTime=0x589cef40, ftLastAccessTime.dwHighDateTime=0x1d5e636, ftLastWriteTime.dwLowDateTime=0xd6f5b5b0, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x12d80)) returned 1 [0108.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea48) returned 1 [0108.824] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\pUouyTxP.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\ofspu 8nuy7mo1n\\puouytxp.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\pUouyTxP.avi.UGMH" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\ofspu 8nuy7mo1n\\puouytxp.avi.ugmh")) returned 1 [0108.849] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\S725Tj.avi", nBufferLength=0x105, lpBuffer=0xefe488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\S725Tj.avi", lpFilePart=0x0) returned 0x40 [0108.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9cc) returned 1 [0108.849] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\S725Tj.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\ofspu 8nuy7mo1n\\s725tj.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0108.849] GetFileType (hFile=0x2e4) returned 0x1 [0108.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9c8) returned 1 [0108.849] GetFileType (hFile=0x2e4) returned 0x1 [0108.849] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeac8 | out: lpFileSizeHigh=0xefeac8*=0x0) returned 0x30c7 [0108.849] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f39690, nNumberOfBytesToRead=0x30c7, lpNumberOfBytesRead=0xefea74, lpOverlapped=0x0 | out: lpBuffer=0x2f39690*, lpNumberOfBytesRead=0xefea74*=0x30c7, lpOverlapped=0x0) returned 1 [0108.850] CloseHandle (hObject=0x2e4) returned 1 [0108.869] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe58c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0108.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0108.869] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeabc | out: lpFileInformation=0xefeabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0108.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0108.870] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\S725Tj.avi", nBufferLength=0x105, lpBuffer=0xefe474, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\S725Tj.avi", lpFilePart=0x0) returned 0x40 [0108.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9b8) returned 1 [0108.870] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\S725Tj.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\ofspu 8nuy7mo1n\\s725tj.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0108.871] GetFileType (hFile=0x2e4) returned 0x1 [0108.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9b4) returned 1 [0108.871] GetFileType (hFile=0x2e4) returned 0x1 [0108.871] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f95888*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0xefea68, lpOverlapped=0x0 | out: lpBuffer=0x2f95888*, lpNumberOfBytesWritten=0xefea68*=0x30d0, lpOverlapped=0x0) returned 1 [0108.873] CloseHandle (hObject=0x2e4) returned 1 [0108.879] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\S725Tj.avi", nBufferLength=0x105, lpBuffer=0xefe598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\S725Tj.avi", lpFilePart=0x0) returned 0x40 [0108.879] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\S725Tj.avi.UGMH", nBufferLength=0x105, lpBuffer=0xefe598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\S725Tj.avi.UGMH", lpFilePart=0x0) returned 0x45 [0108.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea4c) returned 1 [0108.879] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\S725Tj.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\ofspu 8nuy7mo1n\\s725tj.avi"), fInfoLevelId=0x0, lpFileInformation=0xefeac8 | out: lpFileInformation=0xefeac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31a10a10, ftCreationTime.dwHighDateTime=0x1d5e4a2, ftLastAccessTime.dwLowDateTime=0x81434200, ftLastAccessTime.dwHighDateTime=0x1d5eece, ftLastWriteTime.dwLowDateTime=0xd6ffd27f, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x30d0)) returned 1 [0108.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea48) returned 1 [0108.879] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\S725Tj.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\ofspu 8nuy7mo1n\\s725tj.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\OfsPu 8NUy7mO1n\\S725Tj.avi.UGMH" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\ofspu 8nuy7mo1n\\s725tj.avi.ugmh")) returned 1 [0108.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb20) returned 1 [0108.880] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8", nBufferLength=0x105, lpBuffer=0xefe5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8", lpFilePart=0x0) returned 0x2a [0108.880] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\*", lpFindFileData=0xefe848 | out: lpFindFileData=0xefe848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f98d820, ftCreationTime.dwHighDateTime=0x1d5e61b, ftLastAccessTime.dwLowDateTime=0xa1f80790, ftLastAccessTime.dwHighDateTime=0x1d5e980, ftLastWriteTime.dwLowDateTime=0xa1f80790, ftLastWriteTime.dwHighDateTime=0x1d5e980, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104ddf0 [0108.880] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f98d820, ftCreationTime.dwHighDateTime=0x1d5e61b, ftLastAccessTime.dwLowDateTime=0xa1f80790, ftLastAccessTime.dwHighDateTime=0x1d5e980, ftLastWriteTime.dwLowDateTime=0xa1f80790, ftLastWriteTime.dwHighDateTime=0x1d5e980, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.881] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a52a940, ftCreationTime.dwHighDateTime=0x1d5e0ca, ftLastAccessTime.dwLowDateTime=0x2465a880, ftLastAccessTime.dwHighDateTime=0x1d5e982, ftLastWriteTime.dwLowDateTime=0x2465a880, ftLastWriteTime.dwHighDateTime=0x1d5e982, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IZvs706XiyQFlrc", cAlternateFileName="IZVS70~1")) returned 1 [0108.881] FindNextFileW (in: hFindFile=0x104ddf0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a52a940, ftCreationTime.dwHighDateTime=0x1d5e0ca, ftLastAccessTime.dwLowDateTime=0x2465a880, ftLastAccessTime.dwHighDateTime=0x1d5e982, ftLastWriteTime.dwLowDateTime=0x2465a880, ftLastWriteTime.dwHighDateTime=0x1d5e982, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IZvs706XiyQFlrc", cAlternateFileName="IZVS70~1")) returned 0 [0108.881] FindClose (in: hFindFile=0x104ddf0 | out: hFindFile=0x104ddf0) returned 1 [0108.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeadc) returned 1 [0108.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeae8) returned 1 [0108.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb20) returned 1 [0108.881] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8", nBufferLength=0x105, lpBuffer=0xefe5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8", lpFilePart=0x0) returned 0x2a [0108.881] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\*", lpFindFileData=0xefe848 | out: lpFindFileData=0xefe848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f98d820, ftCreationTime.dwHighDateTime=0x1d5e61b, ftLastAccessTime.dwLowDateTime=0xa1f80790, ftLastAccessTime.dwHighDateTime=0x1d5e980, ftLastWriteTime.dwLowDateTime=0xa1f80790, ftLastWriteTime.dwHighDateTime=0x1d5e980, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104e3f0 [0108.881] FindNextFileW (in: hFindFile=0x104e3f0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f98d820, ftCreationTime.dwHighDateTime=0x1d5e61b, ftLastAccessTime.dwLowDateTime=0xa1f80790, ftLastAccessTime.dwHighDateTime=0x1d5e980, ftLastWriteTime.dwLowDateTime=0xa1f80790, ftLastWriteTime.dwHighDateTime=0x1d5e980, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.881] FindNextFileW (in: hFindFile=0x104e3f0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a52a940, ftCreationTime.dwHighDateTime=0x1d5e0ca, ftLastAccessTime.dwLowDateTime=0x2465a880, ftLastAccessTime.dwHighDateTime=0x1d5e982, ftLastWriteTime.dwLowDateTime=0x2465a880, ftLastWriteTime.dwHighDateTime=0x1d5e982, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IZvs706XiyQFlrc", cAlternateFileName="IZVS70~1")) returned 1 [0108.881] FindNextFileW (in: hFindFile=0x104e3f0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0108.882] FindClose (in: hFindFile=0x104e3f0 | out: hFindFile=0x104e3f0) returned 1 [0108.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeadc) returned 1 [0108.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeae8) returned 1 [0108.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaac) returned 1 [0108.882] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc", nBufferLength=0x105, lpBuffer=0xefe560, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc", lpFilePart=0x0) returned 0x3a [0108.882] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\*", lpFindFileData=0xefe7d4 | out: lpFindFileData=0xefe7d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a52a940, ftCreationTime.dwHighDateTime=0x1d5e0ca, ftLastAccessTime.dwLowDateTime=0x2465a880, ftLastAccessTime.dwHighDateTime=0x1d5e982, ftLastWriteTime.dwLowDateTime=0x2465a880, ftLastWriteTime.dwHighDateTime=0x1d5e982, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104e3f0 [0108.882] FindNextFileW (in: hFindFile=0x104e3f0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a52a940, ftCreationTime.dwHighDateTime=0x1d5e0ca, ftLastAccessTime.dwLowDateTime=0x2465a880, ftLastAccessTime.dwHighDateTime=0x1d5e982, ftLastWriteTime.dwLowDateTime=0x2465a880, ftLastWriteTime.dwHighDateTime=0x1d5e982, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.882] FindNextFileW (in: hFindFile=0x104e3f0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3aa7500, ftCreationTime.dwHighDateTime=0x1d5e917, ftLastAccessTime.dwLowDateTime=0xb8f00750, ftLastAccessTime.dwHighDateTime=0x1d5e7db, ftLastWriteTime.dwLowDateTime=0xb8f00750, ftLastWriteTime.dwHighDateTime=0x1d5e7db, nFileSizeHigh=0x0, nFileSizeLow=0x10eeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="dT4ipHywERntWmavAQ.mp4", cAlternateFileName="DT4IPH~1.MP4")) returned 1 [0108.882] FindNextFileW (in: hFindFile=0x104e3f0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18df7d80, ftCreationTime.dwHighDateTime=0x1d5e7be, ftLastAccessTime.dwLowDateTime=0x4843c4d0, ftLastAccessTime.dwHighDateTime=0x1d5e5e5, ftLastWriteTime.dwLowDateTime=0x4843c4d0, ftLastWriteTime.dwHighDateTime=0x1d5e5e5, nFileSizeHigh=0x0, nFileSizeLow=0x1610d, dwReserved0=0x0, dwReserved1=0x0, cFileName="E5xJc.flv", cAlternateFileName="")) returned 1 [0108.882] FindNextFileW (in: hFindFile=0x104e3f0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa754e160, ftCreationTime.dwHighDateTime=0x1d5e334, ftLastAccessTime.dwLowDateTime=0xaccd57f0, ftLastAccessTime.dwHighDateTime=0x1d5f00c, ftLastWriteTime.dwLowDateTime=0xaccd57f0, ftLastWriteTime.dwHighDateTime=0x1d5f00c, nFileSizeHigh=0x0, nFileSizeLow=0x15665, dwReserved0=0x0, dwReserved1=0x0, cFileName="HDIl_.swf", cAlternateFileName="")) returned 1 [0108.882] FindNextFileW (in: hFindFile=0x104e3f0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb177b1c0, ftCreationTime.dwHighDateTime=0x1d5ea5c, ftLastAccessTime.dwLowDateTime=0x279c1550, ftLastAccessTime.dwHighDateTime=0x1d5e335, ftLastWriteTime.dwLowDateTime=0x279c1550, ftLastWriteTime.dwHighDateTime=0x1d5e335, nFileSizeHigh=0x0, nFileSizeLow=0xa459, dwReserved0=0x0, dwReserved1=0x0, cFileName="NaTuTXk.mkv", cAlternateFileName="")) returned 1 [0108.882] FindNextFileW (in: hFindFile=0x104e3f0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbb64360, ftCreationTime.dwHighDateTime=0x1d5e703, ftLastAccessTime.dwLowDateTime=0xbf2061d0, ftLastAccessTime.dwHighDateTime=0x1d5e581, ftLastWriteTime.dwLowDateTime=0xbf2061d0, ftLastWriteTime.dwHighDateTime=0x1d5e581, nFileSizeHigh=0x0, nFileSizeLow=0x16e44, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ov0f0zVd74vnx.avi", cAlternateFileName="OV0F0Z~1.AVI")) returned 1 [0108.882] FindNextFileW (in: hFindFile=0x104e3f0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd451d7d0, ftCreationTime.dwHighDateTime=0x1d5ecef, ftLastAccessTime.dwLowDateTime=0x9d00c4e0, ftLastAccessTime.dwHighDateTime=0x1d5e79e, ftLastWriteTime.dwLowDateTime=0x9d00c4e0, ftLastWriteTime.dwHighDateTime=0x1d5e79e, nFileSizeHigh=0x0, nFileSizeLow=0xde00, dwReserved0=0x0, dwReserved1=0x0, cFileName="UXGhp.mkv", cAlternateFileName="")) returned 1 [0108.882] FindNextFileW (in: hFindFile=0x104e3f0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d4233a0, ftCreationTime.dwHighDateTime=0x1d5e10e, ftLastAccessTime.dwLowDateTime=0x343422c0, ftLastAccessTime.dwHighDateTime=0x1d5ebce, ftLastWriteTime.dwLowDateTime=0x343422c0, ftLastWriteTime.dwHighDateTime=0x1d5ebce, nFileSizeHigh=0x0, nFileSizeLow=0x12ace, dwReserved0=0x0, dwReserved1=0x0, cFileName="YsOWzCeNczRQJHzFLMi1.mkv", cAlternateFileName="YSOWZC~1.MKV")) returned 1 [0108.883] FindNextFileW (in: hFindFile=0x104e3f0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0108.883] FindClose (in: hFindFile=0x104e3f0 | out: hFindFile=0x104e3f0) returned 1 [0108.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea68) returned 1 [0108.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea74) returned 1 [0108.