# Flog Txt Version 1 # Analyzer Version: 3.2.1 # Analyzer Build Date: Feb 5 2020 10:35:20 # Log Creation Date: 10.02.2020 10:40:34.628 Process: id = "1" image_name = "drv.exe" filename = "c:\\users\\fd1hvy\\desktop\\drv.exe" page_root = "0x4b108000" os_pid = "0x13fc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x7d0" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\DRV.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xb0 [0043.831] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x20f0000 [0043.854] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000 [0043.855] GetProcAddress (hModule=0x76750000, lpProcName="FlsAlloc") returned 0x76764ae0 [0043.855] GetProcAddress (hModule=0x76750000, lpProcName="FlsGetValue") returned 0x76764b20 [0043.855] GetProcAddress (hModule=0x76750000, lpProcName="FlsSetValue") returned 0x76764b40 [0043.855] GetProcAddress (hModule=0x76750000, lpProcName="FlsFree") returned 0x76764b00 [0043.855] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000 [0043.855] GetProcAddress (hModule=0x76750000, lpProcName="EncodePointer") returned 0x778b29e0 [0043.855] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000 [0043.855] GetProcAddress (hModule=0x76750000, lpProcName="EncodePointer") returned 0x778b29e0 [0043.855] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000 [0043.855] GetProcAddress (hModule=0x76750000, lpProcName="EncodePointer") returned 0x778b29e0 [0043.856] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000 [0043.856] GetProcAddress (hModule=0x76750000, lpProcName="EncodePointer") returned 0x778b29e0 [0043.856] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000 [0043.856] GetProcAddress (hModule=0x76750000, lpProcName="EncodePointer") returned 0x778b29e0 [0043.856] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000 [0043.856] GetProcAddress (hModule=0x76750000, lpProcName="EncodePointer") returned 0x778b29e0 [0043.856] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000 [0043.856] GetProcAddress (hModule=0x76750000, lpProcName="EncodePointer") returned 0x778b29e0 [0043.857] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000 [0043.857] GetProcAddress (hModule=0x76750000, lpProcName="DecodePointer") returned 0x778b1ec0 [0043.857] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x214) returned 0x20f05a8 [0043.857] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000 [0043.857] GetProcAddress (hModule=0x76750000, lpProcName="DecodePointer") returned 0x778b1ec0 [0043.857] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000 [0043.857] GetProcAddress (hModule=0x76750000, lpProcName="EncodePointer") returned 0x778b29e0 [0043.857] GetProcAddress (hModule=0x76750000, lpProcName="DecodePointer") returned 0x778b1ec0 [0043.858] GetCurrentThreadId () returned 0xb0 [0043.858] GetStartupInfoA (in: lpStartupInfo=0x19fee0 | out: lpStartupInfo=0x19fee0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\DRV.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0043.858] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x800) returned 0x20f07c8 [0043.858] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0043.858] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0043.858] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0043.858] SetHandleCount (uNumber=0x20) returned 0x20 [0043.858] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\Desktop\\DRV.exe\" " [0043.858] GetEnvironmentStringsW () returned 0x69bfd0* [0043.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0043.858] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x0, Size=0x565) returned 0x20f0fd0 [0043.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x20f0fd0, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0043.858] FreeEnvironmentStringsW (penv=0x69bfd0) returned 1 [0043.858] GetLastError () returned 0x0 [0043.858] SetLastError (dwErrCode=0x0) [0043.858] GetLastError () returned 0x0 [0043.858] SetLastError (dwErrCode=0x0) [0043.859] GetLastError () returned 0x0 [0043.859] SetLastError (dwErrCode=0x0) [0043.859] GetACP () returned 0x4e4 [0043.859] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x0, Size=0x220) returned 0x20f1540 [0043.859] GetLastError () returned 0x0 [0043.859] SetLastError (dwErrCode=0x0) [0043.859] IsValidCodePage (CodePage=0x4e4) returned 1 [0043.859] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19fec0 | out: lpCPInfo=0x19fec0) returned 1 [0043.859] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f98c | out: lpCPInfo=0x19f98c) returned 1 [0043.859] GetLastError () returned 0x0 [0043.859] SetLastError (dwErrCode=0x0) [0043.859] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x19f91c | out: lpCharType=0x19f91c) returned 1 [0043.859] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fda0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0043.859] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fda0, cbMultiByte=256, lpWideCharStr=0x19f708, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ釃鐛男AĀ") returned 256 [0043.859] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ釃鐛男AĀ", cchSrc=256, lpCharType=0x19f9a0 | out: lpCharType=0x19f9a0) returned 1 [0043.859] GetLastError () returned 0x0 [0043.859] SetLastError (dwErrCode=0x0) [0043.859] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0043.859] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fda0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0043.859] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fda0, cbMultiByte=256, lpWideCharStr=0x19f6d8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ煻AĀ") returned 256 [0043.859] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ煻AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0043.859] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ煻AĀ", cchSrc=256, lpDestStr=0x19f4c8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0043.859] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x19fca0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ2x\x11ÔØþ\x19", lpUsedDefaultChar=0x0) returned 256 [0043.859] GetLastError () returned 0x0 [0043.859] SetLastError (dwErrCode=0x0) [0043.859] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fda0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0043.859] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fda0, cbMultiByte=256, lpWideCharStr=0x19f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ煻AĀ") returned 256 [0043.859] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ煻AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0043.859] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ煻AĀ", cchSrc=256, lpDestStr=0x19f4e8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0043.860] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x19fba0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ2x\x11ÔØþ\x19", lpUsedDefaultChar=0x0) returned 256 [0043.860] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x423980, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\DRV.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\drv.exe")) returned 0x1f [0043.860] GetLastError () returned 0x0 [0043.860] SetLastError (dwErrCode=0x0) [0043.860] GetLastError () returned 0x0 [0043.860] SetLastError (dwErrCode=0x0) [0043.860] GetLastError () returned 0x0 [0043.860] SetLastError (dwErrCode=0x0) [0043.860] GetLastError () returned 0x0 [0043.860] SetLastError (dwErrCode=0x0) [0043.860] GetLastError () returned 0x0 [0043.860] SetLastError (dwErrCode=0x0) [0043.860] GetLastError () returned 0x0 [0043.860] SetLastError (dwErrCode=0x0) [0043.860] GetLastError () returned 0x0 [0043.860] SetLastError (dwErrCode=0x0) [0043.860] GetLastError () returned 0x0 [0043.860] SetLastError (dwErrCode=0x0) [0043.860] GetLastError () returned 0x0 [0043.860] SetLastError (dwErrCode=0x0) [0043.861] GetLastError () returned 0x0 [0043.861] SetLastError (dwErrCode=0x0) [0043.861] GetLastError () returned 0x0 [0043.861] SetLastError (dwErrCode=0x0) [0043.861] GetLastError () returned 0x0 [0043.861] SetLastError (dwErrCode=0x0) [0043.861] GetLastError () returned 0x0 [0043.861] SetLastError (dwErrCode=0x0) [0043.861] GetLastError () returned 0x0 [0043.861] SetLastError (dwErrCode=0x0) [0043.861] GetLastError () returned 0x0 [0043.861] SetLastError (dwErrCode=0x0) [0043.861] GetLastError () returned 0x0 [0043.861] SetLastError (dwErrCode=0x0) [0043.861] GetLastError () returned 0x0 [0043.861] SetLastError (dwErrCode=0x0) [0043.861] GetLastError () returned 0x0 [0043.861] SetLastError (dwErrCode=0x0) [0043.861] GetLastError () returned 0x0 [0043.861] SetLastError (dwErrCode=0x0) [0043.861] GetLastError () returned 0x0 [0043.861] SetLastError (dwErrCode=0x0) [0043.861] GetLastError () returned 0x0 [0043.861] SetLastError (dwErrCode=0x0) [0043.861] GetLastError () returned 0x0 [0043.862] SetLastError (dwErrCode=0x0) [0043.862] GetLastError () returned 0x0 [0043.862] SetLastError (dwErrCode=0x0) [0043.862] GetLastError () returned 0x0 [0043.862] SetLastError (dwErrCode=0x0) [0043.862] GetLastError () returned 0x0 [0043.862] SetLastError (dwErrCode=0x0) [0043.862] GetLastError () returned 0x0 [0043.862] SetLastError (dwErrCode=0x0) [0043.862] GetLastError () returned 0x0 [0043.862] SetLastError (dwErrCode=0x0) [0043.862] GetLastError () returned 0x0 [0043.862] SetLastError (dwErrCode=0x0) [0043.862] GetLastError () returned 0x0 [0043.862] SetLastError (dwErrCode=0x0) [0043.862] GetLastError () returned 0x0 [0043.862] SetLastError (dwErrCode=0x0) [0043.862] GetLastError () returned 0x0 [0043.862] SetLastError (dwErrCode=0x0) [0043.862] GetLastError () returned 0x0 [0043.862] SetLastError (dwErrCode=0x0) [0043.862] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x0, Size=0x28) returned 0x20f1768 [0043.862] GetLastError () returned 0x0 [0043.862] SetLastError (dwErrCode=0x0) [0043.863] GetLastError () returned 0x0 [0043.863] SetLastError (dwErrCode=0x0) [0043.863] GetLastError () returned 0x0 [0043.863] SetLastError (dwErrCode=0x0) [0043.863] GetLastError () returned 0x0 [0043.863] SetLastError (dwErrCode=0x0) [0043.863] GetLastError () returned 0x0 [0043.863] SetLastError (dwErrCode=0x0) [0043.863] GetLastError () returned 0x0 [0043.863] SetLastError (dwErrCode=0x0) [0043.863] GetLastError () returned 0x0 [0043.863] SetLastError (dwErrCode=0x0) [0043.863] GetLastError () returned 0x0 [0043.863] SetLastError (dwErrCode=0x0) [0043.863] GetLastError () returned 0x0 [0043.863] SetLastError (dwErrCode=0x0) [0043.863] GetLastError () returned 0x0 [0043.863] SetLastError (dwErrCode=0x0) [0043.863] GetLastError () returned 0x0 [0043.863] SetLastError (dwErrCode=0x0) [0043.863] GetLastError () returned 0x0 [0043.863] SetLastError (dwErrCode=0x0) [0043.863] GetLastError () returned 0x0 [0043.863] SetLastError (dwErrCode=0x0) [0043.863] GetLastError () returned 0x0 [0043.864] SetLastError (dwErrCode=0x0) [0043.864] GetLastError () returned 0x0 [0043.864] SetLastError (dwErrCode=0x0) [0043.864] GetLastError () returned 0x0 [0043.864] SetLastError (dwErrCode=0x0) [0043.864] GetLastError () returned 0x0 [0043.864] SetLastError (dwErrCode=0x0) [0043.864] GetLastError () returned 0x0 [0043.864] SetLastError (dwErrCode=0x0) [0043.864] GetLastError () returned 0x0 [0043.864] SetLastError (dwErrCode=0x0) [0043.864] GetLastError () returned 0x0 [0043.864] SetLastError (dwErrCode=0x0) [0043.864] GetLastError () returned 0x0 [0043.864] SetLastError (dwErrCode=0x0) [0043.864] GetLastError () returned 0x0 [0043.864] SetLastError (dwErrCode=0x0) [0043.864] GetLastError () returned 0x0 [0043.864] SetLastError (dwErrCode=0x0) [0043.864] GetLastError () returned 0x0 [0043.864] SetLastError (dwErrCode=0x0) [0043.864] GetLastError () returned 0x0 [0043.864] SetLastError (dwErrCode=0x0) [0043.864] GetLastError () returned 0x0 [0043.865] SetLastError (dwErrCode=0x0) [0043.865] GetLastError () returned 0x0 [0043.865] SetLastError (dwErrCode=0x0) [0043.865] GetLastError () returned 0x0 [0043.865] SetLastError (dwErrCode=0x0) [0043.865] GetLastError () returned 0x0 [0043.865] SetLastError (dwErrCode=0x0) [0043.865] GetLastError () returned 0x0 [0043.865] SetLastError (dwErrCode=0x0) [0043.865] GetLastError () returned 0x0 [0043.865] SetLastError (dwErrCode=0x0) [0043.865] GetLastError () returned 0x0 [0043.865] SetLastError (dwErrCode=0x0) [0043.865] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x94) returned 0x20f1798 [0043.865] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x1f) returned 0x20f1838 [0043.865] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x28) returned 0x20f1860 [0043.865] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x37) returned 0x20f1890 [0043.865] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x3c) returned 0x20f18d0 [0043.865] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x31) returned 0x20f1918 [0043.865] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x14) returned 0x20f1958 [0043.865] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x24) returned 0x20f1978 [0043.865] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0xd) returned 0x20f19a8 [0043.865] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x17) returned 0x20f19c0 [0043.865] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x2b) returned 0x20f19e0 [0043.865] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x15) returned 0x20f1a18 [0043.865] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x17) returned 0x20f1a38 [0043.865] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x22) returned 0x20f1a58 [0043.865] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0xe) returned 0x20f1a88 [0043.865] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0xc1) returned 0x20f1aa0 [0043.866] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x3e) returned 0x20f1b70 [0043.866] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x1b) returned 0x20f1bb8 [0043.866] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x1d) returned 0x20f1be0 [0043.866] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x48) returned 0x20f1c08 [0043.866] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x12) returned 0x20f1c58 [0043.866] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x18) returned 0x20f1c78 [0043.866] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x1b) returned 0x20f1c98 [0043.866] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x24) returned 0x20f1cc0 [0043.866] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x29) returned 0x20f1cf0 [0043.866] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x1e) returned 0x20f1d28 [0043.866] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x6b) returned 0x20f1d50 [0043.866] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x17) returned 0x20f1dc8 [0043.866] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0xf) returned 0x20f1de8 [0043.866] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x16) returned 0x20f1e00 [0043.866] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x28) returned 0x20f1e20 [0043.866] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x27) returned 0x20f1e50 [0043.866] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x12) returned 0x20f1e80 [0043.866] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x21) returned 0x20f1ea0 [0043.866] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x10) returned 0x20f1ed0 [0043.866] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x1c) returned 0x20f1ee8 [0043.866] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x12) returned 0x20f1f10 [0043.866] HeapFree (in: hHeap=0x20f0000, dwFlags=0x0, lpMem=0x20f0fd0 | out: hHeap=0x20f0000) returned 1 [0043.866] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76750000 [0043.866] GetProcAddress (hModule=0x76750000, lpProcName="IsProcessorFeaturePresent") returned 0x76765960 [0043.866] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0043.867] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x80) returned 0x20f1f30 [0043.867] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x8, Size=0x800) returned 0x20f1fb8 [0043.868] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4123af) returned 0x0 [0043.868] RtlSizeHeap (HeapHandle=0x20f0000, Flags=0x0, MemoryPointer=0x20f1f30) returned 0x80 [0043.868] OleInitialize (pvReserved=0x0) returned 0x0 [0044.994] GetLastError () returned 0x0 [0044.994] SetLastError (dwErrCode=0x0) [0044.994] GetLastError () returned 0x0 [0044.994] SetLastError (dwErrCode=0x0) [0044.994] GetLastError () returned 0x0 [0044.994] SetLastError (dwErrCode=0x0) [0044.994] GetLastError () returned 0x0 [0044.994] SetLastError (dwErrCode=0x0) [0044.994] GetCurrentProcessId () returned 0x13fc [0044.994] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x13fc) returned 0x158 [0044.997] Module32First (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0044.997] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0044.998] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0044.998] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0044.999] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0044.999] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0044.999] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0045.000] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0045.000] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0045.001] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0045.001] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0045.001] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0045.002] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0045.002] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0045.003] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0045.003] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0045.004] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0045.004] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0045.004] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0045.005] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0045.005] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0045.005] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0045.006] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0045.006] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 0 [0045.006] CloseHandle (hObject=0x158) returned 1 [0045.007] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0045.007] FindResourceA (hModule=0x400000, lpName="__", lpType=0xa) returned 0x426218 [0045.007] LoadResource (hModule=0x400000, hResInfo=0x426218) returned 0x43e77c [0045.007] LockResource (hResData=0x43e77c) returned 0x43e77c [0045.007] SizeofResource (hModule=0x400000, hResInfo=0x426218) returned 0x1a6fb [0045.007] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x0, Size=0x1a6fb) returned 0x2100048 [0045.008] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x0, Size=0x40022) returned 0x211a750 [0045.013] SizeofResource (hModule=0x400000, hResInfo=0x426218) returned 0x1a6fb [0045.017] GetLastError () returned 0x12 [0045.017] SetLastError (dwErrCode=0x12) [0045.019] GetLastError () returned 0x12 [0045.019] SetLastError (dwErrCode=0x12) [0045.020] GetLastError () returned 0x12 [0045.020] SetLastError (dwErrCode=0x12) [0045.020] GetLastError () returned 0x12 [0045.020] SetLastError (dwErrCode=0x12) [0045.021] GetLastError () returned 0x12 [0045.021] SetLastError (dwErrCode=0x12) [0045.021] GetLastError () returned 0x12 [0045.021] SetLastError (dwErrCode=0x12) [0045.022] GetLastError () returned 0x12 [0045.022] SetLastError (dwErrCode=0x12) [0045.022] GetLastError () returned 0x12 [0045.022] SetLastError (dwErrCode=0x12) [0045.023] GetLastError () returned 0x12 [0045.023] SetLastError (dwErrCode=0x12) [0045.023] GetLastError () returned 0x12 [0045.023] SetLastError (dwErrCode=0x12) [0045.023] GetLastError () returned 0x12 [0045.024] SetLastError (dwErrCode=0x12) [0045.024] GetLastError () returned 0x12 [0045.024] SetLastError (dwErrCode=0x12) [0045.024] GetLastError () returned 0x12 [0045.024] SetLastError (dwErrCode=0x12) [0045.025] GetLastError () returned 0x12 [0045.025] SetLastError (dwErrCode=0x12) [0045.025] GetLastError () returned 0x12 [0045.025] SetLastError (dwErrCode=0x12) [0045.026] GetLastError () returned 0x12 [0045.026] SetLastError (dwErrCode=0x12) [0045.026] GetLastError () returned 0x12 [0045.026] SetLastError (dwErrCode=0x12) [0045.027] GetLastError () returned 0x12 [0045.027] SetLastError (dwErrCode=0x12) [0045.027] GetLastError () returned 0x12 [0045.027] SetLastError (dwErrCode=0x12) [0045.028] GetLastError () returned 0x12 [0045.028] SetLastError (dwErrCode=0x12) [0045.028] GetLastError () returned 0x12 [0045.028] SetLastError (dwErrCode=0x12) [0045.028] GetLastError () returned 0x12 [0045.028] SetLastError (dwErrCode=0x12) [0045.029] GetLastError () returned 0x12 [0045.029] SetLastError (dwErrCode=0x12) [0045.029] GetLastError () returned 0x12 [0045.029] SetLastError (dwErrCode=0x12) [0045.030] GetLastError () returned 0x12 [0045.030] SetLastError (dwErrCode=0x12) [0045.030] GetLastError () returned 0x12 [0045.030] SetLastError (dwErrCode=0x12) [0045.031] GetLastError () returned 0x12 [0045.031] SetLastError (dwErrCode=0x12) [0045.031] FreeResource (hResData=0x43e77c) returned 0 [0045.031] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x0, Size=0x3f40e) returned 0x215a780 [0045.032] SizeofResource (hModule=0x400000, hResInfo=0x426218) returned 0x1a6fb [0045.032] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x0, Size=0x2530) returned 0x2199b98 [0045.039] HeapFree (in: hHeap=0x20f0000, dwFlags=0x0, lpMem=0x2199b98 | out: hHeap=0x20f0000) returned 1 [0045.039] LoadLibraryA (lpLibFileName="mscoree.dll") returned 0x74160000 [0045.248] GetProcAddress (hModule=0x74160000, lpProcName="CLRCreateInstance") returned 0x74175000 [0045.470] lstrlenA (lpString="v4.0.30319") returned 10 [0045.470] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x215a780, cbMultiByte=11, lpWideCharStr=0x19fc18, cchWideChar=11 | out: lpWideCharStr="v4.0.30319") returned 11 [0049.991] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x0, Size=0xc) returned 0x20f0fd0 [0049.991] RtlAllocateHeap (HeapHandle=0x20f0000, Flags=0x0, Size=0xc) returned 0x20f0fe8 [0050.016] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x80010106 [0050.020] RoInitialize () returned 0x1 [0050.020] RoUninitialize () returned 0x0 [0050.558] SafeArrayAccessData (in: psa=0x6b6078, ppvData=0x19fae8 | out: ppvData=0x19fae8) returned 0x0 [0050.559] SafeArrayUnaccessData (psa=0x6b6078) returned 0x0 [0050.662] SafeArrayGetDim (psa=0x6b6078) returned 0x1 [0050.662] SafeArrayGetDim (psa=0x6b6078) returned 0x1 [0050.662] SafeArrayGetLBound (in: psa=0x6b6078, nDim=0x1, plLbound=0x19f86c | out: plLbound=0x19f86c) returned 0x0 [0050.662] SafeArrayGetVartype (in: psa=0x6b6078, pvt=0x19f7dc | out: pvt=0x19f7dc) returned 0x0 [0051.672] SysStringByteLen (bstr="_._") returned 0x6 [0051.709] SafeArrayCreateVector (vt=0xc, lLbound=0, cElements=0x0) returned 0x6b5e38 [0051.713] SysStringByteLen (bstr="___") returned 0x6 [0053.692] CoTaskMemAlloc (cb=0x8) returned 0x6d9ce0 [0053.767] GetCurrentProcessId () returned 0x13fc [0053.810] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x19d904 | out: lpLuid=0x19d904*(LowPart=0x14, HighPart=0)) returned 1 [0053.813] GetCurrentProcess () returned 0xffffffff [0053.814] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x19d900 | out: TokenHandle=0x19d900*=0x2f4) returned 1 [0053.815] AdjustTokenPrivileges (in: TokenHandle=0x2f4, DisableAllPrivileges=0, NewState=0x24a53e4*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0053.815] CloseHandle (hObject=0x2f4) returned 1 [0053.823] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x13fc) returned 0x2f4 [0053.881] EnumProcessModules (in: hProcess=0x2f4, lphModule=0x24a5428, cb=0x100, lpcbNeeded=0x19e074 | out: lphModule=0x24a5428, lpcbNeeded=0x19e074) returned 1 [0053.883] GetModuleInformation (in: hProcess=0x2f4, hModule=0x400000, lpmodinfo=0x24a5568, cb=0xc | out: lpmodinfo=0x24a5568*(lpBaseOfDll=0x400000, SizeOfImage=0x5a000, EntryPoint=0x40cd2f)) returned 1 [0053.883] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.884] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x400000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="DRV.exe") returned 0x7 [0053.886] CoTaskMemFree (pv=0x6de760) [0053.887] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.887] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x400000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\DRV.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\drv.exe")) returned 0x1f [0053.888] CoTaskMemFree (pv=0x6de760) [0053.901] CloseHandle (hObject=0x2f4) returned 1 [0053.940] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76750000 [0053.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FindResourceA", cchWideChar=13, lpMultiByteStr=0x19e04c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FindResourceA\x82\r\x02\x9dÄPtðù\x9fsHç\x19", lpUsedDefaultChar=0x0) returned 13 [0053.952] GetProcAddress (hModule=0x76750000, lpProcName="FindResourceA") returned 0x767a27c0 [0053.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="__", cchWideChar=2, lpMultiByteStr=0x19e054, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="__\r\x02\x9dÄPtðù\x9fsHç\x19", lpUsedDefaultChar=0x0) returned 2 [0053.969] FindResourceA (hModule=0x400000, lpName="__", lpType=0xa) returned 0x426218 [0053.976] GetCurrentProcessId () returned 0x13fc [0053.988] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x13fc) returned 0x2f4 [0053.988] EnumProcessModules (in: hProcess=0x2f4, lphModule=0x24a7aa8, cb=0x100, lpcbNeeded=0x19e080 | out: lphModule=0x24a7aa8, lpcbNeeded=0x19e080) returned 1 [0053.988] GetModuleInformation (in: hProcess=0x2f4, hModule=0x400000, lpmodinfo=0x24a7be8, cb=0xc | out: lpmodinfo=0x24a7be8*(lpBaseOfDll=0x400000, SizeOfImage=0x5a000, EntryPoint=0x40cd2f)) returned 1 [0053.988] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.989] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x400000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="DRV.exe") returned 0x7 [0053.989] CoTaskMemFree (pv=0x6de760) [0053.989] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.989] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x400000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\DRV.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\drv.exe")) returned 0x1f [0053.989] CoTaskMemFree (pv=0x6de760) [0053.989] GetModuleInformation (in: hProcess=0x2f4, hModule=0x77850000, lpmodinfo=0x24a9d08, cb=0xc | out: lpmodinfo=0x24a9d08*(lpBaseOfDll=0x77850000, SizeOfImage=0x18e000, EntryPoint=0x0)) returned 1 [0053.989] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.989] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x77850000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0053.989] CoTaskMemFree (pv=0x6de760) [0053.989] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.989] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x77850000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\SYSTEM32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")) returned 0x1d [0053.990] CoTaskMemFree (pv=0x6de760) [0053.990] GetModuleInformation (in: hProcess=0x2f4, hModule=0x76750000, lpmodinfo=0x24abe0c, cb=0xc | out: lpmodinfo=0x24abe0c*(lpBaseOfDll=0x76750000, SizeOfImage=0xd0000, EntryPoint=0x767606a0)) returned 1 [0053.990] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.990] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x76750000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="KERNEL32.DLL") returned 0xc [0053.990] CoTaskMemFree (pv=0x6de760) [0053.990] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.990] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x76750000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\KERNEL32.DLL" (normalized: "c:\\windows\\system32\\kernel32.dll")) returned 0x20 [0053.990] CoTaskMemFree (pv=0x6de760) [0053.990] GetModuleInformation (in: hProcess=0x2f4, hModule=0x747b0000, lpmodinfo=0x24adf20, cb=0xc | out: lpmodinfo=0x24adf20*(lpBaseOfDll=0x747b0000, SizeOfImage=0x1c2000, EntryPoint=0x7489ff30)) returned 1 [0053.990] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.990] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x747b0000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0053.991] CoTaskMemFree (pv=0x6de760) [0053.991] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.991] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x747b0000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\KERNELBASE.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")) returned 0x22 [0053.991] CoTaskMemFree (pv=0x6de760) [0053.991] GetModuleInformation (in: hProcess=0x2f4, hModule=0x74270000, lpmodinfo=0x24b003c, cb=0xc | out: lpmodinfo=0x24b003c*(lpBaseOfDll=0x74270000, SizeOfImage=0x93000, EntryPoint=0x742a4270)) returned 1 [0053.991] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.991] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x74270000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="apphelp.dll") returned 0xb [0053.991] CoTaskMemFree (pv=0x6de760) [0053.991] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.991] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x74270000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\SYSTEM32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll")) returned 0x1f [0053.992] CoTaskMemFree (pv=0x6de760) [0053.992] GetModuleInformation (in: hProcess=0x2f4, hModule=0x76470000, lpmodinfo=0x24b2174, cb=0xc | out: lpmodinfo=0x24b2174*(lpBaseOfDll=0x76470000, SizeOfImage=0xf3000, EntryPoint=0x764aa100)) returned 1 [0053.992] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.992] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x76470000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0053.992] CoTaskMemFree (pv=0x6de760) [0053.992] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.992] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x76470000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")) returned 0x1d [0053.993] CoTaskMemFree (pv=0x6de760) [0053.993] GetModuleInformation (in: hProcess=0x2f4, hModule=0x77130000, lpmodinfo=0x24b4278, cb=0xc | out: lpmodinfo=0x24b4278*(lpBaseOfDll=0x77130000, SizeOfImage=0x238000, EntryPoint=0x7724e060)) returned 1 [0053.993] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.993] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x77130000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="combase.dll") returned 0xb [0053.993] CoTaskMemFree (pv=0x6de760) [0053.993] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.993] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x77130000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")) returned 0x1f [0053.993] CoTaskMemFree (pv=0x6de760) [0053.993] GetModuleInformation (in: hProcess=0x2f4, hModule=0x77370000, lpmodinfo=0x24b6384, cb=0xc | out: lpmodinfo=0x24b6384*(lpBaseOfDll=0x77370000, SizeOfImage=0x118000, EntryPoint=0x7739a3c0)) returned 1 [0053.993] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.993] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x77370000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="ucrtbase.dll") returned 0xc [0053.993] CoTaskMemFree (pv=0x6de760) [0053.993] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.994] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x77370000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll")) returned 0x20 [0053.994] CoTaskMemFree (pv=0x6de760) [0053.994] GetModuleInformation (in: hProcess=0x2f4, hModule=0x76570000, lpmodinfo=0x24b8498, cb=0xc | out: lpmodinfo=0x24b8498*(lpBaseOfDll=0x76570000, SizeOfImage=0xc0000, EntryPoint=0x7659fb20)) returned 1 [0053.994] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.994] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x76570000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0053.994] CoTaskMemFree (pv=0x6de760) [0053.994] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.994] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x76570000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\RPCRT4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")) returned 0x1e [0053.994] CoTaskMemFree (pv=0x6de760) [0053.994] GetModuleInformation (in: hProcess=0x2f4, hModule=0x74320000, lpmodinfo=0x24ba5f0, cb=0xc | out: lpmodinfo=0x24ba5f0*(lpBaseOfDll=0x74320000, SizeOfImage=0x20000, EntryPoint=0x7432c9a0)) returned 1 [0053.994] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.995] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x74320000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0053.995] CoTaskMemFree (pv=0x6de760) [0053.995] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.995] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x74320000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\SspiCli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")) returned 0x1f [0053.995] CoTaskMemFree (pv=0x6de760) [0053.995] GetModuleInformation (in: hProcess=0x2f4, hModule=0x74310000, lpmodinfo=0x24bc6fc, cb=0xc | out: lpmodinfo=0x24bc6fc*(lpBaseOfDll=0x74310000, SizeOfImage=0xa000, EntryPoint=0x74312a00)) returned 1 [0053.995] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.995] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x74310000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0053.995] CoTaskMemFree (pv=0x6de760) [0053.995] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.995] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x74310000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\CRYPTBASE.