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaac) returned 1 [0108.883] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc", nBufferLength=0x105, lpBuffer=0xefe560, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc", lpFilePart=0x0) returned 0x3a [0108.883] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\*", lpFindFileData=0xefe7d4 | out: lpFindFileData=0xefe7d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a52a940, ftCreationTime.dwHighDateTime=0x1d5e0ca, ftLastAccessTime.dwLowDateTime=0x2465a880, ftLastAccessTime.dwHighDateTime=0x1d5e982, ftLastWriteTime.dwLowDateTime=0x2465a880, ftLastWriteTime.dwHighDateTime=0x1d5e982, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104deb0 [0108.883] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a52a940, ftCreationTime.dwHighDateTime=0x1d5e0ca, ftLastAccessTime.dwLowDateTime=0x2465a880, ftLastAccessTime.dwHighDateTime=0x1d5e982, ftLastWriteTime.dwLowDateTime=0x2465a880, ftLastWriteTime.dwHighDateTime=0x1d5e982, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.883] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3aa7500, ftCreationTime.dwHighDateTime=0x1d5e917, ftLastAccessTime.dwLowDateTime=0xb8f00750, ftLastAccessTime.dwHighDateTime=0x1d5e7db, ftLastWriteTime.dwLowDateTime=0xb8f00750, ftLastWriteTime.dwHighDateTime=0x1d5e7db, nFileSizeHigh=0x0, nFileSizeLow=0x10eeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="dT4ipHywERntWmavAQ.mp4", cAlternateFileName="DT4IPH~1.MP4")) returned 1 [0108.883] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18df7d80, ftCreationTime.dwHighDateTime=0x1d5e7be, ftLastAccessTime.dwLowDateTime=0x4843c4d0, ftLastAccessTime.dwHighDateTime=0x1d5e5e5, ftLastWriteTime.dwLowDateTime=0x4843c4d0, ftLastWriteTime.dwHighDateTime=0x1d5e5e5, nFileSizeHigh=0x0, nFileSizeLow=0x1610d, dwReserved0=0x0, dwReserved1=0x0, cFileName="E5xJc.flv", cAlternateFileName="")) returned 1 [0108.883] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa754e160, ftCreationTime.dwHighDateTime=0x1d5e334, ftLastAccessTime.dwLowDateTime=0xaccd57f0, ftLastAccessTime.dwHighDateTime=0x1d5f00c, ftLastWriteTime.dwLowDateTime=0xaccd57f0, ftLastWriteTime.dwHighDateTime=0x1d5f00c, nFileSizeHigh=0x0, nFileSizeLow=0x15665, dwReserved0=0x0, dwReserved1=0x0, cFileName="HDIl_.swf", cAlternateFileName="")) returned 1 [0108.883] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb177b1c0, ftCreationTime.dwHighDateTime=0x1d5ea5c, ftLastAccessTime.dwLowDateTime=0x279c1550, ftLastAccessTime.dwHighDateTime=0x1d5e335, ftLastWriteTime.dwLowDateTime=0x279c1550, ftLastWriteTime.dwHighDateTime=0x1d5e335, nFileSizeHigh=0x0, nFileSizeLow=0xa459, dwReserved0=0x0, dwReserved1=0x0, cFileName="NaTuTXk.mkv", cAlternateFileName="")) returned 1 [0108.883] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbb64360, ftCreationTime.dwHighDateTime=0x1d5e703, ftLastAccessTime.dwLowDateTime=0xbf2061d0, ftLastAccessTime.dwHighDateTime=0x1d5e581, ftLastWriteTime.dwLowDateTime=0xbf2061d0, ftLastWriteTime.dwHighDateTime=0x1d5e581, nFileSizeHigh=0x0, nFileSizeLow=0x16e44, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ov0f0zVd74vnx.avi", cAlternateFileName="OV0F0Z~1.AVI")) returned 1 [0108.884] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd451d7d0, ftCreationTime.dwHighDateTime=0x1d5ecef, ftLastAccessTime.dwLowDateTime=0x9d00c4e0, ftLastAccessTime.dwHighDateTime=0x1d5e79e, ftLastWriteTime.dwLowDateTime=0x9d00c4e0, ftLastWriteTime.dwHighDateTime=0x1d5e79e, nFileSizeHigh=0x0, nFileSizeLow=0xde00, dwReserved0=0x0, dwReserved1=0x0, cFileName="UXGhp.mkv", cAlternateFileName="")) returned 1 [0108.884] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d4233a0, ftCreationTime.dwHighDateTime=0x1d5e10e, ftLastAccessTime.dwLowDateTime=0x343422c0, ftLastAccessTime.dwHighDateTime=0x1d5ebce, ftLastWriteTime.dwLowDateTime=0x343422c0, ftLastWriteTime.dwHighDateTime=0x1d5ebce, nFileSizeHigh=0x0, nFileSizeLow=0x12ace, dwReserved0=0x0, dwReserved1=0x0, cFileName="YsOWzCeNczRQJHzFLMi1.mkv", cAlternateFileName="YSOWZC~1.MKV")) returned 1 [0108.884] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d4233a0, ftCreationTime.dwHighDateTime=0x1d5e10e, ftLastAccessTime.dwLowDateTime=0x343422c0, ftLastAccessTime.dwHighDateTime=0x1d5ebce, ftLastWriteTime.dwLowDateTime=0x343422c0, ftLastWriteTime.dwHighDateTime=0x1d5ebce, nFileSizeHigh=0x0, nFileSizeLow=0x12ace, dwReserved0=0x0, dwReserved1=0x0, cFileName="YsOWzCeNczRQJHzFLMi1.mkv", cAlternateFileName="YSOWZC~1.MKV")) returned 0 [0108.884] FindClose (in: hFindFile=0x104deb0 | out: hFindFile=0x104deb0) returned 1 [0108.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea68) returned 1 [0108.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea74) returned 1 [0108.884] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\dT4ipHywERntWmavAQ.mp4", nBufferLength=0x105, lpBuffer=0xefe414, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\dT4ipHywERntWmavAQ.mp4", lpFilePart=0x0) returned 0x51 [0108.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe958) returned 1 [0108.884] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\dT4ipHywERntWmavAQ.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\uha8\\izvs706xiyqflrc\\dt4iphywerntwmavaq.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0108.884] GetFileType (hFile=0x2e4) returned 0x1 [0108.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe954) returned 1 [0108.884] GetFileType (hFile=0x2e4) returned 0x1 [0108.884] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefea54 | out: lpFileSizeHigh=0xefea54*=0x0) returned 0x10eeb [0108.885] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f9c7e8, nNumberOfBytesToRead=0x10eeb, lpNumberOfBytesRead=0xefea00, lpOverlapped=0x0 | out: lpBuffer=0x2f9c7e8*, lpNumberOfBytesRead=0xefea00*=0x10eeb, lpOverlapped=0x0) returned 1 [0108.886] CloseHandle (hObject=0x2e4) returned 1 [0108.911] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0108.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9cc) returned 1 [0108.911] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefea48 | out: lpFileInformation=0xefea48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0108.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9c8) returned 1 [0108.911] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\dT4ipHywERntWmavAQ.mp4", nBufferLength=0x105, lpBuffer=0xefe400, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\dT4ipHywERntWmavAQ.mp4", lpFilePart=0x0) returned 0x51 [0108.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe944) returned 1 [0108.911] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\dT4ipHywERntWmavAQ.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\uha8\\izvs706xiyqflrc\\dt4iphywerntwmavaq.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0108.913] GetFileType (hFile=0x2e4) returned 0x1 [0108.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe940) returned 1 [0108.913] GetFileType (hFile=0x2e4) returned 0x1 [0108.913] WriteFile (in: hFile=0x2e4, lpBuffer=0x301c2b4*, nNumberOfBytesToWrite=0x10ef0, lpNumberOfBytesWritten=0xefe9f4, lpOverlapped=0x0 | out: lpBuffer=0x301c2b4*, lpNumberOfBytesWritten=0xefe9f4*=0x10ef0, lpOverlapped=0x0) returned 1 [0108.915] CloseHandle (hObject=0x2e4) returned 1 [0108.917] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\dT4ipHywERntWmavAQ.mp4", nBufferLength=0x105, lpBuffer=0xefe524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\dT4ipHywERntWmavAQ.mp4", lpFilePart=0x0) returned 0x51 [0108.917] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\dT4ipHywERntWmavAQ.mp4.UGMH", nBufferLength=0x105, lpBuffer=0xefe524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\dT4ipHywERntWmavAQ.mp4.UGMH", lpFilePart=0x0) returned 0x56 [0108.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9d8) returned 1 [0108.917] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\dT4ipHywERntWmavAQ.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\uha8\\izvs706xiyqflrc\\dt4iphywerntwmavaq.mp4"), fInfoLevelId=0x0, lpFileInformation=0xefea54 | out: lpFileInformation=0xefea54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3aa7500, ftCreationTime.dwHighDateTime=0x1d5e917, ftLastAccessTime.dwLowDateTime=0xb8f00750, ftLastAccessTime.dwHighDateTime=0x1d5e7db, ftLastWriteTime.dwLowDateTime=0xd70403fd, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x10ef0)) returned 1 [0108.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9d4) returned 1 [0108.917] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\dT4ipHywERntWmavAQ.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\uha8\\izvs706xiyqflrc\\dt4iphywerntwmavaq.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\dT4ipHywERntWmavAQ.mp4.UGMH" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\uha8\\izvs706xiyqflrc\\dt4iphywerntwmavaq.mp4.ugmh")) returned 1 [0108.918] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\NaTuTXk.mkv", nBufferLength=0x105, lpBuffer=0xefe414, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\NaTuTXk.mkv", lpFilePart=0x0) returned 0x46 [0108.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe958) returned 1 [0108.918] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\NaTuTXk.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\uha8\\izvs706xiyqflrc\\natutxk.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0108.918] GetFileType (hFile=0x2e4) returned 0x1 [0108.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe954) returned 1 [0108.918] GetFileType (hFile=0x2e4) returned 0x1 [0108.918] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefea54 | out: lpFileSizeHigh=0xefea54*=0x0) returned 0xa459 [0108.918] ReadFile (in: hFile=0x2e4, lpBuffer=0x302d770, nNumberOfBytesToRead=0xa459, lpNumberOfBytesRead=0xefea00, lpOverlapped=0x0 | out: lpBuffer=0x302d770*, lpNumberOfBytesRead=0xefea00*=0xa459, lpOverlapped=0x0) returned 1 [0108.919] CloseHandle (hObject=0x2e4) returned 1 [0109.001] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0109.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9cc) returned 1 [0109.001] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefea48 | out: lpFileInformation=0xefea48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0109.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9c8) returned 1 [0109.002] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\NaTuTXk.mkv", nBufferLength=0x105, lpBuffer=0xefe400, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\NaTuTXk.mkv", lpFilePart=0x0) returned 0x46 [0109.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe944) returned 1 [0109.002] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\NaTuTXk.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\uha8\\izvs706xiyqflrc\\natutxk.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0109.002] GetFileType (hFile=0x2e4) returned 0x1 [0109.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe940) returned 1 [0109.002] GetFileType (hFile=0x2e4) returned 0x1 [0109.002] WriteFile (in: hFile=0x2e4, lpBuffer=0x2eb8d58*, nNumberOfBytesToWrite=0xa460, lpNumberOfBytesWritten=0xefe9f4, lpOverlapped=0x0 | out: lpBuffer=0x2eb8d58*, lpNumberOfBytesWritten=0xefe9f4*=0xa460, lpOverlapped=0x0) returned 1 [0109.004] CloseHandle (hObject=0x2e4) returned 1 [0109.006] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\NaTuTXk.mkv", nBufferLength=0x105, lpBuffer=0xefe524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\NaTuTXk.mkv", lpFilePart=0x0) returned 0x46 [0109.006] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\NaTuTXk.mkv.UGMH", nBufferLength=0x105, lpBuffer=0xefe524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\NaTuTXk.mkv.UGMH", lpFilePart=0x0) returned 0x4b [0109.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9d8) returned 1 [0109.006] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\NaTuTXk.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\uha8\\izvs706xiyqflrc\\natutxk.mkv"), fInfoLevelId=0x0, lpFileInformation=0xefea54 | out: lpFileInformation=0xefea54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb177b1c0, ftCreationTime.dwHighDateTime=0x1d5ea5c, ftLastAccessTime.dwLowDateTime=0x279c1550, ftLastAccessTime.dwHighDateTime=0x1d5e335, ftLastWriteTime.dwLowDateTime=0xd712524c, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xa460)) returned 1 [0109.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9d4) returned 1 [0109.007] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\NaTuTXk.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\uha8\\izvs706xiyqflrc\\natutxk.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\NaTuTXk.mkv.UGMH" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\uha8\\izvs706xiyqflrc\\natutxk.mkv.ugmh")) returned 1 [0109.007] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\Ov0f0zVd74vnx.avi", nBufferLength=0x105, lpBuffer=0xefe414, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\Ov0f0zVd74vnx.avi", lpFilePart=0x0) returned 0x4c [0109.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe958) returned 1 [0109.008] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\Ov0f0zVd74vnx.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\uha8\\izvs706xiyqflrc\\ov0f0zvd74vnx.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0109.008] GetFileType (hFile=0x2e4) returned 0x1 [0109.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe954) returned 1 [0109.008] GetFileType (hFile=0x2e4) returned 0x1 [0109.008] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefea54 | out: lpFileSizeHigh=0xefea54*=0x0) returned 0x16e44 [0109.009] ReadFile (in: hFile=0x2e4, lpBuffer=0x3fefc60, nNumberOfBytesToRead=0x16e44, lpNumberOfBytesRead=0xefea00, lpOverlapped=0x0 | out: lpBuffer=0x3fefc60*, lpNumberOfBytesRead=0xefea00*=0x16e44, lpOverlapped=0x0) returned 1 [0109.012] CloseHandle (hObject=0x2e4) returned 1 [0109.100] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0109.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9cc) returned 1 [0109.100] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefea48 | out: lpFileInformation=0xefea48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0109.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9c8) returned 1 [0109.100] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\Ov0f0zVd74vnx.avi", nBufferLength=0x105, lpBuffer=0xefe400, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\Ov0f0zVd74vnx.avi", lpFilePart=0x0) returned 0x4c [0109.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe944) returned 1 [0109.100] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\Ov0f0zVd74vnx.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\uha8\\izvs706xiyqflrc\\ov0f0zvd74vnx.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0109.102] GetFileType (hFile=0x2e4) returned 0x1 [0109.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe940) returned 1 [0109.102] GetFileType (hFile=0x2e4) returned 0x1 [0109.103] WriteFile (in: hFile=0x2e4, lpBuffer=0x4062420*, nNumberOfBytesToWrite=0x16e50, lpNumberOfBytesWritten=0xefe9f4, lpOverlapped=0x0 | out: lpBuffer=0x4062420*, lpNumberOfBytesWritten=0xefe9f4*=0x16e50, lpOverlapped=0x0) returned 1 [0109.105] CloseHandle (hObject=0x2e4) returned 1 [0109.119] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\Ov0f0zVd74vnx.avi", nBufferLength=0x105, lpBuffer=0xefe524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\Ov0f0zVd74vnx.avi", lpFilePart=0x0) returned 0x4c [0109.119] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\Ov0f0zVd74vnx.avi.UGMH", nBufferLength=0x105, lpBuffer=0xefe524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\Ov0f0zVd74vnx.avi.UGMH", lpFilePart=0x0) returned 0x51 [0109.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9d8) returned 1 [0109.119] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\Ov0f0zVd74vnx.