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")) returned 0x21 [0053.995] CoTaskMemFree (pv=0x6de760) [0053.995] GetModuleInformation (in: hProcess=0x2f4, hModule=0x744e0000, lpmodinfo=0x24be810, cb=0xc | out: lpmodinfo=0x24be810*(lpBaseOfDll=0x744e0000, SizeOfImage=0x57000, EntryPoint=0x7451de40)) returned 1 [0053.996] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.996] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x744e0000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="bcryptPrimitives.dll") returned 0x14 [0053.996] CoTaskMemFree (pv=0x6de760) [0053.996] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.996] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x744e0000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\bcryptPrimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")) returned 0x28 [0053.996] CoTaskMemFree (pv=0x6de760) [0053.996] GetModuleInformation (in: hProcess=0x2f4, hModule=0x761a0000, lpmodinfo=0x24c0944, cb=0xc | out: lpmodinfo=0x24c0944*(lpBaseOfDll=0x761a0000, SizeOfImage=0x41000, EntryPoint=0x761b3400)) returned 1 [0053.996] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.996] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x761a0000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0053.996] CoTaskMemFree (pv=0x6de760) [0053.997] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.997] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x761a0000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")) returned 0x1f [0053.997] CoTaskMemFree (pv=0x6de760) [0053.997] GetModuleInformation (in: hProcess=0x2f4, hModule=0x76920000, lpmodinfo=0x24c2a50, cb=0xc | out: lpmodinfo=0x24c2a50*(lpBaseOfDll=0x76920000, SizeOfImage=0x21000, EntryPoint=0x76926900)) returned 1 [0053.997] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.997] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x76920000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0053.997] CoTaskMemFree (pv=0x6de760) [0053.997] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.997] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x76920000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\GDI32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")) returned 0x1d [0053.998] CoTaskMemFree (pv=0x6de760) [0053.998] GetModuleInformation (in: hProcess=0x2f4, hModule=0x74380000, lpmodinfo=0x24c4b54, cb=0xc | out: lpmodinfo=0x24c4b54*(lpBaseOfDll=0x74380000, SizeOfImage=0x158000, EntryPoint=0x7443a9c0)) returned 1 [0053.998] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.998] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x74380000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="gdi32full.dll") returned 0xd [0053.998] CoTaskMemFree (pv=0x6de760) [0053.998] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.998] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x74380000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\gdi32full.dll" (normalized: "c:\\windows\\system32\\gdi32full.dll")) returned 0x21 [0053.998] CoTaskMemFree (pv=0x6de760) [0053.998] GetModuleInformation (in: hProcess=0x2f4, hModule=0x76630000, lpmodinfo=0x24c6c68, cb=0xc | out: lpmodinfo=0x24c6c68*(lpBaseOfDll=0x76630000, SizeOfImage=0x79000, EntryPoint=0x76644180)) returned 1 [0053.998] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.998] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x76630000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="msvcp_win.dll") returned 0xd [0053.998] CoTaskMemFree (pv=0x6de760) [0053.999] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.999] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x76630000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\msvcp_win.dll" (normalized: "c:\\windows\\system32\\msvcp_win.dll")) returned 0x21 [0053.999] CoTaskMemFree (pv=0x6de760) [0053.999] GetModuleInformation (in: hProcess=0x2f4, hModule=0x76240000, lpmodinfo=0x24c8d7c, cb=0xc | out: lpmodinfo=0x24c8d7c*(lpBaseOfDll=0x76240000, SizeOfImage=0x13c000, EntryPoint=0x7626b3d0)) returned 1 [0053.999] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0053.999] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x76240000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0054.000] CoTaskMemFree (pv=0x6de760) [0054.000] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.000] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x76240000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\USER32.dll" (normalized: "c:\\windows\\system32\\user32.dll")) returned 0x1e [0054.000] CoTaskMemFree (pv=0x6de760) [0054.000] GetModuleInformation (in: hProcess=0x2f4, hModule=0x77100000, lpmodinfo=0x24caf14, cb=0xc | out: lpmodinfo=0x24caf14*(lpBaseOfDll=0x77100000, SizeOfImage=0x16000, EntryPoint=0x0)) returned 1 [0054.000] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.000] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x77100000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="win32u.dll") returned 0xa [0054.001] CoTaskMemFree (pv=0x6de760) [0054.001] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.001] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x77100000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\win32u.dll" (normalized: "c:\\windows\\system32\\win32u.dll")) returned 0x1e [0054.001] CoTaskMemFree (pv=0x6de760) [0054.001] GetModuleInformation (in: hProcess=0x2f4, hModule=0x76950000, lpmodinfo=0x24cd020, cb=0xc | out: lpmodinfo=0x24cd020*(lpBaseOfDll=0x76950000, SizeOfImage=0x96000, EntryPoint=0x76988f60)) returned 1 [0054.001] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.002] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x76950000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0054.002] CoTaskMemFree (pv=0x6de760) [0054.002] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.002] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x76950000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\OLEAUT32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")) returned 0x20 [0054.002] CoTaskMemFree (pv=0x6de760) [0054.002] GetModuleInformation (in: hProcess=0x2f4, hModule=0x77670000, lpmodinfo=0x24cf134, cb=0xc | out: lpmodinfo=0x24cf134*(lpBaseOfDll=0x77670000, SizeOfImage=0x25000, EntryPoint=0x776747d0)) returned 1 [0054.002] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.003] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x77670000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0054.003] CoTaskMemFree (pv=0x6de760) [0054.003] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.003] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x77670000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0054.003] CoTaskMemFree (pv=0x6de760) [0054.003] GetModuleInformation (in: hProcess=0x2f4, hModule=0x77840000, lpmodinfo=0x24d1238, cb=0xc | out: lpmodinfo=0x24d1238*(lpBaseOfDll=0x77840000, SizeOfImage=0xe000, EntryPoint=0x77843e30)) returned 1 [0054.003] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.003] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x77840000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="kernel.appcore.dll") returned 0x12 [0054.004] CoTaskMemFree (pv=0x6de760) [0054.004] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.004] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x77840000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")) returned 0x26 [0054.004] CoTaskMemFree (pv=0x6de760) [0054.004] GetModuleInformation (in: hProcess=0x2f4, hModule=0x77750000, lpmodinfo=0x24d3364, cb=0xc | out: lpmodinfo=0x24d3364*(lpBaseOfDll=0x77750000, SizeOfImage=0xbd000, EntryPoint=0x777855e0)) returned 1 [0054.005] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.005] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x77750000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0054.005] CoTaskMemFree (pv=0x6de760) [0054.005] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.005] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x77750000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")) returned 0x1e [0054.005] CoTaskMemFree (pv=0x6de760) [0054.005] GetModuleInformation (in: hProcess=0x2f4, hModule=0x741f0000, lpmodinfo=0x24d5470, cb=0xc | out: lpmodinfo=0x24d5470*(lpBaseOfDll=0x741f0000, SizeOfImage=0x78000, EntryPoint=0x742285b0)) returned 1 [0054.006] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.006] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x741f0000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0054.006] CoTaskMemFree (pv=0x6de760) [0054.006] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.006] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x741f0000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0054.006] CoTaskMemFree (pv=0x6de760) [0054.006] GetModuleInformation (in: hProcess=0x2f4, hModule=0x74160000, lpmodinfo=0x24d757c, cb=0xc | out: lpmodinfo=0x24d757c*(lpBaseOfDll=0x74160000, SizeOfImage=0x55000, EntryPoint=0x74190a30)) returned 1 [0054.007] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.007] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x74160000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="mscoree.dll") returned 0xb [0054.007] CoTaskMemFree (pv=0x6de760) [0054.007] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.007] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x74160000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\SYSTEM32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0054.007] CoTaskMemFree (pv=0x6de760) [0054.007] GetModuleInformation (in: hProcess=0x2f4, hModule=0x76390000, lpmodinfo=0x24d9688, cb=0xc | out: lpmodinfo=0x24d9688*(lpBaseOfDll=0x76390000, SizeOfImage=0x77000, EntryPoint=0x763ae5b0)) returned 1 [0054.008] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.008] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x76390000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0054.008] CoTaskMemFree (pv=0x6de760) [0054.008] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.008] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x76390000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\ADVAPI32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")) returned 0x20 [0054.008] CoTaskMemFree (pv=0x6de760) [0054.008] GetModuleInformation (in: hProcess=0x2f4, hModule=0x740e0000, lpmodinfo=0x24db79c, cb=0xc | out: lpmodinfo=0x24db79c*(lpBaseOfDll=0x740e0000, SizeOfImage=0x7d000, EntryPoint=0x740e3c80)) returned 1 [0054.009] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.009] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x740e0000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0054.009] CoTaskMemFree (pv=0x6de760) [0054.009] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.009] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x740e0000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0054.009] CoTaskMemFree (pv=0x6de760) [0054.009] GetModuleInformation (in: hProcess=0x2f4, hModule=0x739f0000, lpmodinfo=0x24dd8e4, cb=0xc | out: lpmodinfo=0x24dd8e4*(lpBaseOfDll=0x739f0000, SizeOfImage=0x6e6000, EntryPoint=0x73a083d0)) returned 1 [0054.010] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.010] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x739f0000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0054.010] CoTaskMemFree (pv=0x6de760) [0054.010] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.010] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x739f0000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0054.010] CoTaskMemFree (pv=0x6de760) [0054.010] GetModuleInformation (in: hProcess=0x2f4, hModule=0x74980000, lpmodinfo=0x24dfa14, cb=0xc | out: lpmodinfo=0x24dfa14*(lpBaseOfDll=0x74980000, SizeOfImage=0x45000, EntryPoint=0x74999260)) returned 1 [0054.011] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.011] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x74980000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0054.011] CoTaskMemFree (pv=0x6de760) [0054.011] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.011] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x74980000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\SHLWAPI.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")) returned 0x1f [0054.011] CoTaskMemFree (pv=0x6de760) [0054.011] GetModuleInformation (in: hProcess=0x2f4, hModule=0x738f0000, lpmodinfo=0x24e1b20, cb=0xc | out: lpmodinfo=0x24e1b20*(lpBaseOfDll=0x738f0000, SizeOfImage=0xf5000, EntryPoint=0x73944180)) returned 1 [0054.011] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.011] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x738f0000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0054.012] CoTaskMemFree (pv=0x6de760) [0054.012] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.012] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x738f0000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\SYSTEM32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0054.012] CoTaskMemFree (pv=0x6de760) [0054.012] GetModuleInformation (in: hProcess=0x2f4, hModule=0x72560000, lpmodinfo=0x24e3c54, cb=0xc | out: lpmodinfo=0x24e3c54*(lpBaseOfDll=0x72560000, SizeOfImage=0x138d000, EntryPoint=0x0)) returned 1 [0054.012] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.012] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x72560000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0054.012] CoTaskMemFree (pv=0x6de760) [0054.012] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.012] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x72560000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\f12799647dc4f4abd2f0f17790337f04\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\f12799647dc4f4abd2f0f17790337f04\\mscorlib.ni.dll")) returned 0x68 [0054.012] CoTaskMemFree (pv=0x6de760) [0054.012] GetModuleInformation (in: hProcess=0x2f4, hModule=0x72540000, lpmodinfo=0x24e5dfc, cb=0xc | out: lpmodinfo=0x24e5dfc*(lpBaseOfDll=0x72540000, SizeOfImage=0x13000, EntryPoint=0x72546c40)) returned 1 [0054.013] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.013] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x72540000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0054.013] CoTaskMemFree (pv=0x6de760) [0054.013] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.013] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x72540000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\SYSTEM32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0054.013] CoTaskMemFree (pv=0x6de760) [0054.013] GetModuleInformation (in: hProcess=0x2f4, hModule=0x72510000, lpmodinfo=0x24e7f08, cb=0xc | out: lpmodinfo=0x24e7f08*(lpBaseOfDll=0x72510000, SizeOfImage=0x2f000, EntryPoint=0x7251c000)) returned 1 [0054.013] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.013] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x72510000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0054.013] CoTaskMemFree (pv=0x6de760) [0054.014] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.014] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x72510000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0054.014] CoTaskMemFree (pv=0x6de760) [0054.014] GetModuleInformation (in: hProcess=0x2f4, hModule=0x724f0000, lpmodinfo=0x24ea014, cb=0xc | out: lpmodinfo=0x24ea014*(lpBaseOfDll=0x724f0000, SizeOfImage=0x18000, EntryPoint=0x724f8f30)) returned 1 [0054.014] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.014] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x724f0000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="bcrypt.dll") returned 0xa [0054.015] CoTaskMemFree (pv=0x6de760) [0054.015] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.015] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x724f0000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\SYSTEM32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")) returned 0x1e [0054.019] CoTaskMemFree (pv=0x6de760) [0054.019] GetModuleInformation (in: hProcess=0x2f4, hModule=0x72470000, lpmodinfo=0x24ec22c, cb=0xc | out: lpmodinfo=0x24ec22c*(lpBaseOfDll=0x72470000, SizeOfImage=0x80000, EntryPoint=0x72471180)) returned 1 [0054.020] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.020] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x72470000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0054.020] CoTaskMemFree (pv=0x6de760) [0054.020] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.020] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x72470000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0054.020] CoTaskMemFree (pv=0x6de760) [0054.020] GetModuleInformation (in: hProcess=0x2f4, hModule=0x71a90000, lpmodinfo=0x24ee36c, cb=0xc | out: lpmodinfo=0x24ee36c*(lpBaseOfDll=0x71a90000, SizeOfImage=0x9df000, EntryPoint=0x0)) returned 1 [0054.020] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.021] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x71a90000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0054.021] CoTaskMemFree (pv=0x6de760) [0054.021] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.021] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x71a90000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\assembly\\NativeImages_v4.0.30319_32\\System\\fcfb8bac8ea9a0e69d72c350b22f8e3f\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\fcfb8bac8ea9a0e69d72c350b22f8e3f\\system.ni.dll")) returned 0x64 [0054.021] CoTaskMemFree (pv=0x6de760) [0054.021] GetModuleInformation (in: hProcess=0x2f4, hModule=0x718f0000, lpmodinfo=0x24f0508, cb=0xc | out: lpmodinfo=0x24f0508*(lpBaseOfDll=0x718f0000, SizeOfImage=0x194000, EntryPoint=0x0)) returned 1 [0054.022] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.022] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x718f0000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0054.022] CoTaskMemFree (pv=0x6de760) [0054.022] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.022] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x718f0000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\5b307e2b9719b21749a8c73127ab5f45\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\5b307e2b9719b21749a8c73127ab5f45\\system.drawing.ni.dll")) returned 0x74 [0054.023] CoTaskMemFree (pv=0x6de760) [0054.023] GetModuleInformation (in: hProcess=0x2f4, hModule=0x70bf0000, lpmodinfo=0x24f26d4, cb=0xc | out: lpmodinfo=0x24f26d4*(lpBaseOfDll=0x70bf0000, SizeOfImage=0xcf2000, EntryPoint=0x0)) returned 1 [0054.023] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.023] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x70bf0000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0054.023] CoTaskMemFree (pv=0x6de760) [0054.023] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.023] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x70bf0000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\02d3b6022cc1ee466eb660dedcff59aa\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\02d3b6022cc1ee466eb660dedcff59aa\\system.windows.forms.ni.dll")) returned 0x80 [0054.024] CoTaskMemFree (pv=0x6de760) [0054.024] GetModuleInformation (in: hProcess=0x2f4, hModule=0x77830000, lpmodinfo=0x24f48c4, cb=0xc | out: lpmodinfo=0x24f48c4*(lpBaseOfDll=0x77830000, SizeOfImage=0x6000, EntryPoint=0x77831460)) returned 1 [0054.024] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.024] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x77830000, lpBaseName=0x6de760, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0054.024] CoTaskMemFree (pv=0x6de760) [0054.024] CoTaskMemAlloc (cb=0x804) returned 0x6de760 [0054.024] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x77830000, lpFilename=0x6de760, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll")) returned 0x1d [0054.025] CoTaskMemFree (pv=0x6de760) [0054.025] CloseHandle (hObject=0x2f4) returned 1 [0054.052] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x19d898 | out: phkResult=0x19d898*=0x0) returned 0x2 [0054.053] RegCloseKey (hKey=0x80000002) returned 0x0 [0054.056] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll", nBufferLength=0x105, lpBuffer=0x19db18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll", lpFilePart=0x0) returned 0x38 [0054.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19dfcc) returned 1 [0054.059] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll"), fInfoLevelId=0x0, lpFileInformation=0x19e048 | out: lpFileInformation=0x19e048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x795c1cb6, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x795c1cb6, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x795c1cb6, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x7faa0)) returned 1 [0054.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19dfc8) returned 1 [0054.086] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll", lpdwHandle=0x19e0bc | out: lpdwHandle=0x19e0bc) returned 0x814 [0054.087] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll", dwHandle=0x0, dwLen=0x814, lpData=0x24f8068 | out: lpData=0x24f8068) returned 1 [0054.089] VerQueryValueW (in: pBlock=0x24f8068, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19e090, puLen=0x19e08c | out: lplpBuffer=0x19e090*=0x24f846c, puLen=0x19e08c) returned 1 [0054.092] VerQueryValueW (in: pBlock=0x24f8068, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x19e010, puLen=0x19e00c | out: lplpBuffer=0x19e010*=0x24f8120, puLen=0x19e00c) returned 1 [0054.092] VerQueryValueW (in: pBlock=0x24f8068, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x19e010, puLen=0x19e00c | out: lplpBuffer=0x19e010*=0x24f8174, puLen=0x19e00c) returned 1 [0054.092] VerQueryValueW (in: pBlock=0x24f8068, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x19e010, puLen=0x19e00c | out: lplpBuffer=0x19e010*=0x24f81f0, puLen=0x19e00c) returned 1 [0054.092] VerQueryValueW (in: pBlock=0x24f8068, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x19e010, puLen=0x19e00c | out: lplpBuffer=0x19e010*=0x24f8258, puLen=0x19e00c) returned 1 [0054.092] VerQueryValueW (in: pBlock=0x24f8068, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x19e010, puLen=0x19e00c | out: lplpBuffer=0x19e010*=0x24f8294, puLen=0x19e00c) returned 1 [0054.092] VerQueryValueW (in: pBlock=0x24f8068, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x19e010, puLen=0x19e00c | out: lplpBuffer=0x19e010*=0x24f831c, puLen=0x19e00c) returned 1 [0054.092] VerQueryValueW (in: pBlock=0x24f8068, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x19e010, puLen=0x19e00c | out: lplpBuffer=0x19e010*=0x24f8354, puLen=0x19e00c) returned 1 [0054.092] VerQueryValueW (in: pBlock=0x24f8068, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x19e010, puLen=0x19e00c | out: lplpBuffer=0x19e010*=0x24f83ac, puLen=0x19e00c) returned 1 [0054.092] VerQueryValueW (in: pBlock=0x24f8068, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x19e010, puLen=0x19e00c | out: lplpBuffer=0x19e010*=0x24f83dc, puLen=0x19e00c) returned 1 [0054.092] VerQueryValueW (in: pBlock=0x24f8068, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x19e010, puLen=0x19e00c | out: lplpBuffer=0x19e010*=0x0, puLen=0x19e00c) returned 0 [0054.092] VerQueryValueW (in: pBlock=0x24f8068, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x19e010, puLen=0x19e00c | out: lplpBuffer=0x19e010*=0x24f8418, puLen=0x19e00c) returned 1 [0054.092] VerQueryValueW (in: pBlock=0x24f8068, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x19e010, puLen=0x19e00c | out: lplpBuffer=0x19e010*=0x0, puLen=0x19e00c) returned 0 [0054.092] VerQueryValueW (in: pBlock=0x24f8068, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19e004, puLen=0x19e000 | out: lplpBuffer=0x19e004*=0x24f846c, puLen=0x19e000) returned 1 [0054.092] VerLanguageNameW (in: wLang=0x409, szLang=0x19dd94, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0054.097] VerQueryValueW (in: pBlock=0x24f8068, lpSubBlock="\\", lplpBuffer=0x19e014, puLen=0x19e010 | out: lplpBuffer=0x19e014*=0x24f8090, puLen=0x19e010) returned 1 [0054.176] GetCurrentProcessId () returned 0x13fc [0054.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OpenProcess", cchWideChar=11, lpMultiByteStr=0x19e04c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OpenProcesssU\x82\r\x02\x9dÄPtðù\x9fsHç\x19", lpUsedDefaultChar=0x0) returned 11 [0054.186] GetProcAddress (hModule=0x76750000, lpProcName="OpenProcess") returned 0x76765cc0 [0054.197] OpenProcess (dwDesiredAccess=0x38, bInheritHandle=1, dwProcessId=0x13fc) returned 0xe8 [0054.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualProtect", cchWideChar=14, lpMultiByteStr=0x19e054, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VirtualProtect\r\x02\x9dÄPtðù\x9fsHç\x19", lpUsedDefaultChar=0x0) returned 14 [0054.208] GetProcAddress (hModule=0x76750000, lpProcName="VirtualProtect") returned 0x76766a30 [0054.220] VirtualProtect (in: lpAddress=0x22b0260, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.223] VirtualProtect (in: lpAddress=0x22b0260, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.223] VirtualProtect (in: lpAddress=0x22b02b8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.223] VirtualProtect (in: lpAddress=0x22b02b8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.223] VirtualProtect (in: lpAddress=0x22b0374, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.224] VirtualProtect (in: lpAddress=0x22b0374, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.224] VirtualProtect (in: lpAddress=0x22b0384, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.224] VirtualProtect (in: lpAddress=0x22b0384, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.224] VirtualProtect (in: lpAddress=0x22b03a8, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.225] VirtualProtect (in: lpAddress=0x22b03a8, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.225] VirtualProtect (in: lpAddress=0x22b03b8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.225] VirtualProtect (in: lpAddress=0x22b03b8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.226] VirtualProtect (in: lpAddress=0x22b03cc, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.226] VirtualProtect (in: lpAddress=0x22b03cc, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.226] VirtualProtect (in: lpAddress=0x22b03dc, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.226] VirtualProtect (in: lpAddress=0x22b03dc, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.227] VirtualProtect (in: lpAddress=0x22b03ec, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.227] VirtualProtect (in: lpAddress=0x22b03ec, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.227] VirtualProtect (in: lpAddress=0x22b03fc, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.227] VirtualProtect (in: lpAddress=0x22b03fc, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.228] VirtualProtect (in: lpAddress=0x22b040c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.228] VirtualProtect (in: lpAddress=0x22b040c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.228] VirtualProtect (in: lpAddress=0x22b0504, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.229] VirtualProtect (in: lpAddress=0x22b0504, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.229] VirtualProtect (in: lpAddress=0x22b0514, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.229] VirtualProtect (in: lpAddress=0x22b0514, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.229] VirtualProtect (in: lpAddress=0x22b0528, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.230] VirtualProtect (in: lpAddress=0x22b0528, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.230] VirtualProtect (in: lpAddress=0x22b0538, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.230] VirtualProtect (in: lpAddress=0x22b0538, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.230] VirtualProtect (in: lpAddress=0x22b0548, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.231] VirtualProtect (in: lpAddress=0x22b0548, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.231] VirtualProtect (in: lpAddress=0x22b0634, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.231] VirtualProtect (in: lpAddress=0x22b0634, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.231] VirtualProtect (in: lpAddress=0x22b096c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.232] VirtualProtect (in: lpAddress=0x22b096c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.232] VirtualProtect (in: lpAddress=0x22b0db4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.232] VirtualProtect (in: lpAddress=0x22b0db4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.232] VirtualProtect (in: lpAddress=0x22b0ebc, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.233] VirtualProtect (in: lpAddress=0x22b0ebc, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.233] VirtualProtect (in: lpAddress=0x22b0fa0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.233] VirtualProtect (in: lpAddress=0x22b0fa0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.233] VirtualProtect (in: lpAddress=0x22b10d8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.234] VirtualProtect (in: lpAddress=0x22b10d8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.235] VirtualProtect (in: lpAddress=0x22b1568, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.235] VirtualProtect (in: lpAddress=0x22b1568, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.235] VirtualProtect (in: lpAddress=0x22b16a8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.235] VirtualProtect (in: lpAddress=0x22b16a8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.236] VirtualProtect (in: lpAddress=0x22b1bd0, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.236] VirtualProtect (in: lpAddress=0x22b1bd0, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.236] VirtualProtect (in: lpAddress=0x22b1be0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.236] VirtualProtect (in: lpAddress=0x22b1be0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.236] VirtualProtect (in: lpAddress=0x22b1c98, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.237] VirtualProtect (in: lpAddress=0x22b1c98, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.237] VirtualProtect (in: lpAddress=0x22b1f04, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.237] VirtualProtect (in: lpAddress=0x22b1f04, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.238] VirtualProtect (in: lpAddress=0x22b1f14, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.238] VirtualProtect (in: lpAddress=0x22b1f14, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.238] VirtualProtect (in: lpAddress=0x22b1f24, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.238] VirtualProtect (in: lpAddress=0x22b1f24, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.238] VirtualProtect (in: lpAddress=0x22b1f38, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.239] VirtualProtect (in: lpAddress=0x22b1f38, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.239] VirtualProtect (in: lpAddress=0x22b1f4c, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.239] VirtualProtect (in: lpAddress=0x22b1f4c, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.240] VirtualProtect (in: lpAddress=0x22b2044, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.240] VirtualProtect (in: lpAddress=0x22b2044, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.240] VirtualProtect (in: lpAddress=0x22b2058, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.240] VirtualProtect (in: lpAddress=0x22b2058, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.241] VirtualProtect (in: lpAddress=0x22b2084, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.241] VirtualProtect (in: lpAddress=0x22b2084, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.241] VirtualProtect (in: lpAddress=0x22b221c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.242] VirtualProtect (in: lpAddress=0x22b221c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.242] VirtualProtect (in: lpAddress=0x22b231c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.242] VirtualProtect (in: lpAddress=0x22b231c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.242] VirtualProtect (in: lpAddress=0x22b2330, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.243] VirtualProtect (in: lpAddress=0x22b2330, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.243] VirtualProtect (in: lpAddress=0x22b2340, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.243] VirtualProtect (in: lpAddress=0x22b2340, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.243] VirtualProtect (in: lpAddress=0x22b2350, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.244] VirtualProtect (in: lpAddress=0x22b2350, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.244] VirtualProtect (in: lpAddress=0x22bdf28, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.244] VirtualProtect (in: lpAddress=0x22bdf28, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.244] VirtualProtect (in: lpAddress=0x22bdf40, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.245] VirtualProtect (in: lpAddress=0x22bdf40, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.245] VirtualProtect (in: lpAddress=0x22bdf98, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.245] VirtualProtect (in: lpAddress=0x22bdf98, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.245] VirtualProtect (in: lpAddress=0x22bdfac, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.246] VirtualProtect (in: lpAddress=0x22bdfac, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.246] VirtualProtect (in: lpAddress=0x22bdfc4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.246] VirtualProtect (in: lpAddress=0x22bdfc4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.246] VirtualProtect (in: lpAddress=0x22be048, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.246] VirtualProtect (in: lpAddress=0x22be048, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.247] VirtualProtect (in: lpAddress=0x22be058, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.247] VirtualProtect (in: lpAddress=0x22be058, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.247] VirtualProtect (in: lpAddress=0x22be068, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.247] VirtualProtect (in: lpAddress=0x22be068, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.248] VirtualProtect (in: lpAddress=0x22be080, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.248] VirtualProtect (in: lpAddress=0x22be080, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.248] VirtualProtect (in: lpAddress=0x22be098, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.249] VirtualProtect (in: lpAddress=0x22be098, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.249] VirtualProtect (in: lpAddress=0x22be0a8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.250] VirtualProtect (in: lpAddress=0x22be0a8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.251] VirtualProtect (in: lpAddress=0x22be0bc, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.251] VirtualProtect (in: lpAddress=0x22be0bc, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.252] VirtualProtect (in: lpAddress=0x22be0dc, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.252] VirtualProtect (in: lpAddress=0x22be0dc, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.252] VirtualProtect (in: lpAddress=0x22be0f0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.253] VirtualProtect (in: lpAddress=0x22be0f0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.253] VirtualProtect (in: lpAddress=0x22be4e4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.253] VirtualProtect (in: lpAddress=0x22be4e4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.254] VirtualProtect (in: lpAddress=0x22be598, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.254] VirtualProtect (in: lpAddress=0x22be598, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.254] VirtualProtect (in: lpAddress=0x22be5ac, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.255] VirtualProtect (in: lpAddress=0x22be5ac, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.255] VirtualProtect (in: lpAddress=0x22c1ef8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.255] VirtualProtect (in: lpAddress=0x22c1ef8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.256] VirtualProtect (in: lpAddress=0x22c1f88, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.256] VirtualProtect (in: lpAddress=0x22c1f88, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.256] VirtualProtect (in: lpAddress=0x22c2020, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.256] VirtualProtect (in: lpAddress=0x22c2020, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.257] VirtualProtect (in: lpAddress=0x22c205c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.257] VirtualProtect (in: lpAddress=0x22c205c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.257] VirtualProtect (in: lpAddress=0x22c20a8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.257] VirtualProtect (in: lpAddress=0x22c20a8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.258] VirtualProtect (in: lpAddress=0x22c20d4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.258] VirtualProtect (in: lpAddress=0x22c20d4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.258] VirtualProtect (in: lpAddress=0x22c2104, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.259] VirtualProtect (in: lpAddress=0x22c2104, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.259] VirtualProtect (in: lpAddress=0x22c2154, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.259] VirtualProtect (in: lpAddress=0x22c2154, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.259] VirtualProtect (in: lpAddress=0x22c21d8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.260] VirtualProtect (in: lpAddress=0x22c21d8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.260] VirtualProtect (in: lpAddress=0x22c2238, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.260] VirtualProtect (in: lpAddress=0x22c2238, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.260] VirtualProtect (in: lpAddress=0x22c224c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.261] VirtualProtect (in: lpAddress=0x22c224c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.261] VirtualProtect (in: lpAddress=0x22c2260, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.261] VirtualProtect (in: lpAddress=0x22c2260, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.261] VirtualProtect (in: lpAddress=0x22c28c4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.262] VirtualProtect (in: lpAddress=0x22c28c4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.262] VirtualProtect (in: lpAddress=0x22c2c44, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.262] VirtualProtect (in: lpAddress=0x22c2c44, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.262] VirtualProtect (in: lpAddress=0x22c2c9c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.263] VirtualProtect (in: lpAddress=0x22c2c9c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.263] VirtualProtect (in: lpAddress=0x22c2cb0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.263] VirtualProtect (in: lpAddress=0x22c2cb0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.263] VirtualProtect (in: lpAddress=0x22c2cc4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.264] VirtualProtect (in: lpAddress=0x22c2cc4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.264] VirtualProtect (in: lpAddress=0x22c2cdc, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.264] VirtualProtect (in: lpAddress=0x22c2cdc, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.264] VirtualProtect (in: lpAddress=0x22c2cec, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.265] VirtualProtect (in: lpAddress=0x22c2cec, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.265] VirtualProtect (in: lpAddress=0x22c2d44, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.265] VirtualProtect (in: lpAddress=0x22c2d44, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.265] VirtualProtect (in: lpAddress=0x22c2d90, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.266] VirtualProtect (in: lpAddress=0x22c2d90, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.266] VirtualProtect (in: lpAddress=0x22c2dc8, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.266] VirtualProtect (in: lpAddress=0x22c2dc8, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.267] VirtualProtect (in: lpAddress=0x22c2dd8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.267] VirtualProtect (in: lpAddress=0x22c2dd8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.267] VirtualProtect (in: lpAddress=0x22c2df0, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.268] VirtualProtect (in: lpAddress=0x22c2df0, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.268] VirtualProtect (in: lpAddress=0x22c2e00, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.268] VirtualProtect (in: lpAddress=0x22c2e00, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.268] VirtualProtect (in: lpAddress=0x22c2e14, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.269] VirtualProtect (in: lpAddress=0x22c2e14, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.269] VirtualProtect (in: lpAddress=0x22c2e30, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.269] VirtualProtect (in: lpAddress=0x22c2e30, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.270] VirtualProtect (in: lpAddress=0x22c2e44, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.270] VirtualProtect (in: lpAddress=0x22c2e44, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.270] VirtualProtect (in: lpAddress=0x22c2e5c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.270] VirtualProtect (in: lpAddress=0x22c2e5c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.271] VirtualProtect (in: lpAddress=0x22c2e7c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.271] VirtualProtect (in: lpAddress=0x22c2e7c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.271] VirtualProtect (in: lpAddress=0x22c2e90, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.272] VirtualProtect (in: lpAddress=0x22c2e90, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.272] VirtualProtect (in: lpAddress=0x22c2eb0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.272] VirtualProtect (in: lpAddress=0x22c2eb0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.272] VirtualProtect (in: lpAddress=0x22c2ec4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.273] VirtualProtect (in: lpAddress=0x22c2ec4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.273] VirtualProtect (in: lpAddress=0x22c2ed8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.273] VirtualProtect (in: lpAddress=0x22c2ed8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.274] VirtualProtect (in: lpAddress=0x22c2eec, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.274] VirtualProtect (in: lpAddress=0x22c2eec, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.274] VirtualProtect (in: lpAddress=0x22c2f00, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.274] VirtualProtect (in: lpAddress=0x22c2f00, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.275] VirtualProtect (in: lpAddress=0x22c2f14, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.275] VirtualProtect (in: lpAddress=0x22c2f14, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.275] VirtualProtect (in: lpAddress=0x22c2f30, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.276] VirtualProtect (in: lpAddress=0x22c2f30, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.276] VirtualProtect (in: lpAddress=0x22c2f48, dwSize=0xc, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.276] VirtualProtect (in: lpAddress=0x22c2f48, dwSize=0xc, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.276] VirtualProtect (in: lpAddress=0x22c2f5c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.277] VirtualProtect (in: lpAddress=0x22c2f5c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.277] VirtualProtect (in: lpAddress=0x22c2f70, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.277] VirtualProtect (in: lpAddress=0x22c2f70, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.277] VirtualProtect (in: lpAddress=0x22c2f8c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.278] VirtualProtect (in: lpAddress=0x22c2f8c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.278] VirtualProtect (in: lpAddress=0x22c2fac, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.278] VirtualProtect (in: lpAddress=0x22c2fac, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0054.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=11, lpMultiByteStr=0x19e058, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandlesU\x82\r\x02\x9dÄPtðù\x9fsHç\x19", lpUsedDefaultChar=0x0) returned 11 [0054.287] GetProcAddress (hModule=0x76750000, lpProcName="CloseHandle") returned 0x767beab0 [0054.297] CloseHandle (hObject=0xe8) returned 1 [0054.500] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x19e950, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0054.518] IsAppThemed () returned 0x1 [0054.520] CoTaskMemAlloc (cb=0xf0) returned 0x6dc630 [0054.521] CreateActCtxA (pActCtx=0x19eea0) returned 0x71a3a4 [0054.602] CoTaskMemFree (pv=0x6dc630) [0054.614] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc151 [0054.614] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc197 [0054.834] GetUserObjectInformationA (in: hObj=0x12c, nIndex=1, pvInfo=0x24ffe10, nLength=0xc, lpnLengthNeeded=0x19eea4 | out: pvInfo=0x24ffe10, lpnLengthNeeded=0x19eea4) returned 1 [0054.848] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x0 [0054.848] LoadLibraryW (lpLibFileName="shell32.dll") returned 0x74e50000 [0059.497] GetCurrentActCtx (in: lphActCtx=0x19ee98 | out: lphActCtx=0x19ee98*=0x0) returned 1 [0059.498] ActivateActCtx (in: hActCtx=0x71a3a4, lpCookie=0x19eea8 | out: hActCtx=0x71a3a4, lpCookie=0x19eea8) returned 1 [0059.499] GetCurrentProcess () returned 0xffffffff [0059.500] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x19ee98, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x19ee98*=0x370) returned 1 [0059.515] OleInitialize (pvReserved=0x0) returned 0x1 [0059.516] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x19ee60 | out: lplpMessageFilter=0x19ee60*=0x0) returned 0x0 [0059.525] GetCurrentThreadId () returned 0xb0 [0059.534] EnumThreadWindows (dwThreadId=0xb0, lpfn=0x2264a86, lParam=0x0) returned 1 [0059.534] GetActiveWindow () returned 0x0 [0059.539] MessageBoxW (hWnd=0x0, lpText="This assembly is protected by an unregistered version of Eziriz's \".NET Reactor\"!", lpCaption="", uType=0x0) returned 1 [0063.276] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1ab40001) returned 1 [0063.276] SendMessageW (hWnd=0x0, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0063.334] GetUserNameW (in: lpBuffer=0x19ece0, pcbBuffer=0x19ef58 | out: lpBuffer="FD1HVy", pcbBuffer=0x19ef58) returned 1 [0063.337] GetComputerNameW (in: lpBuffer=0x19ece0, nSize=0x19ef58 | out: lpBuffer="NQDPDE", nSize=0x19ef58) returned 1 [0064.001] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\DRV.exe.config", nBufferLength=0x105, lpBuffer=0x19e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\DRV.exe.config", lpFilePart=0x0) returned 0x26 [0064.002] CoTaskMemAlloc (cb=0x20c) returned 0x7003c0 [0064.003] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7003c0, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\DRV.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\drv.exe")) returned 0x1f [0064.003] CoTaskMemFree (pv=0x7003c0) [0064.003] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\DRV.exe", nBufferLength=0x105, lpBuffer=0x19e7e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\DRV.exe", lpFilePart=0x0) returned 0x1f [0064.610] GetCurrentProcess () returned 0xffffffff [0064.610] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eb28 | out: TokenHandle=0x19eb28*=0x410) returned 1 [0064.614] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x19e5b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0064.615] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19eb20 | out: lpFileInformation=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0064.616] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0064.616] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19eb28 | out: lpFileInformation=0x19eb28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0064.617] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x19e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0064.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea60) returned 1 [0064.617] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x42c [0064.618] GetFileType (hFile=0x42c) returned 0x1 [0064.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea5c) returned 1 [0064.618] GetFileType (hFile=0x42c) returned 0x1 [0064.692] GetFileSize (in: hFile=0x42c, lpFileSizeHigh=0x19eb1c | out: lpFileSizeHigh=0x19eb1c*=0x0) returned 0x8c8f [0064.693] ReadFile (in: hFile=0x42c, lpBuffer=0x2508490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ead8, lpOverlapped=0x0 | out: lpBuffer=0x2508490*, lpNumberOfBytesRead=0x19ead8*=0x1000, lpOverlapped=0x0) returned 1 [0064.708] ReadFile (in: hFile=0x42c, lpBuffer=0x2508490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e984, lpOverlapped=0x0 | out: lpBuffer=0x2508490*, lpNumberOfBytesRead=0x19e984*=0x1000, lpOverlapped=0x0) returned 1 [0064.709] ReadFile (in: hFile=0x42c, lpBuffer=0x2508490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e838, lpOverlapped=0x0 | out: lpBuffer=0x2508490*, lpNumberOfBytesRead=0x19e838*=0x1000, lpOverlapped=0x0) returned 1 [0064.710] ReadFile (in: hFile=0x42c, lpBuffer=0x2508490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e838, lpOverlapped=0x0 | out: lpBuffer=0x2508490*, lpNumberOfBytesRead=0x19e838*=0x1000, lpOverlapped=0x0) returned 1 [0064.710] ReadFile (in: hFile=0x42c, lpBuffer=0x2508490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e838, lpOverlapped=0x0 | out: lpBuffer=0x2508490*, lpNumberOfBytesRead=0x19e838*=0x1000, lpOverlapped=0x0) returned 1 [0064.711] ReadFile (in: hFile=0x42c, lpBuffer=0x2508490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e770, lpOverlapped=0x0 | out: lpBuffer=0x2508490*, lpNumberOfBytesRead=0x19e770*=0x1000, lpOverlapped=0x0) returned 1 [0064.714] ReadFile (in: hFile=0x42c, lpBuffer=0x2508490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e8f4, lpOverlapped=0x0 | out: lpBuffer=0x2508490*, lpNumberOfBytesRead=0x19e8f4*=0x1000, lpOverlapped=0x0) returned 1 [0064.715] ReadFile (in: hFile=0x42c, lpBuffer=0x2508490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e800, lpOverlapped=0x0 | out: lpBuffer=0x2508490*, lpNumberOfBytesRead=0x19e800*=0x1000, lpOverlapped=0x0) returned 1 [0064.715] ReadFile (in: hFile=0x42c, lpBuffer=0x2508490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e800, lpOverlapped=0x0 | out: lpBuffer=0x2508490*, lpNumberOfBytesRead=0x19e800*=0xc8f, lpOverlapped=0x0) returned 1 [0064.715] ReadFile (in: hFile=0x42c, lpBuffer=0x2508490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e8c4, lpOverlapped=0x0 | out: lpBuffer=0x2508490*, lpNumberOfBytesRead=0x19e8c4*=0x0, lpOverlapped=0x0) returned 1 [0064.715] CloseHandle (hObject=0x42c) returned 1 [0064.716] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\DRV.exe.config", nBufferLength=0x105, lpBuffer=0x19e7bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\DRV.exe.config", lpFilePart=0x0) returned 0x26 [0064.716] CoTaskMemAlloc (cb=0x20c) returned 0x7061d8 [0064.716] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7061d8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\DRV.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\drv.exe")) returned 0x1f [0064.716] CoTaskMemFree (pv=0x7061d8) [0064.716] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\DRV.exe", nBufferLength=0x105, lpBuffer=0x19e7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\DRV.exe", lpFilePart=0x0) returned 0x1f [0064.717] GetCurrentProcess () returned 0xffffffff [0064.717] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ec70 | out: TokenHandle=0x19ec70*=0x42c) returned 1 [0064.718] GetCurrentProcess () returned 0xffffffff [0064.718] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ec70 | out: TokenHandle=0x19ec70*=0x430) returned 1 [0064.718] GetCurrentProcess () returned 0xffffffff [0064.718] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eb28 | out: TokenHandle=0x19eb28*=0x420) returned 1 [0064.719] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\DRV.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\drv.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19eb20 | out: lpFileInformation=0x19eb20*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0064.719] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\DRV.exe.config", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\DRV.exe.config", lpFilePart=0x0) returned 0x26 [0064.719] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\DRV.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\drv.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19eb28 | out: lpFileInformation=0x19eb28*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0064.719] GetCurrentProcess () returned 0xffffffff [0064.719] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ec70 | out: TokenHandle=0x19ec70*=0x424) returned 1 [0064.720] GetCurrentProcess () returned 0xffffffff [0064.720] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ec70 | out: TokenHandle=0x19ec70*=0x428) returned 1 [0064.754] GetCurrentProcess () returned 0xffffffff [0064.754] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ead0 | out: TokenHandle=0x19ead0*=0x434) returned 1 [0064.759] GetCurrentProcess () returned 0xffffffff [0064.759] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eae0 | out: TokenHandle=0x19eae0*=0x438) returned 1 [0064.767] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0064.769] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x6f550000 [0065.403] AdjustWindowRectEx (in: lpRect=0x19ef00, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x19ef00) returned 1 [0065.408] GetCurrentActCtx (in: lphActCtx=0x19ed74 | out: lphActCtx=0x19ed74*=0x0) returned 1 [0065.408] ActivateActCtx (in: hActCtx=0x71a3a4, lpCookie=0x19ed84 | out: hActCtx=0x71a3a4, lpCookie=0x19ed84) returned 1 [0065.408] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x709d0000 [0065.409] GetModuleHandleW (lpModuleName="user32.dll") returned 0x76240000 [0065.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x19ec38, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcWßp\x9dÄPtðù\x9fs°ò\x19", lpUsedDefaultChar=0x0) returned 14 [0065.409] GetProcAddress (hModule=0x76240000, lpProcName="DefWindowProcW") returned 0x742a0140 [0065.410] GetStockObject (i=5) returned 0x900015 [0065.413] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0065.415] CoTaskMemAlloc (cb=0x5c) returned 0x6da1f8 [0065.415] RegisterClassW (lpWndClass=0x19ec28) returned 0xc199 [0065.415] CoTaskMemFree (pv=0x6da1f8) [0065.416] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0065.416] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r10_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x301d2 [0065.417] SetWindowLongW (hWnd=0x301d2, nIndex=-4, dwNewLong=1948909888) returned 36063918 [0065.417] GetWindowLongW (hWnd=0x301d2, nIndex=-4) returned 1948909888 [0065.420] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e448 | out: phkResult=0x19e448*=0x440) returned 0x0 [0065.421] RegQueryValueExW (in: hKey=0x440, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x19e468, lpData=0x0, lpcbData=0x19e464*=0x0 | out: lpType=0x19e468*=0x0, lpData=0x0, lpcbData=0x19e464*=0x0) returned 0x2 [0065.421] RegQueryValueExW (in: hKey=0x440, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x19e468, lpData=0x0, lpcbData=0x19e464*=0x0 | out: lpType=0x19e468*=0x0, lpData=0x0, lpcbData=0x19e464*=0x0) returned 0x2 [0065.421] RegCloseKey (hKey=0x440) returned 0x0 [0065.422] SetWindowLongW (hWnd=0x301d2, nIndex=-4, dwNewLong=36063958) returned 1948909888 [0065.422] GetWindowLongW (hWnd=0x301d2, nIndex=-4) returned 36063958 [0065.422] GetWindowLongW (hWnd=0x301d2, nIndex=-16) returned 113311744 [0065.422] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc19a [0065.423] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc19b [0065.423] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x301d2, Msg=0x81, wParam=0x0, lParam=0x19e798) returned 0x1 [0065.424] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x301d2, Msg=0x83, wParam=0x0, lParam=0x19e784) returned 0x0 [0065.424] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x301d2, Msg=0x1, wParam=0x0, lParam=0x19e798) returned 0x0 [0065.424] GetClientRect (in: hWnd=0x301d2, lpRect=0x19e480 | out: lpRect=0x19e480) returned 1 [0065.424] GetWindowRect (in: hWnd=0x301d2, lpRect=0x19e480 | out: lpRect=0x19e480) returned 1 [0065.426] GetParent (hWnd=0x301d2) returned 0x0 [0065.426] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1ab40004) returned 1 [0065.506] EtwEventRegister (in: ProviderId=0x2524b60, EnableCallback=0x2264afe, CallbackContext=0x0, RegHandle=0x2524b3c | out: RegHandle=0x2524b3c) returned 0x0 [0065.586] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6f550000 [0065.586] AdjustWindowRectEx (in: lpRect=0x19eec8, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19eec8) returned 1 [0065.586] GetSystemMetrics (nIndex=59) returned 1460 [0065.586] GetSystemMetrics (nIndex=60) returned 920 [0065.586] GetSystemMetrics (nIndex=34) returned 136 [0065.586] GetSystemMetrics (nIndex=35) returned 39 [0065.587] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6f550000 [0065.587] AdjustWindowRectEx (in: lpRect=0x19edc8, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19edc8) returned 1 [0065.595] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\DRV.exe.config", nBufferLength=0x105, lpBuffer=0x19e7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\DRV.exe.config", lpFilePart=0x0) returned 0x26 [0065.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec5c) returned 1 [0065.595] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\DRV.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\drv.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19ecd8 | out: lpFileInformation=0x19ecd8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0065.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec58) returned 1 [0066.270] GetSystemMetrics (nIndex=11) returned 32 [0066.270] GetSystemMetrics (nIndex=12) returned 32 [0066.271] GetDC (hWnd=0x0) returned 0x60100ce [0066.274] GetDeviceCaps (hdc=0x60100ce, index=12) returned 32 [0066.274] GetDeviceCaps (hdc=0x60100ce, index=14) returned 1 [0066.274] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0066.275] CreateIconFromResourceEx (presbits=0x254b424, dwResSize=0x10a8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0xb02a7 [0066.340] CreateCompatibleDC (hdc=0x0) returned 0x600107c8 [0066.342] GetSystemDefaultLCID () returned 0x409 [0066.343] GetStockObject (i=17) returned 0xa01c1 [0066.344] GetObjectW (in: h=0xa01c1, c=92, pv=0x19ec1c | out: pv=0x19ec1c) returned 92 [0066.344] GetDC (hWnd=0x0) returned 0x60100ce [0066.401] GdiplusStartup (in: token=0x1f45b08, input=0x19e1d0, output=0x19e220 | out: token=0x1f45b08, output=0x19e220) returned 0x0 [0066.408] CoTaskMemAlloc (cb=0x5c) returned 0x6da2c8 [0066.409] GdipCreateFontFromLogfontW (hdc=0x60100ce, logfont=0x6da2c8, font=0x19ece4) returned 0x0 [0066.915] CoTaskMemFree (pv=0x6da2c8) [0066.915] CoTaskMemAlloc (cb=0x5c) returned 0x6da0c0 [0066.916] CoTaskMemFree (pv=0x6da0c0) [0066.916] CoTaskMemAlloc (cb=0x5c) returned 0x6da4d0 [0066.916] CoTaskMemFree (pv=0x6da4d0) [0066.916] GdipGetFontUnit (font=0x6bb1f08, unit=0x19ecac) returned 0x0 [0066.919] GdipGetFontSize (font=0x6bb1f08, size=0x19ecb0) returned 0x0 [0066.919] GdipGetFontStyle (font=0x6bb1f08, style=0x19eca8) returned 0x0 [0066.920] GdipGetFamily (font=0x6bb1f08, family=0x19eca4) returned 0x0 [0066.920] GdipGetFontSize (font=0x6bb1f08, size=0x254ef98) returned 0x0 [0066.920] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0066.920] GetDC (hWnd=0x0) returned 0x17010523 [0066.920] GdipCreateFromHDC (hdc=0x17010523, graphics=0x19ecc0) returned 0x0 [0066.926] GdipGetDpiY (graphics=0x7dcf260, dpi=0x254f074) returned 0x0 [0066.926] GdipGetFontHeight (font=0x6bb1f08, graphics=0x7dcf260, height=0x19ecb8) returned 0x0 [0066.926] GdipGetEmHeight (family=0x6bb8ee0, style=0, EmHeight=0x19ecc0) returned 0x0 [0066.926] GdipGetLineSpacing (family=0x6bb8ee0, style=0, LineSpacing=0x19ecc0) returned 0x0 [0066.927] GdipDeleteGraphics (graphics=0x7dcf260) returned 0x0 [0066.927] ReleaseDC (hWnd=0x0, hDC=0x17010523) returned 1 [0066.927] GdipCreateFont (fontFamily=0x6bb8ee0, emSize=0x41040000, style=0, unit=0x3, font=0x254f090) returned 0x0 [0066.927] GdipGetFontSize (font=0x6bbef48, size=0x254f094) returned 0x0 [0066.927] GdipDeleteFont (font=0x6bb1f08) returned 0x0 [0066.928] GetDC (hWnd=0x0) returned 0x17010523 [0066.928] GdipCreateFromHDC (hdc=0x17010523, graphics=0x19ecf4) returned 0x0 [0066.928] CoTaskMemAlloc (cb=0x5c) returned 0x6da2c8 [0066.929] GdipGetLogFontW (font=0x6bbef48, graphics=0x7dcf260, logfontW=0x6da2c8) returned 0x0 [0066.933] CoTaskMemFree (pv=0x6da2c8) [0066.933] CoTaskMemAlloc (cb=0x5c) returned 0x6da1f8 [0066.933] CoTaskMemFree (pv=0x6da1f8) [0066.933] CoTaskMemAlloc (cb=0x5c) returned 0x6da058 [0066.933] CoTaskMemFree (pv=0x6da058) [0066.933] GdipDeleteGraphics (graphics=0x7dcf260) returned 0x0 [0066.933] ReleaseDC (hWnd=0x0, hDC=0x17010523) returned 1 [0066.934] CoTaskMemAlloc (cb=0x5c) returned 0x6da4d0 [0066.934] CreateFontIndirectW (lplf=0x6da4d0) returned 0x460a07c4 [0066.934] CoTaskMemFree (pv=0x6da4d0) [0066.934] SelectObject (hdc=0x600107c8, h=0x460a07c4) returned 0x8a01c2 [0066.935] GetTextMetricsW (in: hdc=0x600107c8, lptm=0x19ee00 | out: lptm=0x19ee00) returned 1 [0066.942] GetTextExtentPoint32W (in: hdc=0x600107c8, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x254f2bc | out: psizl=0x254f2bc) returned 1 [0066.943] SelectObject (hdc=0x600107c8, h=0x8a01c2) returned 0x460a07c4 [0066.944] DeleteDC (hdc=0x600107c8) returned 1 [0066.944] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6f550000 [0066.944] AdjustWindowRectEx (in: lpRect=0x19eb68, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19eb68) returned 1 [0066.944] AdjustWindowRectEx (in: lpRect=0x19ed8c, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19ed8c) returned 1 [0066.945] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6f550000 [0066.945] AdjustWindowRectEx (in: lpRect=0x19eae0, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19eae0) returned 1 [0066.945] AdjustWindowRectEx (in: lpRect=0x19ebc4, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19ebc4) returned 1 [0066.946] GetSystemMetrics (nIndex=34) returned 136 [0066.946] GetSystemMetrics (nIndex=35) returned 39 [0066.950] GetCurrentActCtx (in: lphActCtx=0x19ef14 | out: lphActCtx=0x19ef14*=0x0) returned 1 [0066.950] ActivateActCtx (in: hActCtx=0x71a3a4, lpCookie=0x19ef24 | out: hActCtx=0x71a3a4, lpCookie=0x19ef24) returned 1 [0066.951] GetCurrentActCtx (in: lphActCtx=0x19ed34 | out: lphActCtx=0x19ed34*=0x71a3a4) returned 1 [0066.951] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x709d0000 [0066.951] AdjustWindowRectEx (in: lpRect=0x19ec94, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19ec94) returned 1 [0066.951] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0066.951] CreateWindowExW (dwExStyle=0x50000, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r10_ad1", lpWindowName="Lasan", dwStyle=0x2cf0000, X=-2147483648, Y=-2147483648, nWidth=185, nHeight=79, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x402b8 [0066.952] SetWindowLongW (hWnd=0x402b8, nIndex=-4, dwNewLong=1948909888) returned 36063918 [0066.952] GetWindowLongW (hWnd=0x402b8, nIndex=-4) returned 1948909888 [0066.952] SetWindowLongW (hWnd=0x402b8, nIndex=-4, dwNewLong=36064038) returned 1948909888 [0066.952] GetWindowLongW (hWnd=0x402b8, nIndex=-4) returned 36064038 [0066.952] GetWindowLongW (hWnd=0x402b8, nIndex=-16) returned 114229248 [0066.952] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0x81, wParam=0x0, lParam=0x19e758) returned 0x1 [0066.955] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0x83, wParam=0x0, lParam=0x19e744) returned 0x0 [0066.956] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0x1, wParam=0x0, lParam=0x19e758) returned 0x0 [0066.956] GetClientRect (in: hWnd=0x402b8, lpRect=0x19e410 | out: lpRect=0x19e410) returned 1 [0066.956] GetWindowRect (in: hWnd=0x402b8, lpRect=0x19e410 | out: lpRect=0x19e410) returned 1 [0066.957] SetWindowTextW (hWnd=0x402b8, lpString="Lasan") returned 1 [0066.957] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0xc, wParam=0x0, lParam=0x254d73c) returned 0x1 [0066.963] GetUserObjectInformationA (in: hObj=0x12c, nIndex=1, pvInfo=0x254fb20, nLength=0xc, lpnLengthNeeded=0x19e308 | out: pvInfo=0x254fb20, lpnLengthNeeded=0x19e308) returned 1 [0066.966] SetConsoleCtrlHandler (HandlerRoutine=0x2264b4e, Add=1) returned 1 [0066.966] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0066.967] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0066.967] GetClassInfoW (in: hInstance=0x400000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWndClass=0x254fb84 | out: lpWndClass=0x254fb84) returned 0 [0066.969] CoTaskMemAlloc (cb=0x58) returned 0x71e080 [0066.969] RegisterClassW (lpWndClass=0x19e258) returned 0xc19d [0066.969] CoTaskMemFree (pv=0x71e080) [0066.970] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x402c8 [0066.972] NtdllDefWindowProc_W (hWnd=0x402c8, Msg=0x83, wParam=0x0, lParam=0x19dd84) returned 0x0 [0066.972] NtdllDefWindowProc_W (hWnd=0x402c8, Msg=0x1, wParam=0x0, lParam=0x19dd98) returned 0x0 [0066.972] NtdllDefWindowProc_W (hWnd=0x402c8, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0066.972] NtdllDefWindowProc_W (hWnd=0x402c8, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0066.975] GetStartupInfoW (in: lpStartupInfo=0x254fe7c | out: lpStartupInfo=0x254fe7c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\DRV.