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\uha8\\izvs706xiyqflrc\\ov0f0zvd74vnx.avi"), fInfoLevelId=0x0, lpFileInformation=0xefea54 | out: lpFileInformation=0xefea54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbb64360, ftCreationTime.dwHighDateTime=0x1d5e703, ftLastAccessTime.dwLowDateTime=0xbf2061d0, ftLastAccessTime.dwHighDateTime=0x1d5e581, ftLastWriteTime.dwLowDateTime=0xd7230e1e, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x16e50)) returned 1 [0109.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9d4) returned 1 [0109.119] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\Ov0f0zVd74vnx.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\uha8\\izvs706xiyqflrc\\ov0f0zvd74vnx.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\Ov0f0zVd74vnx.avi.UGMH" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\uha8\\izvs706xiyqflrc\\ov0f0zvd74vnx.avi.ugmh")) returned 1 [0109.120] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\UXGhp.mkv", nBufferLength=0x105, lpBuffer=0xefe414, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\UXGhp.mkv", lpFilePart=0x0) returned 0x44 [0109.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe958) returned 1 [0109.120] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\UXGhp.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\uha8\\izvs706xiyqflrc\\uxghp.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0109.121] GetFileType (hFile=0x2e4) returned 0x1 [0109.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe954) returned 1 [0109.121] GetFileType (hFile=0x2e4) returned 0x1 [0109.121] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefea54 | out: lpFileSizeHigh=0xefea54*=0x0) returned 0xde00 [0109.121] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f10bac, nNumberOfBytesToRead=0xde00, lpNumberOfBytesRead=0xefea00, lpOverlapped=0x0 | out: lpBuffer=0x2f10bac*, lpNumberOfBytesRead=0xefea00*=0xde00, lpOverlapped=0x0) returned 1 [0109.122] CloseHandle (hObject=0x2e4) returned 1 [0109.152] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0109.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9cc) returned 1 [0109.153] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefea48 | out: lpFileInformation=0xefea48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0109.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9c8) returned 1 [0109.153] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\UXGhp.mkv", nBufferLength=0x105, lpBuffer=0xefe400, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\UXGhp.mkv", lpFilePart=0x0) returned 0x44 [0109.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe944) returned 1 [0109.153] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\UXGhp.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\uha8\\izvs706xiyqflrc\\uxghp.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0109.155] GetFileType (hFile=0x2e4) returned 0x1 [0109.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe940) returned 1 [0109.155] GetFileType (hFile=0x2e4) returned 0x1 [0109.155] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f873d4*, nNumberOfBytesToWrite=0xde10, lpNumberOfBytesWritten=0xefe9f4, lpOverlapped=0x0 | out: lpBuffer=0x2f873d4*, lpNumberOfBytesWritten=0xefe9f4*=0xde10, lpOverlapped=0x0) returned 1 [0109.256] CloseHandle (hObject=0x2e4) returned 1 [0109.258] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\UXGhp.mkv", nBufferLength=0x105, lpBuffer=0xefe524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\UXGhp.mkv", lpFilePart=0x0) returned 0x44 [0109.258] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\UXGhp.mkv.UGMH", nBufferLength=0x105, lpBuffer=0xefe524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\UXGhp.mkv.UGMH", lpFilePart=0x0) returned 0x49 [0109.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9d8) returned 1 [0109.258] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\UXGhp.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\uha8\\izvs706xiyqflrc\\uxghp.mkv"), fInfoLevelId=0x0, lpFileInformation=0xefea54 | out: lpFileInformation=0xefea54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd451d7d0, ftCreationTime.dwHighDateTime=0x1d5ecef, ftLastAccessTime.dwLowDateTime=0x9d00c4e0, ftLastAccessTime.dwHighDateTime=0x1d5e79e, ftLastWriteTime.dwLowDateTime=0xd738778d, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xde10)) returned 1 [0109.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9d4) returned 1 [0109.258] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\UXGhp.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\uha8\\izvs706xiyqflrc\\uxghp.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\UXGhp.mkv.UGMH" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\uha8\\izvs706xiyqflrc\\uxghp.mkv.ugmh")) returned 1 [0109.259] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\YsOWzCeNczRQJHzFLMi1.mkv", nBufferLength=0x105, lpBuffer=0xefe414, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\YsOWzCeNczRQJHzFLMi1.mkv", lpFilePart=0x0) returned 0x53 [0109.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe958) returned 1 [0109.259] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\YsOWzCeNczRQJHzFLMi1.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\uha8\\izvs706xiyqflrc\\ysowzcenczrqjhzflmi1.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0109.259] GetFileType (hFile=0x2e4) returned 0x1 [0109.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe954) returned 1 [0109.259] GetFileType (hFile=0x2e4) returned 0x1 [0109.259] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefea54 | out: lpFileSizeHigh=0xefea54*=0x0) returned 0x12ace [0109.259] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f95730, nNumberOfBytesToRead=0x12ace, lpNumberOfBytesRead=0xefea00, lpOverlapped=0x0 | out: lpBuffer=0x2f95730*, lpNumberOfBytesRead=0xefea00*=0x12ace, lpOverlapped=0x0) returned 1 [0109.261] CloseHandle (hObject=0x2e4) returned 1 [0109.290] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0109.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9cc) returned 1 [0109.290] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefea48 | out: lpFileInformation=0xefea48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0109.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9c8) returned 1 [0109.290] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\YsOWzCeNczRQJHzFLMi1.mkv", nBufferLength=0x105, lpBuffer=0xefe400, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\YsOWzCeNczRQJHzFLMi1.mkv", lpFilePart=0x0) returned 0x53 [0109.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe944) returned 1 [0109.290] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\YsOWzCeNczRQJHzFLMi1.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\uha8\\izvs706xiyqflrc\\ysowzcenczrqjhzflmi1.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0109.291] GetFileType (hFile=0x2e4) returned 0x1 [0109.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe940) returned 1 [0109.291] GetFileType (hFile=0x2e4) returned 0x1 [0109.292] WriteFile (in: hFile=0x2e4, lpBuffer=0x301a59c*, nNumberOfBytesToWrite=0x12ad0, lpNumberOfBytesWritten=0xefe9f4, lpOverlapped=0x0 | out: lpBuffer=0x301a59c*, lpNumberOfBytesWritten=0xefe9f4*=0x12ad0, lpOverlapped=0x0) returned 1 [0109.293] CloseHandle (hObject=0x2e4) returned 1 [0109.298] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\YsOWzCeNczRQJHzFLMi1.mkv", nBufferLength=0x105, lpBuffer=0xefe524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\YsOWzCeNczRQJHzFLMi1.mkv", lpFilePart=0x0) returned 0x53 [0109.298] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\YsOWzCeNczRQJHzFLMi1.mkv.UGMH", nBufferLength=0x105, lpBuffer=0xefe524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\YsOWzCeNczRQJHzFLMi1.mkv.UGMH", lpFilePart=0x0) returned 0x58 [0109.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9d8) returned 1 [0109.298] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\YsOWzCeNczRQJHzFLMi1.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\uha8\\izvs706xiyqflrc\\ysowzcenczrqjhzflmi1.mkv"), fInfoLevelId=0x0, lpFileInformation=0xefea54 | out: lpFileInformation=0xefea54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d4233a0, ftCreationTime.dwHighDateTime=0x1d5e10e, ftLastAccessTime.dwLowDateTime=0x343422c0, ftLastAccessTime.dwHighDateTime=0x1d5ebce, ftLastWriteTime.dwLowDateTime=0xd73f9c43, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x12ad0)) returned 1 [0109.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9d4) returned 1 [0109.298] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\YsOWzCeNczRQJHzFLMi1.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\uha8\\izvs706xiyqflrc\\ysowzcenczrqjhzflmi1.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Uha8\\IZvs706XiyQFlrc\\YsOWzCeNczRQJHzFLMi1.mkv.UGMH" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\uha8\\izvs706xiyqflrc\\ysowzcenczrqjhzflmi1.mkv.ugmh")) returned 1 [0109.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb20) returned 1 [0109.299] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J", nBufferLength=0x105, lpBuffer=0xefe5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J", lpFilePart=0x0) returned 0x2b [0109.299] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\*", lpFindFileData=0xefe848 | out: lpFindFileData=0xefe848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9cf3440, ftCreationTime.dwHighDateTime=0x1d5eea0, ftLastAccessTime.dwLowDateTime=0x9ac0e40, ftLastAccessTime.dwHighDateTime=0x1d5e684, ftLastWriteTime.dwLowDateTime=0x9ac0e40, ftLastWriteTime.dwHighDateTime=0x1d5e684, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104dd70 [0109.299] FindNextFileW (in: hFindFile=0x104dd70, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9cf3440, ftCreationTime.dwHighDateTime=0x1d5eea0, ftLastAccessTime.dwLowDateTime=0x9ac0e40, ftLastAccessTime.dwHighDateTime=0x1d5e684, ftLastWriteTime.dwLowDateTime=0x9ac0e40, ftLastWriteTime.dwHighDateTime=0x1d5e684, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.299] FindNextFileW (in: hFindFile=0x104dd70, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca435ad0, ftCreationTime.dwHighDateTime=0x1d5e4ab, ftLastAccessTime.dwLowDateTime=0xd7f01530, ftLastAccessTime.dwHighDateTime=0x1d5e544, ftLastWriteTime.dwLowDateTime=0xd7f01530, ftLastWriteTime.dwHighDateTime=0x1d5e544, nFileSizeHigh=0x0, nFileSizeLow=0x7361, dwReserved0=0x0, dwReserved1=0x0, cFileName="CuVZ7lm07C.flv", cAlternateFileName="CUVZ7L~1.FLV")) returned 1 [0109.299] FindNextFileW (in: hFindFile=0x104dd70, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x738b29e0, ftCreationTime.dwHighDateTime=0x1d5e459, ftLastAccessTime.dwLowDateTime=0x4937b8f0, ftLastAccessTime.dwHighDateTime=0x1d5e66d, ftLastWriteTime.dwLowDateTime=0x4937b8f0, ftLastWriteTime.dwHighDateTime=0x1d5e66d, nFileSizeHigh=0x0, nFileSizeLow=0xeb33, dwReserved0=0x0, dwReserved1=0x0, cFileName="duekHlmObDZYAeVuvJ.mkv", cAlternateFileName="DUEKHL~1.MKV")) returned 1 [0109.299] FindNextFileW (in: hFindFile=0x104dd70, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1afcc7b0, ftCreationTime.dwHighDateTime=0x1d5ed2e, ftLastAccessTime.dwLowDateTime=0xacf73430, ftLastAccessTime.dwHighDateTime=0x1d5edf5, ftLastWriteTime.dwLowDateTime=0xacf73430, ftLastWriteTime.dwHighDateTime=0x1d5edf5, nFileSizeHigh=0x0, nFileSizeLow=0x1611f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITxrggS4wiktxecIHG.flv", cAlternateFileName="ITXRGG~1.FLV")) returned 1 [0109.299] FindNextFileW (in: hFindFile=0x104dd70, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x513412f0, ftCreationTime.dwHighDateTime=0x1d5e65a, ftLastAccessTime.dwLowDateTime=0xb75ada00, ftLastAccessTime.dwHighDateTime=0x1d5e0d8, ftLastWriteTime.dwLowDateTime=0xb75ada00, ftLastWriteTime.dwHighDateTime=0x1d5e0d8, nFileSizeHigh=0x0, nFileSizeLow=0xdfbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="ltvs sc0QMv.avi", cAlternateFileName="LTVSSC~1.AVI")) returned 1 [0109.299] FindNextFileW (in: hFindFile=0x104dd70, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8339b830, ftCreationTime.dwHighDateTime=0x1d5e7e6, ftLastAccessTime.dwLowDateTime=0x219b00d0, ftLastAccessTime.dwHighDateTime=0x1d5e803, ftLastWriteTime.dwLowDateTime=0x219b00d0, ftLastWriteTime.dwHighDateTime=0x1d5e803, nFileSizeHigh=0x0, nFileSizeLow=0xf69c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OeCasvgcMID2Loh_.swf", cAlternateFileName="OECASV~1.SWF")) returned 1 [0109.299] FindNextFileW (in: hFindFile=0x104dd70, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b588fd0, ftCreationTime.dwHighDateTime=0x1d5e3f2, ftLastAccessTime.dwLowDateTime=0x3c4a90a0, ftLastAccessTime.dwHighDateTime=0x1d5e4b9, ftLastWriteTime.dwLowDateTime=0x3c4a90a0, ftLastWriteTime.dwHighDateTime=0x1d5e4b9, nFileSizeHigh=0x0, nFileSizeLow=0x18fc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ox_Q.swf", cAlternateFileName="")) returned 1 [0109.299] FindNextFileW (in: hFindFile=0x104dd70, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0f6f480, ftCreationTime.dwHighDateTime=0x1d5e941, ftLastAccessTime.dwLowDateTime=0x5e240d00, ftLastAccessTime.dwHighDateTime=0x1d5e211, ftLastWriteTime.dwLowDateTime=0x5e240d00, ftLastWriteTime.dwHighDateTime=0x1d5e211, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pd0PEn Mcf7JTIRM0t", cAlternateFileName="PD0PEN~1")) returned 1 [0109.299] FindNextFileW (in: hFindFile=0x104dd70, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ad6e520, ftCreationTime.dwHighDateTime=0x1d5e9b0, ftLastAccessTime.dwLowDateTime=0xb89a9960, ftLastAccessTime.dwHighDateTime=0x1d5e46f, ftLastWriteTime.dwLowDateTime=0xb89a9960, ftLastWriteTime.dwHighDateTime=0x1d5e46f, nFileSizeHigh=0x0, nFileSizeLow=0x9c39, dwReserved0=0x0, dwReserved1=0x0, cFileName="W3tKg.swf", cAlternateFileName="")) returned 1 [0109.300] FindNextFileW (in: hFindFile=0x104dd70, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0109.300] FindClose (in: hFindFile=0x104dd70 | out: hFindFile=0x104dd70) returned 1 [0109.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeadc) returned 1 [0109.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeae8) returned 1 [0109.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb20) returned 1 [0109.300] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J", nBufferLength=0x105, lpBuffer=0xefe5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J", lpFilePart=0x0) returned 0x2b [0109.300] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\*", lpFindFileData=0xefe848 | out: lpFindFileData=0xefe848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9cf3440, ftCreationTime.dwHighDateTime=0x1d5eea0, ftLastAccessTime.dwLowDateTime=0x9ac0e40, ftLastAccessTime.dwHighDateTime=0x1d5e684, ftLastWriteTime.dwLowDateTime=0x9ac0e40, ftLastWriteTime.dwHighDateTime=0x1d5e684, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104deb0 [0109.300] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9cf3440, ftCreationTime.dwHighDateTime=0x1d5eea0, ftLastAccessTime.dwLowDateTime=0x9ac0e40, ftLastAccessTime.dwHighDateTime=0x1d5e684, ftLastWriteTime.dwLowDateTime=0x9ac0e40, ftLastWriteTime.dwHighDateTime=0x1d5e684, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.300] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca435ad0, ftCreationTime.dwHighDateTime=0x1d5e4ab, ftLastAccessTime.dwLowDateTime=0xd7f01530, ftLastAccessTime.dwHighDateTime=0x1d5e544, ftLastWriteTime.dwLowDateTime=0xd7f01530, ftLastWriteTime.dwHighDateTime=0x1d5e544, nFileSizeHigh=0x0, nFileSizeLow=0x7361, dwReserved0=0x0, dwReserved1=0x0, cFileName="CuVZ7lm07C.flv", cAlternateFileName="CUVZ7L~1.FLV")) returned 1 [0109.300] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x738b29e0, ftCreationTime.dwHighDateTime=0x1d5e459, ftLastAccessTime.dwLowDateTime=0x4937b8f0, ftLastAccessTime.dwHighDateTime=0x1d5e66d, ftLastWriteTime.dwLowDateTime=0x4937b8f0, ftLastWriteTime.dwHighDateTime=0x1d5e66d, nFileSizeHigh=0x0, nFileSizeLow=0xeb33, dwReserved0=0x0, dwReserved1=0x0, cFileName="duekHlmObDZYAeVuvJ.mkv", cAlternateFileName="DUEKHL~1.MKV")) returned 1 [0109.300] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1afcc7b0, ftCreationTime.dwHighDateTime=0x1d5ed2e, ftLastAccessTime.dwLowDateTime=0xacf73430, ftLastAccessTime.dwHighDateTime=0x1d5edf5, ftLastWriteTime.dwLowDateTime=0xacf73430, ftLastWriteTime.dwHighDateTime=0x1d5edf5, nFileSizeHigh=0x0, nFileSizeLow=0x1611f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITxrggS4wiktxecIHG.flv", cAlternateFileName="ITXRGG~1.FLV")) returned 1 [0109.300] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x513412f0, ftCreationTime.dwHighDateTime=0x1d5e65a, ftLastAccessTime.dwLowDateTime=0xb75ada00, ftLastAccessTime.dwHighDateTime=0x1d5e0d8, ftLastWriteTime.dwLowDateTime=0xb75ada00, ftLastWriteTime.dwHighDateTime=0x1d5e0d8, nFileSizeHigh=0x0, nFileSizeLow=0xdfbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="ltvs sc0QMv.avi", cAlternateFileName="LTVSSC~1.AVI")) returned 1 [0109.300] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8339b830, ftCreationTime.dwHighDateTime=0x1d5e7e6, ftLastAccessTime.dwLowDateTime=0x219b00d0, ftLastAccessTime.dwHighDateTime=0x1d5e803, ftLastWriteTime.dwLowDateTime=0x219b00d0, ftLastWriteTime.dwHighDateTime=0x1d5e803, nFileSizeHigh=0x0, nFileSizeLow=0xf69c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OeCasvgcMID2Loh_.swf", cAlternateFileName="OECASV~1.SWF")) returned 1 [0109.300] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b588fd0, ftCreationTime.dwHighDateTime=0x1d5e3f2, ftLastAccessTime.dwLowDateTime=0x3c4a90a0, ftLastAccessTime.dwHighDateTime=0x1d5e4b9, ftLastWriteTime.dwLowDateTime=0x3c4a90a0, ftLastWriteTime.dwHighDateTime=0x1d5e4b9, nFileSizeHigh=0x0, nFileSizeLow=0x18fc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ox_Q.swf", cAlternateFileName="")) returned 1 [0109.300] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0f6f480, ftCreationTime.dwHighDateTime=0x1d5e941, ftLastAccessTime.dwLowDateTime=0x5e240d00, ftLastAccessTime.dwHighDateTime=0x1d5e211, ftLastWriteTime.dwLowDateTime=0x5e240d00, ftLastWriteTime.dwHighDateTime=0x1d5e211, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pd0PEn Mcf7JTIRM0t", cAlternateFileName="PD0PEN~1")) returned 1 [0109.300] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ad6e520, ftCreationTime.dwHighDateTime=0x1d5e9b0, ftLastAccessTime.dwLowDateTime=0xb89a9960, ftLastAccessTime.dwHighDateTime=0x1d5e46f, ftLastWriteTime.dwLowDateTime=0xb89a9960, ftLastWriteTime.dwHighDateTime=0x1d5e46f, nFileSizeHigh=0x0, nFileSizeLow=0x9c39, dwReserved0=0x0, dwReserved1=0x0, cFileName="W3tKg.swf", cAlternateFileName="")) returned 1 [0109.300] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe854 | out: lpFindFileData=0xefe854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ad6e520, ftCreationTime.dwHighDateTime=0x1d5e9b0, ftLastAccessTime.dwLowDateTime=0xb89a9960, ftLastAccessTime.dwHighDateTime=0x1d5e46f, ftLastWriteTime.dwLowDateTime=0xb89a9960, ftLastWriteTime.dwHighDateTime=0x1d5e46f, nFileSizeHigh=0x0, nFileSizeLow=0x9c39, dwReserved0=0x0, dwReserved1=0x0, cFileName="W3tKg.swf", cAlternateFileName="")) returned 0 [0109.300] FindClose (in: hFindFile=0x104deb0 | out: hFindFile=0x104deb0) returned 1 [0109.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeadc) returned 1 [0109.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeae8) returned 1 [0109.301] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\duekHlmObDZYAeVuvJ.mkv", nBufferLength=0x105, lpBuffer=0xefe488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\duekHlmObDZYAeVuvJ.mkv", lpFilePart=0x0) returned 0x42 [0109.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9cc) returned 1 [0109.301] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\duekHlmObDZYAeVuvJ.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\yio0j\\duekhlmobdzyaevuvj.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0109.301] GetFileType (hFile=0x2e4) returned 0x1 [0109.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9c8) returned 1 [0109.301] GetFileType (hFile=0x2e4) returned 0x1 [0109.301] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeac8 | out: lpFileSizeHigh=0xefeac8*=0x0) returned 0xeb33 [0109.301] ReadFile (in: hFile=0x2e4, lpBuffer=0x302fd1c, nNumberOfBytesToRead=0xeb33, lpNumberOfBytesRead=0xefea74, lpOverlapped=0x0 | out: lpBuffer=0x302fd1c*, lpNumberOfBytesRead=0xefea74*=0xeb33, lpOverlapped=0x0) returned 1 [0109.302] CloseHandle (hObject=0x2e4) returned 1 [0109.333] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe58c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0109.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0109.333] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeabc | out: lpFileInformation=0xefeabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0109.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0109.333] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\duekHlmObDZYAeVuvJ.mkv", nBufferLength=0x105, lpBuffer=0xefe474, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\duekHlmObDZYAeVuvJ.mkv", lpFilePart=0x0) returned 0x42 [0109.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9b8) returned 1 [0109.333] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\duekHlmObDZYAeVuvJ.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\yio0j\\duekhlmobdzyaevuvj.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0109.335] GetFileType (hFile=0x2e4) returned 0x1 [0109.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9b4) returned 1 [0109.335] GetFileType (hFile=0x2e4) returned 0x1 [0109.335] WriteFile (in: hFile=0x2e4, lpBuffer=0x2ecccb0*, nNumberOfBytesToWrite=0xeb40, lpNumberOfBytesWritten=0xefea68, lpOverlapped=0x0 | out: lpBuffer=0x2ecccb0*, lpNumberOfBytesWritten=0xefea68*=0xeb40, lpOverlapped=0x0) returned 1 [0109.337] CloseHandle (hObject=0x2e4) returned 1 [0109.340] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\duekHlmObDZYAeVuvJ.mkv", nBufferLength=0x105, lpBuffer=0xefe598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\duekHlmObDZYAeVuvJ.mkv", lpFilePart=0x0) returned 0x42 [0109.340] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\duekHlmObDZYAeVuvJ.mkv.UGMH", nBufferLength=0x105, lpBuffer=0xefe598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\duekHlmObDZYAeVuvJ.mkv.UGMH", lpFilePart=0x0) returned 0x47 [0109.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea4c) returned 1 [0109.340] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\duekHlmObDZYAeVuvJ.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\yio0j\\duekhlmobdzyaevuvj.mkv"), fInfoLevelId=0x0, lpFileInformation=0xefeac8 | out: lpFileInformation=0xefeac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x738b29e0, ftCreationTime.dwHighDateTime=0x1d5e459, ftLastAccessTime.dwLowDateTime=0x4937b8f0, ftLastAccessTime.dwHighDateTime=0x1d5e66d, ftLastWriteTime.dwLowDateTime=0xd744618c, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xeb40)) returned 1 [0109.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea48) returned 1 [0109.340] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\duekHlmObDZYAeVuvJ.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\yio0j\\duekhlmobdzyaevuvj.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\duekHlmObDZYAeVuvJ.mkv.UGMH" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\yio0j\\duekhlmobdzyaevuvj.mkv.ugmh")) returned 1 [0109.340] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\ltvs sc0QMv.avi", nBufferLength=0x105, lpBuffer=0xefe488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\ltvs sc0QMv.avi", lpFilePart=0x0) returned 0x3b [0109.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9cc) returned 1 [0109.341] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\ltvs sc0QMv.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\yio0j\\ltvs sc0qmv.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0109.341] GetFileType (hFile=0x2e4) returned 0x1 [0109.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9c8) returned 1 [0109.341] GetFileType (hFile=0x2e4) returned 0x1 [0109.341] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefeac8 | out: lpFileSizeHigh=0xefeac8*=0x0) returned 0xdfbe [0109.341] ReadFile (in: hFile=0x2e4, lpBuffer=0x2edbd1c, nNumberOfBytesToRead=0xdfbe, lpNumberOfBytesRead=0xefea74, lpOverlapped=0x0 | out: lpBuffer=0x2edbd1c*, lpNumberOfBytesRead=0xefea74*=0xdfbe, lpOverlapped=0x0) returned 1 [0109.342] CloseHandle (hObject=0x2e4) returned 1 [0109.363] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe58c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0109.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea40) returned 1 [0109.363] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefeabc | out: lpFileInformation=0xefeabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0109.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea3c) returned 1 [0109.364] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\ltvs sc0QMv.avi", nBufferLength=0x105, lpBuffer=0xefe474, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\ltvs sc0QMv.avi", lpFilePart=0x0) returned 0x3b [0109.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9b8) returned 1 [0109.364] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\ltvs sc0QMv.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\yio0j\\ltvs sc0qmv.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0109.365] GetFileType (hFile=0x2e4) returned 0x1 [0109.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9b4) returned 1 [0109.365] GetFileType (hFile=0x2e4) returned 0x1 [0109.365] WriteFile (in: hFile=0x2e4, lpBuffer=0x2f52bb4*, nNumberOfBytesToWrite=0xdfc0, lpNumberOfBytesWritten=0xefea68, lpOverlapped=0x0 | out: lpBuffer=0x2f52bb4*, lpNumberOfBytesWritten=0xefea68*=0xdfc0, lpOverlapped=0x0) returned 1 [0109.367] CloseHandle (hObject=0x2e4) returned 1 [0109.369] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\ltvs sc0QMv.avi", nBufferLength=0x105, lpBuffer=0xefe598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\ltvs sc0QMv.avi", lpFilePart=0x0) returned 0x3b [0109.369] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\ltvs sc0QMv.avi.UGMH", nBufferLength=0x105, lpBuffer=0xefe598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\ltvs sc0QMv.avi.UGMH", lpFilePart=0x0) returned 0x40 [0109.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea4c) returned 1 [0109.369] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\ltvs sc0QMv.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\yio0j\\ltvs sc0qmv.avi"), fInfoLevelId=0x0, lpFileInformation=0xefeac8 | out: lpFileInformation=0xefeac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x513412f0, ftCreationTime.dwHighDateTime=0x1d5e65a, ftLastAccessTime.dwLowDateTime=0xb75ada00, ftLastAccessTime.dwHighDateTime=0x1d5e0d8, ftLastWriteTime.dwLowDateTime=0xd7492785, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0xdfc0)) returned 1 [0109.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea48) returned 1 [0109.369] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\ltvs sc0QMv.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\yio0j\\ltvs sc0qmv.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\ltvs sc0QMv.avi.UGMH" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\yio0j\\ltvs sc0qmv.avi.ugmh")) returned 1 [0109.