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0066.977] GetParent (hWnd=0x402b8) returned 0x0 [0066.977] SetWindowLongW (hWnd=0x402b8, nIndex=-8, dwNewLong=0) returned 0 [0066.978] GetSystemMetrics (nIndex=49) returned 16 [0066.978] GetSystemMetrics (nIndex=50) returned 16 [0066.979] CreateIconFromResourceEx (presbits=0x254fefc, dwResSize=0x468, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x60235 [0066.980] SendMessageW (hWnd=0x402b8, Msg=0x80, wParam=0x0, lParam=0x60235) returned 0x0 [0066.980] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0x80, wParam=0x0, lParam=0x60235) returned 0x0 [0066.981] SendMessageW (hWnd=0x402b8, Msg=0x80, wParam=0x1, lParam=0xb02a7) returned 0x0 [0066.981] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0x80, wParam=0x1, lParam=0xb02a7) returned 0x0 [0066.982] GetSystemMenu (hWnd=0x402b8, bRevert=0) returned 0x701ef [0066.985] GetWindowPlacement (in: hWnd=0x402b8, lpwndpl=0x19ed44 | out: lpwndpl=0x19ed44) returned 1 [0066.985] EnableMenuItem (hMenu=0x701ef, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0066.985] EnableMenuItem (hMenu=0x701ef, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0066.985] EnableMenuItem (hMenu=0x701ef, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0066.985] EnableMenuItem (hMenu=0x701ef, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0066.985] EnableMenuItem (hMenu=0x701ef, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0066.985] GetClientRect (in: hWnd=0x402b8, lpRect=0x19ed88 | out: lpRect=0x19ed88) returned 1 [0066.985] GetClientRect (in: hWnd=0x402b8, lpRect=0x19ece8 | out: lpRect=0x19ece8) returned 1 [0066.985] GetWindowRect (in: hWnd=0x402b8, lpRect=0x19ece8 | out: lpRect=0x19ece8) returned 1 [0066.986] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x709d0000 [0066.986] GetWindowLongW (hWnd=0x402b8, nIndex=-16) returned 114229248 [0066.986] GetWindowTextLengthW (hWnd=0x402b8) returned 5 [0066.986] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0066.986] GetSystemMetrics (nIndex=42) returned 0 [0066.987] GetWindowTextW (in: hWnd=0x402b8, lpString=0x19ec8c, nMaxCount=6 | out: lpString="Lasan") returned 5 [0066.987] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0xd, wParam=0x6, lParam=0x19ec8c) returned 0x5 [0066.987] GetWindowTextLengthW (hWnd=0x402b8) returned 5 [0066.987] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0066.987] GetSystemMetrics (nIndex=42) returned 0 [0066.987] GetWindowTextW (in: hWnd=0x402b8, lpString=0x19ec8c, nMaxCount=6 | out: lpString="Lasan") returned 5 [0066.987] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0xd, wParam=0x6, lParam=0x19ec8c) returned 0x5 [0066.987] GetWindowLongW (hWnd=0x402b8, nIndex=-16) returned 114229248 [0066.987] GetWindowLongW (hWnd=0x402b8, nIndex=-20) returned 327936 [0066.987] SetWindowLongW (hWnd=0x402b8, nIndex=-16, dwNewLong=47120384) returned 114229248 [0066.987] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0x7c, wParam=0xfffffff0, lParam=0x19ece4) returned 0x0 [0066.988] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0x7d, wParam=0xfffffff0, lParam=0x19ece4) returned 0x0 [0066.988] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x60235 [0066.988] SetWindowLongW (hWnd=0x402b8, nIndex=-20, dwNewLong=327680) returned 327936 [0066.989] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0x7c, wParam=0xffffffec, lParam=0x19ece4) returned 0x0 [0066.989] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0x7d, wParam=0xffffffec, lParam=0x19ece4) returned 0x0 [0066.989] SetWindowPos (hWnd=0x402b8, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0066.990] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0x46, wParam=0x0, lParam=0x19ecfc) returned 0x0 [0066.990] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0x83, wParam=0x1, lParam=0x19ecd4) returned 0x0 [0066.991] GetWindowPlacement (in: hWnd=0x402b8, lpwndpl=0x19ea28 | out: lpwndpl=0x19ea28) returned 1 [0066.991] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0x47, wParam=0x0, lParam=0x19ecfc) returned 0x0 [0066.991] GetClientRect (in: hWnd=0x402b8, lpRect=0x19e9d8 | out: lpRect=0x19e9d8) returned 1 [0066.991] GetWindowRect (in: hWnd=0x402b8, lpRect=0x19e9d8 | out: lpRect=0x19e9d8) returned 1 [0066.992] RedrawWindow (hWnd=0x402b8, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0066.992] GetSystemMenu (hWnd=0x402b8, bRevert=0) returned 0x701ef [0066.992] GetWindowPlacement (in: hWnd=0x402b8, lpwndpl=0x19ed34 | out: lpwndpl=0x19ed34) returned 1 [0066.992] EnableMenuItem (hMenu=0x701ef, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0066.992] EnableMenuItem (hMenu=0x701ef, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0066.992] EnableMenuItem (hMenu=0x701ef, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0066.992] EnableMenuItem (hMenu=0x701ef, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0066.992] EnableMenuItem (hMenu=0x701ef, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0066.993] ShowWindow (hWnd=0x402b8, nCmdShow=5) returned 0 [0066.993] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0066.993] GetWindowTextLengthW (hWnd=0x402b8) returned 5 [0066.993] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0066.993] GetSystemMetrics (nIndex=42) returned 0 [0066.993] GetWindowTextW (in: hWnd=0x402b8, lpString=0x19e930, nMaxCount=6 | out: lpString="Lasan") returned 5 [0066.993] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0xd, wParam=0x6, lParam=0x19e930) returned 0x5 [0067.126] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x709d0000 [0067.127] GetWindowLongW (hWnd=0x402b8, nIndex=-16) returned 114229248 [0067.127] GetWindowTextLengthW (hWnd=0x402b8) returned 5 [0067.127] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0067.127] GetSystemMetrics (nIndex=42) returned 0 [0067.127] GetWindowTextW (in: hWnd=0x402b8, lpString=0x19e7f0, nMaxCount=6 | out: lpString="Lasan") returned 5 [0067.127] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0xd, wParam=0x6, lParam=0x19e7f0) returned 0x5 [0067.127] GetWindowTextLengthW (hWnd=0x402b8) returned 5 [0067.127] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0067.127] GetSystemMetrics (nIndex=42) returned 0 [0067.127] GetWindowTextW (in: hWnd=0x402b8, lpString=0x19e7f0, nMaxCount=6 | out: lpString="Lasan") returned 5 [0067.127] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0xd, wParam=0x6, lParam=0x19e7f0) returned 0x5 [0067.127] GetWindowLongW (hWnd=0x402b8, nIndex=-16) returned 114229248 [0067.127] GetWindowLongW (hWnd=0x402b8, nIndex=-20) returned 327936 [0067.127] SetWindowLongW (hWnd=0x402b8, nIndex=-16, dwNewLong=315555840) returned 114229248 [0067.127] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0x7c, wParam=0xfffffff0, lParam=0x19e84c) returned 0x0 [0067.133] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0x7d, wParam=0xfffffff0, lParam=0x19e84c) returned 0x0 [0067.134] SetWindowLongW (hWnd=0x402b8, nIndex=-20, dwNewLong=851968) returned 327936 [0067.134] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0x7c, wParam=0xffffffec, lParam=0x19e84c) returned 0x0 [0067.134] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0x7d, wParam=0xffffffec, lParam=0x19e84c) returned 0x0 [0067.135] SetWindowPos (hWnd=0x402b8, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0067.135] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0x46, wParam=0x0, lParam=0x19e864) returned 0x0 [0067.135] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0x83, wParam=0x1, lParam=0x19e83c) returned 0x0 [0067.136] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0x85, wParam=0x490407cc, lParam=0x0) returned 0x0 [0067.137] GetWindowPlacement (in: hWnd=0x402b8, lpwndpl=0x19e5ac | out: lpwndpl=0x19e5ac) returned 1 [0067.137] GetClientRect (in: hWnd=0x402b8, lpRect=0x19e558 | out: lpRect=0x19e558) returned 1 [0067.137] GetWindowTextLengthW (hWnd=0x402b8) returned 5 [0067.138] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0067.138] GetSystemMetrics (nIndex=42) returned 0 [0067.138] GetWindowTextW (in: hWnd=0x402b8, lpString=0x19e424, nMaxCount=6 | out: lpString="Lasan") returned 5 [0067.138] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0xd, wParam=0x6, lParam=0x19e424) returned 0x5 [0067.139] GetClientRect (in: hWnd=0x402b8, lpRect=0x19e460 | out: lpRect=0x19e460) returned 1 [0067.140] GetSysColor (nIndex=10) returned 0xb4b4b4 [0067.140] GetSysColor (nIndex=2) returned 0xd1b499 [0067.140] GetSysColor (nIndex=9) returned 0x0 [0067.140] GetSysColor (nIndex=12) returned 0xababab [0067.140] GetSysColor (nIndex=15) returned 0xf0f0f0 [0067.140] GetSysColor (nIndex=20) returned 0xffffff [0067.140] GetSysColor (nIndex=16) returned 0xa0a0a0 [0067.140] GetSysColor (nIndex=15) returned 0xf0f0f0 [0067.140] GetSysColor (nIndex=16) returned 0xa0a0a0 [0067.140] GetSysColor (nIndex=21) returned 0x696969 [0067.140] GetSysColor (nIndex=22) returned 0xe3e3e3 [0067.140] GetSysColor (nIndex=20) returned 0xffffff [0067.140] GetSysColor (nIndex=18) returned 0x0 [0067.140] GetSysColor (nIndex=1) returned 0x0 [0067.140] GetSysColor (nIndex=27) returned 0xead1b9 [0067.140] GetSysColor (nIndex=28) returned 0xf2e4d7 [0067.140] GetSysColor (nIndex=17) returned 0x6d6d6d [0067.140] GetSysColor (nIndex=13) returned 0xd77800 [0067.141] GetSysColor (nIndex=14) returned 0xffffff [0067.141] GetSysColor (nIndex=26) returned 0xcc6600 [0067.141] GetSysColor (nIndex=11) returned 0xfcf7f4 [0067.141] GetSysColor (nIndex=3) returned 0xdbcdbf [0067.141] GetSysColor (nIndex=19) returned 0x0 [0067.141] GetSysColor (nIndex=24) returned 0xe1ffff [0067.141] GetSysColor (nIndex=23) returned 0x0 [0067.141] GetSysColor (nIndex=4) returned 0xf0f0f0 [0067.141] GetSysColor (nIndex=30) returned 0xf0f0f0 [0067.141] GetSysColor (nIndex=29) returned 0xd77800 [0067.141] GetSysColor (nIndex=7) returned 0x0 [0067.141] GetSysColor (nIndex=0) returned 0xc8c8c8 [0067.141] GetSysColor (nIndex=5) returned 0xffffff [0067.141] GetSysColor (nIndex=6) returned 0x646464 [0067.141] GetSysColor (nIndex=8) returned 0x0 [0067.142] GetSystemMetrics (nIndex=80) returned 1 [0067.150] EnumDisplayMonitors (hdc=0x0, lprcClip=0x0, lpfnEnum=0x2264b9e, dwData=0x0) returned 1 [0067.154] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19e0c0 | out: lpmi=0x19e0c0) returned 1 [0067.155] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x3a0101a9 [0067.155] GetDeviceCaps (hdc=0x3a0101a9, index=12) returned 32 [0067.155] GetDeviceCaps (hdc=0x3a0101a9, index=14) returned 1 [0067.155] DeleteDC (hdc=0x3a0101a9) returned 1 [0067.156] GetCurrentObject (hdc=0x60100ce, type=0x1) returned 0xb00017 [0067.156] GetCurrentObject (hdc=0x60100ce, type=0x2) returned 0x900010 [0067.156] GetCurrentObject (hdc=0x60100ce, type=0x7) returned 0x4a0507b2 [0067.156] GetCurrentObject (hdc=0x60100ce, type=0x6) returned 0x8a01c2 [0067.156] SaveDC (hdc=0x60100ce) returned 1 [0067.157] GetNearestColor (hdc=0x60100ce, color=0xf0f0f0) returned 0xf0f0f0 [0067.157] CreateSolidBrush (color=0xf0f0f0) returned 0x661004fe [0067.158] FillRect (hDC=0x60100ce, lprc=0x19e300, hbr=0x661004fe) returned 1 [0067.158] DeleteObject (ho=0x661004fe) returned 1 [0067.159] RestoreDC (hdc=0x60100ce, nSavedDC=-1) returned 1 [0067.159] GetWindowPlacement (in: hWnd=0x402b8, lpwndpl=0x19e590 | out: lpwndpl=0x19e590) returned 1 [0067.160] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0x47, wParam=0x0, lParam=0x19e864) returned 0x0 [0067.160] GetClientRect (in: hWnd=0x402b8, lpRect=0x19e540 | out: lpRect=0x19e540) returned 1 [0067.160] GetWindowRect (in: hWnd=0x402b8, lpRect=0x19e540 | out: lpRect=0x19e540) returned 1 [0067.160] RedrawWindow (hWnd=0x402b8, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0067.160] GetSystemMenu (hWnd=0x402b8, bRevert=0) returned 0x701ef [0067.160] GetWindowPlacement (in: hWnd=0x402b8, lpwndpl=0x19e898 | out: lpwndpl=0x19e898) returned 1 [0067.160] EnableMenuItem (hMenu=0x701ef, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0067.160] EnableMenuItem (hMenu=0x701ef, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0067.161] EnableMenuItem (hMenu=0x701ef, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0067.161] EnableMenuItem (hMenu=0x701ef, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0067.161] EnableMenuItem (hMenu=0x701ef, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0067.161] SetLayeredWindowAttributes (hwnd=0x402b8, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0067.171] GetCurrentThreadId () returned 0xb0 [0067.171] EnumThreadWindows (dwThreadId=0xb0, lpfn=0x2264bc6, lParam=0x402b8) returned 1 [0067.215] GetWindowLongW (hWnd=0x402c8, nIndex=-8) returned 0 [0067.215] GetWindowLongW (hWnd=0x402b8, nIndex=-8) returned 0 [0067.215] GetWindowLongW (hWnd=0x90080, nIndex=-8) returned 262840 [0067.260] SetWindowLongW (hWnd=0x90080, nIndex=-8, dwNewLong=0) returned 262840 [0067.267] GetFocus () returned 0x0 [0067.267] GetParent (hWnd=0x402b8) returned 0x0 [0067.267] GetWindowLongW (hWnd=0x402b8, nIndex=-20) returned 852224 [0067.267] DestroyWindow (hWnd=0x402b8) returned 1 [0067.267] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0067.268] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0x46, wParam=0x0, lParam=0x19e79c) returned 0x0 [0067.272] GetWindowPlacement (in: hWnd=0x402b8, lpwndpl=0x19e4c8 | out: lpwndpl=0x19e4c8) returned 1 [0067.272] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0x47, wParam=0x0, lParam=0x19e79c) returned 0x0 [0067.272] GetClientRect (in: hWnd=0x402b8, lpRect=0x19e478 | out: lpRect=0x19e478) returned 1 [0067.272] GetWindowRect (in: hWnd=0x402b8, lpRect=0x19e478 | out: lpRect=0x19e478) returned 1 [0067.272] GetWindowTextLengthW (hWnd=0x402b8) returned 5 [0067.272] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0067.272] GetSystemMetrics (nIndex=42) returned 0 [0067.272] GetWindowTextW (in: hWnd=0x402b8, lpString=0x19e3a8, nMaxCount=6 | out: lpString="Lasan") returned 5 [0067.272] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0xd, wParam=0x6, lParam=0x19e3a8) returned 0x5 [0067.272] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0067.273] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402b8, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0067.275] GetCurrentActCtx (in: lphActCtx=0x19e7fc | out: lphActCtx=0x19e7fc*=0x71a3a4) returned 1 [0067.275] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x709d0000 [0067.276] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0067.276] CreateWindowExW (dwExStyle=0x90000, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r10_ad1", lpWindowName="Lasan", dwStyle=0x2cf0000, X=78, Y=78, nWidth=185, nHeight=79, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x6006e [0067.276] SetWindowLongW (hWnd=0x6006e, nIndex=-4, dwNewLong=1948909888) returned 36063918 [0067.276] GetWindowLongW (hWnd=0x6006e, nIndex=-4) returned 1948909888 [0067.276] SetWindowLongW (hWnd=0x6006e, nIndex=-4, dwNewLong=36064238) returned 1948909888 [0067.277] GetWindowLongW (hWnd=0x6006e, nIndex=-4) returned 36064238 [0067.277] GetWindowLongW (hWnd=0x6006e, nIndex=-16) returned 114229248 [0067.277] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0x81, wParam=0x0, lParam=0x19e220) returned 0x1 [0067.299] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0x83, wParam=0x0, lParam=0x19e20c) returned 0x0 [0067.300] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0x1, wParam=0x0, lParam=0x19e220) returned 0x0 [0067.300] GetClientRect (in: hWnd=0x6006e, lpRect=0x19ded8 | out: lpRect=0x19ded8) returned 1 [0067.300] GetWindowRect (in: hWnd=0x6006e, lpRect=0x19ded8 | out: lpRect=0x19ded8) returned 1 [0067.300] SetWindowTextW (hWnd=0x6006e, lpString="Lasan") returned 1 [0067.300] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0xc, wParam=0x0, lParam=0x25518ec) returned 0x1 [0067.301] SetLayeredWindowAttributes (hwnd=0x6006e, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0067.303] GetStartupInfoW (in: lpStartupInfo=0x2551bbc | out: lpStartupInfo=0x2551bbc*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\DRV.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0067.305] GetParent (hWnd=0x6006e) returned 0x0 [0067.305] GetStockObject (i=5) returned 0x900015 [0067.305] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0067.306] CoTaskMemAlloc (cb=0x5c) returned 0x6da670 [0067.306] RegisterClassW (lpWndClass=0x19e6d8) returned 0xc19e [0067.306] CoTaskMemFree (pv=0x6da670) [0067.306] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0067.306] CreateWindowExW (dwExStyle=0x80, lpClassName="WindowsForms10.Window.0.app.0.141b42a_r10_ad1", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x7006c [0067.306] SetWindowLongW (hWnd=0x7006c, nIndex=-4, dwNewLong=1948909888) returned 36064278 [0067.307] GetWindowLongW (hWnd=0x7006c, nIndex=-4) returned 1948909888 [0067.307] SetWindowLongW (hWnd=0x7006c, nIndex=-4, dwNewLong=36064318) returned 1948909888 [0067.310] GetWindowLongW (hWnd=0x7006c, nIndex=-4) returned 36064318 [0067.311] GetWindowLongW (hWnd=0x7006c, nIndex=-16) returned 79691776 [0067.311] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x7006c, Msg=0x24, wParam=0x0, lParam=0x19e254) returned 0x0 [0067.311] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x7006c, Msg=0x81, wParam=0x0, lParam=0x19e248) returned 0x1 [0067.312] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x7006c, Msg=0x83, wParam=0x0, lParam=0x19e234) returned 0x0 [0067.313] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x7006c, Msg=0x1, wParam=0x0, lParam=0x19e248) returned 0x0 [0067.313] SetWindowLongW (hWnd=0x6006e, nIndex=-8, dwNewLong=458860) returned 0 [0067.315] SendMessageW (hWnd=0x6006e, Msg=0x80, wParam=0x0, lParam=0x60235) returned 0x0 [0067.315] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0x80, wParam=0x0, lParam=0x60235) returned 0x0 [0067.315] SendMessageW (hWnd=0x6006e, Msg=0x80, wParam=0x1, lParam=0xb02a7) returned 0x0 [0067.315] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0x80, wParam=0x1, lParam=0xb02a7) returned 0x0 [0067.316] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x60235 [0067.318] GetSystemMenu (hWnd=0x6006e, bRevert=0) returned 0x801ef [0067.318] GetWindowPlacement (in: hWnd=0x6006e, lpwndpl=0x19e80c | out: lpwndpl=0x19e80c) returned 1 [0067.318] EnableMenuItem (hMenu=0x801ef, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0067.318] EnableMenuItem (hMenu=0x801ef, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0067.318] EnableMenuItem (hMenu=0x801ef, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0067.318] EnableMenuItem (hMenu=0x801ef, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0067.318] EnableMenuItem (hMenu=0x801ef, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0067.318] GetClientRect (in: hWnd=0x6006e, lpRect=0x19e850 | out: lpRect=0x19e850) returned 1 [0067.318] GetClientRect (in: hWnd=0x6006e, lpRect=0x19e7b0 | out: lpRect=0x19e7b0) returned 1 [0067.318] GetWindowRect (in: hWnd=0x6006e, lpRect=0x19e7b0 | out: lpRect=0x19e7b0) returned 1 [0067.319] SetWindowPos (hWnd=0x6006e, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1 [0067.319] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0x46, wParam=0x0, lParam=0x19e71c) returned 0x0 [0067.322] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0067.324] GetWindowPlacement (in: hWnd=0x6006e, lpwndpl=0x19e464 | out: lpwndpl=0x19e464) returned 1 [0067.324] GetClientRect (in: hWnd=0x6006e, lpRect=0x19e410 | out: lpRect=0x19e410) returned 1 [0067.324] GetWindowTextLengthW (hWnd=0x6006e) returned 5 [0067.324] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0067.324] GetSystemMetrics (nIndex=42) returned 0 [0067.324] GetWindowTextW (in: hWnd=0x6006e, lpString=0x19e2dc, nMaxCount=6 | out: lpString="Lasan") returned 5 [0067.324] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0xd, wParam=0x6, lParam=0x19e2dc) returned 0x5 [0067.324] GetClientRect (in: hWnd=0x6006e, lpRect=0x19e318 | out: lpRect=0x19e318) returned 1 [0067.324] GetCurrentObject (hdc=0x60100ce, type=0x1) returned 0xb00017 [0067.324] GetCurrentObject (hdc=0x60100ce, type=0x2) returned 0x900010 [0067.324] GetCurrentObject (hdc=0x60100ce, type=0x7) returned 0x4b0507b2 [0067.324] GetCurrentObject (hdc=0x60100ce, type=0x6) returned 0x8a01c2 [0067.325] SaveDC (hdc=0x60100ce) returned 1 [0067.325] GetNearestColor (hdc=0x60100ce, color=0xf0f0f0) returned 0xf0f0f0 [0067.326] CreateSolidBrush (color=0xf0f0f0) returned 0x671004fe [0067.326] FillRect (hDC=0x60100ce, lprc=0x19e1b8, hbr=0x671004fe) returned 1 [0067.326] DeleteObject (ho=0x671004fe) returned 1 [0067.326] RestoreDC (hdc=0x60100ce, nSavedDC=-1) returned 1 [0067.326] GetWindowPlacement (in: hWnd=0x6006e, lpwndpl=0x19e448 | out: lpwndpl=0x19e448) returned 1 [0067.326] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0x47, wParam=0x0, lParam=0x19e71c) returned 0x0 [0067.326] GetClientRect (in: hWnd=0x6006e, lpRect=0x19e3f8 | out: lpRect=0x19e3f8) returned 1 [0067.326] GetWindowRect (in: hWnd=0x6006e, lpRect=0x19e3f8 | out: lpRect=0x19e3f8) returned 1 [0067.327] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0x83, wParam=0x1, lParam=0x19e234) returned 0x0 [0067.329] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0067.330] GetWindowPlacement (in: hWnd=0x6006e, lpwndpl=0x19dfa4 | out: lpwndpl=0x19dfa4) returned 1 [0067.331] GetClientRect (in: hWnd=0x6006e, lpRect=0x19df50 | out: lpRect=0x19df50) returned 1 [0067.331] GetWindowTextLengthW (hWnd=0x6006e) returned 5 [0067.331] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0067.331] GetSystemMetrics (nIndex=42) returned 0 [0067.331] GetWindowTextW (in: hWnd=0x6006e, lpString=0x19de1c, nMaxCount=6 | out: lpString="Lasan") returned 5 [0067.331] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0xd, wParam=0x6, lParam=0x19de1c) returned 0x5 [0067.331] GetClientRect (in: hWnd=0x6006e, lpRect=0x19de58 | out: lpRect=0x19de58) returned 1 [0067.331] GetCurrentObject (hdc=0x17010523, type=0x1) returned 0xb00017 [0067.331] GetCurrentObject (hdc=0x17010523, type=0x2) returned 0x900010 [0067.331] GetCurrentObject (hdc=0x17010523, type=0x7) returned 0x4b0507b2 [0067.331] GetCurrentObject (hdc=0x17010523, type=0x6) returned 0x8a01c2 [0067.331] SaveDC (hdc=0x17010523) returned 1 [0067.331] GetNearestColor (hdc=0x17010523, color=0xf0f0f0) returned 0xf0f0f0 [0067.331] CreateSolidBrush (color=0xf0f0f0) returned 0x681004fe [0067.331] FillRect (hDC=0x17010523, lprc=0x19dcf8, hbr=0x681004fe) returned 1 [0067.331] DeleteObject (ho=0x681004fe) returned 1 [0067.331] RestoreDC (hdc=0x17010523, nSavedDC=-1) returned 1 [0067.332] SetWindowLongW (hWnd=0x6006e, nIndex=-8, dwNewLong=458860) returned 458860 [0067.333] SendMessageW (hWnd=0x7006c, Msg=0x80, wParam=0x1, lParam=0xb02a7) returned 0x0 [0067.333] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x7006c, Msg=0x80, wParam=0x1, lParam=0xb02a7) returned 0x0 [0067.335] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x709d0000 [0067.335] GetWindowLongW (hWnd=0x6006e, nIndex=-16) returned 382664704 [0067.335] GetWindowTextLengthW (hWnd=0x6006e) returned 5 [0067.335] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0067.335] GetSystemMetrics (nIndex=42) returned 0 [0067.335] GetWindowTextW (in: hWnd=0x6006e, lpString=0x19e754, nMaxCount=6 | out: lpString="Lasan") returned 5 [0067.335] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0xd, wParam=0x6, lParam=0x19e754) returned 0x5 [0067.335] GetWindowTextLengthW (hWnd=0x6006e) returned 5 [0067.335] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0067.335] GetSystemMetrics (nIndex=42) returned 0 [0067.335] GetWindowTextW (in: hWnd=0x6006e, lpString=0x19e754, nMaxCount=6 | out: lpString="Lasan") returned 5 [0067.335] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0xd, wParam=0x6, lParam=0x19e754) returned 0x5 [0067.335] GetWindowLongW (hWnd=0x6006e, nIndex=-16) returned 382664704 [0067.335] GetWindowLongW (hWnd=0x6006e, nIndex=-20) returned 590080 [0067.335] SetWindowLongW (hWnd=0x6006e, nIndex=-16, dwNewLong=315555840) returned 382664704 [0067.335] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0x7c, wParam=0xfffffff0, lParam=0x19e7ac) returned 0x0 [0067.336] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0x7d, wParam=0xfffffff0, lParam=0x19e7ac) returned 0x0 [0067.336] SetWindowLongW (hWnd=0x6006e, nIndex=-20, dwNewLong=589824) returned 590080 [0067.336] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0x7c, wParam=0xffffffec, lParam=0x19e7ac) returned 0x0 [0067.337] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0x7d, wParam=0xffffffec, lParam=0x19e7ac) returned 0x0 [0067.337] SetWindowPos (hWnd=0x6006e, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0067.337] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0x46, wParam=0x0, lParam=0x19e7c4) returned 0x0 [0067.337] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0x83, wParam=0x1, lParam=0x19e79c) returned 0x0 [0067.338] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0067.341] GetWindowPlacement (in: hWnd=0x6006e, lpwndpl=0x19e50c | out: lpwndpl=0x19e50c) returned 1 [0067.342] GetClientRect (in: hWnd=0x6006e, lpRect=0x19e4b8 | out: lpRect=0x19e4b8) returned 1 [0067.342] GetWindowTextLengthW (hWnd=0x6006e) returned 5 [0067.342] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0067.342] GetSystemMetrics (nIndex=42) returned 0 [0067.342] GetWindowTextW (in: hWnd=0x6006e, lpString=0x19e384, nMaxCount=6 | out: lpString="Lasan") returned 5 [0067.342] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0xd, wParam=0x6, lParam=0x19e384) returned 0x5 [0067.342] GetClientRect (in: hWnd=0x6006e, lpRect=0x19e3c0 | out: lpRect=0x19e3c0) returned 1 [0067.342] GetCurrentObject (hdc=0x60100ce, type=0x1) returned 0xb00017 [0067.342] GetCurrentObject (hdc=0x60100ce, type=0x2) returned 0x900010 [0067.342] GetCurrentObject (hdc=0x60100ce, type=0x7) returned 0x4b0507b2 [0067.342] GetCurrentObject (hdc=0x60100ce, type=0x6) returned 0x8a01c2 [0067.342] SaveDC (hdc=0x60100ce) returned 1 [0067.342] GetNearestColor (hdc=0x60100ce, color=0xf0f0f0) returned 0xf0f0f0 [0067.342] CreateSolidBrush (color=0xf0f0f0) returned 0x691004fe [0067.342] FillRect (hDC=0x60100ce, lprc=0x19e260, hbr=0x691004fe) returned 1 [0067.343] DeleteObject (ho=0x691004fe) returned 1 [0067.343] RestoreDC (hdc=0x60100ce, nSavedDC=-1) returned 1 [0067.343] GetWindowPlacement (in: hWnd=0x6006e, lpwndpl=0x19e4f0 | out: lpwndpl=0x19e4f0) returned 1 [0067.343] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0x47, wParam=0x0, lParam=0x19e7c4) returned 0x0 [0067.343] GetClientRect (in: hWnd=0x6006e, lpRect=0x19e4a0 | out: lpRect=0x19e4a0) returned 1 [0067.343] GetWindowRect (in: hWnd=0x6006e, lpRect=0x19e4a0 | out: lpRect=0x19e4a0) returned 1 [0067.344] RedrawWindow (hWnd=0x6006e, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0067.344] GetSystemMenu (hWnd=0x6006e, bRevert=0) returned 0x801ef [0067.344] GetWindowPlacement (in: hWnd=0x6006e, lpwndpl=0x19e7fc | out: lpwndpl=0x19e7fc) returned 1 [0067.344] EnableMenuItem (hMenu=0x801ef, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0067.344] EnableMenuItem (hMenu=0x801ef, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0067.344] EnableMenuItem (hMenu=0x801ef, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0067.344] EnableMenuItem (hMenu=0x801ef, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0067.344] EnableMenuItem (hMenu=0x801ef, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0067.344] SetWindowLongW (hWnd=0x90080, nIndex=-8, dwNewLong=393326) returned 262856 [0067.357] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\SystemConfig.txt", nBufferLength=0x105, lpBuffer=0x19e438, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\SystemConfig.txt", lpFilePart=0x0) returned 0x20 [0067.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e8ec) returned 1 [0067.358] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\SystemConfig.txt" (normalized: "c:\\users\\fd1hvy\\systemconfig.txt"), fInfoLevelId=0x0, lpFileInformation=0x19e968 | out: lpFileInformation=0x19e968*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0067.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e8e8) returned 1 [0067.365] GetProcessWindowStation () returned 0x12c [0067.365] GetActiveWindow () returned 0x0 [0067.365] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x74e50000 [0067.365] GetCurrentActCtx (in: lphActCtx=0x19e8ec | out: lphActCtx=0x19e8ec*=0x71a3a4) returned 1 [0067.365] GetCurrentThreadId () returned 0xb0 [0067.366] EnumThreadWindows (dwThreadId=0xb0, lpfn=0x2264d06, lParam=0x0) returned 1 [0067.366] IsWindowVisible (hWnd=0x7006c) returned 0 [0067.366] IsWindowVisible (hWnd=0x6006e) returned 1 [0067.366] IsWindowEnabled (hWnd=0x6006e) returned 1 [0067.366] IsWindowVisible (hWnd=0x402c8) returned 0 [0067.366] IsWindowVisible (hWnd=0x90080) returned 0 [0067.366] GetActiveWindow () returned 0x0 [0067.366] GetFocus () returned 0x0 [0067.366] IsWindow (hWnd=0x6006e) returned 1 [0067.367] EnableWindow (hWnd=0x6006e, bEnable=0) returned 0 [0067.367] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0067.377] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0067.377] MessageBoxW (hWnd=0x0, lpText="Something Went Wrong!\nPlease Delete and Redownload the Pdf.", lpCaption="Error pdf", uType=0x10) returned 1 [0067.691] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x7006c, Msg=0x1c, wParam=0x1, lParam=0x600) returned 0x0 [0067.691] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0x1c, wParam=0x1, lParam=0x600) returned 0x0 [0067.691] NtdllDefWindowProc_W (hWnd=0x402c8, Msg=0x1c, wParam=0x1, lParam=0x600) returned 0x0 [0067.727] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0x46, wParam=0x0, lParam=0x19e35c) returned 0x0 [0067.728] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0x83, wParam=0x1, lParam=0x19e334) returned 0x0 [0067.728] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0067.740] GetWindowPlacement (in: hWnd=0x6006e, lpwndpl=0x19e0a4 | out: lpwndpl=0x19e0a4) returned 1 [0067.740] GetClientRect (in: hWnd=0x6006e, lpRect=0x19e050 | out: lpRect=0x19e050) returned 1 [0067.740] GetWindowTextLengthW (hWnd=0x6006e) returned 5 [0067.740] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0067.740] GetSystemMetrics (nIndex=42) returned 0 [0067.740] GetWindowTextW (in: hWnd=0x6006e, lpString=0x19df1c, nMaxCount=6 | out: lpString="Lasan") returned 5 [0067.740] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0xd, wParam=0x6, lParam=0x19df1c) returned 0x5 [0067.740] GetClientRect (in: hWnd=0x6006e, lpRect=0x19df58 | out: lpRect=0x19df58) returned 1 [0067.740] GetCurrentObject (hdc=0x17010523, type=0x1) returned 0xb00017 [0067.741] GetCurrentObject (hdc=0x17010523, type=0x2) returned 0x900010 [0067.741] GetCurrentObject (hdc=0x17010523, type=0x7) returned 0x4b0507b2 [0067.741] GetCurrentObject (hdc=0x17010523, type=0x6) returned 0x8a01c2 [0067.741] SaveDC (hdc=0x17010523) returned 1 [0067.741] GetNearestColor (hdc=0x17010523, color=0xf0f0f0) returned 0xf0f0f0 [0067.741] CreateSolidBrush (color=0xf0f0f0) returned 0x6a1004fe [0067.741] FillRect (hDC=0x17010523, lprc=0x19ddf8, hbr=0x6a1004fe) returned 1 [0067.741] DeleteObject (ho=0x6a1004fe) returned 1 [0067.741] RestoreDC (hdc=0x17010523, nSavedDC=-1) returned 1 [0067.741] GetWindowPlacement (in: hWnd=0x6006e, lpwndpl=0x19e088 | out: lpwndpl=0x19e088) returned 1 [0067.742] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0x47, wParam=0x0, lParam=0x19e35c) returned 0x0 [0067.742] GetClientRect (in: hWnd=0x6006e, lpRect=0x19e038 | out: lpRect=0x19e038) returned 1 [0067.742] GetWindowRect (in: hWnd=0x6006e, lpRect=0x19e038 | out: lpRect=0x19e038) returned 1 [0067.742] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0x83, wParam=0x1, lParam=0x19de74) returned 0x0 [0067.743] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0067.744] GetWindowPlacement (in: hWnd=0x6006e, lpwndpl=0x19dbe4 | out: lpwndpl=0x19dbe4) returned 1 [0067.744] GetClientRect (in: hWnd=0x6006e, lpRect=0x19db90 | out: lpRect=0x19db90) returned 1 [0067.744] GetWindowTextLengthW (hWnd=0x6006e) returned 5 [0067.744] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0067.744] GetSystemMetrics (nIndex=42) returned 0 [0067.744] GetWindowTextW (in: hWnd=0x6006e, lpString=0x19da5c, nMaxCount=6 | out: lpString="Lasan") returned 5 [0067.744] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0xd, wParam=0x6, lParam=0x19da5c) returned 0x5 [0067.745] GetClientRect (in: hWnd=0x6006e, lpRect=0x19da98 | out: lpRect=0x19da98) returned 1 [0067.745] GetCurrentObject (hdc=0x10105d1, type=0x1) returned 0xb00017 [0067.745] GetCurrentObject (hdc=0x10105d1, type=0x2) returned 0x900010 [0067.745] GetCurrentObject (hdc=0x10105d1, type=0x7) returned 0x4b0507b2 [0067.745] GetCurrentObject (hdc=0x10105d1, type=0x6) returned 0x8a01c2 [0067.745] SaveDC (hdc=0x10105d1) returned 1 [0067.745] GetNearestColor (hdc=0x10105d1, color=0xf0f0f0) returned 0xf0f0f0 [0067.745] CreateSolidBrush (color=0xf0f0f0) returned 0x6b1004fe [0067.745] FillRect (hDC=0x10105d1, lprc=0x19d938, hbr=0x6b1004fe) returned 1 [0067.745] DeleteObject (ho=0x6b1004fe) returned 1 [0067.745] RestoreDC (hdc=0x10105d1, nSavedDC=-1) returned 1 [0067.746] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0067.746] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x7006c, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0067.747] BeginPaint (in: hWnd=0x6006e, lpPaint=0x19e078 | out: lpPaint=0x19e078) returned 0x10105d1 [0067.748] GdipCreateHalftonePalette () returned 0x5708078e [0067.748] SelectPalette (hdc=0x10105d1, hPal=0x5708078e, bForceBkgd=1) returned 0x88000b [0067.748] GetWindowTextLengthW (hWnd=0x6006e) returned 5 [0067.748] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0067.748] GetSystemMetrics (nIndex=42) returned 0 [0067.748] GetWindowTextW (in: hWnd=0x6006e, lpString=0x19e014, nMaxCount=6 | out: lpString="Lasan") returned 5 [0067.748] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0xd, wParam=0x6, lParam=0x19e014) returned 0x5 [0067.748] SelectPalette (hdc=0x10105d1, hPal=0x88000b, bForceBkgd=0) returned 0x5708078e [0067.748] EndPaint (hWnd=0x6006e, lpPaint=0x19e074) returned 1 [0068.147] IsWindow (hWnd=0x6006e) returned 1 [0068.147] EnableWindow (hWnd=0x6006e, bEnable=1) returned 1 [0068.147] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0068.148] SendMessageW (hWnd=0x0, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0068.412] GetFullPathNameW (in: lpFileName="Password.txt", nBufferLength=0x105, lpBuffer=0x19e2c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Password.txt", lpFilePart=0x0) returned 0x24 [0068.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e80c) returned 1 [0068.412] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Password.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\password.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x490 [0068.414] GetFileType (hFile=0x490) returned 0x1 [0068.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e808) returned 1 [0068.414] GetFileType (hFile=0x490) returned 0x1 [0068.415] WriteFile (in: hFile=0x490, lpBuffer=0x25598f0*, nNumberOfBytesToWrite=0x23, lpNumberOfBytesWritten=0x19e888, lpOverlapped=0x0 | out: lpBuffer=0x25598f0*, lpNumberOfBytesWritten=0x19e888*=0x23, lpOverlapped=0x0) returned 1 [0068.416] CloseHandle (hObject=0x490) returned 1 [0068.418] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\SystemConfig.txt", nBufferLength=0x105, lpBuffer=0x19e2c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\SystemConfig.txt", lpFilePart=0x0) returned 0x20 [0068.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e80c) returned 1 [0068.418] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\SystemConfig.txt" (normalized: "c:\\users\\fd1hvy\\systemconfig.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x490 [0068.418] GetFileType (hFile=0x490) returned 0x1 [0068.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e808) returned 1 [0068.418] GetFileType (hFile=0x490) returned 0x1 [0068.418] WriteFile (in: hFile=0x490, lpBuffer=0x255be60*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x19e888, lpOverlapped=0x0 | out: lpBuffer=0x255be60*, lpNumberOfBytesWritten=0x19e888*=0xf, lpOverlapped=0x0) returned 1 [0068.420] CloseHandle (hObject=0x490) returned 1 [0068.427] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\SystemConfig.txt", nBufferLength=0x105, lpBuffer=0x19e448, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\SystemConfig.txt", lpFilePart=0x0) returned 0x20 [0068.430] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\SystemConfig.txt", dwFileAttributes=0x2) returned 1 [0068.430] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Info.exe", nBufferLength=0x105, lpBuffer=0x19e438, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Info.exe", lpFilePart=0x0) returned 0x26 [0068.