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaac) returned 1 [0109.370] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t", nBufferLength=0x105, lpBuffer=0xefe560, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t", lpFilePart=0x0) returned 0x3e [0109.370] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\*", lpFindFileData=0xefe7d4 | out: lpFindFileData=0xefe7d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0f6f480, ftCreationTime.dwHighDateTime=0x1d5e941, ftLastAccessTime.dwLowDateTime=0x5e240d00, ftLastAccessTime.dwHighDateTime=0x1d5e211, ftLastWriteTime.dwLowDateTime=0x5e240d00, ftLastWriteTime.dwHighDateTime=0x1d5e211, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104deb0 [0109.370] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0f6f480, ftCreationTime.dwHighDateTime=0x1d5e941, ftLastAccessTime.dwLowDateTime=0x5e240d00, ftLastAccessTime.dwHighDateTime=0x1d5e211, ftLastWriteTime.dwLowDateTime=0x5e240d00, ftLastWriteTime.dwHighDateTime=0x1d5e211, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.370] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ac82a70, ftCreationTime.dwHighDateTime=0x1d5e9a9, ftLastAccessTime.dwLowDateTime=0x68d5cdc0, ftLastAccessTime.dwHighDateTime=0x1d5e495, ftLastWriteTime.dwLowDateTime=0x68d5cdc0, ftLastWriteTime.dwHighDateTime=0x1d5e495, nFileSizeHigh=0x0, nFileSizeLow=0x66ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="9DmrWOL.mkv", cAlternateFileName="")) returned 1 [0109.370] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c4b4480, ftCreationTime.dwHighDateTime=0x1d5ecdd, ftLastAccessTime.dwLowDateTime=0xa39ad990, ftLastAccessTime.dwHighDateTime=0x1d5ebda, ftLastWriteTime.dwLowDateTime=0xa39ad990, ftLastWriteTime.dwHighDateTime=0x1d5ebda, nFileSizeHigh=0x0, nFileSizeLow=0x12ebf, dwReserved0=0x0, dwReserved1=0x0, cFileName="i88R.mp4", cAlternateFileName="")) returned 1 [0109.370] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1a41b50, ftCreationTime.dwHighDateTime=0x1d5e3b2, ftLastAccessTime.dwLowDateTime=0x3b774720, ftLastAccessTime.dwHighDateTime=0x1d5e5e2, ftLastWriteTime.dwLowDateTime=0x3b774720, ftLastWriteTime.dwHighDateTime=0x1d5e5e2, nFileSizeHigh=0x0, nFileSizeLow=0x107be, dwReserved0=0x0, dwReserved1=0x0, cFileName="P21UaK4uFmS2exm.mkv", cAlternateFileName="P21UAK~1.MKV")) returned 1 [0109.370] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b4cec0, ftCreationTime.dwHighDateTime=0x1d5ea6d, ftLastAccessTime.dwLowDateTime=0x9c776e90, ftLastAccessTime.dwHighDateTime=0x1d5efcb, ftLastWriteTime.dwLowDateTime=0x9c776e90, ftLastWriteTime.dwHighDateTime=0x1d5efcb, nFileSizeHigh=0x0, nFileSizeLow=0x176bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="uta0.mp4", cAlternateFileName="")) returned 1 [0109.370] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a3688d0, ftCreationTime.dwHighDateTime=0x1d5e0e3, ftLastAccessTime.dwLowDateTime=0x6047330, ftLastAccessTime.dwHighDateTime=0x1d5e5f9, ftLastWriteTime.dwLowDateTime=0x6047330, ftLastWriteTime.dwHighDateTime=0x1d5e5f9, nFileSizeHigh=0x0, nFileSizeLow=0x3bb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="XIioo3Y.flv", cAlternateFileName="")) returned 1 [0109.370] FindNextFileW (in: hFindFile=0x104deb0, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0109.370] FindClose (in: hFindFile=0x104deb0 | out: hFindFile=0x104deb0) returned 1 [0109.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea68) returned 1 [0109.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea74) returned 1 [0109.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaac) returned 1 [0109.371] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t", nBufferLength=0x105, lpBuffer=0xefe560, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t", lpFilePart=0x0) returned 0x3e [0109.371] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\*", lpFindFileData=0xefe7d4 | out: lpFindFileData=0xefe7d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0f6f480, ftCreationTime.dwHighDateTime=0x1d5e941, ftLastAccessTime.dwLowDateTime=0x5e240d00, ftLastAccessTime.dwHighDateTime=0x1d5e211, ftLastWriteTime.dwLowDateTime=0x5e240d00, ftLastWriteTime.dwHighDateTime=0x1d5e211, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x104e470 [0109.371] FindNextFileW (in: hFindFile=0x104e470, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0f6f480, ftCreationTime.dwHighDateTime=0x1d5e941, ftLastAccessTime.dwLowDateTime=0x5e240d00, ftLastAccessTime.dwHighDateTime=0x1d5e211, ftLastWriteTime.dwLowDateTime=0x5e240d00, ftLastWriteTime.dwHighDateTime=0x1d5e211, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.371] FindNextFileW (in: hFindFile=0x104e470, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ac82a70, ftCreationTime.dwHighDateTime=0x1d5e9a9, ftLastAccessTime.dwLowDateTime=0x68d5cdc0, ftLastAccessTime.dwHighDateTime=0x1d5e495, ftLastWriteTime.dwLowDateTime=0x68d5cdc0, ftLastWriteTime.dwHighDateTime=0x1d5e495, nFileSizeHigh=0x0, nFileSizeLow=0x66ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="9DmrWOL.mkv", cAlternateFileName="")) returned 1 [0109.371] FindNextFileW (in: hFindFile=0x104e470, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c4b4480, ftCreationTime.dwHighDateTime=0x1d5ecdd, ftLastAccessTime.dwLowDateTime=0xa39ad990, ftLastAccessTime.dwHighDateTime=0x1d5ebda, ftLastWriteTime.dwLowDateTime=0xa39ad990, ftLastWriteTime.dwHighDateTime=0x1d5ebda, nFileSizeHigh=0x0, nFileSizeLow=0x12ebf, dwReserved0=0x0, dwReserved1=0x0, cFileName="i88R.mp4", cAlternateFileName="")) returned 1 [0109.371] FindNextFileW (in: hFindFile=0x104e470, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1a41b50, ftCreationTime.dwHighDateTime=0x1d5e3b2, ftLastAccessTime.dwLowDateTime=0x3b774720, ftLastAccessTime.dwHighDateTime=0x1d5e5e2, ftLastWriteTime.dwLowDateTime=0x3b774720, ftLastWriteTime.dwHighDateTime=0x1d5e5e2, nFileSizeHigh=0x0, nFileSizeLow=0x107be, dwReserved0=0x0, dwReserved1=0x0, cFileName="P21UaK4uFmS2exm.mkv", cAlternateFileName="P21UAK~1.MKV")) returned 1 [0109.371] FindNextFileW (in: hFindFile=0x104e470, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b4cec0, ftCreationTime.dwHighDateTime=0x1d5ea6d, ftLastAccessTime.dwLowDateTime=0x9c776e90, ftLastAccessTime.dwHighDateTime=0x1d5efcb, ftLastWriteTime.dwLowDateTime=0x9c776e90, ftLastWriteTime.dwHighDateTime=0x1d5efcb, nFileSizeHigh=0x0, nFileSizeLow=0x176bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="uta0.mp4", cAlternateFileName="")) returned 1 [0109.371] FindNextFileW (in: hFindFile=0x104e470, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a3688d0, ftCreationTime.dwHighDateTime=0x1d5e0e3, ftLastAccessTime.dwLowDateTime=0x6047330, ftLastAccessTime.dwHighDateTime=0x1d5e5f9, ftLastWriteTime.dwLowDateTime=0x6047330, ftLastWriteTime.dwHighDateTime=0x1d5e5f9, nFileSizeHigh=0x0, nFileSizeLow=0x3bb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="XIioo3Y.flv", cAlternateFileName="")) returned 1 [0109.371] FindNextFileW (in: hFindFile=0x104e470, lpFindFileData=0xefe7e0 | out: lpFindFileData=0xefe7e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a3688d0, ftCreationTime.dwHighDateTime=0x1d5e0e3, ftLastAccessTime.dwLowDateTime=0x6047330, ftLastAccessTime.dwHighDateTime=0x1d5e5f9, ftLastWriteTime.dwLowDateTime=0x6047330, ftLastWriteTime.dwHighDateTime=0x1d5e5f9, nFileSizeHigh=0x0, nFileSizeLow=0x3bb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="XIioo3Y.flv", cAlternateFileName="")) returned 0 [0109.371] FindClose (in: hFindFile=0x104e470 | out: hFindFile=0x104e470) returned 1 [0109.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea68) returned 1 [0109.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea74) returned 1 [0109.371] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\9DmrWOL.mkv", nBufferLength=0x105, lpBuffer=0xefe414, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\9DmrWOL.mkv", lpFilePart=0x0) returned 0x4a [0109.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe958) returned 1 [0109.371] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\9DmrWOL.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\yio0j\\pd0pen mcf7jtirm0t\\9dmrwol.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0109.372] GetFileType (hFile=0x2e4) returned 0x1 [0109.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe954) returned 1 [0109.372] GetFileType (hFile=0x2e4) returned 0x1 [0109.372] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefea54 | out: lpFileSizeHigh=0xefea54*=0x0) returned 0x66ce [0109.372] ReadFile (in: hFile=0x2e4, lpBuffer=0x2f63268, nNumberOfBytesToRead=0x66ce, lpNumberOfBytesRead=0xefea00, lpOverlapped=0x0 | out: lpBuffer=0x2f63268*, lpNumberOfBytesRead=0xefea00*=0x66ce, lpOverlapped=0x0) returned 1 [0109.373] CloseHandle (hObject=0x2e4) returned 1 [0109.390] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0109.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9cc) returned 1 [0109.390] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefea48 | out: lpFileInformation=0xefea48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0109.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9c8) returned 1 [0109.390] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\9DmrWOL.mkv", nBufferLength=0x105, lpBuffer=0xefe400, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\9DmrWOL.mkv", lpFilePart=0x0) returned 0x4a [0109.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe944) returned 1 [0109.390] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\9DmrWOL.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\yio0j\\pd0pen mcf7jtirm0t\\9dmrwol.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0109.392] GetFileType (hFile=0x2e4) returned 0x1 [0109.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe940) returned 1 [0109.392] GetFileType (hFile=0x2e4) returned 0x1 [0109.392] WriteFile (in: hFile=0x2e4, lpBuffer=0x2fd0260*, nNumberOfBytesToWrite=0x66d0, lpNumberOfBytesWritten=0xefe9f4, lpOverlapped=0x0 | out: lpBuffer=0x2fd0260*, lpNumberOfBytesWritten=0xefe9f4*=0x66d0, lpOverlapped=0x0) returned 1 [0109.393] CloseHandle (hObject=0x2e4) returned 1 [0109.394] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\9DmrWOL.mkv", nBufferLength=0x105, lpBuffer=0xefe524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\9DmrWOL.mkv", lpFilePart=0x0) returned 0x4a [0109.394] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\9DmrWOL.mkv.UGMH", nBufferLength=0x105, lpBuffer=0xefe524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\9DmrWOL.mkv.UGMH", lpFilePart=0x0) returned 0x4f [0109.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9d8) returned 1 [0109.395] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\9DmrWOL.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\yio0j\\pd0pen mcf7jtirm0t\\9dmrwol.mkv"), fInfoLevelId=0x0, lpFileInformation=0xefea54 | out: lpFileInformation=0xefea54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ac82a70, ftCreationTime.dwHighDateTime=0x1d5e9a9, ftLastAccessTime.dwLowDateTime=0x68d5cdc0, ftLastAccessTime.dwHighDateTime=0x1d5e495, ftLastWriteTime.dwLowDateTime=0xd74dedac, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x66d0)) returned 1 [0109.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9d4) returned 1 [0109.395] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\9DmrWOL.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\yio0j\\pd0pen mcf7jtirm0t\\9dmrwol.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\9DmrWOL.mkv.UGMH" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\yio0j\\pd0pen mcf7jtirm0t\\9dmrwol.mkv.ugmh")) returned 1 [0109.395] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\i88R.mp4", nBufferLength=0x105, lpBuffer=0xefe414, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\i88R.mp4", lpFilePart=0x0) returned 0x47 [0109.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe958) returned 1 [0109.395] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\i88R.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\yio0j\\pd0pen mcf7jtirm0t\\i88r.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0109.396] GetFileType (hFile=0x2e4) returned 0x1 [0109.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe954) returned 1 [0109.396] GetFileType (hFile=0x2e4) returned 0x1 [0109.396] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefea54 | out: lpFileSizeHigh=0xefea54*=0x0) returned 0x12ebf [0109.396] ReadFile (in: hFile=0x2e4, lpBuffer=0x2fd6e78, nNumberOfBytesToRead=0x12ebf, lpNumberOfBytesRead=0xefea00, lpOverlapped=0x0 | out: lpBuffer=0x2fd6e78*, lpNumberOfBytesRead=0xefea00*=0x12ebf, lpOverlapped=0x0) returned 1 [0109.397] CloseHandle (hObject=0x2e4) returned 1 [0109.422] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0109.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9cc) returned 1 [0109.422] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefea48 | out: lpFileInformation=0xefea48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0109.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9c8) returned 1 [0109.422] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\i88R.mp4", nBufferLength=0x105, lpBuffer=0xefe400, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\i88R.mp4", lpFilePart=0x0) returned 0x47 [0109.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe944) returned 1 [0109.422] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\i88R.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\yio0j\\pd0pen mcf7jtirm0t\\i88r.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0109.424] GetFileType (hFile=0x2e4) returned 0x1 [0109.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe940) returned 1 [0109.424] GetFileType (hFile=0x2e4) returned 0x1 [0109.424] WriteFile (in: hFile=0x2e4, lpBuffer=0x305c8b4*, nNumberOfBytesToWrite=0x12ec0, lpNumberOfBytesWritten=0xefe9f4, lpOverlapped=0x0 | out: lpBuffer=0x305c8b4*, lpNumberOfBytesWritten=0xefe9f4*=0x12ec0, lpOverlapped=0x0) returned 1 [0109.426] CloseHandle (hObject=0x2e4) returned 1 [0109.428] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\i88R.mp4", nBufferLength=0x105, lpBuffer=0xefe524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\i88R.mp4", lpFilePart=0x0) returned 0x47 [0109.428] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\i88R.mp4.UGMH", nBufferLength=0x105, lpBuffer=0xefe524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\i88R.mp4.UGMH", lpFilePart=0x0) returned 0x4c [0109.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9d8) returned 1 [0109.428] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\i88R.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\yio0j\\pd0pen mcf7jtirm0t\\i88r.mp4"), fInfoLevelId=0x0, lpFileInformation=0xefea54 | out: lpFileInformation=0xefea54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c4b4480, ftCreationTime.dwHighDateTime=0x1d5ecdd, ftLastAccessTime.dwLowDateTime=0xa39ad990, ftLastAccessTime.dwHighDateTime=0x1d5ebda, ftLastWriteTime.dwLowDateTime=0xd752b1de, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x12ec0)) returned 1 [0109.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9d4) returned 1 [0109.429] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\i88R.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\yio0j\\pd0pen mcf7jtirm0t\\i88r.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\i88R.mp4.UGMH" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\yio0j\\pd0pen mcf7jtirm0t\\i88r.mp4.ugmh")) returned 1 [0109.429] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\P21UaK4uFmS2exm.mkv", nBufferLength=0x105, lpBuffer=0xefe414, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\P21UaK4uFmS2exm.mkv", lpFilePart=0x0) returned 0x52 [0109.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe958) returned 1 [0109.429] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\P21UaK4uFmS2exm.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\yio0j\\pd0pen mcf7jtirm0t\\p21uak4ufms2exm.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0109.430] GetFileType (hFile=0x2e4) returned 0x1 [0109.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe954) returned 1 [0109.430] GetFileType (hFile=0x2e4) returned 0x1 [0109.430] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefea54 | out: lpFileSizeHigh=0xefea54*=0x0) returned 0x107be [0109.430] ReadFile (in: hFile=0x2e4, lpBuffer=0x306fccc, nNumberOfBytesToRead=0x107be, lpNumberOfBytesRead=0xefea00, lpOverlapped=0x0 | out: lpBuffer=0x306fccc*, lpNumberOfBytesRead=0xefea00*=0x107be, lpOverlapped=0x0) returned 1 [0109.431] CloseHandle (hObject=0x2e4) returned 1 [0109.451] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0109.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9cc) returned 1 [0109.451] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefea48 | out: lpFileInformation=0xefea48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0109.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9c8) returned 1 [0109.451] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\P21UaK4uFmS2exm.mkv", nBufferLength=0x105, lpBuffer=0xefe400, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\P21UaK4uFmS2exm.mkv", lpFilePart=0x0) returned 0x52 [0109.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe944) returned 1 [0109.451] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\P21UaK4uFmS2exm.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\yio0j\\pd0pen mcf7jtirm0t\\p21uak4ufms2exm.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0109.473] GetFileType (hFile=0x2e4) returned 0x1 [0109.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe940) returned 1 [0109.474] GetFileType (hFile=0x2e4) returned 0x1 [0109.474] WriteFile (in: hFile=0x2e4, lpBuffer=0x30ee208*, nNumberOfBytesToWrite=0x107c0, lpNumberOfBytesWritten=0xefe9f4, lpOverlapped=0x0 | out: lpBuffer=0x30ee208*, lpNumberOfBytesWritten=0xefe9f4*=0x107c0, lpOverlapped=0x0) returned 1 [0109.475] CloseHandle (hObject=0x2e4) returned 1 [0109.478] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\P21UaK4uFmS2exm.mkv", nBufferLength=0x105, lpBuffer=0xefe524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\P21UaK4uFmS2exm.mkv", lpFilePart=0x0) returned 0x52 [0109.478] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\P21UaK4uFmS2exm.mkv.UGMH", nBufferLength=0x105, lpBuffer=0xefe524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\P21UaK4uFmS2exm.mkv.UGMH", lpFilePart=0x0) returned 0x57 [0109.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9d8) returned 1 [0109.478] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\P21UaK4uFmS2exm.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\yio0j\\pd0pen mcf7jtirm0t\\p21uak4ufms2exm.mkv"), fInfoLevelId=0x0, lpFileInformation=0xefea54 | out: lpFileInformation=0xefea54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1a41b50, ftCreationTime.dwHighDateTime=0x1d5e3b2, ftLastAccessTime.dwLowDateTime=0x3b774720, ftLastAccessTime.dwHighDateTime=0x1d5e5e2, ftLastWriteTime.dwLowDateTime=0xd759d6c6, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x107c0)) returned 1 [0109.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9d4) returned 1 [0109.479] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\P21UaK4uFmS2exm.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\yio0j\\pd0pen mcf7jtirm0t\\p21uak4ufms2exm.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\P21UaK4uFmS2exm.mkv.UGMH" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\yio0j\\pd0pen mcf7jtirm0t\\p21uak4ufms2exm.mkv.ugmh")) returned 1 [0109.482] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\uta0.mp4", nBufferLength=0x105, lpBuffer=0xefe414, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\uta0.mp4", lpFilePart=0x0) returned 0x47 [0109.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe958) returned 1 [0109.483] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\uta0.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\yio0j\\pd0pen mcf7jtirm0t\\uta0.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0109.483] GetFileType (hFile=0x2e4) returned 0x1 [0109.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe954) returned 1 [0109.483] GetFileType (hFile=0x2e4) returned 0x1 [0109.483] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0xefea54 | out: lpFileSizeHigh=0xefea54*=0x0) returned 0x176bc [0109.484] ReadFile (in: hFile=0x2e4, lpBuffer=0x413a750, nNumberOfBytesToRead=0x176bc, lpNumberOfBytesRead=0xefea00, lpOverlapped=0x0 | out: lpBuffer=0x413a750*, lpNumberOfBytesRead=0xefea00*=0x176bc, lpOverlapped=0x0) returned 1 [0109.486] CloseHandle (hObject=0x2e4) returned 1 [0109.529] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0109.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9cc) returned 1 [0109.529] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), fInfoLevelId=0x0, lpFileInformation=0xefea48 | out: lpFileInformation=0xefea48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0109.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9c8) returned 1 [0109.530] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\uta0.mp4", nBufferLength=0x105, lpBuffer=0xefe400, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\uta0.mp4", lpFilePart=0x0) returned 0x47 [0109.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe944) returned 1 [0109.530] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\uta0.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\yio0j\\pd0pen mcf7jtirm0t\\uta0.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0109.533] GetFileType (hFile=0x2e4) returned 0x1 [0109.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe940) returned 1 [0109.533] GetFileType (hFile=0x2e4) returned 0x1 [0109.533] WriteFile (in: hFile=0x2e4, lpBuffer=0x3ea7d20*, nNumberOfBytesToWrite=0x176c0, lpNumberOfBytesWritten=0xefe9f4, lpOverlapped=0x0 | out: lpBuffer=0x3ea7d20*, lpNumberOfBytesWritten=0xefe9f4*=0x176c0, lpOverlapped=0x0) returned 1 [0109.536] CloseHandle (hObject=0x2e4) returned 1 [0109.546] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\uta0.mp4", nBufferLength=0x105, lpBuffer=0xefe524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\uta0.mp4", lpFilePart=0x0) returned 0x47 [0109.546] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\uta0.mp4.UGMH", nBufferLength=0x105, lpBuffer=0xefe524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\uta0.mp4.UGMH", lpFilePart=0x0) returned 0x4c [0109.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefe9d8) returned 1 [0109.547] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\uta0.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\yio0j\\pd0pen mcf7jtirm0t\\uta0.mp4"), fInfoLevelId=0x0, lpFileInformation=0xefea54 | out: lpFileInformation=0xefea54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b4cec0, ftCreationTime.dwHighDateTime=0x1d5ea6d, ftLastAccessTime.dwLowDateTime=0x9c776e90, ftLastAccessTime.dwHighDateTime=0x1d5efcb, ftLastWriteTime.dwLowDateTime=0xd765c2cf, ftLastWriteTime.dwHighDateTime=0x1d68033, nFileSizeHigh=0x0, nFileSizeLow=0x176c0)) returned 1 [0109.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefe9d4) returned 1 [0109.547] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\uta0.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\yio0j\\pd0pen mcf7jtirm0t\\uta0.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\LrqG45 pQjyr9v\\Yio0J\\pd0PEn Mcf7JTIRM0t\\uta0.mp4.UGMH" (normalized: "c:\\users\\fd1hvy\\videos\\lrqg45 pqjyr9v\\yio0j\\pd0pen mcf7jtirm0t\\uta0.mp4.ugmh")) returned 1 [0109.555] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", nBufferLength=0x105, lpBuffer=0xefe6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt", lpFilePart=0x0) returned 0x21 [0109.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebe4) returned 1 [0109.555] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pwned.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\pwned.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2e4 [0109.584] GetFileType (hFile=0x2e4) returned 0x1 [0109.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebe0) returned 1 [0109.584] GetFileType (hFile=0x2e4) returned 0x1 [0109.629] WriteFile (in: hFile=0x2e4, lpBuffer=0x2e3f5fc*, nNumberOfBytesToWrite=0xbd, lpNumberOfBytesWritten=0xefec44, lpOverlapped=0x0 | out: lpBuffer=0x2e3f5fc*, lpNumberOfBytesWritten=0xefec44*=0xbd, lpOverlapped=0x0) returned 1 [0109.630] CloseHandle (hObject=0x2e4) returned 1 [0110.713] GetCurrentProcess () returned 0xffffffff [0110.713] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xefe8fc | out: TokenHandle=0xefe8fc*=0x2d0) returned 1 [0110.724] GetCurrentProcess () returned 0xffffffff [0110.724] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xefe90c | out: TokenHandle=0xefe90c*=0x2d4) returned 1 [0110.745] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2e8 [0110.745] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x2d8 [0110.748] GetCurrentProcess () returned 0xffffffff [0110.748] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xefe91c | out: TokenHandle=0xefe91c*=0x2dc) returned 1 [0110.791] GetCurrentProcess () returned 0xffffffff [0110.791] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xefe92c | out: TokenHandle=0xefe92c*=0x2cc) returned 1 [0110.796] QueryPerformanceFrequency (in: lpFrequency=0xfc5a98 | out: lpFrequency=0xfc5a98*=100000000) returned 1 [0110.797] QueryPerformanceCounter (in: lpPerformanceCount=0xefeca0 | out: lpPerformanceCount=0xefeca0*=20593418896) returned 1 [0110.800] GetCurrentProcess () returned 0xffffffff [0110.800] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xefe8e8 | out: TokenHandle=0xefe8e8*=0x2e0) returned 1 [0110.804] GetCurrentProcess () returned 0xffffffff [0110.804] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xefe8f8 | out: TokenHandle=0xefe8f8*=0x408) returned 1 [0110.817] GetCurrentProcess () returned 0xffffffff [0110.817] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xefe8fc | out: TokenHandle=0xefe8fc*=0x418) returned 1 [0110.818] GetCurrentProcess () returned 0xffffffff [0110.818] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xefe90c | out: TokenHandle=0xefe90c*=0x41c) returned 1 [0110.821] GetCurrentProcess () returned 0xffffffff [0110.821] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xefeb84 | out: TokenHandle=0xefeb84*=0x420) returned 1 [0110.825] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0xefdcbc | out: phkResult=0xefdcbc*=0x424) returned 0x0 [0110.826] RegQueryValueExW (in: hKey=0x424, lpValueName="InstallationType", lpReserved=0x0, lpType=0xefdcdc, lpData=0x0, lpcbData=0xefdcd8*=0x0 | out: lpType=0xefdcdc*=0x1, lpData=0x0, lpcbData=0xefdcd8*=0xe) returned 0x0 [0110.826] RegQueryValueExW (in: hKey=0x424, lpValueName="InstallationType", lpReserved=0x0, lpType=0xefdcdc, lpData=0x2e4a83c, lpcbData=0xefdcd8*=0xe | out: lpType=0xefdcdc*=0x1, lpData="Client", lpcbData=0xefdcd8*=0xe) returned 0x0 [0110.827] RegCloseKey (hKey=0x424) returned 0x0 [0111.545] CoTaskMemAlloc (cb=0xcc0) returned 0x108c338 [0111.547] RasEnumConnectionsW (in: param_1=0x108c338, param_2=0xefeb94, param_3=0xefeb98 | out: param_1=0x108c338, param_2=0xefeb94, param_3=0xefeb98) returned 0x0 [0111.933] CoTaskMemFree (pv=0x108c338) [0112.754] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xefe980 | out: lpWSAData=0xefe980) returned 0 [0112.762] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x488 [0113.218] setsockopt (s=0x488, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0113.218] closesocket (s=0x488) returned 0 [0113.218] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x488 [0113.224] setsockopt (s=0x488, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0113.224] closesocket (s=0x488) returned 0 [0113.224] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x488 [0113.225] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x48c [0113.225] ioctlsocket (in: s=0x488, cmd=-2147195266, argp=0xefeb9c | out: argp=0xefeb9c) returned 0 [0113.226] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x490 [0113.226] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x494 [0113.226] ioctlsocket (in: s=0x490, cmd=-2147195266, argp=0xefeb9c | out: argp=0xefeb9c) returned 0 [0113.227] WSAIoctl (in: s=0x488, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0xefeb84, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0xefeb84, lpOverlapped=0x0) returned -1 [0113.332] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0xefe8b4, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0113.366] WSAEventSelect (s=0x488, hEventObject=0x48c, lNetworkEvents=512) returned 0 [0113.367] WSAIoctl (in: s=0x490, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0xefeb84, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0xefeb84, lpOverlapped=0x0) returned -1 [0113.367] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0xefe8b4, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0113.367] WSAEventSelect (s=0x490, hEventObject=0x494, lNetworkEvents=512) returned 0 [0113.367] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x49c [0113.368] RasConnectionNotificationW (param_1=0xffffffff, param_2=0x49c, param_3=0x3) returned 0x0 [0113.380] RegOpenCurrentUser (in: samDesired=0x20019, phkResult=0xefebb0 | out: phkResult=0xefebb0*=0x4b4) returned 0x0 [0113.381] RegOpenKeyExW (in: hKey=0x4b4, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0xefeb64 | out: phkResult=0xefeb64*=0x4b8) returned 0x0 [0113.381] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4bc [0113.382] RegNotifyChangeKeyValue (hKey=0x4b8, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x4bc, fAsynchronous=1) returned 0x0 [0113.383] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0xefeb68 | out: phkResult=0xefeb68*=0x4c0) returned 0x0 [0113.383] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4c4 [0113.384] RegNotifyChangeKeyValue (hKey=0x4c0, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x4c4, fAsynchronous=1) returned 0x0 [0113.384] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0xefeb68 | out: phkResult=0xefeb68*=0x4c8) returned 0x0 [0113.385] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4cc [0113.385] RegNotifyChangeKeyValue (hKey=0x4c8, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x4cc, fAsynchronous=1) returned 0x0 [0113.385] GetCurrentProcess () returned 0xffffffff [0113.385] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xefeb54 | out: TokenHandle=0xefeb54*=0x4d0) returned 1 [0113.389] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0xefe460 | out: phkResult=0xefe460*=0x4d4) returned 0x0 [0113.390] RegQueryValueExW (in: hKey=0x4d4, lpValueName="LegacyWPADSupport", lpReserved=0x0, lpType=0xefe47c, lpData=0x0, lpcbData=0xefe478*=0x0 | out: lpType=0xefe47c*=0x0, lpData=0x0, lpcbData=0xefe478*=0x0) returned 0x2 [0113.390] RegCloseKey (hKey=0x4d4) returned 0x0 [0114.087] WinHttpOpen (pszAgentW=0x0, dwAccessType=0x1, pszProxyW=0x0, pszProxyBypassW=0x0, dwFlags=0x0) returned 0x10cbe98 [0114.680] WinHttpSetTimeouts (hInternet=0x10cbe98, nResolveTimeout=60000, nConnectTimeout=60000, nSendTimeout=60000, nReceiveTimeout=60000) returned 1 [0114.681] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0xefeb64 | out: pProxyConfig=0xefeb64) returned 1 [0115.700] CoTaskMemAlloc (cb=0x20e) returned 0x10ddd50 [0115.700] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_Disabled", lpBuffer=0x10ddd50, nSize=0x105 | out: lpBuffer="Ԩč?