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e8ec) returned 1 [0068.430] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Info.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\info.exe"), fInfoLevelId=0x0, lpFileInformation=0x19e968 | out: lpFileInformation=0x19e968*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0068.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e8e8) returned 1 [0068.433] CoTaskMemAlloc (cb=0x20c) returned 0x70eac8 [0068.433] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x70eac8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\DRV.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\drv.exe")) returned 0x1f [0068.433] CoTaskMemFree (pv=0x70eac8) [0068.441] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\DRV.exe", nBufferLength=0x105, lpBuffer=0x19e408, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\DRV.exe", lpFilePart=0x0) returned 0x1f [0068.441] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\DRV.exe", nBufferLength=0x105, lpBuffer=0x19e3b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\DRV.exe", lpFilePart=0x0) returned 0x1f [0068.441] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\DRV.exe", nBufferLength=0x105, lpBuffer=0x19e3ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\DRV.exe", lpFilePart=0x0) returned 0x1f [0068.441] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Info.exe", nBufferLength=0x105, lpBuffer=0x19e3ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Info.exe", lpFilePart=0x0) returned 0x26 [0068.442] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\DRV.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\drv.exe"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Info.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\info.exe"), bFailIfExists=1) returned 1 [0068.567] ShellExecuteExW (in: pExecInfo=0x255df54*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\FD1HVy\\AppData\\Local\\Info.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x255df54*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\FD1HVy\\AppData\\Local\\Info.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x670)) returned 1 [0078.165] LocalFree (hMem=0x6c7cf0) returned 0x0 [0078.205] GetWindowThreadProcessId (in: hWnd=0x6006e, lpdwProcessId=0x19e998 | out: lpdwProcessId=0x19e998) returned 0xb0 [0078.205] GetCurrentThreadId () returned 0xb0 [0078.206] RegisterClipboardFormatW (lpszFormat="WindowsForms12_ThreadCallbackMessage") returned 0xc1a1 [0078.207] PostMessageW (hWnd=0x6006e, Msg=0xc1a1, wParam=0x0, lParam=0x0) returned 1 [0078.207] GetWindowTextLengthW (hWnd=0x6006e) returned 5 [0078.207] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0078.207] GetSystemMetrics (nIndex=42) returned 0 [0078.207] GetWindowTextW (in: hWnd=0x6006e, lpString=0x19e918, nMaxCount=6 | out: lpString="Lasan") returned 5 [0078.207] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0xd, wParam=0x6, lParam=0x19e918) returned 0x5 [0078.212] PeekMessageW (in: lpMsg=0x19ee98, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee98) returned 1 [0078.212] GetMessageA (in: lpMsg=0x19ee98, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19ee98) returned 0 [0078.247] DestroyCursor (hCursor=0x60235) returned 1 [0078.368] GetWindowLongW (hWnd=0x6006e, nIndex=-20) returned 590080 [0078.368] DestroyWindow (hWnd=0x6006e) returned 1 [0078.370] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0078.370] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0x46, wParam=0x0, lParam=0x19ec3c) returned 0x0 [0078.373] GetWindowPlacement (in: hWnd=0x6006e, lpwndpl=0x19e968 | out: lpwndpl=0x19e968) returned 1 [0078.373] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0x47, wParam=0x0, lParam=0x19ec3c) returned 0x0 [0078.373] GetClientRect (in: hWnd=0x6006e, lpRect=0x19e918 | out: lpRect=0x19e918) returned 1 [0078.373] GetWindowRect (in: hWnd=0x6006e, lpRect=0x19e918 | out: lpRect=0x19e918) returned 1 [0078.374] PostThreadMessageW (idThread=0xb0, Msg=0x12, wParam=0x0, lParam=0x0) returned 1 [0078.388] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0078.389] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x6006e, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0078.389] DestroyWindow (hWnd=0x7006c) returned 1 [0078.389] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x7006c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0078.389] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x7006c, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0078.389] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x7006c, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0078.394] GetCurrentThreadId () returned 0xb0 [0078.394] EnumThreadWindows (dwThreadId=0xb0, lpfn=0x2264d2e, lParam=0x0) returned 1 [0078.394] IsWindowVisible (hWnd=0x402c8) returned 0 [0078.394] IsWindowVisible (hWnd=0x202c2) returned 0 [0078.394] IsWindowVisible (hWnd=0x90080) returned 0 [0078.395] GetCurrentThreadId () returned 0xb0 [0078.395] GetCurrentThreadId () returned 0xb0 [0078.395] EnumThreadWindows (dwThreadId=0xb0, lpfn=0x2264d56, lParam=0x0) returned 1 [0078.395] IsWindowVisible (hWnd=0x402c8) returned 0 [0078.395] IsWindowVisible (hWnd=0x202c2) returned 0 [0078.395] IsWindowVisible (hWnd=0x90080) returned 0 [0078.396] OleUninitialize () [0078.396] CloseHandle (hObject=0x370) returned 1 [0078.399] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1ab40005) returned 1 [0078.401] HeapFree (in: hHeap=0x20f0000, dwFlags=0x0, lpMem=0x20f0fe8 | out: hHeap=0x20f0000) returned 1 [0078.401] HeapFree (in: hHeap=0x20f0000, dwFlags=0x0, lpMem=0x20f0fd0 | out: hHeap=0x20f0000) returned 1 [0078.402] HeapFree (in: hHeap=0x20f0000, dwFlags=0x0, lpMem=0x20f1fb8 | out: hHeap=0x20f0000) returned 1 [0078.403] GetModuleHandleW (lpModuleName="mscoree.dll") returned 0x74160000 [0078.403] GetProcAddress (hModule=0x74160000, lpProcName="CorExitProcess") returned 0x741721f0 [0078.407] CoGetContextToken (in: pToken=0x19fb08 | out: pToken=0x19fb08) returned 0x0 [0078.407] CObjectContext::QueryInterface () returned 0x0 [0078.407] CObjectContext::GetCurrentThreadType () returned 0x0 [0078.407] Release () returned 0x0 [0078.408] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x13880, cHandles=0x1, pHandles=0x6a14c8*=0x1b4, lpdwindex=0x19f9ac | out: lpdwindex=0x19f9ac) returned 0x0 [0078.649] HeapFree (in: hHeap=0x20f0000, dwFlags=0x0, lpMem=0x20f05a8 | out: hHeap=0x20f0000) returned 1 Thread: id = 2 os_tid = 0x1110 Thread: id = 3 os_tid = 0x1120 Thread: id = 4 os_tid = 0x4c0 [0050.024] CoGetContextToken (in: pToken=0x459fc74 | out: pToken=0x459fc74) returned 0x800401f0 [0050.024] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0050.024] RoInitialize () returned 0x1 [0050.024] RoUninitialize () returned 0x0 [0078.538] SetWindowLongW (hWnd=0x301d2, nIndex=-4, dwNewLong=1948909888) returned 36063958 [0078.538] SetClassLongW (hWnd=0x301d2, nIndex=-24, dwNewLong=1948909888) returned 0x2264aae [0078.539] PostMessageW (hWnd=0x301d2, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0078.539] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0078.539] UnregisterClassW (lpClassName="WindowsForms10.Window.0.app.0.141b42a_r10_ad1", hInstance=0x400000) returned 1 [0078.540] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0078.540] UnregisterClassW (lpClassName="WindowsForms10.Window.8.app.0.141b42a_r10_ad1", hInstance=0x400000) returned 0 [0078.541] EtwEventUnregister (RegHandle=0x6de288) returned 0x0 [0078.593] IsWindow (hWnd=0x402c8) returned 1 [0078.595] GetModuleHandleW (lpModuleName="user32.dll") returned 0x76240000 [0078.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x459fa14, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcWÊq\x9dÄPtðù\x9fs\x98üY\x04\x01", lpUsedDefaultChar=0x0) returned 14 [0078.595] GetProcAddress (hModule=0x76240000, lpProcName="DefWindowProcW") returned 0x742a0140 [0078.596] SetWindowLongW (hWnd=0x402c8, nIndex=-4, dwNewLong=1948909888) returned 36064118 [0078.596] SetClassLongW (hWnd=0x402c8, nIndex=-24, dwNewLong=1948909888) returned 0x2264b76 [0078.596] IsWindow (hWnd=0x402c8) returned 1 [0078.596] DestroyWindow (hWnd=0x402c8) returned 0 [0078.596] PostMessageW (hWnd=0x402c8, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0078.597] SetConsoleCtrlHandler (HandlerRoutine=0x2264b4e, Add=0) returned 1 [0078.597] DeleteObject (ho=0x5708078e) returned 1 [0078.635] GdipDeleteFont (font=0x6bbef48) returned 0x0 [0078.636] DeleteObject (ho=0x460a07c4) returned 1 [0078.637] DestroyCursor (hCursor=0xb02a7) returned 1 [0078.641] CloseHandle (hObject=0x428) returned 1 [0078.641] CloseHandle (hObject=0x424) returned 1 [0078.642] CloseHandle (hObject=0x420) returned 1 [0078.642] CloseHandle (hObject=0x430) returned 1 [0078.642] CloseHandle (hObject=0x42c) returned 1 [0078.642] RegCloseKey (hKey=0x80000004) returned 0x0 [0078.643] CloseHandle (hObject=0x410) returned 1 [0078.643] CloseHandle (hObject=0x670) returned 1 [0078.644] CloseHandle (hObject=0x438) returned 1 [0078.644] CloseHandle (hObject=0x434) returned 1 [0078.645] SleepEx (dwMilliseconds=0xffffffff, bAlertable=0) Thread: id = 5 os_tid = 0xd98 Thread: id = 6 os_tid = 0xa60 Thread: id = 7 os_tid = 0x2c0 Thread: id = 8 os_tid = 0x5b8 Thread: id = 9 os_tid = 0xdbc Thread: id = 10 os_tid = 0xac8 Thread: id = 11 os_tid = 0x434 Thread: id = 12 os_tid = 0xef4 Thread: id = 28 os_tid = 0xfa4 [0078.647] SleepEx (dwMilliseconds=0x14, bAlertable=0) Process: id = "2" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x4ef15000" os_pid = "0x5b0" os_integrity_level = "0x4000" os_privileges = "0x260814080" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0x23c" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k appmodel" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EntAppSvc" [0xa], "NT SERVICE\\StateRepository" [0xe], "NT SERVICE\\tiledatamodelsvc" [0xa], "NT SERVICE\\WalletService" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000f253" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 13 os_tid = 0x117c Thread: id = 14 os_tid = 0x1178 Thread: id = 15 os_tid = 0x988 Thread: id = 16 os_tid = 0x820 Thread: id = 17 os_tid = 0x734 Thread: id = 18 os_tid = 0x6e8 Thread: id = 19 os_tid = 0x76c Thread: id = 20 os_tid = 0x690 Thread: id = 21 os_tid = 0x680 Thread: id = 22 os_tid = 0x614 Thread: id = 23 os_tid = 0x610 Thread: id = 24 os_tid = 0x60c Thread: id = 25 os_tid = 0x5b4 Process: id = "3" image_name = "info.exe" filename = "c:\\users\\fd1hvy\\appdata\\local\\info.exe" page_root = "0x6a5d000" os_pid = "0x10c4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x13fc" cmd_line = "\"C:\\Users\\FD1HVy\\AppData\\Local\\Info.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 26 os_tid = 0xfb0 [0078.660] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x1fd0000 [0078.682] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000 [0078.682] GetProcAddress (hModule=0x76750000, lpProcName="FlsAlloc") returned 0x76764ae0 [0078.682] GetProcAddress (hModule=0x76750000, lpProcName="FlsGetValue") returned 0x76764b20 [0078.682] GetProcAddress (hModule=0x76750000, lpProcName="FlsSetValue") returned 0x76764b40 [0078.682] GetProcAddress (hModule=0x76750000, lpProcName="FlsFree") returned 0x76764b00 [0078.683] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000 [0078.683] GetProcAddress (hModule=0x76750000, lpProcName="EncodePointer") returned 0x778b29e0 [0078.683] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000 [0078.683] GetProcAddress (hModule=0x76750000, lpProcName="EncodePointer") returned 0x778b29e0 [0078.683] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000 [0078.683] GetProcAddress (hModule=0x76750000, lpProcName="EncodePointer") returned 0x778b29e0 [0078.683] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000 [0078.683] GetProcAddress (hModule=0x76750000, lpProcName="EncodePointer") returned 0x778b29e0 [0078.683] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000 [0078.684] GetProcAddress (hModule=0x76750000, lpProcName="EncodePointer") returned 0x778b29e0 [0078.684] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000 [0078.684] GetProcAddress (hModule=0x76750000, lpProcName="EncodePointer") returned 0x778b29e0 [0078.684] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000 [0078.684] GetProcAddress (hModule=0x76750000, lpProcName="EncodePointer") returned 0x778b29e0 [0078.684] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000 [0078.684] GetProcAddress (hModule=0x76750000, lpProcName="DecodePointer") returned 0x778b1ec0 [0078.685] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x214) returned 0x1fd05a8 [0078.685] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000 [0078.685] GetProcAddress (hModule=0x76750000, lpProcName="DecodePointer") returned 0x778b1ec0 [0078.685] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76750000 [0078.685] GetProcAddress (hModule=0x76750000, lpProcName="EncodePointer") returned 0x778b29e0 [0078.685] GetProcAddress (hModule=0x76750000, lpProcName="DecodePointer") returned 0x778b1ec0 [0078.723] GetCurrentThreadId () returned 0xfb0 [0078.723] GetStartupInfoA (in: lpStartupInfo=0x19fee0 | out: lpStartupInfo=0x19fee0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Local\\Info.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0078.723] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x800) returned 0x1fd07c8 [0078.723] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0078.723] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0078.723] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0078.723] SetHandleCount (uNumber=0x20) returned 0x20 [0078.723] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\AppData\\Local\\Info.exe\" " [0078.723] GetEnvironmentStringsW () returned 0x5bbd80* [0078.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0078.724] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x0, Size=0x565) returned 0x1fd0fd0 [0078.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x1fd0fd0, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0078.724] FreeEnvironmentStringsW (penv=0x5bbd80) returned 1 [0078.724] GetLastError () returned 0x0 [0078.724] SetLastError (dwErrCode=0x0) [0078.724] GetLastError () returned 0x0 [0078.724] SetLastError (dwErrCode=0x0) [0078.724] GetLastError () returned 0x0 [0078.724] SetLastError (dwErrCode=0x0) [0078.724] GetACP () returned 0x4e4 [0078.724] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x0, Size=0x220) returned 0x1fd1540 [0078.724] GetLastError () returned 0x0 [0078.724] SetLastError (dwErrCode=0x0) [0078.724] IsValidCodePage (CodePage=0x4e4) returned 1 [0078.725] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19fec0 | out: lpCPInfo=0x19fec0) returned 1 [0078.725] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f98c | out: lpCPInfo=0x19f98c) returned 1 [0078.725] GetLastError () returned 0x0 [0078.725] SetLastError (dwErrCode=0x0) [0078.725] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x19f91c | out: lpCharType=0x19f91c) returned 1 [0078.725] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fda0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0078.725] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fda0, cbMultiByte=256, lpWideCharStr=0x19f708, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鷫깽男AĀ") returned 256 [0078.725] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鷫깽男AĀ", cchSrc=256, lpCharType=0x19f9a0 | out: lpCharType=0x19f9a0) returned 1 [0078.725] GetLastError () returned 0x0 [0078.725] SetLastError (dwErrCode=0x0) [0078.725] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0078.725] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fda0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0078.725] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fda0, cbMultiByte=256, lpWideCharStr=0x19f6d8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ煻AĀ") returned 256 [0078.725] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ煻AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0078.725] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ煻AĀ", cchSrc=256, lpDestStr=0x19f4c8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0078.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x19fca0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿö9zÎØþ\x19", lpUsedDefaultChar=0x0) returned 256 [0078.725] GetLastError () returned 0x0 [0078.725] SetLastError (dwErrCode=0x0) [0078.725] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fda0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0078.725] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fda0, cbMultiByte=256, lpWideCharStr=0x19f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ煻AĀ") returned 256 [0078.725] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ煻AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0078.725] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ煻AĀ", cchSrc=256, lpDestStr=0x19f4e8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0078.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x19fba0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿö9zÎØþ\x19", lpUsedDefaultChar=0x0) returned 256 [0078.725] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x423980, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\Info.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\info.exe")) returned 0x26 [0078.726] GetLastError () returned 0x0 [0078.726] SetLastError (dwErrCode=0x0) [0078.726] GetLastError () returned 0x0 [0078.726] SetLastError (dwErrCode=0x0) [0078.726] GetLastError () returned 0x0 [0078.726] SetLastError (dwErrCode=0x0) [0078.726] GetLastError () returned 0x0 [0078.726] SetLastError (dwErrCode=0x0) [0078.726] GetLastError () returned 0x0 [0078.726] SetLastError (dwErrCode=0x0) [0078.726] GetLastError () returned 0x0 [0078.726] SetLastError (dwErrCode=0x0) [0078.726] GetLastError () returned 0x0 [0078.726] SetLastError (dwErrCode=0x0) [0078.726] GetLastError () returned 0x0 [0078.726] SetLastError (dwErrCode=0x0) [0078.726] GetLastError () returned 0x0 [0078.726] SetLastError (dwErrCode=0x0) [0078.726] GetLastError () returned 0x0 [0078.726] SetLastError (dwErrCode=0x0) [0078.726] GetLastError () returned 0x0 [0078.726] SetLastError (dwErrCode=0x0) [0078.726] GetLastError () returned 0x0 [0078.726] SetLastError (dwErrCode=0x0) [0078.726] GetLastError () returned 0x0 [0078.727] SetLastError (dwErrCode=0x0) [0078.727] GetLastError () returned 0x0 [0078.727] SetLastError (dwErrCode=0x0) [0078.727] GetLastError () returned 0x0 [0078.727] SetLastError (dwErrCode=0x0) [0078.727] GetLastError () returned 0x0 [0078.727] SetLastError (dwErrCode=0x0) [0078.727] GetLastError () returned 0x0 [0078.727] SetLastError (dwErrCode=0x0) [0078.727] GetLastError () returned 0x0 [0078.727] SetLastError (dwErrCode=0x0) [0078.727] GetLastError () returned 0x0 [0078.727] SetLastError (dwErrCode=0x0) [0078.727] GetLastError () returned 0x0 [0078.727] SetLastError (dwErrCode=0x0) [0078.727] GetLastError () returned 0x0 [0078.727] SetLastError (dwErrCode=0x0) [0078.727] GetLastError () returned 0x0 [0078.727] SetLastError (dwErrCode=0x0) [0078.727] GetLastError () returned 0x0 [0078.727] SetLastError (dwErrCode=0x0) [0078.727] GetLastError () returned 0x0 [0078.727] SetLastError (dwErrCode=0x0) [0078.727] GetLastError () returned 0x0 [0078.728] SetLastError (dwErrCode=0x0) [0078.728] GetLastError () returned 0x0 [0078.728] SetLastError (dwErrCode=0x0) [0078.728] GetLastError () returned 0x0 [0078.728] SetLastError (dwErrCode=0x0) [0078.728] GetLastError () returned 0x0 [0078.728] SetLastError (dwErrCode=0x0) [0078.728] GetLastError () returned 0x0 [0078.728] SetLastError (dwErrCode=0x0) [0078.728] GetLastError () returned 0x0 [0078.728] SetLastError (dwErrCode=0x0) [0078.728] GetLastError () returned 0x0 [0078.728] SetLastError (dwErrCode=0x0) [0078.728] GetLastError () returned 0x0 [0078.728] SetLastError (dwErrCode=0x0) [0078.728] GetLastError () returned 0x0 [0078.728] SetLastError (dwErrCode=0x0) [0078.728] GetLastError () returned 0x0 [0078.728] SetLastError (dwErrCode=0x0) [0078.728] GetLastError () returned 0x0 [0078.728] SetLastError (dwErrCode=0x0) [0078.728] GetLastError () returned 0x0 [0078.728] SetLastError (dwErrCode=0x0) [0078.728] GetLastError () returned 0x0 [0078.728] SetLastError (dwErrCode=0x0) [0078.729] GetLastError () returned 0x0 [0078.729] SetLastError (dwErrCode=0x0) [0078.729] GetLastError () returned 0x0 [0078.729] SetLastError (dwErrCode=0x0) [0078.729] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x0, Size=0x2f) returned 0x1fd1768 [0078.729] GetLastError () returned 0x0 [0078.729] SetLastError (dwErrCode=0x0) [0078.729] GetLastError () returned 0x0 [0078.729] SetLastError (dwErrCode=0x0) [0078.729] GetLastError () returned 0x0 [0078.729] SetLastError (dwErrCode=0x0) [0078.729] GetLastError () returned 0x0 [0078.729] SetLastError (dwErrCode=0x0) [0078.729] GetLastError () returned 0x0 [0078.729] SetLastError (dwErrCode=0x0) [0078.729] GetLastError () returned 0x0 [0078.729] SetLastError (dwErrCode=0x0) [0078.729] GetLastError () returned 0x0 [0078.729] SetLastError (dwErrCode=0x0) [0078.729] GetLastError () returned 0x0 [0078.729] SetLastError (dwErrCode=0x0) [0078.729] GetLastError () returned 0x0 [0078.729] SetLastError (dwErrCode=0x0) [0078.729] GetLastError () returned 0x0 [0078.730] SetLastError (dwErrCode=0x0) [0078.730] GetLastError () returned 0x0 [0078.730] SetLastError (dwErrCode=0x0) [0078.730] GetLastError () returned 0x0 [0078.730] SetLastError (dwErrCode=0x0) [0078.730] GetLastError () returned 0x0 [0078.730] SetLastError (dwErrCode=0x0) [0078.730] GetLastError () returned 0x0 [0078.730] SetLastError (dwErrCode=0x0) [0078.730] GetLastError () returned 0x0 [0078.730] SetLastError (dwErrCode=0x0) [0078.730] GetLastError () returned 0x0 [0078.730] SetLastError (dwErrCode=0x0) [0078.730] GetLastError () returned 0x0 [0078.730] SetLastError (dwErrCode=0x0) [0078.730] GetLastError () returned 0x0 [0078.730] SetLastError (dwErrCode=0x0) [0078.730] GetLastError () returned 0x0 [0078.730] SetLastError (dwErrCode=0x0) [0078.730] GetLastError () returned 0x0 [0078.730] SetLastError (dwErrCode=0x0) [0078.730] GetLastError () returned 0x0 [0078.730] SetLastError (dwErrCode=0x0) [0078.730] GetLastError () returned 0x0 [0078.730] SetLastError (dwErrCode=0x0) [0078.730] GetLastError () returned 0x0 [0078.731] SetLastError (dwErrCode=0x0) [0078.731] GetLastError () returned 0x0 [0078.731] SetLastError (dwErrCode=0x0) [0078.731] GetLastError () returned 0x0 [0078.731] SetLastError (dwErrCode=0x0) [0078.731] GetLastError () returned 0x0 [0078.731] SetLastError (dwErrCode=0x0) [0078.731] GetLastError () returned 0x0 [0078.731] SetLastError (dwErrCode=0x0) [0078.731] GetLastError () returned 0x0 [0078.731] SetLastError (dwErrCode=0x0) [0078.731] GetLastError () returned 0x0 [0078.731] SetLastError (dwErrCode=0x0) [0078.731] GetLastError () returned 0x0 [0078.731] SetLastError (dwErrCode=0x0) [0078.731] GetLastError () returned 0x0 [0078.731] SetLastError (dwErrCode=0x0) [0078.731] GetLastError () returned 0x0 [0078.731] SetLastError (dwErrCode=0x0) [0078.731] GetLastError () returned 0x0 [0078.731] SetLastError (dwErrCode=0x0) [0078.731] GetLastError () returned 0x0 [0078.731] SetLastError (dwErrCode=0x0) [0078.731] GetLastError () returned 0x0 [0078.732] SetLastError (dwErrCode=0x0) [0078.732] GetLastError () returned 0x0 [0078.732] SetLastError (dwErrCode=0x0) [0078.732] GetLastError () returned 0x0 [0078.732] SetLastError (dwErrCode=0x0) [0078.732] GetLastError () returned 0x0 [0078.732] SetLastError (dwErrCode=0x0) [0078.732] GetLastError () returned 0x0 [0078.732] SetLastError (dwErrCode=0x0) [0078.732] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x94) returned 0x1fd17a0 [0078.732] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x1f) returned 0x1fd1840 [0078.732] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x28) returned 0x1fd1868 [0078.732] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x37) returned 0x1fd1898 [0078.732] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x3c) returned 0x1fd18d8 [0078.732] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x31) returned 0x1fd1920 [0078.732] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x14) returned 0x1fd1960 [0078.732] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x24) returned 0x1fd1980 [0078.732] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0xd) returned 0x1fd19b0 [0078.732] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x17) returned 0x1fd19c8 [0078.732] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x2b) returned 0x1fd19e8 [0078.732] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x15) returned 0x1fd1a20 [0078.732] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x17) returned 0x1fd1a40 [0078.732] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x22) returned 0x1fd1a60 [0078.732] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0xe) returned 0x1fd1a90 [0078.732] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0xc1) returned 0x1fd1aa8 [0078.732] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x3e) returned 0x1fd1b78 [0078.732] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x1b) returned 0x1fd1bc0 [0078.732] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x1d) returned 0x1fd1be8 [0078.732] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x48) returned 0x1fd1c10 [0078.732] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x12) returned 0x1fd1c60 [0078.732] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x18) returned 0x1fd1c80 [0078.732] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x1b) returned 0x1fd1ca0 [0078.732] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x24) returned 0x1fd1cc8 [0078.732] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x29) returned 0x1fd1cf8 [0078.732] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x1e) returned 0x1fd1d30 [0078.732] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x6b) returned 0x1fd1d58 [0078.733] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x17) returned 0x1fd1dd0 [0078.733] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0xf) returned 0x1fd1df0 [0078.733] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x16) returned 0x1fd1e08 [0078.733] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x28) returned 0x1fd1e28 [0078.733] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x27) returned 0x1fd1e58 [0078.733] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x12) returned 0x1fd1e88 [0078.733] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x21) returned 0x1fd1ea8 [0078.733] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x10) returned 0x1fd1ed8 [0078.733] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x1c) returned 0x1fd1ef0 [0078.733] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x12) returned 0x1fd1f18 [0078.733] HeapFree (in: hHeap=0x1fd0000, dwFlags=0x0, lpMem=0x1fd0fd0 | out: hHeap=0x1fd0000) returned 1 [0078.733] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76750000 [0078.733] GetProcAddress (hModule=0x76750000, lpProcName="IsProcessorFeaturePresent") returned 0x76765960 [0078.733] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0078.734] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x80) returned 0x1fd1f38 [0078.734] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x8, Size=0x800) returned 0x1fd1fc0 [0078.734] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4123af) returned 0x0 [0078.735] RtlSizeHeap (HeapHandle=0x1fd0000, Flags=0x0, MemoryPointer=0x1fd1f38) returned 0x80 [0078.735] OleInitialize (pvReserved=0x0) returned 0x0 [0078.981] GetLastError () returned 0x0 [0078.981] SetLastError (dwErrCode=0x0) [0078.981] GetLastError () returned 0x0 [0078.982] SetLastError (dwErrCode=0x0) [0078.982] GetLastError () returned 0x0 [0078.982] SetLastError (dwErrCode=0x0) [0078.982] GetLastError () returned 0x0 [0078.982] SetLastError (dwErrCode=0x0) [0078.982] GetCurrentProcessId () returned 0x10c4 [0078.982] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x10c4) returned 0x158 [0078.985] Module32First (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0078.985] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0078.986] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0078.986] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0078.987] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0078.987] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0078.988] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0078.988] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0078.988] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0078.989] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0078.989] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0078.991] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0078.991] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0078.992] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0078.992] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0078.992] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0078.993] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0078.993] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0078.994] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0078.994] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0078.995] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0078.995] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0078.995] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 1 [0078.996] Module32Next (hSnapshot=0x158, lpme=0x19fd18) returned 0 [0078.996] CloseHandle (hObject=0x158) returned 1 [0078.996] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0078.996] FindResourceA (hModule=0x400000, lpName="__", lpType=0xa) returned 0x426218 [0078.996] LoadResource (hModule=0x400000, hResInfo=0x426218) returned 0x43e77c [0078.996] LockResource (hResData=0x43e77c) returned 0x43e77c [0078.996] SizeofResource (hModule=0x400000, hResInfo=0x426218) returned 0x1a6fb [0078.996] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x0, Size=0x1a6fb) returned 0x1fe0048 [0078.997] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x0, Size=0x40022) returned 0x1ffa750 [0079.014] SizeofResource (hModule=0x400000, hResInfo=0x426218) returned 0x1a6fb [0079.016] GetLastError () returned 0x12 [0079.016] SetLastError (dwErrCode=0x12) [0079.017] GetLastError () returned 0x12 [0079.017] SetLastError (dwErrCode=0x12) [0079.017] GetLastError () returned 0x12 [0079.017] SetLastError (dwErrCode=0x12) [0079.018] GetLastError () returned 0x12 [0079.018] SetLastError (dwErrCode=0x12) [0079.018] GetLastError () returned 0x12 [0079.018] SetLastError (dwErrCode=0x12) [0079.019] GetLastError () returned 0x12 [0079.019] SetLastError (dwErrCode=0x12) [0079.019] GetLastError () returned 0x12 [0079.019] SetLastError (dwErrCode=0x12) [0079.020] GetLastError () returned 0x12 [0079.020] SetLastError (dwErrCode=0x12) [0079.020] GetLastError () returned 0x12 [0079.020] SetLastError (dwErrCode=0x12) [0079.021] GetLastError () returned 0x12 [0079.021] SetLastError (dwErrCode=0x12) [0079.021] GetLastError () returned 0x12 [0079.021] SetLastError (dwErrCode=0x12) [0079.022] GetLastError () returned 0x12 [0079.022] SetLastError (dwErrCode=0x12) [0079.022] GetLastError () returned 0x12 [0079.022] SetLastError (dwErrCode=0x12) [0079.023] GetLastError () returned 0x12 [0079.023] SetLastError (dwErrCode=0x12) [0079.023] GetLastError () returned 0x12 [0079.023] SetLastError (dwErrCode=0x12) [0079.024] GetLastError () returned 0x12 [0079.024] SetLastError (dwErrCode=0x12) [0079.024] GetLastError () returned 0x12 [0079.024] SetLastError (dwErrCode=0x12) [0079.024] GetLastError () returned 0x12 [0079.025] SetLastError (dwErrCode=0x12) [0079.025] GetLastError () returned 0x12 [0079.025] SetLastError (dwErrCode=0x12) [0079.025] GetLastError () returned 0x12 [0079.025] SetLastError (dwErrCode=0x12) [0079.026] GetLastError () returned 0x12 [0079.026] SetLastError (dwErrCode=0x12) [0079.026] GetLastError () returned 0x12 [0079.026] SetLastError (dwErrCode=0x12) [0079.027] GetLastError () returned 0x12 [0079.027] SetLastError (dwErrCode=0x12) [0079.027] GetLastError () returned 0x12 [0079.027] SetLastError (dwErrCode=0x12) [0079.028] GetLastError () returned 0x12 [0079.028] SetLastError (dwErrCode=0x12) [0079.028] GetLastError () returned 0x12 [0079.028] SetLastError (dwErrCode=0x12) [0079.029] GetLastError () returned 0x12 [0079.029] SetLastError (dwErrCode=0x12) [0079.029] FreeResource (hResData=0x43e77c) returned 0 [0079.029] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x0, Size=0x3f40e) returned 0x203a780 [0079.030] SizeofResource (hModule=0x400000, hResInfo=0x426218) returned 0x1a6fb [0079.030] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x0, Size=0x2530) returned 0x2079b98 [0079.133] HeapFree (in: hHeap=0x1fd0000, dwFlags=0x0, lpMem=0x2079b98 | out: hHeap=0x1fd0000) returned 1 [0079.134] LoadLibraryA (lpLibFileName="mscoree.dll") returned 0x74160000 [0079.149] GetProcAddress (hModule=0x74160000, lpProcName="CLRCreateInstance") returned 0x74175000 [0079.250] lstrlenA (lpString="v4.0.30319") returned 10 [0079.250] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x203a780, cbMultiByte=11, lpWideCharStr=0x19fc18, cchWideChar=11 | out: lpWideCharStr="v4.0.30319") returned 11 [0080.131] PathRemoveBackslashW (in: pszPath="C:\\WINDOWS" | out: pszPath="C:\\WINDOWS") returned="S" [0080.241] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x0, Size=0xc) returned 0x1fd0fd0 [0080.241] RtlAllocateHeap (HeapHandle=0x1fd0000, Flags=0x0, Size=0xc) returned 0x1fd0fe8 [0080.242] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x80010106 [0080.243] RoInitialize () returned 0x1 [0080.243] RoUninitialize () returned 0x0 [0080.399] SafeArrayAccessData (in: psa=0x5d2a28, ppvData=0x19fae8 | out: ppvData=0x19fae8) returned 0x0 [0080.399] SafeArrayUnaccessData (psa=0x5d2a28) returned 0x0 [0080.403] SafeArrayGetDim (psa=0x5d2a28) returned 0x1 [0080.403] SafeArrayGetDim (psa=0x5d2a28) returned 0x1 [0080.404] SafeArrayGetLBound (in: psa=0x5d2a28, nDim=0x1, plLbound=0x19f86c | out: plLbound=0x19f86c) returned 0x0 [0080.404] SafeArrayGetVartype (in: psa=0x5d2a28, pvt=0x19f7dc | out: pvt=0x19f7dc) returned 0x0 [0080.574] SysStringByteLen (bstr="_._") returned 0x6 [0080.598] SafeArrayCreateVector (vt=0xc, lLbound=0, cElements=0x0) returned 0x5d2d28 [0080.678] SysStringByteLen (bstr="___") returned 0x6 [0082.266] CoTaskMemAlloc (cb=0x8) returned 0x5fc020 [0082.276] GetCurrentProcessId () returned 0x10c4 [0082.285] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x19d904 | out: lpLuid=0x19d904*(LowPart=0x14, HighPart=0)) returned 1 [0082.287] GetCurrentProcess () returned 0xffffffff [0082.288] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x19d900 | out: TokenHandle=0x19d900*=0x2f4) returned 1 [0082.288] AdjustTokenPrivileges (in: TokenHandle=0x2f4, DisableAllPrivileges=0, NewState=0x238541c*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0082.288] CloseHandle (hObject=0x2f4) returned 1 [0082.290] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10c4) returned 0x2f4 [0082.298] EnumProcessModules (in: hProcess=0x2f4, lphModule=0x2385460, cb=0x100, lpcbNeeded=0x19e074 | out: lphModule=0x2385460, lpcbNeeded=0x19e074) returned 1 [0082.299] GetModuleInformation (in: hProcess=0x2f4, hModule=0x400000, lpmodinfo=0x23855a0, cb=0xc | out: lpmodinfo=0x23855a0*(lpBaseOfDll=0x400000, SizeOfImage=0x5a000, EntryPoint=0x40cd2f)) returned 1 [0082.299] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.299] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x400000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="Info.exe") returned 0x8 [0082.300] CoTaskMemFree (pv=0x5fcd98) [0082.301] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.301] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x400000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\Info.