ćက") returned 0x0 [0115.701] CoTaskMemFree (pv=0x10ddd50) [0115.701] CoTaskMemAlloc (cb=0x20e) returned 0x10ddd50 [0115.701] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_MinCount", lpBuffer=0x10ddd50, nSize=0x105 | out: lpBuffer="Ԩč?ćက") returned 0x0 [0115.701] CoTaskMemFree (pv=0x10ddd50) [0115.715] EtwEventRegister (in: ProviderId=0x2e4d5d4, EnableCallback=0x2da0636, CallbackContext=0x0, RegHandle=0x2e4d5b0 | out: RegHandle=0x2e4d5b0) returned 0x0 [0115.715] EtwEventSetInformation (RegHandle=0x1074968, InformationClass=0x65, EventInformation=0x2, InformationLength=0x2e4d570) returned 0x0 [0115.721] GetCurrentProcess () returned 0xffffffff [0115.721] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xefe8c4 | out: TokenHandle=0xefe8c4*=0x518) returned 1 [0115.723] GetCurrentProcess () returned 0xffffffff [0115.723] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xefe8d4 | out: TokenHandle=0xefe8d4*=0x51c) returned 1 [0115.727] SetEvent (hEvent=0x2e8) returned 1 [0115.748] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeacc*=0x49c, lpdwindex=0xefe8ec | out: lpdwindex=0xefe8ec) returned 0x80010115 [0116.869] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeaac*=0x48c, lpdwindex=0xefe8cc | out: lpdwindex=0xefe8cc) returned 0x80010115 [0116.869] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeaac*=0x494, lpdwindex=0xefe8cc | out: lpdwindex=0xefe8cc) returned 0x80010115 [0116.870] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeb00*=0x4bc, lpdwindex=0xefe91c | out: lpdwindex=0xefe91c) returned 0x80010115 [0116.870] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeb00*=0x4c4, lpdwindex=0xefe91c | out: lpdwindex=0xefe91c) returned 0x80010115 [0116.871] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeb00*=0x4cc, lpdwindex=0xefe91c | out: lpdwindex=0xefe91c) returned 0x80010115 [0116.882] GetCurrentProcess () returned 0xffffffff [0116.883] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xefe83c | out: TokenHandle=0xefe83c*=0x558) returned 1 [0116.884] GetCurrentProcess () returned 0xffffffff [0116.884] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xefe84c | out: TokenHandle=0xefe84c*=0x55c) returned 1 [0116.886] GetTimeZoneInformation (in: lpTimeZoneInformation=0xefe9bc | out: lpTimeZoneInformation=0xefe9bc) returned 0x2 [0116.888] GetDynamicTimeZoneInformation (in: pTimeZoneInformation=0xefe818 | out: pTimeZoneInformation=0xefe818) returned 0x2 [0116.889] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time", ulOptions=0x0, samDesired=0x20019, phkResult=0xefe8fc | out: phkResult=0xefe8fc*=0x560) returned 0x0 [0116.892] RegQueryValueExW (in: hKey=0x560, lpValueName="TZI", lpReserved=0x0, lpType=0xefe918, lpData=0x0, lpcbData=0xefe914*=0x0 | out: lpType=0xefe918*=0x3, lpData=0x0, lpcbData=0xefe914*=0x2c) returned 0x0 [0116.892] RegQueryValueExW (in: hKey=0x560, lpValueName="TZI", lpReserved=0x0, lpType=0xefe918, lpData=0x2e505ec, lpcbData=0xefe914*=0x2c | out: lpType=0xefe918*=0x3, lpData=0x2e505ec*, lpcbData=0xefe914*=0x2c) returned 0x0 [0116.893] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time\\Dynamic DST", ulOptions=0x0, samDesired=0x20019, phkResult=0xefe750 | out: phkResult=0xefe750*=0x0) returned 0x2 [0116.895] RegQueryValueExW (in: hKey=0x560, lpValueName="MUI_Display", lpReserved=0x0, lpType=0xefe8f0, lpData=0x0, lpcbData=0xefe8ec*=0x0 | out: lpType=0xefe8f0*=0x1, lpData=0x0, lpcbData=0xefe8ec*=0x20) returned 0x0 [0116.895] RegQueryValueExW (in: hKey=0x560, lpValueName="MUI_Display", lpReserved=0x0, lpType=0xefe8f0, lpData=0x2e50a10, lpcbData=0xefe8ec*=0x20 | out: lpType=0xefe8f0*=0x1, lpData="@tzres.dll,-320", lpcbData=0xefe8ec*=0x20) returned 0x0 [0116.895] RegQueryValueExW (in: hKey=0x560, lpValueName="MUI_Std", lpReserved=0x0, lpType=0xefe8f0, lpData=0x0, lpcbData=0xefe8ec*=0x0 | out: lpType=0xefe8f0*=0x1, lpData=0x0, lpcbData=0xefe8ec*=0x20) returned 0x0 [0116.895] RegQueryValueExW (in: hKey=0x560, lpValueName="MUI_Std", lpReserved=0x0, lpType=0xefe8f0, lpData=0x2e50a68, lpcbData=0xefe8ec*=0x20 | out: lpType=0xefe8f0*=0x1, lpData="@tzres.dll,-322", lpcbData=0xefe8ec*=0x20) returned 0x0 [0116.895] RegQueryValueExW (in: hKey=0x560, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0xefe8f0, lpData=0x0, lpcbData=0xefe8ec*=0x0 | out: lpType=0xefe8f0*=0x1, lpData=0x0, lpcbData=0xefe8ec*=0x20) returned 0x0 [0116.895] RegQueryValueExW (in: hKey=0x560, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0xefe8f0, lpData=0x2e50ac0, lpcbData=0xefe8ec*=0x20 | out: lpType=0xefe8f0*=0x1, lpData="@tzres.dll,-321", lpcbData=0xefe8ec*=0x20) returned 0x0 [0116.904] CoTaskMemAlloc (cb=0x20c) returned 0x10e4a78 [0116.904] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x10e4a78 | out: pszPath="C:\\WINDOWS\\system32") returned 0x0 [0116.926] CoTaskMemFree (pv=0x10e4a78) [0116.927] CoTaskMemAlloc (cb=0x20e) returned 0x10e4a78 [0116.927] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\WINDOWS\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0xefe90c, pwszFileMUIPath=0x10e4a78, pcchFileMUIPath=0xefe910, pululEnumerator=0xefe904 | out: pwszLanguage=0x0, pcchLanguage=0xefe90c, pwszFileMUIPath="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0xefe910, pululEnumerator=0xefe904) returned 1 [0116.965] CoTaskMemFree (pv=0x0) [0116.965] CoTaskMemFree (pv=0x10e4a78) [0116.966] LoadLibraryExW (lpLibFileName="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x8810001 [0116.974] CoTaskMemAlloc (cb=0x3ec) returned 0x10e7e28 [0116.974] LoadStringW (in: hInstance=0x8810001, uID=0x140, lpBuffer=0x10e7e28, cchBufferMax=500 | out: lpBuffer="(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna") returned 0x3c [0116.975] CoTaskMemFree (pv=0x10e7e28) [0116.975] FreeLibrary (hLibModule=0x8810001) returned 1 [0116.976] CoTaskMemAlloc (cb=0x20c) returned 0x10e4a78 [0116.976] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x10e4a78 | out: pszPath="C:\\WINDOWS\\system32") returned 0x0 [0116.976] CoTaskMemFree (pv=0x10e4a78) [0116.976] CoTaskMemAlloc (cb=0x20e) returned 0x10e4a78 [0116.976] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\WINDOWS\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0xefe90c, pwszFileMUIPath=0x10e4a78, pcchFileMUIPath=0xefe910, pululEnumerator=0xefe904 | out: pwszLanguage=0x0, pcchLanguage=0xefe90c, pwszFileMUIPath="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0xefe910, pululEnumerator=0xefe904) returned 1 [0116.977] CoTaskMemFree (pv=0x0) [0116.977] CoTaskMemFree (pv=0x10e4a78) [0116.977] LoadLibraryExW (lpLibFileName="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x8810001 [0116.978] CoTaskMemAlloc (cb=0x3ec) returned 0x10e7e28 [0116.978] LoadStringW (in: hInstance=0x8810001, uID=0x142, lpBuffer=0x10e7e28, cchBufferMax=500 | out: lpBuffer="W. Europe Standard Time") returned 0x17 [0116.978] CoTaskMemFree (pv=0x10e7e28) [0116.978] FreeLibrary (hLibModule=0x8810001) returned 1 [0116.979] CoTaskMemAlloc (cb=0x20c) returned 0x10e4a78 [0116.979] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x10e4a78 | out: pszPath="C:\\WINDOWS\\system32") returned 0x0 [0116.979] CoTaskMemFree (pv=0x10e4a78) [0116.979] CoTaskMemAlloc (cb=0x20e) returned 0x10e4a78 [0116.979] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\WINDOWS\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0xefe90c, pwszFileMUIPath=0x10e4a78, pcchFileMUIPath=0xefe910, pululEnumerator=0xefe904 | out: pwszLanguage=0x0, pcchLanguage=0xefe90c, pwszFileMUIPath="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0xefe910, pululEnumerator=0xefe904) returned 1 [0116.980] CoTaskMemFree (pv=0x0) [0116.980] CoTaskMemFree (pv=0x10e4a78) [0116.980] LoadLibraryExW (lpLibFileName="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x8810001 [0116.981] CoTaskMemAlloc (cb=0x3ec) returned 0x10e7e28 [0116.981] LoadStringW (in: hInstance=0x8810001, uID=0x141, lpBuffer=0x10e7e28, cchBufferMax=500 | out: lpBuffer="W. Europe Daylight Time") returned 0x17 [0116.981] CoTaskMemFree (pv=0x10e7e28) [0116.981] FreeLibrary (hLibModule=0x8810001) returned 1 [0116.982] RegCloseKey (hKey=0x560) returned 0x0 [0116.982] SetEvent (hEvent=0x2e8) returned 1 [0116.989] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x560 [0116.990] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x570 [0116.990] ioctlsocket (in: s=0x560, cmd=-2147195266, argp=0xefeb60 | out: argp=0xefeb60) returned 0 [0116.990] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x564 [0116.990] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x574 [0116.990] ioctlsocket (in: s=0x564, cmd=-2147195266, argp=0xefeb60 | out: argp=0xefeb60) returned 0 [0116.991] WSAIoctl (in: s=0x560, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0xefeb48, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0xefeb48, lpOverlapped=0x0) returned -1 [0116.991] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0xefe878, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0116.991] WSAEventSelect (s=0x560, hEventObject=0x570, lNetworkEvents=512) returned 0 [0116.991] WSAIoctl (in: s=0x564, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0xefeb48, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0xefeb48, lpOverlapped=0x0) returned -1 [0116.991] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0xefe878, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0116.991] WSAEventSelect (s=0x564, hEventObject=0x574, lNetworkEvents=512) returned 0 [0116.998] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0xefeb44*=0x0 | out: AdapterAddresses=0x0, SizePointer=0xefeb44*=0x818) returned 0x6f [0117.058] LocalAlloc (uFlags=0x0, uBytes=0x818) returned 0x10e7e28 [0117.058] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x10e7e28, SizePointer=0xefeb44*=0x818 | out: AdapterAddresses=0x10e7e28*(Alignment=0x300000178, Length=0x178, IfIndex=0x3, Next=0x10e80d8, AdapterName="{9E48833B-70C6-43EE-85DC-893C1782D802}", FirstUnicastAddress=0x10e804c, FirstAnycastAddress=0x0, FirstMulticastAddress=0x0, FirstDnsServerAddress=0x0, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection #2", FriendlyName="Ethernet 2", PhysicalAddress=([0]=0x0, [1]=0x25, [2]=0xa3, [3]=0xbc, [4]=0x60, [5]=0x7f, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x1c5, DdnsEnabled=0x1c5, RegisterAdapterSuffix=0x1c5, Dhcpv4Enabled=0x1c5, ReceiveOnly=0x1c5, NoMulticast=0x1c5, Ipv6OtherStatefulConfig=0x1c5, NetbiosOverTcpipEnabled=0x1c5, Ipv4Enabled=0x1c5, Ipv6Enabled=0x1c5, Ipv6ManagedAddressConfigurationSupported=0x1c5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x3, ZoneIndices=([0]=0x3, [1]=0x3, [2]=0x3, [3]=0x3, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0x19, Ipv6Metric=0x19, Luid=0x6008002000000, Dhcpv4Server.lpSockaddr=0x10e7fa0*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11e7933cfae992b0, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x23, [5]=0x7d, [6]=0xeb, [7]=0x9, [8]=0x7c, [9]=0x4a, [10]=0x82, [11]=0x56, [12]=0xb9, [13]=0x2b, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x57c4a82, FirstDnsSuffix=0x0), SizePointer=0xefeb44*=0x818) returned 0x0 [0117.073] LocalFree (hMem=0x10e7e28) returned 0x0 [0117.077] CoTaskMemAlloc (cb=0x20e) returned 0x10d4298 [0117.077] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_Disabled", lpBuffer=0x10d4298, nSize=0x105 | out: lpBuffer="縨ĎⳈĎ") returned 0x0 [0117.360] CoTaskMemFree (pv=0x10d4298) [0117.360] CoTaskMemAlloc (cb=0x20e) returned 0x10d4298 [0117.360] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_MinCount", lpBuffer=0x10d4298, nSize=0x105 | out: lpBuffer="縨ĎⳈĎ") returned 0x0 [0117.360] CoTaskMemFree (pv=0x10d4298) [0117.363] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x578 [0117.365] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x57c [0117.373] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefe944*=0x570, lpdwindex=0xefe764 | out: lpdwindex=0xefe764) returned 0x80010115 [0117.374] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefe944*=0x574, lpdwindex=0xefe764 | out: lpdwindex=0xefe764) returned 0x80010115 [0117.379] WSAConnect (in: s=0x578, name=0x2e5bd70*(sa_family=2, sin_port=0x50, sin_addr="192.168.109.134"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned -1 [0138.525] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x274c, dwLanguageId=0x0, lpBuffer=0xefe7dc, nSize=0x101, Arguments=0x0 | out: lpBuffer="A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.\r\n") returned 0xb9 [0138.598] setsockopt (s=0x578, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0138.599] closesocket (s=0x578) returned 0 [0138.601] setsockopt (s=0x57c, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0138.601] closesocket (s=0x57c) returned 0 [0138.621] QueryPerformanceCounter (in: lpPerformanceCount=0xefeca0 | out: lpPerformanceCount=0xefeca0*=23375884367) returned 1 [0138.622] SetEvent (hEvent=0x2e8) returned 1 [0138.622] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeacc*=0x49c, lpdwindex=0xefe8ec | out: lpdwindex=0xefe8ec) returned 0x80010115 [0138.623] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeaac*=0x48c, lpdwindex=0xefe8cc | out: lpdwindex=0xefe8cc) returned 0x80010115 [0138.623] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeaac*=0x494, lpdwindex=0xefe8cc | out: lpdwindex=0xefe8cc) returned 0x80010115 [0138.624] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeb00*=0x4bc, lpdwindex=0xefe91c | out: lpdwindex=0xefe91c) returned 0x80010115 [0138.624] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeb00*=0x4c4, lpdwindex=0xefe91c | out: lpdwindex=0xefe91c) returned 0x80010115 [0138.624] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeb00*=0x4cc, lpdwindex=0xefe91c | out: lpdwindex=0xefe91c) returned 0x80010115 [0138.625] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x57c [0138.626] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x578 [0138.627] WSAConnect (in: s=0x57c, name=0x2e5f8f4*(sa_family=2, sin_port=0x50, sin_addr="192.168.109.134"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned -1 [0159.923] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x274c, dwLanguageId=0x0, lpBuffer=0xefe7dc, nSize=0x101, Arguments=0x0 | out: lpBuffer="A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.\r\n") returned 0xb9 [0159.927] setsockopt (s=0x57c, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0159.927] closesocket (s=0x57c) returned 0 [0159.927] setsockopt (s=0x578, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0159.927] closesocket (s=0x578) returned 0 [0159.931] QueryPerformanceCounter (in: lpPerformanceCount=0xefeca0 | out: lpPerformanceCount=0xefeca0*=25506837593) returned 1 [0159.931] SetEvent (hEvent=0x2e8) returned 1 [0159.931] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeacc*=0x49c, lpdwindex=0xefe8ec | out: lpdwindex=0xefe8ec) returned 0x80010115 [0159.931] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeaac*=0x48c, lpdwindex=0xefe8cc | out: lpdwindex=0xefe8cc) returned 0x80010115 [0159.932] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeaac*=0x494, lpdwindex=0xefe8cc | out: lpdwindex=0xefe8cc) returned 0x80010115 [0159.932] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeb00*=0x4bc, lpdwindex=0xefe91c | out: lpdwindex=0xefe91c) returned 0x80010115 [0159.933] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeb00*=0x4c4, lpdwindex=0xefe91c | out: lpdwindex=0xefe91c) returned 0x80010115 [0159.933] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeb00*=0x4cc, lpdwindex=0xefe91c | out: lpdwindex=0xefe91c) returned 0x80010115 [0159.933] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x578 [0159.935] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x57c [0159.935] WSAConnect (in: s=0x578, name=0x2e614e8*(sa_family=2, sin_port=0x50, sin_addr="192.168.109.134"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned -1 [0181.148] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x274c, dwLanguageId=0x0, lpBuffer=0xefe7dc, nSize=0x101, Arguments=0x0 | out: lpBuffer="A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.\r\n") returned 0xb9 [0181.152] setsockopt (s=0x578, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0181.152] closesocket (s=0x578) returned 0 [0181.153] setsockopt (s=0x57c, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0181.153] closesocket (s=0x57c) returned 0 [0181.156] QueryPerformanceCounter (in: lpPerformanceCount=0xefeca0 | out: lpPerformanceCount=0xefeca0*=27629382367) returned 1 [0181.156] SetEvent (hEvent=0x2e8) returned 1 [0181.156] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeacc*=0x49c, lpdwindex=0xefe8ec | out: lpdwindex=0xefe8ec) returned 0x80010115 [0181.157] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeaac*=0x48c, lpdwindex=0xefe8cc | out: lpdwindex=0xefe8cc) returned 0x80010115 [0181.157] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeaac*=0x494, lpdwindex=0xefe8cc | out: lpdwindex=0xefe8cc) returned 0x80010115 [0181.158] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeb00*=0x4bc, lpdwindex=0xefe91c | out: lpdwindex=0xefe91c) returned 0x80010115 [0181.158] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeb00*=0x4c4, lpdwindex=0xefe91c | out: lpdwindex=0xefe91c) returned 0x80010115 [0181.159] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeb00*=0x4cc, lpdwindex=0xefe91c | out: lpdwindex=0xefe91c) returned 0x80010115 [0181.159] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x57c [0181.159] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x578 [0181.159] WSAConnect (in: s=0x57c, name=0x2e630dc*(sa_family=2, sin_port=0x50, sin_addr="192.168.109.134"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned -1 [0202.323] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x274c, dwLanguageId=0x0, lpBuffer=0xefe7dc, nSize=0x101, Arguments=0x0 | out: lpBuffer="A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.\r\n") returned 0xb9 [0202.332] setsockopt (s=0x57c, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0202.333] closesocket (s=0x57c) returned 0 [0202.334] setsockopt (s=0x578, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0202.334] closesocket (s=0x578) returned 0 [0202.340] QueryPerformanceCounter (in: lpPerformanceCount=0xefeca0 | out: lpPerformanceCount=0xefeca0*=29747757583) returned 1 [0202.340] SetEvent (hEvent=0x2e8) returned 1 [0202.341] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeacc*=0x49c, lpdwindex=0xefe8ec | out: lpdwindex=0xefe8ec) returned 0x80010115 [0202.342] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeaac*=0x48c, lpdwindex=0xefe8cc | out: lpdwindex=0xefe8cc) returned 0x80010115 [0202.342] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeaac*=0x494, lpdwindex=0xefe8cc | out: lpdwindex=0xefe8cc) returned 0x80010115 [0202.343] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeb00*=0x4bc, lpdwindex=0xefe91c | out: lpdwindex=0xefe91c) returned 0x80010115 [0202.343] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeb00*=0x4c4, lpdwindex=0xefe91c | out: lpdwindex=0xefe91c) returned 0x80010115 [0202.343] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeb00*=0x4cc, lpdwindex=0xefe91c | out: lpdwindex=0xefe91c) returned 0x80010115 [0202.344] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x578 [0202.345] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x57c [0202.346] WSAConnect (in: s=0x578, name=0x2e64cd0*(sa_family=2, sin_port=0x50, sin_addr="192.168.109.134"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned -1 [0223.431] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x274c, dwLanguageId=0x0, lpBuffer=0xefe7dc, nSize=0x101, Arguments=0x0 | out: lpBuffer="A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.\r\n") returned 0xb9 [0223.443] setsockopt (s=0x578, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0223.443] closesocket (s=0x578) returned 0 [0223.444] setsockopt (s=0x57c, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0223.444] closesocket (s=0x57c) returned 0 [0223.453] QueryPerformanceCounter (in: lpPerformanceCount=0xefeca0 | out: lpPerformanceCount=0xefeca0*=31859112023) returned 1 [0223.454] SetEvent (hEvent=0x2e8) returned 1 [0223.454] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeacc*=0x49c, lpdwindex=0xefe8ec | out: lpdwindex=0xefe8ec) returned 0x80010115 [0223.456] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeaac*=0x48c, lpdwindex=0xefe8cc | out: lpdwindex=0xefe8cc) returned 0x80010115 [0223.456] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeaac*=0x494, lpdwindex=0xefe8cc | out: lpdwindex=0xefe8cc) returned 0x80010115 [0223.457] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeb00*=0x4bc, lpdwindex=0xefe91c | out: lpdwindex=0xefe91c) returned 0x80010115 [0223.457] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeb00*=0x4c4, lpdwindex=0xefe91c | out: lpdwindex=0xefe91c) returned 0x80010115 [0223.457] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeb00*=0x4cc, lpdwindex=0xefe91c | out: lpdwindex=0xefe91c) returned 0x80010115 [0223.458] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x57c [0223.459] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x578 [0223.460] WSAConnect (in: s=0x57c, name=0x2e668c4*(sa_family=2, sin_port=0x50, sin_addr="192.168.109.134"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned -1 [0244.666] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x274c, dwLanguageId=0x0, lpBuffer=0xefe7dc, nSize=0x101, Arguments=0x0 | out: lpBuffer="A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.\r\n") returned 0xb9 [0244.676] setsockopt (s=0x57c, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0244.676] closesocket (s=0x57c) returned 0 [0244.677] setsockopt (s=0x578, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0244.677] closesocket (s=0x578) returned 0 [0244.685] QueryPerformanceCounter (in: lpPerformanceCount=0xefeca0 | out: lpPerformanceCount=0xefeca0*=33982254221) returned 1 [0244.685] SetEvent (hEvent=0x2e8) returned 1 [0244.686] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeacc*=0x49c, lpdwindex=0xefe8ec | out: lpdwindex=0xefe8ec) returned 0x80010115 [0244.687] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeaac*=0x48c, lpdwindex=0xefe8cc | out: lpdwindex=0xefe8cc) returned 0x80010115 [0244.688] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeaac*=0x494, lpdwindex=0xefe8cc | out: lpdwindex=0xefe8cc) returned 0x80010115 [0244.688] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeb00*=0x4bc, lpdwindex=0xefe91c | out: lpdwindex=0xefe91c) returned 0x80010115 [0244.689] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeb00*=0x4c4, lpdwindex=0xefe91c | out: lpdwindex=0xefe91c) returned 0x80010115 [0244.689] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeb00*=0x4cc, lpdwindex=0xefe91c | out: lpdwindex=0xefe91c) returned 0x80010115 [0244.690] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x578 [0244.692] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x57c [0244.693] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefe944*=0x570, lpdwindex=0xefe764 | out: lpdwindex=0xefe764) returned 0x80010115 [0244.693] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefe944*=0x574, lpdwindex=0xefe764 | out: lpdwindex=0xefe764) returned 0x80010115 [0244.693] WSAConnect (in: s=0x578, name=0x2e685e0*(sa_family=2, sin_port=0x50, sin_addr="192.168.109.134"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned -1 [0265.876] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x274c, dwLanguageId=0x0, lpBuffer=0xefe7dc, nSize=0x101, Arguments=0x0 | out: lpBuffer="A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.\r\n") returned 0xb9 [0265.884] setsockopt (s=0x578, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0265.885] closesocket (s=0x578) returned 0 [0265.886] setsockopt (s=0x57c, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0265.886] closesocket (s=0x57c) returned 0 [0265.891] QueryPerformanceCounter (in: lpPerformanceCount=0xefeca0 | out: lpPerformanceCount=0xefeca0*=36102865444) returned 1 [0265.891] SetEvent (hEvent=0x2e8) returned 1 [0265.892] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeacc*=0x49c, lpdwindex=0xefe8ec | out: lpdwindex=0xefe8ec) returned 0x80010115 [0265.893] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeaac*=0x48c, lpdwindex=0xefe8cc | out: lpdwindex=0xefe8cc) returned 0x80010115 [0265.893] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeaac*=0x494, lpdwindex=0xefe8cc | out: lpdwindex=0xefe8cc) returned 0x80010115 [0265.894] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeb00*=0x4bc, lpdwindex=0xefe91c | out: lpdwindex=0xefe91c) returned 0x80010115 [0265.894] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeb00*=0x4c4, lpdwindex=0xefe91c | out: lpdwindex=0xefe91c) returned 0x80010115 [0265.894] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeb00*=0x4cc, lpdwindex=0xefe91c | out: lpdwindex=0xefe91c) returned 0x80010115 [0265.895] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x57c [0265.896] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x578 [0265.897] WSAConnect (in: s=0x57c, name=0x2e6a1d4*(sa_family=2, sin_port=0x50, sin_addr="192.168.109.134"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned -1 [0287.182] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x274c, dwLanguageId=0x0, lpBuffer=0xefe7dc, nSize=0x101, Arguments=0x0 | out: lpBuffer="A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.\r\n") returned 0xb9 [0287.192] setsockopt (s=0x57c, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0287.193] closesocket (s=0x57c) returned 0 [0287.194] setsockopt (s=0x578, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0287.194] closesocket (s=0x578) returned 0 [0287.200] QueryPerformanceCounter (in: lpPerformanceCount=0xefeca0 | out: lpPerformanceCount=0xefeca0*=38233765426) returned 1 [0287.200] SetEvent (hEvent=0x2e8) returned 1 [0287.201] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeacc*=0x49c, lpdwindex=0xefe8ec | out: lpdwindex=0xefe8ec) returned 0x80010115 [0287.202] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeaac*=0x48c, lpdwindex=0xefe8cc | out: lpdwindex=0xefe8cc) returned 0x80010115 [0287.202] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeaac*=0x494, lpdwindex=0xefe8cc | out: lpdwindex=0xefe8cc) returned 0x80010115 [0287.203] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeb00*=0x4bc, lpdwindex=0xefe91c | out: lpdwindex=0xefe91c) returned 0x80010115 [0287.203] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeb00*=0x4c4, lpdwindex=0xefe91c | out: lpdwindex=0xefe91c) returned 0x80010115 [0287.204] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeb00*=0x4cc, lpdwindex=0xefe91c | out: lpdwindex=0xefe91c) returned 0x80010115 [0287.205] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x578 [0287.206] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x57c [0287.207] WSAConnect (s=0x578, name=0x2e6bdc8*(sa_family=2, sin_port=0x50, sin_addr="192.168.109.134"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0) Thread: id = 2 os_tid = 0x1118 Thread: id = 3 os_tid = 0x114c Thread: id = 4 os_tid = 0x1150 [0061.251] CoGetContextToken (in: pToken=0x4f0fb34 | out: pToken=0x4f0fb34) returned 0x800401f0 [0061.251] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0061.251] RoInitialize () returned 0x1 [0061.251] RoUninitialize () returned 0x0 [0094.338] CloseHandle (hObject=0x2e0) returned 1 [0094.338] CloseHandle (hObject=0x2cc) returned 1 [0094.339] CloseHandle (hObject=0x2dc) returned 1 [0094.339] CloseHandle (hObject=0x2d8) returned 1 [0094.339] CloseHandle (hObject=0x2e8) returned 1 [0094.339] CloseHandle (hObject=0x2d4) returned 1 [0094.339] CloseHandle (hObject=0x2d0) returned 1 [0094.339] CloseHandle (hObject=0x2e4) returned 1 Thread: id = 5 os_tid = 0xd10 Thread: id = 6 os_tid = 0xdc4 Thread: id = 7 os_tid = 0xdb8 Thread: id = 8 os_tid = 0xef4 Thread: id = 9 os_tid = 0xeec Thread: id = 10 os_tid = 0xf10 [0115.741] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0115.741] RoInitialize () returned 0x1 [0115.741] RoUninitialize () returned 0x0 [0115.744] ResetEvent (hEvent=0x2e8) returned 1 Thread: id = 11 os_tid = 0xcb8