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\info.exe")) returned 0x26 [0082.301] CoTaskMemFree (pv=0x5fcd98) [0082.302] CloseHandle (hObject=0x2f4) returned 1 [0082.395] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76750000 [0082.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FindResourceA", cchWideChar=13, lpMultiByteStr=0x19e04c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FindResourceA\x82ü\x01Ýá\x07Bðù\x9fsHç\x19", lpUsedDefaultChar=0x0) returned 13 [0082.407] GetProcAddress (hModule=0x76750000, lpProcName="FindResourceA") returned 0x767a27c0 [0082.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="__", cchWideChar=2, lpMultiByteStr=0x19e054, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="__ü\x01Ýá\x07Bðù\x9fsHç\x19", lpUsedDefaultChar=0x0) returned 2 [0082.423] FindResourceA (hModule=0x400000, lpName="__", lpType=0xa) returned 0x426218 [0082.477] GetCurrentProcessId () returned 0x10c4 [0082.481] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10c4) returned 0x2f4 [0082.481] EnumProcessModules (in: hProcess=0x2f4, lphModule=0x2387af4, cb=0x100, lpcbNeeded=0x19e080 | out: lphModule=0x2387af4, lpcbNeeded=0x19e080) returned 1 [0082.481] GetModuleInformation (in: hProcess=0x2f4, hModule=0x400000, lpmodinfo=0x2387c34, cb=0xc | out: lpmodinfo=0x2387c34*(lpBaseOfDll=0x400000, SizeOfImage=0x5a000, EntryPoint=0x40cd2f)) returned 1 [0082.481] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.481] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x400000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="Info.exe") returned 0x8 [0082.481] CoTaskMemFree (pv=0x5fcd98) [0082.481] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.481] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x400000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\Info.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\info.exe")) returned 0x26 [0082.481] CoTaskMemFree (pv=0x5fcd98) [0082.481] GetModuleInformation (in: hProcess=0x2f4, hModule=0x77850000, lpmodinfo=0x2389d68, cb=0xc | out: lpmodinfo=0x2389d68*(lpBaseOfDll=0x77850000, SizeOfImage=0x18e000, EntryPoint=0x0)) returned 1 [0082.482] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.482] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x77850000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0082.482] CoTaskMemFree (pv=0x5fcd98) [0082.482] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.482] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x77850000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\SYSTEM32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")) returned 0x1d [0082.482] CoTaskMemFree (pv=0x5fcd98) [0082.482] GetModuleInformation (in: hProcess=0x2f4, hModule=0x76750000, lpmodinfo=0x238be6c, cb=0xc | out: lpmodinfo=0x238be6c*(lpBaseOfDll=0x76750000, SizeOfImage=0xd0000, EntryPoint=0x767606a0)) returned 1 [0082.482] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.482] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x76750000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="KERNEL32.DLL") returned 0xc [0082.482] CoTaskMemFree (pv=0x5fcd98) [0082.482] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.482] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x76750000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\KERNEL32.DLL" (normalized: "c:\\windows\\system32\\kernel32.dll")) returned 0x20 [0082.482] CoTaskMemFree (pv=0x5fcd98) [0082.482] GetModuleInformation (in: hProcess=0x2f4, hModule=0x747b0000, lpmodinfo=0x238df80, cb=0xc | out: lpmodinfo=0x238df80*(lpBaseOfDll=0x747b0000, SizeOfImage=0x1c2000, EntryPoint=0x7489ff30)) returned 1 [0082.483] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.483] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x747b0000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0082.483] CoTaskMemFree (pv=0x5fcd98) [0082.483] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.483] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x747b0000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\KERNELBASE.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")) returned 0x22 [0082.483] CoTaskMemFree (pv=0x5fcd98) [0082.483] GetModuleInformation (in: hProcess=0x2f4, hModule=0x74270000, lpmodinfo=0x239009c, cb=0xc | out: lpmodinfo=0x239009c*(lpBaseOfDll=0x74270000, SizeOfImage=0x93000, EntryPoint=0x742a4270)) returned 1 [0082.483] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.483] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x74270000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="apphelp.dll") returned 0xb [0082.483] CoTaskMemFree (pv=0x5fcd98) [0082.483] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.483] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x74270000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\SYSTEM32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll")) returned 0x1f [0082.484] CoTaskMemFree (pv=0x5fcd98) [0082.484] GetModuleInformation (in: hProcess=0x2f4, hModule=0x76470000, lpmodinfo=0x23921d4, cb=0xc | out: lpmodinfo=0x23921d4*(lpBaseOfDll=0x76470000, SizeOfImage=0xf3000, EntryPoint=0x764aa100)) returned 1 [0082.484] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.484] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x76470000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0082.484] CoTaskMemFree (pv=0x5fcd98) [0082.484] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.484] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x76470000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")) returned 0x1d [0082.484] CoTaskMemFree (pv=0x5fcd98) [0082.484] GetModuleInformation (in: hProcess=0x2f4, hModule=0x77130000, lpmodinfo=0x23942d8, cb=0xc | out: lpmodinfo=0x23942d8*(lpBaseOfDll=0x77130000, SizeOfImage=0x238000, EntryPoint=0x7724e060)) returned 1 [0082.484] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.484] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x77130000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="combase.dll") returned 0xb [0082.484] CoTaskMemFree (pv=0x5fcd98) [0082.484] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.484] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x77130000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")) returned 0x1f [0082.485] CoTaskMemFree (pv=0x5fcd98) [0082.485] GetModuleInformation (in: hProcess=0x2f4, hModule=0x77370000, lpmodinfo=0x23963e4, cb=0xc | out: lpmodinfo=0x23963e4*(lpBaseOfDll=0x77370000, SizeOfImage=0x118000, EntryPoint=0x7739a3c0)) returned 1 [0082.485] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.485] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x77370000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="ucrtbase.dll") returned 0xc [0082.485] CoTaskMemFree (pv=0x5fcd98) [0082.485] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.485] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x77370000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll")) returned 0x20 [0082.485] CoTaskMemFree (pv=0x5fcd98) [0082.485] GetModuleInformation (in: hProcess=0x2f4, hModule=0x76570000, lpmodinfo=0x23984f8, cb=0xc | out: lpmodinfo=0x23984f8*(lpBaseOfDll=0x76570000, SizeOfImage=0xc0000, EntryPoint=0x7659fb20)) returned 1 [0082.485] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.485] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x76570000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0082.485] CoTaskMemFree (pv=0x5fcd98) [0082.485] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.485] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x76570000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\RPCRT4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")) returned 0x1e [0082.486] CoTaskMemFree (pv=0x5fcd98) [0082.486] GetModuleInformation (in: hProcess=0x2f4, hModule=0x74320000, lpmodinfo=0x239a650, cb=0xc | out: lpmodinfo=0x239a650*(lpBaseOfDll=0x74320000, SizeOfImage=0x20000, EntryPoint=0x7432c9a0)) returned 1 [0082.486] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.486] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x74320000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0082.486] CoTaskMemFree (pv=0x5fcd98) [0082.486] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.486] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x74320000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\SspiCli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")) returned 0x1f [0082.486] CoTaskMemFree (pv=0x5fcd98) [0082.486] GetModuleInformation (in: hProcess=0x2f4, hModule=0x74310000, lpmodinfo=0x239c75c, cb=0xc | out: lpmodinfo=0x239c75c*(lpBaseOfDll=0x74310000, SizeOfImage=0xa000, EntryPoint=0x74312a00)) returned 1 [0082.486] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.486] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x74310000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0082.486] CoTaskMemFree (pv=0x5fcd98) [0082.486] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.487] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x74310000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\CRYPTBASE.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")) returned 0x21 [0082.487] CoTaskMemFree (pv=0x5fcd98) [0082.487] GetModuleInformation (in: hProcess=0x2f4, hModule=0x744e0000, lpmodinfo=0x239e870, cb=0xc | out: lpmodinfo=0x239e870*(lpBaseOfDll=0x744e0000, SizeOfImage=0x57000, EntryPoint=0x7451de40)) returned 1 [0082.487] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.487] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x744e0000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="bcryptPrimitives.dll") returned 0x14 [0082.487] CoTaskMemFree (pv=0x5fcd98) [0082.487] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.487] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x744e0000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\bcryptPrimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")) returned 0x28 [0082.487] CoTaskMemFree (pv=0x5fcd98) [0082.487] GetModuleInformation (in: hProcess=0x2f4, hModule=0x761a0000, lpmodinfo=0x23a09a4, cb=0xc | out: lpmodinfo=0x23a09a4*(lpBaseOfDll=0x761a0000, SizeOfImage=0x41000, EntryPoint=0x761b3400)) returned 1 [0082.487] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.487] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x761a0000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0082.487] CoTaskMemFree (pv=0x5fcd98) [0082.488] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.488] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x761a0000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")) returned 0x1f [0082.488] CoTaskMemFree (pv=0x5fcd98) [0082.488] GetModuleInformation (in: hProcess=0x2f4, hModule=0x76920000, lpmodinfo=0x23a2ab0, cb=0xc | out: lpmodinfo=0x23a2ab0*(lpBaseOfDll=0x76920000, SizeOfImage=0x21000, EntryPoint=0x76926900)) returned 1 [0082.488] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.488] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x76920000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0082.488] CoTaskMemFree (pv=0x5fcd98) [0082.488] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.488] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x76920000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\GDI32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")) returned 0x1d [0082.488] CoTaskMemFree (pv=0x5fcd98) [0082.488] GetModuleInformation (in: hProcess=0x2f4, hModule=0x74380000, lpmodinfo=0x23a4bb4, cb=0xc | out: lpmodinfo=0x23a4bb4*(lpBaseOfDll=0x74380000, SizeOfImage=0x158000, EntryPoint=0x7443a9c0)) returned 1 [0082.488] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.488] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x74380000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="gdi32full.dll") returned 0xd [0082.489] CoTaskMemFree (pv=0x5fcd98) [0082.489] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.489] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x74380000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\gdi32full.dll" (normalized: "c:\\windows\\system32\\gdi32full.dll")) returned 0x21 [0082.489] CoTaskMemFree (pv=0x5fcd98) [0082.489] GetModuleInformation (in: hProcess=0x2f4, hModule=0x76630000, lpmodinfo=0x23a6cc8, cb=0xc | out: lpmodinfo=0x23a6cc8*(lpBaseOfDll=0x76630000, SizeOfImage=0x79000, EntryPoint=0x76644180)) returned 1 [0082.489] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.489] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x76630000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="msvcp_win.dll") returned 0xd [0082.489] CoTaskMemFree (pv=0x5fcd98) [0082.489] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.489] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x76630000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\msvcp_win.dll" (normalized: "c:\\windows\\system32\\msvcp_win.dll")) returned 0x21 [0082.489] CoTaskMemFree (pv=0x5fcd98) [0082.489] GetModuleInformation (in: hProcess=0x2f4, hModule=0x76240000, lpmodinfo=0x23a8ddc, cb=0xc | out: lpmodinfo=0x23a8ddc*(lpBaseOfDll=0x76240000, SizeOfImage=0x13c000, EntryPoint=0x7626b3d0)) returned 1 [0082.489] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.490] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x76240000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0082.490] CoTaskMemFree (pv=0x5fcd98) [0082.490] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.490] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x76240000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\USER32.dll" (normalized: "c:\\windows\\system32\\user32.dll")) returned 0x1e [0082.490] CoTaskMemFree (pv=0x5fcd98) [0082.490] GetModuleInformation (in: hProcess=0x2f4, hModule=0x77100000, lpmodinfo=0x23aaf74, cb=0xc | out: lpmodinfo=0x23aaf74*(lpBaseOfDll=0x77100000, SizeOfImage=0x16000, EntryPoint=0x0)) returned 1 [0082.490] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.491] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x77100000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="win32u.dll") returned 0xa [0082.491] CoTaskMemFree (pv=0x5fcd98) [0082.491] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.491] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x77100000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\win32u.dll" (normalized: "c:\\windows\\system32\\win32u.dll")) returned 0x1e [0082.491] CoTaskMemFree (pv=0x5fcd98) [0082.491] GetModuleInformation (in: hProcess=0x2f4, hModule=0x76950000, lpmodinfo=0x23ad080, cb=0xc | out: lpmodinfo=0x23ad080*(lpBaseOfDll=0x76950000, SizeOfImage=0x96000, EntryPoint=0x76988f60)) returned 1 [0082.491] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.491] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x76950000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0082.491] CoTaskMemFree (pv=0x5fcd98) [0082.491] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.491] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x76950000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\OLEAUT32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")) returned 0x20 [0082.491] CoTaskMemFree (pv=0x5fcd98) [0082.491] GetModuleInformation (in: hProcess=0x2f4, hModule=0x77670000, lpmodinfo=0x23af194, cb=0xc | out: lpmodinfo=0x23af194*(lpBaseOfDll=0x77670000, SizeOfImage=0x25000, EntryPoint=0x776747d0)) returned 1 [0082.492] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.492] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x77670000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0082.492] CoTaskMemFree (pv=0x5fcd98) [0082.492] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.492] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x77670000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0082.492] CoTaskMemFree (pv=0x5fcd98) [0082.492] GetModuleInformation (in: hProcess=0x2f4, hModule=0x77840000, lpmodinfo=0x23b1298, cb=0xc | out: lpmodinfo=0x23b1298*(lpBaseOfDll=0x77840000, SizeOfImage=0xe000, EntryPoint=0x77843e30)) returned 1 [0082.492] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.492] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x77840000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="kernel.appcore.dll") returned 0x12 [0082.492] CoTaskMemFree (pv=0x5fcd98) [0082.492] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.492] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x77840000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")) returned 0x26 [0082.493] CoTaskMemFree (pv=0x5fcd98) [0082.493] GetModuleInformation (in: hProcess=0x2f4, hModule=0x77750000, lpmodinfo=0x23b33c4, cb=0xc | out: lpmodinfo=0x23b33c4*(lpBaseOfDll=0x77750000, SizeOfImage=0xbd000, EntryPoint=0x777855e0)) returned 1 [0082.493] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.493] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x77750000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0082.493] CoTaskMemFree (pv=0x5fcd98) [0082.493] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.493] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x77750000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")) returned 0x1e [0082.493] CoTaskMemFree (pv=0x5fcd98) [0082.493] GetModuleInformation (in: hProcess=0x2f4, hModule=0x741f0000, lpmodinfo=0x23b54d0, cb=0xc | out: lpmodinfo=0x23b54d0*(lpBaseOfDll=0x741f0000, SizeOfImage=0x78000, EntryPoint=0x742285b0)) returned 1 [0082.493] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.493] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x741f0000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0082.493] CoTaskMemFree (pv=0x5fcd98) [0082.494] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.494] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x741f0000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0082.494] CoTaskMemFree (pv=0x5fcd98) [0082.494] GetModuleInformation (in: hProcess=0x2f4, hModule=0x74160000, lpmodinfo=0x23b75dc, cb=0xc | out: lpmodinfo=0x23b75dc*(lpBaseOfDll=0x74160000, SizeOfImage=0x55000, EntryPoint=0x74190a30)) returned 1 [0082.494] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.494] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x74160000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="mscoree.dll") returned 0xb [0082.494] CoTaskMemFree (pv=0x5fcd98) [0082.494] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.494] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x74160000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\SYSTEM32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0082.494] CoTaskMemFree (pv=0x5fcd98) [0082.494] GetModuleInformation (in: hProcess=0x2f4, hModule=0x76390000, lpmodinfo=0x23b96e8, cb=0xc | out: lpmodinfo=0x23b96e8*(lpBaseOfDll=0x76390000, SizeOfImage=0x77000, EntryPoint=0x763ae5b0)) returned 1 [0082.494] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.494] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x76390000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0082.495] CoTaskMemFree (pv=0x5fcd98) [0082.495] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.495] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x76390000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\ADVAPI32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")) returned 0x20 [0082.495] CoTaskMemFree (pv=0x5fcd98) [0082.495] GetModuleInformation (in: hProcess=0x2f4, hModule=0x740e0000, lpmodinfo=0x23bb7fc, cb=0xc | out: lpmodinfo=0x23bb7fc*(lpBaseOfDll=0x740e0000, SizeOfImage=0x7d000, EntryPoint=0x740e3c80)) returned 1 [0082.495] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.495] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x740e0000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0082.495] CoTaskMemFree (pv=0x5fcd98) [0082.495] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.495] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x740e0000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0082.495] CoTaskMemFree (pv=0x5fcd98) [0082.495] GetModuleInformation (in: hProcess=0x2f4, hModule=0x739f0000, lpmodinfo=0x23bd944, cb=0xc | out: lpmodinfo=0x23bd944*(lpBaseOfDll=0x739f0000, SizeOfImage=0x6e6000, EntryPoint=0x73a083d0)) returned 1 [0082.495] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.495] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x739f0000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0082.496] CoTaskMemFree (pv=0x5fcd98) [0082.496] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.496] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x739f0000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0082.496] CoTaskMemFree (pv=0x5fcd98) [0082.496] GetModuleInformation (in: hProcess=0x2f4, hModule=0x74980000, lpmodinfo=0x23bfa74, cb=0xc | out: lpmodinfo=0x23bfa74*(lpBaseOfDll=0x74980000, SizeOfImage=0x45000, EntryPoint=0x74999260)) returned 1 [0082.496] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.496] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x74980000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0082.496] CoTaskMemFree (pv=0x5fcd98) [0082.496] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.496] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x74980000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\SHLWAPI.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")) returned 0x1f [0082.496] CoTaskMemFree (pv=0x5fcd98) [0082.496] GetModuleInformation (in: hProcess=0x2f4, hModule=0x738f0000, lpmodinfo=0x23c1b80, cb=0xc | out: lpmodinfo=0x23c1b80*(lpBaseOfDll=0x738f0000, SizeOfImage=0xf5000, EntryPoint=0x73944180)) returned 1 [0082.497] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.497] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x738f0000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0082.497] CoTaskMemFree (pv=0x5fcd98) [0082.497] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.497] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x738f0000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\SYSTEM32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0082.497] CoTaskMemFree (pv=0x5fcd98) [0082.497] GetModuleInformation (in: hProcess=0x2f4, hModule=0x72560000, lpmodinfo=0x23c3cb4, cb=0xc | out: lpmodinfo=0x23c3cb4*(lpBaseOfDll=0x72560000, SizeOfImage=0x138d000, EntryPoint=0x0)) returned 1 [0082.497] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.497] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x72560000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0082.497] CoTaskMemFree (pv=0x5fcd98) [0082.497] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.497] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x72560000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\f12799647dc4f4abd2f0f17790337f04\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\f12799647dc4f4abd2f0f17790337f04\\mscorlib.ni.dll")) returned 0x68 [0082.498] CoTaskMemFree (pv=0x5fcd98) [0082.498] GetModuleInformation (in: hProcess=0x2f4, hModule=0x72540000, lpmodinfo=0x23c5e5c, cb=0xc | out: lpmodinfo=0x23c5e5c*(lpBaseOfDll=0x72540000, SizeOfImage=0x13000, EntryPoint=0x72546c40)) returned 1 [0082.498] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.498] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x72540000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0082.498] CoTaskMemFree (pv=0x5fcd98) [0082.498] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.498] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x72540000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\SYSTEM32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0082.498] CoTaskMemFree (pv=0x5fcd98) [0082.498] GetModuleInformation (in: hProcess=0x2f4, hModule=0x72510000, lpmodinfo=0x23c7f68, cb=0xc | out: lpmodinfo=0x23c7f68*(lpBaseOfDll=0x72510000, SizeOfImage=0x2f000, EntryPoint=0x7251c000)) returned 1 [0082.498] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.498] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x72510000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0082.499] CoTaskMemFree (pv=0x5fcd98) [0082.499] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.499] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x72510000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0082.499] CoTaskMemFree (pv=0x5fcd98) [0082.499] GetModuleInformation (in: hProcess=0x2f4, hModule=0x724f0000, lpmodinfo=0x23ca074, cb=0xc | out: lpmodinfo=0x23ca074*(lpBaseOfDll=0x724f0000, SizeOfImage=0x18000, EntryPoint=0x724f8f30)) returned 1 [0082.499] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.499] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x724f0000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="bcrypt.dll") returned 0xa [0082.499] CoTaskMemFree (pv=0x5fcd98) [0082.499] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.499] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x724f0000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\SYSTEM32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")) returned 0x1e [0082.499] CoTaskMemFree (pv=0x5fcd98) [0082.499] GetModuleInformation (in: hProcess=0x2f4, hModule=0x72470000, lpmodinfo=0x23cc28c, cb=0xc | out: lpmodinfo=0x23cc28c*(lpBaseOfDll=0x72470000, SizeOfImage=0x80000, EntryPoint=0x72471180)) returned 1 [0082.499] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.499] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x72470000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0082.500] CoTaskMemFree (pv=0x5fcd98) [0082.500] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.500] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x72470000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0082.500] CoTaskMemFree (pv=0x5fcd98) [0082.500] GetModuleInformation (in: hProcess=0x2f4, hModule=0x71a90000, lpmodinfo=0x23ce3cc, cb=0xc | out: lpmodinfo=0x23ce3cc*(lpBaseOfDll=0x71a90000, SizeOfImage=0x9df000, EntryPoint=0x0)) returned 1 [0082.500] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.500] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x71a90000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0082.500] CoTaskMemFree (pv=0x5fcd98) [0082.500] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.500] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x71a90000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\assembly\\NativeImages_v4.0.30319_32\\System\\fcfb8bac8ea9a0e69d72c350b22f8e3f\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\fcfb8bac8ea9a0e69d72c350b22f8e3f\\system.ni.dll")) returned 0x64 [0082.500] CoTaskMemFree (pv=0x5fcd98) [0082.500] GetModuleInformation (in: hProcess=0x2f4, hModule=0x718f0000, lpmodinfo=0x23d0568, cb=0xc | out: lpmodinfo=0x23d0568*(lpBaseOfDll=0x718f0000, SizeOfImage=0x194000, EntryPoint=0x0)) returned 1 [0082.500] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.501] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x718f0000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0082.501] CoTaskMemFree (pv=0x5fcd98) [0082.501] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.501] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x718f0000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\5b307e2b9719b21749a8c73127ab5f45\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\5b307e2b9719b21749a8c73127ab5f45\\system.drawing.ni.dll")) returned 0x74 [0082.501] CoTaskMemFree (pv=0x5fcd98) [0082.501] GetModuleInformation (in: hProcess=0x2f4, hModule=0x70bf0000, lpmodinfo=0x23d2734, cb=0xc | out: lpmodinfo=0x23d2734*(lpBaseOfDll=0x70bf0000, SizeOfImage=0xcf2000, EntryPoint=0x0)) returned 1 [0082.501] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.501] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x70bf0000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0082.501] CoTaskMemFree (pv=0x5fcd98) [0082.501] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.501] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x70bf0000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\02d3b6022cc1ee466eb660dedcff59aa\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\02d3b6022cc1ee466eb660dedcff59aa\\system.windows.forms.ni.dll")) returned 0x80 [0082.502] CoTaskMemFree (pv=0x5fcd98) [0082.502] GetModuleInformation (in: hProcess=0x2f4, hModule=0x77830000, lpmodinfo=0x23d4924, cb=0xc | out: lpmodinfo=0x23d4924*(lpBaseOfDll=0x77830000, SizeOfImage=0x6000, EntryPoint=0x77831460)) returned 1 [0082.502] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.502] GetModuleBaseNameW (in: hProcess=0x2f4, hModule=0x77830000, lpBaseName=0x5fcd98, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0082.502] CoTaskMemFree (pv=0x5fcd98) [0082.502] CoTaskMemAlloc (cb=0x804) returned 0x5fcd98 [0082.502] GetModuleFileNameExW (in: hProcess=0x2f4, hModule=0x77830000, lpFilename=0x5fcd98, nSize=0x800 | out: lpFilename="C:\\WINDOWS\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll")) returned 0x1d [0082.502] CoTaskMemFree (pv=0x5fcd98) [0082.502] CloseHandle (hObject=0x2f4) returned 1 [0082.572] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x19d898 | out: phkResult=0x19d898*=0x0) returned 0x2 [0082.572] RegCloseKey (hKey=0x80000002) returned 0x0 [0082.575] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll", nBufferLength=0x105, lpBuffer=0x19db18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll", lpFilePart=0x0) returned 0x38 [0082.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19dfcc) returned 1 [0082.576] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll"), fInfoLevelId=0x0, lpFileInformation=0x19e048 | out: lpFileInformation=0x19e048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x795c1cb6, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x795c1cb6, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x795c1cb6, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x7faa0)) returned 1 [0082.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19dfc8) returned 1 [0082.580] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll", lpdwHandle=0x19e0bc | out: lpdwHandle=0x19e0bc) returned 0x814 [0082.580] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll", dwHandle=0x0, dwLen=0x814, lpData=0x23d80cc | out: lpData=0x23d80cc) returned 1 [0082.581] VerQueryValueW (in: pBlock=0x23d80cc, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19e090, puLen=0x19e08c | out: lplpBuffer=0x19e090*=0x23d84d0, puLen=0x19e08c) returned 1 [0082.584] VerQueryValueW (in: pBlock=0x23d80cc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x19e010, puLen=0x19e00c | out: lplpBuffer=0x19e010*=0x23d8184, puLen=0x19e00c) returned 1 [0082.584] VerQueryValueW (in: pBlock=0x23d80cc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x19e010, puLen=0x19e00c | out: lplpBuffer=0x19e010*=0x23d81d8, puLen=0x19e00c) returned 1 [0082.584] VerQueryValueW (in: pBlock=0x23d80cc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x19e010, puLen=0x19e00c | out: lplpBuffer=0x19e010*=0x23d8254, puLen=0x19e00c) returned 1 [0082.584] VerQueryValueW (in: pBlock=0x23d80cc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x19e010, puLen=0x19e00c | out: lplpBuffer=0x19e010*=0x23d82bc, puLen=0x19e00c) returned 1 [0082.584] VerQueryValueW (in: pBlock=0x23d80cc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x19e010, puLen=0x19e00c | out: lplpBuffer=0x19e010*=0x23d82f8, puLen=0x19e00c) returned 1 [0082.584] VerQueryValueW (in: pBlock=0x23d80cc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x19e010, puLen=0x19e00c | out: lplpBuffer=0x19e010*=0x23d8380, puLen=0x19e00c) returned 1 [0082.584] VerQueryValueW (in: pBlock=0x23d80cc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x19e010, puLen=0x19e00c | out: lplpBuffer=0x19e010*=0x23d83b8, puLen=0x19e00c) returned 1 [0082.584] VerQueryValueW (in: pBlock=0x23d80cc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x19e010, puLen=0x19e00c | out: lplpBuffer=0x19e010*=0x23d8410, puLen=0x19e00c) returned 1 [0082.584] VerQueryValueW (in: pBlock=0x23d80cc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x19e010, puLen=0x19e00c | out: lplpBuffer=0x19e010*=0x23d8440, puLen=0x19e00c) returned 1 [0082.584] VerQueryValueW (in: pBlock=0x23d80cc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x19e010, puLen=0x19e00c | out: lplpBuffer=0x19e010*=0x0, puLen=0x19e00c) returned 0 [0082.584] VerQueryValueW (in: pBlock=0x23d80cc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x19e010, puLen=0x19e00c | out: lplpBuffer=0x19e010*=0x23d847c, puLen=0x19e00c) returned 1 [0082.584] VerQueryValueW (in: pBlock=0x23d80cc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x19e010, puLen=0x19e00c | out: lplpBuffer=0x19e010*=0x0, puLen=0x19e00c) returned 0 [0082.585] VerQueryValueW (in: pBlock=0x23d80cc, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19e004, puLen=0x19e000 | out: lplpBuffer=0x19e004*=0x23d84d0, puLen=0x19e000) returned 1 [0082.585] VerLanguageNameW (in: wLang=0x409, szLang=0x19dd94, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0082.586] VerQueryValueW (in: pBlock=0x23d80cc, lpSubBlock="\\", lplpBuffer=0x19e014, puLen=0x19e010 | out: lplpBuffer=0x19e014*=0x23d80f4, puLen=0x19e010) returned 1 [0082.683] GetCurrentProcessId () returned 0x10c4 [0082.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OpenProcess", cchWideChar=11, lpMultiByteStr=0x19e04c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OpenProcesssU\x82ü\x01Ýá\x07Bðù\x9fsHç\x19", lpUsedDefaultChar=0x0) returned 11 [0082.695] GetProcAddress (hModule=0x76750000, lpProcName="OpenProcess") returned 0x76765cc0 [0082.705] OpenProcess (dwDesiredAccess=0x38, bInheritHandle=1, dwProcessId=0x10c4) returned 0xe8 [0082.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualProtect", cchWideChar=14, lpMultiByteStr=0x19e054, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VirtualProtectü\x01Ýá\x07Bðù\x9fsHç\x19", lpUsedDefaultChar=0x0) returned 14 [0082.764] GetProcAddress (hModule=0x76750000, lpProcName="VirtualProtect") returned 0x76766a30 [0082.778] VirtualProtect (in: lpAddress=0x21d0260, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.781] VirtualProtect (in: lpAddress=0x21d0260, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.781] VirtualProtect (in: lpAddress=0x21d02b8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.782] VirtualProtect (in: lpAddress=0x21d02b8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.782] VirtualProtect (in: lpAddress=0x21d0374, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.782] VirtualProtect (in: lpAddress=0x21d0374, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.782] VirtualProtect (in: lpAddress=0x21d0384, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.783] VirtualProtect (in: lpAddress=0x21d0384, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.783] VirtualProtect (in: lpAddress=0x21d03a8, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.783] VirtualProtect (in: lpAddress=0x21d03a8, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.784] VirtualProtect (in: lpAddress=0x21d03b8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.784] VirtualProtect (in: lpAddress=0x21d03b8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.784] VirtualProtect (in: lpAddress=0x21d03cc, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.785] VirtualProtect (in: lpAddress=0x21d03cc, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.785] VirtualProtect (in: lpAddress=0x21d03dc, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.785] VirtualProtect (in: lpAddress=0x21d03dc, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.785] VirtualProtect (in: lpAddress=0x21d03ec, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.786] VirtualProtect (in: lpAddress=0x21d03ec, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.786] VirtualProtect (in: lpAddress=0x21d03fc, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.786] VirtualProtect (in: lpAddress=0x21d03fc, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.787] VirtualProtect (in: lpAddress=0x21d040c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.787] VirtualProtect (in: lpAddress=0x21d040c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.788] VirtualProtect (in: lpAddress=0x21d0504, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.788] VirtualProtect (in: lpAddress=0x21d0504, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.788] VirtualProtect (in: lpAddress=0x21d0514, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.789] VirtualProtect (in: lpAddress=0x21d0514, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.789] VirtualProtect (in: lpAddress=0x21d0528, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.789] VirtualProtect (in: lpAddress=0x21d0528, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.789] VirtualProtect (in: lpAddress=0x21d0538, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.790] VirtualProtect (in: lpAddress=0x21d0538, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.790] VirtualProtect (in: lpAddress=0x21d0548, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.790] VirtualProtect (in: lpAddress=0x21d0548, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.790] VirtualProtect (in: lpAddress=0x21d0634, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.791] VirtualProtect (in: lpAddress=0x21d0634, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.791] VirtualProtect (in: lpAddress=0x21d096c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.791] VirtualProtect (in: lpAddress=0x21d096c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.791] VirtualProtect (in: lpAddress=0x21d0db4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.792] VirtualProtect (in: lpAddress=0x21d0db4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.792] VirtualProtect (in: lpAddress=0x21d0ebc, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.792] VirtualProtect (in: lpAddress=0x21d0ebc, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.792] VirtualProtect (in: lpAddress=0x21d0fa0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.793] VirtualProtect (in: lpAddress=0x21d0fa0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.793] VirtualProtect (in: lpAddress=0x21d10d8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.793] VirtualProtect (in: lpAddress=0x21d10d8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.793] VirtualProtect (in: lpAddress=0x21d1568, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.794] VirtualProtect (in: lpAddress=0x21d1568, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.794] VirtualProtect (in: lpAddress=0x21d16a8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.794] VirtualProtect (in: lpAddress=0x21d16a8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.794] VirtualProtect (in: lpAddress=0x21d1bd0, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.794] VirtualProtect (in: lpAddress=0x21d1bd0, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.795] VirtualProtect (in: lpAddress=0x21d1be0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.795] VirtualProtect (in: lpAddress=0x21d1be0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.795] VirtualProtect (in: lpAddress=0x21d1c98, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.795] VirtualProtect (in: lpAddress=0x21d1c98, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.795] VirtualProtect (in: lpAddress=0x21d1f04, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.796] VirtualProtect (in: lpAddress=0x21d1f04, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.796] VirtualProtect (in: lpAddress=0x21d1f14, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.796] VirtualProtect (in: lpAddress=0x21d1f14, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.796] VirtualProtect (in: lpAddress=0x21d1f24, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.796] VirtualProtect (in: lpAddress=0x21d1f24, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.797] VirtualProtect (in: lpAddress=0x21d1f38, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.797] VirtualProtect (in: lpAddress=0x21d1f38, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.797] VirtualProtect (in: lpAddress=0x21d1f4c, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.797] VirtualProtect (in: lpAddress=0x21d1f4c, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.797] VirtualProtect (in: lpAddress=0x21d2044, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.798] VirtualProtect (in: lpAddress=0x21d2044, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.798] VirtualProtect (in: lpAddress=0x21d2058, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.798] VirtualProtect (in: lpAddress=0x21d2058, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.798] VirtualProtect (in: lpAddress=0x21d2084, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.798] VirtualProtect (in: lpAddress=0x21d2084, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.799] VirtualProtect (in: lpAddress=0x21d221c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.799] VirtualProtect (in: lpAddress=0x21d221c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.799] VirtualProtect (in: lpAddress=0x21d231c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.799] VirtualProtect (in: lpAddress=0x21d231c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.799] VirtualProtect (in: lpAddress=0x21d2330, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.800] VirtualProtect (in: lpAddress=0x21d2330, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.800] VirtualProtect (in: lpAddress=0x21d2340, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.800] VirtualProtect (in: lpAddress=0x21d2340, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.800] VirtualProtect (in: lpAddress=0x21d2350, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.800] VirtualProtect (in: lpAddress=0x21d2350, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.801] VirtualProtect (in: lpAddress=0x21ddf28, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.801] VirtualProtect (in: lpAddress=0x21ddf28, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.801] VirtualProtect (in: lpAddress=0x21ddf40, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.801] VirtualProtect (in: lpAddress=0x21ddf40, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.801] VirtualProtect (in: lpAddress=0x21ddf98, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.802] VirtualProtect (in: lpAddress=0x21ddf98, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.802] VirtualProtect (in: lpAddress=0x21ddfac, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.802] VirtualProtect (in: lpAddress=0x21ddfac, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.914] VirtualProtect (in: lpAddress=0x21ddfc4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.914] VirtualProtect (in: lpAddress=0x21ddfc4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.915] VirtualProtect (in: lpAddress=0x21de048, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.915] VirtualProtect (in: lpAddress=0x21de048, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.915] VirtualProtect (in: lpAddress=0x21de058, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.915] VirtualProtect (in: lpAddress=0x21de058, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.915] VirtualProtect (in: lpAddress=0x21de068, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.916] VirtualProtect (in: lpAddress=0x21de068, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.916] VirtualProtect (in: lpAddress=0x21de080, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.916] VirtualProtect (in: lpAddress=0x21de080, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.916] VirtualProtect (in: lpAddress=0x21de098, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.916] VirtualProtect (in: lpAddress=0x21de098, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.917] VirtualProtect (in: lpAddress=0x21de0a8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.917] VirtualProtect (in: lpAddress=0x21de0a8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.917] VirtualProtect (in: lpAddress=0x21de0bc, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.917] VirtualProtect (in: lpAddress=0x21de0bc, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.917] VirtualProtect (in: lpAddress=0x21de0dc, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.918] VirtualProtect (in: lpAddress=0x21de0dc, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.918] VirtualProtect (in: lpAddress=0x21de0f0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.918] VirtualProtect (in: lpAddress=0x21de0f0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.918] VirtualProtect (in: lpAddress=0x21de4e4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.918] VirtualProtect (in: lpAddress=0x21de4e4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.919] VirtualProtect (in: lpAddress=0x21de598, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.919] VirtualProtect (in: lpAddress=0x21de598, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.919] VirtualProtect (in: lpAddress=0x21de5ac, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.919] VirtualProtect (in: lpAddress=0x21de5ac, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.919] VirtualProtect (in: lpAddress=0x21e1ef8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.920] VirtualProtect (in: lpAddress=0x21e1ef8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.920] VirtualProtect (in: lpAddress=0x21e1f88, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.920] VirtualProtect (in: lpAddress=0x21e1f88, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.920] VirtualProtect (in: lpAddress=0x21e2020, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.920] VirtualProtect (in: lpAddress=0x21e2020, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.921] VirtualProtect (in: lpAddress=0x21e205c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.921] VirtualProtect (in: lpAddress=0x21e205c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.921] VirtualProtect (in: lpAddress=0x21e20a8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.921] VirtualProtect (in: lpAddress=0x21e20a8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.921] VirtualProtect (in: lpAddress=0x21e20d4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.922] VirtualProtect (in: lpAddress=0x21e20d4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.922] VirtualProtect (in: lpAddress=0x21e2104, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.922] VirtualProtect (in: lpAddress=0x21e2104, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.922] VirtualProtect (in: lpAddress=0x21e2154, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.922] VirtualProtect (in: lpAddress=0x21e2154, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.923] VirtualProtect (in: lpAddress=0x21e21d8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.923] VirtualProtect (in: lpAddress=0x21e21d8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.923] VirtualProtect (in: lpAddress=0x21e2238, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.923] VirtualProtect (in: lpAddress=0x21e2238, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.923] VirtualProtect (in: lpAddress=0x21e224c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.924] VirtualProtect (in: lpAddress=0x21e224c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.924] VirtualProtect (in: lpAddress=0x21e2260, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.924] VirtualProtect (in: lpAddress=0x21e2260, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.924] VirtualProtect (in: lpAddress=0x21e28c4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.924] VirtualProtect (in: lpAddress=0x21e28c4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.924] VirtualProtect (in: lpAddress=0x21e2c44, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.925] VirtualProtect (in: lpAddress=0x21e2c44, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.925] VirtualProtect (in: lpAddress=0x21e2c9c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.925] VirtualProtect (in: lpAddress=0x21e2c9c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.925] VirtualProtect (in: lpAddress=0x21e2cb0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.925] VirtualProtect (in: lpAddress=0x21e2cb0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.926] VirtualProtect (in: lpAddress=0x21e2cc4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.926] VirtualProtect (in: lpAddress=0x21e2cc4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.926] VirtualProtect (in: lpAddress=0x21e2cdc, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.926] VirtualProtect (in: lpAddress=0x21e2cdc, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.926] VirtualProtect (in: lpAddress=0x21e2cec, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.927] VirtualProtect (in: lpAddress=0x21e2cec, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.927] VirtualProtect (in: lpAddress=0x21e2d44, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.927] VirtualProtect (in: lpAddress=0x21e2d44, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.927] VirtualProtect (in: lpAddress=0x21e2d90, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.928] VirtualProtect (in: lpAddress=0x21e2d90, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.928] VirtualProtect (in: lpAddress=0x21e2dc8, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.928] VirtualProtect (in: lpAddress=0x21e2dc8, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.928] VirtualProtect (in: lpAddress=0x21e2dd8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.928] VirtualProtect (in: lpAddress=0x21e2dd8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.928] VirtualProtect (in: lpAddress=0x21e2df0, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.929] VirtualProtect (in: lpAddress=0x21e2df0, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.929] VirtualProtect (in: lpAddress=0x21e2e00, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.929] VirtualProtect (in: lpAddress=0x21e2e00, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.929] VirtualProtect (in: lpAddress=0x21e2e14, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.929] VirtualProtect (in: lpAddress=0x21e2e14, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.930] VirtualProtect (in: lpAddress=0x21e2e30, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.930] VirtualProtect (in: lpAddress=0x21e2e30, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.930] VirtualProtect (in: lpAddress=0x21e2e44, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.930] VirtualProtect (in: lpAddress=0x21e2e44, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.930] VirtualProtect (in: lpAddress=0x21e2e5c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.931] VirtualProtect (in: lpAddress=0x21e2e5c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.931] VirtualProtect (in: lpAddress=0x21e2e7c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.931] VirtualProtect (in: lpAddress=0x21e2e7c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.931] VirtualProtect (in: lpAddress=0x21e2e90, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.931] VirtualProtect (in: lpAddress=0x21e2e90, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.932] VirtualProtect (in: lpAddress=0x21e2eb0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.932] VirtualProtect (in: lpAddress=0x21e2eb0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.932] VirtualProtect (in: lpAddress=0x21e2ec4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.932] VirtualProtect (in: lpAddress=0x21e2ec4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.932] VirtualProtect (in: lpAddress=0x21e2ed8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.933] VirtualProtect (in: lpAddress=0x21e2ed8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.933] VirtualProtect (in: lpAddress=0x21e2eec, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.933] VirtualProtect (in: lpAddress=0x21e2eec, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.933] VirtualProtect (in: lpAddress=0x21e2f00, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.933] VirtualProtect (in: lpAddress=0x21e2f00, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.934] VirtualProtect (in: lpAddress=0x21e2f14, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.934] VirtualProtect (in: lpAddress=0x21e2f14, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.934] VirtualProtect (in: lpAddress=0x21e2f30, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.934] VirtualProtect (in: lpAddress=0x21e2f30, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.934] VirtualProtect (in: lpAddress=0x21e2f48, dwSize=0xc, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.935] VirtualProtect (in: lpAddress=0x21e2f48, dwSize=0xc, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.935] VirtualProtect (in: lpAddress=0x21e2f5c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.935] VirtualProtect (in: lpAddress=0x21e2f5c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.935] VirtualProtect (in: lpAddress=0x21e2f70, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.935] VirtualProtect (in: lpAddress=0x21e2f70, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.936] VirtualProtect (in: lpAddress=0x21e2f8c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.936] VirtualProtect (in: lpAddress=0x21e2f8c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.936] VirtualProtect (in: lpAddress=0x21e2fac, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.936] VirtualProtect (in: lpAddress=0x21e2fac, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19e454 | out: lpflOldProtect=0x19e454*=0x4) returned 1 [0082.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=11, lpMultiByteStr=0x19e058, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandlesU\x82ü\x01Ýá\x07Bðù\x9fsHç\x19", lpUsedDefaultChar=0x0) returned 11 [0082.944] GetProcAddress (hModule=0x76750000, lpProcName="CloseHandle") returned 0x767beab0 [0082.952] CloseHandle (hObject=0xe8) returned 1 [0083.146] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x19e950, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0083.208] IsAppThemed () returned 0x1 [0083.210] CoTaskMemAlloc (cb=0xf0) returned 0x63ab18 [0083.210] CreateActCtxA (pActCtx=0x19eea0) returned 0x63ad0c [0083.213] CoTaskMemFree (pv=0x63ab18) [0083.225] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc151 [0083.225] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc197 [0083.446] GetUserObjectInformationA (in: hObj=0x12c, nIndex=1, pvInfo=0x23dfe74, nLength=0xc, lpnLengthNeeded=0x19eea4 | out: pvInfo=0x23dfe74, lpnLengthNeeded=0x19eea4) returned 1 [0083.499] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x0 [0083.500] LoadLibraryW (lpLibFileName="shell32.dll") returned 0x74e50000 [0083.521] GetCurrentActCtx (in: lphActCtx=0x19ee98 | out: lphActCtx=0x19ee98*=0x0) returned 1 [0083.521] ActivateActCtx (in: hActCtx=0x63ad0c, lpCookie=0x19eea8 | out: hActCtx=0x63ad0c, lpCookie=0x19eea8) returned 1 [0083.522] GetCurrentProcess () returned 0xffffffff [0083.522] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x19ee98, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x19ee98*=0x370) returned 1 [0083.525] OleInitialize (pvReserved=0x0) returned 0x1 [0083.526] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x19ee60 | out: lplpMessageFilter=0x19ee60*=0x0) returned 0x0 [0083.529] GetCurrentThreadId () returned 0xfb0 [0083.531] EnumThreadWindows (dwThreadId=0xfb0, lpfn=0x1f94a86, lParam=0x0) returned 1 [0083.531] GetActiveWindow () returned 0x0 [0083.532] MessageBoxW (hWnd=0x0, lpText="This assembly is protected by an unregistered version of Eziriz's \".NET Reactor\"!", lpCaption="", uType=0x0) returned 1 [0084.272] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1e880001) returned 1 [0084.272] SendMessageW (hWnd=0x0, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0084.302] GetUserNameW (in: lpBuffer=0x19ece0, pcbBuffer=0x19ef58 | out: lpBuffer="FD1HVy", pcbBuffer=0x19ef58) returned 1 [0084.305] GetComputerNameW (in: lpBuffer=0x19ece0, nSize=0x19ef58 | out: lpBuffer="NQDPDE", nSize=0x19ef58) returned 1 [0084.717] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Info.exe.config", nBufferLength=0x105, lpBuffer=0x19e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Info.exe.config", lpFilePart=0x0) returned 0x2d [0084.719] CoTaskMemAlloc (cb=0x20c) returned 0x6095b8 [0084.719] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6095b8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\Info.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\info.exe")) returned 0x26 [0084.719] CoTaskMemFree (pv=0x6095b8) [0084.719] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Info.exe", nBufferLength=0x105, lpBuffer=0x19e7e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Info.exe", lpFilePart=0x0) returned 0x26 [0084.828] GetCurrentProcess () returned 0xffffffff [0084.828] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eb28 | out: TokenHandle=0x19eb28*=0x40c) returned 1 [0084.831] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x19e5b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0084.832] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19eb20 | out: lpFileInformation=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0084.834] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0084.834] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19eb28 | out: lpFileInformation=0x19eb28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0084.834] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x19e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0084.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea60) returned 1 [0084.835] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x428 [0084.835] GetFileType (hFile=0x428) returned 0x1 [0084.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea5c) returned 1 [0084.835] GetFileType (hFile=0x428) returned 0x1 [0084.968] GetFileSize (in: hFile=0x428, lpFileSizeHigh=0x19eb1c | out: lpFileSizeHigh=0x19eb1c*=0x0) returned 0x8c8f [0084.968] ReadFile (in: hFile=0x428, lpBuffer=0x23e8520, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ead8, lpOverlapped=0x0 | out: lpBuffer=0x23e8520*, lpNumberOfBytesRead=0x19ead8*=0x1000, lpOverlapped=0x0) returned 1 [0084.981] ReadFile (in: hFile=0x428, lpBuffer=0x23e8520, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e984, lpOverlapped=0x0 | out: lpBuffer=0x23e8520*, lpNumberOfBytesRead=0x19e984*=0x1000, lpOverlapped=0x0) returned 1 [0084.982] ReadFile (in: hFile=0x428, lpBuffer=0x23e8520, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e838, lpOverlapped=0x0 | out: lpBuffer=0x23e8520*, lpNumberOfBytesRead=0x19e838*=0x1000, lpOverlapped=0x0) returned 1 [0084.983] ReadFile (in: hFile=0x428, lpBuffer=0x23e8520, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e838, lpOverlapped=0x0 | out: lpBuffer=0x23e8520*, lpNumberOfBytesRead=0x19e838*=0x1000, lpOverlapped=0x0) returned 1 [0084.983] ReadFile (in: hFile=0x428, lpBuffer=0x23e8520, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e838, lpOverlapped=0x0 | out: lpBuffer=0x23e8520*, lpNumberOfBytesRead=0x19e838*=0x1000, lpOverlapped=0x0) returned 1 [0084.983] ReadFile (in: hFile=0x428, lpBuffer=0x23e8520, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e770, lpOverlapped=0x0 | out: lpBuffer=0x23e8520*, lpNumberOfBytesRead=0x19e770*=0x1000, lpOverlapped=0x0) returned 1 [0084.986] ReadFile (in: hFile=0x428, lpBuffer=0x23e8520, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e8f4, lpOverlapped=0x0 | out: lpBuffer=0x23e8520*, lpNumberOfBytesRead=0x19e8f4*=0x1000, lpOverlapped=0x0) returned 1 [0084.987] ReadFile (in: hFile=0x428, lpBuffer=0x23e8520, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e800, lpOverlapped=0x0 | out: lpBuffer=0x23e8520*, lpNumberOfBytesRead=0x19e800*=0x1000, lpOverlapped=0x0) returned 1 [0084.987] ReadFile (in: hFile=0x428, lpBuffer=0x23e8520, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e800, lpOverlapped=0x0 | out: lpBuffer=0x23e8520*, lpNumberOfBytesRead=0x19e800*=0xc8f, lpOverlapped=0x0) returned 1 [0084.987] ReadFile (in: hFile=0x428, lpBuffer=0x23e8520, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e8c4, lpOverlapped=0x0 | out: lpBuffer=0x23e8520*, lpNumberOfBytesRead=0x19e8c4*=0x0, lpOverlapped=0x0) returned 1 [0084.987] CloseHandle (hObject=0x428) returned 1 [0084.988] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Info.exe.config", nBufferLength=0x105, lpBuffer=0x19e7bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Info.exe.config", lpFilePart=0x0) returned 0x2d [0084.988] CoTaskMemAlloc (cb=0x20c) returned 0x6095b8 [0084.988] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6095b8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\Info.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\info.exe")) returned 0x26 [0084.988] CoTaskMemFree (pv=0x6095b8) [0084.988] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Info.exe", nBufferLength=0x105, lpBuffer=0x19e7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Info.exe", lpFilePart=0x0) returned 0x26 [0084.989] GetCurrentProcess () returned 0xffffffff [0084.989] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ec70 | out: TokenHandle=0x19ec70*=0x428) returned 1 [0084.990] GetCurrentProcess () returned 0xffffffff [0084.990] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ec70 | out: TokenHandle=0x19ec70*=0x42c) returned 1 [0084.990] GetCurrentProcess () returned 0xffffffff [0084.990] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eb28 | out: TokenHandle=0x19eb28*=0x41c) returned 1 [0084.990] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Info.exe.config" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\info.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19eb20 | out: lpFileInformation=0x19eb20*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0084.990] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Info.exe.config", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Info.exe.config", lpFilePart=0x0) returned 0x2d [0084.991] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Info.exe.config" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\info.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19eb28 | out: lpFileInformation=0x19eb28*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0084.991] GetCurrentProcess () returned 0xffffffff [0084.991] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ec70 | out: TokenHandle=0x19ec70*=0x420) returned 1 [0084.991] GetCurrentProcess () returned 0xffffffff [0084.991] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ec70 | out: TokenHandle=0x19ec70*=0x424) returned 1 [0085.054] GetCurrentProcess () returned 0xffffffff [0085.054] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ead0 | out: TokenHandle=0x19ead0*=0x430) returned 1 [0085.059] GetCurrentProcess () returned 0xffffffff [0085.059] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eae0 | out: TokenHandle=0x19eae0*=0x434) returned 1 [0085.065] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0085.066] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x6f550000 [0085.151] AdjustWindowRectEx (in: lpRect=0x19ef00, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x19ef00) returned 1 [0085.155] GetCurrentActCtx (in: lphActCtx=0x19ed74 | out: lphActCtx=0x19ed74*=0x0) returned 1 [0085.155] ActivateActCtx (in: hActCtx=0x63ad0c, lpCookie=0x19ed84 | out: hActCtx=0x63ad0c, lpCookie=0x19ed84) returned 1 [0085.155] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x709d0000 [0085.156] GetModuleHandleW (lpModuleName="user32.dll") returned 0x76240000 [0085.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x19ec38, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcWßpÝá\x07Bðù\x9fs°ò\x19", lpUsedDefaultChar=0x0) returned 14 [0085.157] GetProcAddress (hModule=0x76240000, lpProcName="DefWindowProcW") returned 0x742a0140 [0085.157] GetStockObject (i=5) returned 0x900015 [0085.161] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0085.162] CoTaskMemAlloc (cb=0x5c) returned 0x5f1488 [0085.162] RegisterClassW (lpWndClass=0x19ec28) returned 0xc1a0 [0085.163] CoTaskMemFree (pv=0x5f1488) [0085.163] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0085.163] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r10_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x80126 [0085.164] SetWindowLongW (hWnd=0x80126, nIndex=-4, dwNewLong=1948909888) returned 33114798 [0085.165] GetWindowLongW (hWnd=0x80126, nIndex=-4) returned 1948909888 [0085.168] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e448 | out: phkResult=0x19e448*=0x43c) returned 0x0 [0085.168] RegQueryValueExW (in: hKey=0x43c, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x19e468, lpData=0x0, lpcbData=0x19e464*=0x0 | out: lpType=0x19e468*=0x0, lpData=0x0, lpcbData=0x19e464*=0x0) returned 0x2 [0085.168] RegQueryValueExW (in: hKey=0x43c, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x19e468, lpData=0x0, lpcbData=0x19e464*=0x0 | out: lpType=0x19e468*=0x0, lpData=0x0, lpcbData=0x19e464*=0x0) returned 0x2 [0085.169] RegCloseKey (hKey=0x43c) returned 0x0 [0085.169] SetWindowLongW (hWnd=0x80126, nIndex=-4, dwNewLong=33114838) returned 1948909888 [0085.169] GetWindowLongW (hWnd=0x80126, nIndex=-4) returned 33114838 [0085.169] GetWindowLongW (hWnd=0x80126, nIndex=-16) returned 113311744 [0085.170] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc19a [0085.170] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc19b [0085.171] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x80126, Msg=0x81, wParam=0x0, lParam=0x19e798) returned 0x1 [0085.171] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x80126, Msg=0x83, wParam=0x0, lParam=0x19e784) returned 0x0 [0085.171] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x80126, Msg=0x1, wParam=0x0, lParam=0x19e798) returned 0x0 [0085.172] GetClientRect (in: hWnd=0x80126, lpRect=0x19e480 | out: lpRect=0x19e480) returned 1 [0085.172] GetWindowRect (in: hWnd=0x80126, lpRect=0x19e480 | out: lpRect=0x19e480) returned 1 [0085.173] GetParent (hWnd=0x80126) returned 0x0 [0085.173] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1e880004) returned 1 [0085.280] EtwEventRegister (in: ProviderId=0x2404c28, EnableCallback=0x1f94afe, CallbackContext=0x0, RegHandle=0x2404c04 | out: RegHandle=0x2404c04) returned 0x0 [0085.380] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6f550000 [0085.380] AdjustWindowRectEx (in: lpRect=0x19eec8, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19eec8) returned 1 [0085.380] GetSystemMetrics (nIndex=59) returned 1460 [0085.380] GetSystemMetrics (nIndex=60) returned 920 [0085.380] GetSystemMetrics (nIndex=34) returned 136 [0085.381] GetSystemMetrics (nIndex=35) returned 39 [0085.381] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6f550000 [0085.381] AdjustWindowRectEx (in: lpRect=0x19edc8, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19edc8) returned 1 [0085.438] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Info.exe.config", nBufferLength=0x105, lpBuffer=0x19e7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Info.exe.config", lpFilePart=0x0) returned 0x2d [0085.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec5c) returned 1 [0085.438] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Info.exe.config" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\info.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19ecd8 | out: lpFileInformation=0x19ecd8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0085.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec58) returned 1 [0086.490] GetSystemMetrics (nIndex=11) returned 32 [0086.490] GetSystemMetrics (nIndex=12) returned 32 [0086.491] GetDC (hWnd=0x0) returned 0x60100ce [0086.494] GetDeviceCaps (hdc=0x60100ce, index=12) returned 32 [0086.494] GetDeviceCaps (hdc=0x60100ce, index=14) returned 1 [0086.494] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0086.494] CreateIconFromResourceEx (presbits=0x242b4f8, dwResSize=0x10a8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0xf0113 [0086.521] CreateCompatibleDC (hdc=0x0) returned 0x390107d0 [0086.522] GetSystemDefaultLCID () returned 0x409 [0086.522] GetStockObject (i=17) returned 0xa01c1 [0086.523] GetObjectW (in: h=0xa01c1, c=92, pv=0x19ec1c | out: pv=0x19ec1c) returned 92 [0086.524] GetDC (hWnd=0x0) returned 0x60100ce [0086.582] GdiplusStartup (in: token=0x1f45b08, input=0x19e1d0, output=0x19e220 | out: token=0x1f45b08, output=0x19e220) returned 0x0 [0086.586] CoTaskMemAlloc (cb=0x5c) returned 0x5f1148 [0086.586] GdipCreateFontFromLogfontW (hdc=0x60100ce, logfont=0x5f1148, font=0x19ece4) returned 0x0 [0086.692] CoTaskMemFree (pv=0x5f1148) [0086.693] CoTaskMemAlloc (cb=0x5c) returned 0x5f1078 [0086.693] CoTaskMemFree (pv=0x5f1078) [0086.693] CoTaskMemAlloc (cb=0x5c) returned 0x5f1488 [0086.693] CoTaskMemFree (pv=0x5f1488) [0086.694] GdipGetFontUnit (font=0x6a71f08, unit=0x19ecac) returned 0x0 [0086.694] GdipGetFontSize (font=0x6a71f08, size=0x19ecb0) returned 0x0 [0086.694] GdipGetFontStyle (font=0x6a71f08, style=0x19eca8) returned 0x0 [0086.694] GdipGetFamily (font=0x6a71f08, family=0x19eca4) returned 0x0 [0086.695] GdipGetFontSize (font=0x6a71f08, size=0x242f06c) returned 0x0 [0086.695] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0086.695] GetDC (hWnd=0x0) returned 0x17010523 [0086.695] GdipCreateFromHDC (hdc=0x17010523, graphics=0x19ecc0) returned 0x0 [0086.696] GdipGetDpiY (graphics=0x7c7f260, dpi=0x242f148) returned 0x0 [0086.696] GdipGetFontHeight (font=0x6a71f08, graphics=0x7c7f260, height=0x19ecb8) returned 0x0 [0086.697] GdipGetEmHeight (family=0x6a77ec0, style=0, EmHeight=0x19ecc0) returned 0x0 [0086.697] GdipGetLineSpacing (family=0x6a77ec0, style=0, LineSpacing=0x19ecc0) returned 0x0 [0086.697] GdipDeleteGraphics (graphics=0x7c7f260) returned 0x0 [0086.697] ReleaseDC (hWnd=0x0, hDC=0x17010523) returned 1 [0086.697] GdipCreateFont (fontFamily=0x6a77ec0, emSize=0x41040000, style=0, unit=0x3, font=0x242f164) returned 0x0 [0086.698] GdipGetFontSize (font=0x6a7ef48, size=0x242f168) returned 0x0 [0086.698] GdipDeleteFont (font=0x6a71f08) returned 0x0 [0086.698] GetDC (hWnd=0x0) returned 0x17010523 [0086.698] GdipCreateFromHDC (hdc=0x17010523, graphics=0x19ecf4) returned 0x0 [0086.699] CoTaskMemAlloc (cb=0x5c) returned 0x5f1488 [0086.699] GdipGetLogFontW (font=0x6a7ef48, graphics=0x7c7f260, logfontW=0x5f1488) returned 0x0 [0086.699] CoTaskMemFree (pv=0x5f1488) [0086.699] CoTaskMemAlloc (cb=0x5c) returned 0x5f1488 [0086.700] CoTaskMemFree (pv=0x5f1488) [0086.700] CoTaskMemAlloc (cb=0x5c) returned 0x5f1488 [0086.700] CoTaskMemFree (pv=0x5f1488) [0086.700] GdipDeleteGraphics (graphics=0x7c7f260) returned 0x0 [0086.700] ReleaseDC (hWnd=0x0, hDC=0x17010523) returned 1 [0086.700] CoTaskMemAlloc (cb=0x5c) returned 0x5f1218 [0086.700] CreateFontIndirectW (lplf=0x5f1218) returned 0x810a0543 [0086.700] CoTaskMemFree (pv=0x5f1218) [0086.701] SelectObject (hdc=0x390107d0, h=0x810a0543) returned 0x8a01c2 [0086.701] GetTextMetricsW (in: hdc=0x390107d0, lptm=0x19ee00 | out: lptm=0x19ee00) returned 1 [0086.701] GetTextExtentPoint32W (in: hdc=0x390107d0, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x242f390 | out: psizl=0x242f390) returned 1 [0086.702] SelectObject (hdc=0x390107d0, h=0x8a01c2) returned 0x810a0543 [0086.702] DeleteDC (hdc=0x390107d0) returned 1 [0086.703] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6f550000 [0086.703] AdjustWindowRectEx (in: lpRect=0x19eb68, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19eb68) returned 1 [0086.703] AdjustWindowRectEx (in: lpRect=0x19ed8c, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19ed8c) returned 1 [0086.703] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6f550000 [0086.703] AdjustWindowRectEx (in: lpRect=0x19eae0, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19eae0) returned 1 [0086.703] AdjustWindowRectEx (in: lpRect=0x19ebc4, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19ebc4) returned 1 [0086.704] GetSystemMetrics (nIndex=34) returned 136 [0086.704] GetSystemMetrics (nIndex=35) returned 39 [0086.708] GetCurrentActCtx (in: lphActCtx=0x19ef14 | out: lphActCtx=0x19ef14*=0x0) returned 1 [0086.708] ActivateActCtx (in: hActCtx=0x63ad0c, lpCookie=0x19ef24 | out: hActCtx=0x63ad0c, lpCookie=0x19ef24) returned 1 [0086.708] GetCurrentActCtx (in: lphActCtx=0x19ed34 | out: lphActCtx=0x19ed34*=0x63ad0c) returned 1 [0086.709] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x709d0000 [0086.709] AdjustWindowRectEx (in: lpRect=0x19ec94, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19ec94) returned 1 [0086.709] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0086.709] CreateWindowExW (dwExStyle=0x50000, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r10_ad1", lpWindowName="Lasan", dwStyle=0x2cf0000, X=-2147483648, Y=-2147483648, nWidth=185, nHeight=79, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x402c2 [0086.716] SetWindowLongW (hWnd=0x402c2, nIndex=-4, dwNewLong=1948909888) returned 33114798 [0086.716] GetWindowLongW (hWnd=0x402c2, nIndex=-4) returned 1948909888 [0086.716] SetWindowLongW (hWnd=0x402c2, nIndex=-4, dwNewLong=33114918) returned 1948909888 [0086.716] GetWindowLongW (hWnd=0x402c2, nIndex=-4) returned 33114918 [0086.716] GetWindowLongW (hWnd=0x402c2, nIndex=-16) returned 114229248 [0086.716] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0x81, wParam=0x0, lParam=0x19e758) returned 0x1 [0086.722] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0x83, wParam=0x0, lParam=0x19e744) returned 0x0 [0086.723] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0x1, wParam=0x0, lParam=0x19e758) returned 0x0 [0086.723] GetClientRect (in: hWnd=0x402c2, lpRect=0x19e410 | out: lpRect=0x19e410) returned 1 [0086.723] GetWindowRect (in: hWnd=0x402c2, lpRect=0x19e410 | out: lpRect=0x19e410) returned 1 [0086.723] SetWindowTextW (hWnd=0x402c2, lpString="Lasan") returned 1 [0086.723] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0xc, wParam=0x0, lParam=0x242d810) returned 0x1 [0086.729] GetUserObjectInformationA (in: hObj=0x12c, nIndex=1, pvInfo=0x242fbf4, nLength=0xc, lpnLengthNeeded=0x19e308 | out: pvInfo=0x242fbf4, lpnLengthNeeded=0x19e308) returned 1 [0086.731] SetConsoleCtrlHandler (HandlerRoutine=0x1f94b4e, Add=1) returned 1 [0086.732] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0086.732] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0086.732] GetClassInfoW (in: hInstance=0x400000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWndClass=0x242fc58 | out: lpWndClass=0x242fc58) returned 0 [0086.734] CoTaskMemAlloc (cb=0x58) returned 0x6445f0 [0086.734] RegisterClassW (lpWndClass=0x19e258) returned 0xc19c [0086.734] CoTaskMemFree (pv=0x6445f0) [0086.735] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x7006e [0086.736] NtdllDefWindowProc_W (hWnd=0x7006e, Msg=0x83, wParam=0x0, lParam=0x19dd84) returned 0x0 [0086.736] NtdllDefWindowProc_W (hWnd=0x7006e, Msg=0x1, wParam=0x0, lParam=0x19dd98) returned 0x0 [0086.737] NtdllDefWindowProc_W (hWnd=0x7006e, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0086.737] NtdllDefWindowProc_W (hWnd=0x7006e, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0086.740] GetStartupInfoW (in: lpStartupInfo=0x242ff50 | out: lpStartupInfo=0x242ff50*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Local\\Info.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0086.742] GetParent (hWnd=0x402c2) returned 0x0 [0086.742] SetWindowLongW (hWnd=0x402c2, nIndex=-8, dwNewLong=0) returned 0 [0086.743] GetSystemMetrics (nIndex=49) returned 16 [0086.743] GetSystemMetrics (nIndex=50) returned 16 [0086.743] CreateIconFromResourceEx (presbits=0x242ffd0, dwResSize=0x468, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x160231 [0086.746] SendMessageW (hWnd=0x402c2, Msg=0x80, wParam=0x0, lParam=0x160231) returned 0x0 [0086.746] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0x80, wParam=0x0, lParam=0x160231) returned 0x0 [0086.747] SendMessageW (hWnd=0x402c2, Msg=0x80, wParam=0x1, lParam=0xf0113) returned 0x0 [0086.747] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0x80, wParam=0x1, lParam=0xf0113) returned 0x0 [0086.747] GetSystemMenu (hWnd=0x402c2, bRevert=0) returned 0xd00db [0086.748] GetWindowPlacement (in: hWnd=0x402c2, lpwndpl=0x19ed44 | out: lpwndpl=0x19ed44) returned 1 [0086.749] EnableMenuItem (hMenu=0xd00db, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0086.749] EnableMenuItem (hMenu=0xd00db, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0086.749] EnableMenuItem (hMenu=0xd00db, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0086.749] EnableMenuItem (hMenu=0xd00db, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0086.749] EnableMenuItem (hMenu=0xd00db, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0086.749] GetClientRect (in: hWnd=0x402c2, lpRect=0x19ed88 | out: lpRect=0x19ed88) returned 1 [0086.749] GetClientRect (in: hWnd=0x402c2, lpRect=0x19ece8 | out: lpRect=0x19ece8) returned 1 [0086.749] GetWindowRect (in: hWnd=0x402c2, lpRect=0x19ece8 | out: lpRect=0x19ece8) returned 1 [0086.749] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x709d0000 [0086.749] GetWindowLongW (hWnd=0x402c2, nIndex=-16) returned 114229248 [0086.750] GetWindowTextLengthW (hWnd=0x402c2) returned 5 [0086.750] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0086.750] GetSystemMetrics (nIndex=42) returned 0 [0086.750] GetWindowTextW (in: hWnd=0x402c2, lpString=0x19ec8c, nMaxCount=6 | out: lpString="Lasan") returned 5 [0086.750] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0xd, wParam=0x6, lParam=0x19ec8c) returned 0x5 [0086.751] GetWindowTextLengthW (hWnd=0x402c2) returned 5 [0086.751] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0086.751] GetSystemMetrics (nIndex=42) returned 0 [0086.751] GetWindowTextW (in: hWnd=0x402c2, lpString=0x19ec8c, nMaxCount=6 | out: lpString="Lasan") returned 5 [0086.751] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0xd, wParam=0x6, lParam=0x19ec8c) returned 0x5 [0086.751] GetWindowLongW (hWnd=0x402c2, nIndex=-16) returned 114229248 [0086.751] GetWindowLongW (hWnd=0x402c2, nIndex=-20) returned 327936 [0086.751] SetWindowLongW (hWnd=0x402c2, nIndex=-16, dwNewLong=47120384) returned 114229248 [0086.751] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0x7c, wParam=0xfffffff0, lParam=0x19ece4) returned 0x0 [0086.751] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0x7d, wParam=0xfffffff0, lParam=0x19ece4) returned 0x0 [0086.752] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x160231 [0086.752] SetWindowLongW (hWnd=0x402c2, nIndex=-20, dwNewLong=327680) returned 327936 [0086.752] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0x7c, wParam=0xffffffec, lParam=0x19ece4) returned 0x0 [0086.752] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0x7d, wParam=0xffffffec, lParam=0x19ece4) returned 0x0 [0086.753] SetWindowPos (hWnd=0x402c2, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0086.753] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0x46, wParam=0x0, lParam=0x19ecfc) returned 0x0 [0086.753] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0x83, wParam=0x1, lParam=0x19ecd4) returned 0x0 [0086.754] GetWindowPlacement (in: hWnd=0x402c2, lpwndpl=0x19ea28 | out: lpwndpl=0x19ea28) returned 1 [0086.754] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0x47, wParam=0x0, lParam=0x19ecfc) returned 0x0 [0086.754] GetClientRect (in: hWnd=0x402c2, lpRect=0x19e9d8 | out: lpRect=0x19e9d8) returned 1 [0086.754] GetWindowRect (in: hWnd=0x402c2, lpRect=0x19e9d8 | out: lpRect=0x19e9d8) returned 1 [0086.755] RedrawWindow (hWnd=0x402c2, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0086.755] GetSystemMenu (hWnd=0x402c2, bRevert=0) returned 0xd00db [0086.755] GetWindowPlacement (in: hWnd=0x402c2, lpwndpl=0x19ed34 | out: lpwndpl=0x19ed34) returned 1 [0086.755] EnableMenuItem (hMenu=0xd00db, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0086.755] EnableMenuItem (hMenu=0xd00db, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0086.756] EnableMenuItem (hMenu=0xd00db, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0086.756] EnableMenuItem (hMenu=0xd00db, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0086.756] EnableMenuItem (hMenu=0xd00db, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0086.756] ShowWindow (hWnd=0x402c2, nCmdShow=5) returned 0 [0086.756] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0086.756] GetWindowTextLengthW (hWnd=0x402c2) returned 5 [0086.756] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0086.756] GetSystemMetrics (nIndex=42) returned 0 [0086.756] GetWindowTextW (in: hWnd=0x402c2, lpString=0x19e930, nMaxCount=6 | out: lpString="Lasan") returned 5 [0086.756] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0xd, wParam=0x6, lParam=0x19e930) returned 0x5 [0086.932] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x709d0000 [0086.932] GetWindowLongW (hWnd=0x402c2, nIndex=-16) returned 114229248 [0086.933] GetWindowTextLengthW (hWnd=0x402c2) returned 5 [0086.933] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0086.933] GetSystemMetrics (nIndex=42) returned 0 [0086.933] GetWindowTextW (in: hWnd=0x402c2, lpString=0x19e7f0, nMaxCount=6 | out: lpString="Lasan") returned 5 [0086.933] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0xd, wParam=0x6, lParam=0x19e7f0) returned 0x5 [0086.933] GetWindowTextLengthW (hWnd=0x402c2) returned 5 [0086.933] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0086.933] GetSystemMetrics (nIndex=42) returned 0 [0086.933] GetWindowTextW (in: hWnd=0x402c2, lpString=0x19e7f0, nMaxCount=6 | out: lpString="Lasan") returned 5 [0086.933] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0xd, wParam=0x6, lParam=0x19e7f0) returned 0x5 [0086.933] GetWindowLongW (hWnd=0x402c2, nIndex=-16) returned 114229248 [0086.933] GetWindowLongW (hWnd=0x402c2, nIndex=-20) returned 327936 [0086.933] SetWindowLongW (hWnd=0x402c2, nIndex=-16, dwNewLong=315555840) returned 114229248 [0086.933] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0x7c, wParam=0xfffffff0, lParam=0x19e84c) returned 0x0 [0086.940] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0x7d, wParam=0xfffffff0, lParam=0x19e84c) returned 0x0 [0086.940] SetWindowLongW (hWnd=0x402c2, nIndex=-20, dwNewLong=851968) returned 327936 [0086.941] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0x7c, wParam=0xffffffec, lParam=0x19e84c) returned 0x0 [0086.941] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0x7d, wParam=0xffffffec, lParam=0x19e84c) returned 0x0 [0086.942] SetWindowPos (hWnd=0x402c2, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0086.942] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0x46, wParam=0x0, lParam=0x19e864) returned 0x0 [0086.942] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0x83, wParam=0x1, lParam=0x19e83c) returned 0x0 [0086.943] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0x85, wParam=0xec040636, lParam=0x0) returned 0x0 [0086.944] GetWindowPlacement (in: hWnd=0x402c2, lpwndpl=0x19e5ac | out: lpwndpl=0x19e5ac) returned 1 [0086.944] GetClientRect (in: hWnd=0x402c2, lpRect=0x19e558 | out: lpRect=0x19e558) returned 1 [0086.944] GetWindowTextLengthW (hWnd=0x402c2) returned 5 [0086.944] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0086.944] GetSystemMetrics (nIndex=42) returned 0 [0086.944] GetWindowTextW (in: hWnd=0x402c2, lpString=0x19e424, nMaxCount=6 | out: lpString="Lasan") returned 5 [0086.944] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0xd, wParam=0x6, lParam=0x19e424) returned 0x5 [0086.944] GetClientRect (in: hWnd=0x402c2, lpRect=0x19e460 | out: lpRect=0x19e460) returned 1 [0086.945] GetSysColor (nIndex=10) returned 0xb4b4b4 [0086.946] GetSysColor (nIndex=2) returned 0xd1b499 [0086.946] GetSysColor (nIndex=9) returned 0x0 [0086.946] GetSysColor (nIndex=12) returned 0xababab [0086.946] GetSysColor (nIndex=15) returned 0xf0f0f0 [0086.946] GetSysColor (nIndex=20) returned 0xffffff [0086.946] GetSysColor (nIndex=16) returned 0xa0a0a0 [0086.946] GetSysColor (nIndex=15) returned 0xf0f0f0 [0086.946] GetSysColor (nIndex=16) returned 0xa0a0a0 [0086.946] GetSysColor (nIndex=21) returned 0x696969 [0086.946] GetSysColor (nIndex=22) returned 0xe3e3e3 [0086.946] GetSysColor (nIndex=20) returned 0xffffff [0086.946] GetSysColor (nIndex=18) returned 0x0 [0086.946] GetSysColor (nIndex=1) returned 0x0 [0086.946] GetSysColor (nIndex=27) returned 0xead1b9 [0086.946] GetSysColor (nIndex=28) returned 0xf2e4d7 [0086.946] GetSysColor (nIndex=17) returned 0x6d6d6d [0086.946] GetSysColor (nIndex=13) returned 0xd77800 [0086.946] GetSysColor (nIndex=14) returned 0xffffff [0086.946] GetSysColor (nIndex=26) returned 0xcc6600 [0086.946] GetSysColor (nIndex=11) returned 0xfcf7f4 [0086.946] GetSysColor (nIndex=3) returned 0xdbcdbf [0086.946] GetSysColor (nIndex=19) returned 0x0 [0086.946] GetSysColor (nIndex=24) returned 0xe1ffff [0086.946] GetSysColor (nIndex=23) returned 0x0 [0086.946] GetSysColor (nIndex=4) returned 0xf0f0f0 [0086.946] GetSysColor (nIndex=30) returned 0xf0f0f0 [0086.947] GetSysColor (nIndex=29) returned 0xd77800 [0086.947] GetSysColor (nIndex=7) returned 0x0 [0086.947] GetSysColor (nIndex=0) returned 0xc8c8c8 [0086.947] GetSysColor (nIndex=5) returned 0xffffff [0086.947] GetSysColor (nIndex=6) returned 0x646464 [0086.947] GetSysColor (nIndex=8) returned 0x0 [0087.040] GetSystemMetrics (nIndex=80) returned 1 [0087.043] EnumDisplayMonitors (hdc=0x0, lprcClip=0x0, lpfnEnum=0x1f94b9e, dwData=0x0) returned 1 [0087.047] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19e0c0 | out: lpmi=0x19e0c0) returned 1 [0087.048] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0xaa0107b3 [0087.048] GetDeviceCaps (hdc=0xaa0107b3, index=12) returned 32 [0087.048] GetDeviceCaps (hdc=0xaa0107b3, index=14) returned 1 [0087.048] DeleteDC (hdc=0xaa0107b3) returned 1 [0087.049] GetCurrentObject (hdc=0x60100ce, type=0x1) returned 0xb00017 [0087.049] GetCurrentObject (hdc=0x60100ce, type=0x2) returned 0x900010 [0087.049] GetCurrentObject (hdc=0x60100ce, type=0x7) returned 0x68050521 [0087.049] GetCurrentObject (hdc=0x60100ce, type=0x6) returned 0x8a01c2 [0087.049] SaveDC (hdc=0x60100ce) returned 1 [0087.049] GetNearestColor (hdc=0x60100ce, color=0xf0f0f0) returned 0xf0f0f0 [0087.050] CreateSolidBrush (color=0xf0f0f0) returned 0x751007b7 [0087.051] FillRect (hDC=0x60100ce, lprc=0x19e300, hbr=0x751007b7) returned 1 [0087.051] DeleteObject (ho=0x751007b7) returned 1 [0087.052] RestoreDC (hdc=0x60100ce, nSavedDC=-1) returned 1 [0087.059] GetWindowPlacement (in: hWnd=0x402c2, lpwndpl=0x19e590 | out: lpwndpl=0x19e590) returned 1 [0087.059] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0x47, wParam=0x0, lParam=0x19e864) returned 0x0 [0087.059] GetClientRect (in: hWnd=0x402c2, lpRect=0x19e540 | out: lpRect=0x19e540) returned 1 [0087.059] GetWindowRect (in: hWnd=0x402c2, lpRect=0x19e540 | out: lpRect=0x19e540) returned 1 [0087.059] RedrawWindow (hWnd=0x402c2, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0087.059] GetSystemMenu (hWnd=0x402c2, bRevert=0) returned 0xd00db [0087.060] GetWindowPlacement (in: hWnd=0x402c2, lpwndpl=0x19e898 | out: lpwndpl=0x19e898) returned 1 [0087.060] EnableMenuItem (hMenu=0xd00db, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0087.060] EnableMenuItem (hMenu=0xd00db, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0087.060] EnableMenuItem (hMenu=0xd00db, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0087.060] EnableMenuItem (hMenu=0xd00db, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0087.060] EnableMenuItem (hMenu=0xd00db, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0087.060] SetLayeredWindowAttributes (hwnd=0x402c2, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0087.063] GetCurrentThreadId () returned 0xfb0 [0087.063] EnumThreadWindows (dwThreadId=0xfb0, lpfn=0x1f94bc6, lParam=0x402c2) returned 1 [0087.096] GetWindowLongW (hWnd=0x7006e, nIndex=-8) returned 0 [0087.096] GetWindowLongW (hWnd=0x402c2, nIndex=-8) returned 0 [0087.096] GetWindowLongW (hWnd=0x302ca, nIndex=-8) returned 262850 [0087.174] SetWindowLongW (hWnd=0x302ca, nIndex=-8, dwNewLong=0) returned 262850 [0087.180] GetFocus () returned 0x0 [0087.180] GetParent (hWnd=0x402c2) returned 0x0 [0087.180] GetWindowLongW (hWnd=0x402c2, nIndex=-20) returned 852224 [0087.180] DestroyWindow (hWnd=0x402c2) returned 1 [0087.180] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0087.181] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0x46, wParam=0x0, lParam=0x19e79c) returned 0x0 [0087.186] GetWindowPlacement (in: hWnd=0x402c2, lpwndpl=0x19e4c8 | out: lpwndpl=0x19e4c8) returned 1 [0087.186] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0x47, wParam=0x0, lParam=0x19e79c) returned 0x0 [0087.186] GetClientRect (in: hWnd=0x402c2, lpRect=0x19e478 | out: lpRect=0x19e478) returned 1 [0087.186] GetWindowRect (in: hWnd=0x402c2, lpRect=0x19e478 | out: lpRect=0x19e478) returned 1 [0087.186] GetWindowTextLengthW (hWnd=0x402c2) returned 5 [0087.186] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0087.186] GetSystemMetrics (nIndex=42) returned 0 [0087.186] GetWindowTextW (in: hWnd=0x402c2, lpString=0x19e3a8, nMaxCount=6 | out: lpString="Lasan") returned 5 [0087.186] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0xd, wParam=0x6, lParam=0x19e3a8) returned 0x5 [0087.187] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0087.187] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x402c2, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0087.190] GetCurrentActCtx (in: lphActCtx=0x19e7fc | out: lphActCtx=0x19e7fc*=0x63ad0c) returned 1 [0087.190] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x709d0000 [0087.190] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0087.190] CreateWindowExW (dwExStyle=0x90000, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r10_ad1", lpWindowName="Lasan", dwStyle=0x2cf0000, X=104, Y=104, nWidth=185, nHeight=79, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x8006c [0087.191] SetWindowLongW (hWnd=0x8006c, nIndex=-4, dwNewLong=1948909888) returned 33114798 [0087.191] GetWindowLongW (hWnd=0x8006c, nIndex=-4) returned 1948909888 [0087.191] SetWindowLongW (hWnd=0x8006c, nIndex=-4, dwNewLong=33115118) returned 1948909888 [0087.191] GetWindowLongW (hWnd=0x8006c, nIndex=-4) returned 33115118 [0087.191] GetWindowLongW (hWnd=0x8006c, nIndex=-16) returned 114229248 [0087.192] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0x81, wParam=0x0, lParam=0x19e220) returned 0x1 [0087.193] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0x83, wParam=0x0, lParam=0x19e20c) returned 0x0 [0087.193] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0x1, wParam=0x0, lParam=0x19e220) returned 0x0 [0087.193] GetClientRect (in: hWnd=0x8006c, lpRect=0x19ded8 | out: lpRect=0x19ded8) returned 1 [0087.193] GetWindowRect (in: hWnd=0x8006c, lpRect=0x19ded8 | out: lpRect=0x19ded8) returned 1 [0087.193] SetWindowTextW (hWnd=0x8006c, lpString="Lasan") returned 1 [0087.193] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0xc, wParam=0x0, lParam=0x24319cc) returned 0x1 [0087.194] SetLayeredWindowAttributes (hwnd=0x8006c, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0087.196] GetStartupInfoW (in: lpStartupInfo=0x2431c9c | out: lpStartupInfo=0x2431c9c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Local\\Info.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0087.197] GetParent (hWnd=0x8006c) returned 0x0 [0087.198] GetStockObject (i=5) returned 0x900015 [0087.201] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0087.201] CoTaskMemAlloc (cb=0x5c) returned 0x5f1488 [0087.201] RegisterClassW (lpWndClass=0x19e6d8) returned 0xc19d [0087.202] CoTaskMemFree (pv=0x5f1488) [0087.202] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0087.202] CreateWindowExW (dwExStyle=0x80, lpClassName="WindowsForms10.Window.0.app.0.141b42a_r10_ad1", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x90036 [0087.202] SetWindowLongW (hWnd=0x90036, nIndex=-4, dwNewLong=1948909888) returned 33115158 [0087.202] GetWindowLongW (hWnd=0x90036, nIndex=-4) returned 1948909888 [0087.203] SetWindowLongW (hWnd=0x90036, nIndex=-4, dwNewLong=33115198) returned 1948909888 [0087.203] GetWindowLongW (hWnd=0x90036, nIndex=-4) returned 33115198 [0087.203] GetWindowLongW (hWnd=0x90036, nIndex=-16) returned 79691776 [0087.203] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x90036, Msg=0x24, wParam=0x0, lParam=0x19e254) returned 0x0 [0087.203] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x90036, Msg=0x81, wParam=0x0, lParam=0x19e248) returned 0x1 [0087.203] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x90036, Msg=0x83, wParam=0x0, lParam=0x19e234) returned 0x0 [0087.204] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x90036, Msg=0x1, wParam=0x0, lParam=0x19e248) returned 0x0 [0087.204] SetWindowLongW (hWnd=0x8006c, nIndex=-8, dwNewLong=589878) returned 0 [0087.206] SendMessageW (hWnd=0x8006c, Msg=0x80, wParam=0x0, lParam=0x160231) returned 0x0 [0087.206] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0x80, wParam=0x0, lParam=0x160231) returned 0x0 [0087.206] SendMessageW (hWnd=0x8006c, Msg=0x80, wParam=0x1, lParam=0xf0113) returned 0x0 [0087.206] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0x80, wParam=0x1, lParam=0xf0113) returned 0x0 [0087.207] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x160231 [0087.209] GetSystemMenu (hWnd=0x8006c, bRevert=0) returned 0xe00db [0087.209] GetWindowPlacement (in: hWnd=0x8006c, lpwndpl=0x19e80c | out: lpwndpl=0x19e80c) returned 1 [0087.209] EnableMenuItem (hMenu=0xe00db, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0087.209] EnableMenuItem (hMenu=0xe00db, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0087.209] EnableMenuItem (hMenu=0xe00db, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0087.209] EnableMenuItem (hMenu=0xe00db, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0087.209] EnableMenuItem (hMenu=0xe00db, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0087.210] GetClientRect (in: hWnd=0x8006c, lpRect=0x19e850 | out: lpRect=0x19e850) returned 1 [0087.210] GetClientRect (in: hWnd=0x8006c, lpRect=0x19e7b0 | out: lpRect=0x19e7b0) returned 1 [0087.210] GetWindowRect (in: hWnd=0x8006c, lpRect=0x19e7b0 | out: lpRect=0x19e7b0) returned 1 [0087.210] SetWindowPos (hWnd=0x8006c, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1 [0087.210] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0x46, wParam=0x0, lParam=0x19e71c) returned 0x0 [0087.214] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0087.215] GetWindowPlacement (in: hWnd=0x8006c, lpwndpl=0x19e464 | out: lpwndpl=0x19e464) returned 1 [0087.215] GetClientRect (in: hWnd=0x8006c, lpRect=0x19e410 | out: lpRect=0x19e410) returned 1 [0087.216] GetWindowTextLengthW (hWnd=0x8006c) returned 5 [0087.216] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0087.216] GetSystemMetrics (nIndex=42) returned 0 [0087.216] GetWindowTextW (in: hWnd=0x8006c, lpString=0x19e2dc, nMaxCount=6 | out: lpString="Lasan") returned 5 [0087.216] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0xd, wParam=0x6, lParam=0x19e2dc) returned 0x5 [0087.216] GetClientRect (in: hWnd=0x8006c, lpRect=0x19e318 | out: lpRect=0x19e318) returned 1 [0087.216] GetCurrentObject (hdc=0x60100ce, type=0x1) returned 0xb00017 [0087.216] GetCurrentObject (hdc=0x60100ce, type=0x2) returned 0x900010 [0087.216] GetCurrentObject (hdc=0x60100ce, type=0x7) returned 0x5f050652 [0087.216] GetCurrentObject (hdc=0x60100ce, type=0x6) returned 0x8a01c2 [0087.217] SaveDC (hdc=0x60100ce) returned 1 [0087.217] GetNearestColor (hdc=0x60100ce, color=0xf0f0f0) returned 0xf0f0f0 [0087.217] CreateSolidBrush (color=0xf0f0f0) returned 0x761007b7 [0087.217] FillRect (hDC=0x60100ce, lprc=0x19e1b8, hbr=0x761007b7) returned 1 [0087.217] DeleteObject (ho=0x761007b7) returned 1 [0087.217] RestoreDC (hdc=0x60100ce, nSavedDC=-1) returned 1 [0087.217] GetWindowPlacement (in: hWnd=0x8006c, lpwndpl=0x19e448 | out: lpwndpl=0x19e448) returned 1 [0087.217] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0x47, wParam=0x0, lParam=0x19e71c) returned 0x0 [0087.217] GetClientRect (in: hWnd=0x8006c, lpRect=0x19e3f8 | out: lpRect=0x19e3f8) returned 1 [0087.217] GetWindowRect (in: hWnd=0x8006c, lpRect=0x19e3f8 | out: lpRect=0x19e3f8) returned 1 [0087.219] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0x83, wParam=0x1, lParam=0x19e234) returned 0x0 [0087.220] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0087.222] GetWindowPlacement (in: hWnd=0x8006c, lpwndpl=0x19dfa4 | out: lpwndpl=0x19dfa4) returned 1 [0087.222] GetClientRect (in: hWnd=0x8006c, lpRect=0x19df50 | out: lpRect=0x19df50) returned 1 [0087.222] GetWindowTextLengthW (hWnd=0x8006c) returned 5 [0087.222] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0087.222] GetSystemMetrics (nIndex=42) returned 0 [0087.222] GetWindowTextW (in: hWnd=0x8006c, lpString=0x19de1c, nMaxCount=6 | out: lpString="Lasan") returned 5 [0087.222] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0xd, wParam=0x6, lParam=0x19de1c) returned 0x5 [0087.222] GetClientRect (in: hWnd=0x8006c, lpRect=0x19de58 | out: lpRect=0x19de58) returned 1 [0087.222] GetCurrentObject (hdc=0x17010523, type=0x1) returned 0xb00017 [0087.222] GetCurrentObject (hdc=0x17010523, type=0x2) returned 0x900010 [0087.222] GetCurrentObject (hdc=0x17010523, type=0x7) returned 0x5f050652 [0087.222] GetCurrentObject (hdc=0x17010523, type=0x6) returned 0x8a01c2 [0087.222] SaveDC (hdc=0x17010523) returned 1 [0087.222] GetNearestColor (hdc=0x17010523, color=0xf0f0f0) returned 0xf0f0f0 [0087.222] CreateSolidBrush (color=0xf0f0f0) returned 0x771007b7 [0087.222] FillRect (hDC=0x17010523, lprc=0x19dcf8, hbr=0x771007b7) returned 1 [0087.222] DeleteObject (ho=0x771007b7) returned 1 [0087.222] RestoreDC (hdc=0x17010523, nSavedDC=-1) returned 1 [0087.223] SetWindowLongW (hWnd=0x8006c, nIndex=-8, dwNewLong=589878) returned 589878 [0087.224] SendMessageW (hWnd=0x90036, Msg=0x80, wParam=0x1, lParam=0xf0113) returned 0x0 [0087.224] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x90036, Msg=0x80, wParam=0x1, lParam=0xf0113) returned 0x0 [0087.226] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x709d0000 [0087.226] GetWindowLongW (hWnd=0x8006c, nIndex=-16) returned 382664704 [0087.226] GetWindowTextLengthW (hWnd=0x8006c) returned 5 [0087.226] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0087.226] GetSystemMetrics (nIndex=42) returned 0 [0087.226] GetWindowTextW (in: hWnd=0x8006c, lpString=0x19e754, nMaxCount=6 | out: lpString="Lasan") returned 5 [0087.226] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0xd, wParam=0x6, lParam=0x19e754) returned 0x5 [0087.226] GetWindowTextLengthW (hWnd=0x8006c) returned 5 [0087.226] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0087.226] GetSystemMetrics (nIndex=42) returned 0 [0087.226] GetWindowTextW (in: hWnd=0x8006c, lpString=0x19e754, nMaxCount=6 | out: lpString="Lasan") returned 5 [0087.226] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0xd, wParam=0x6, lParam=0x19e754) returned 0x5 [0087.226] GetWindowLongW (hWnd=0x8006c, nIndex=-16) returned 382664704 [0087.226] GetWindowLongW (hWnd=0x8006c, nIndex=-20) returned 590080 [0087.226] SetWindowLongW (hWnd=0x8006c, nIndex=-16, dwNewLong=315555840) returned 382664704 [0087.226] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0x7c, wParam=0xfffffff0, lParam=0x19e7ac) returned 0x0 [0087.227] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0x7d, wParam=0xfffffff0, lParam=0x19e7ac) returned 0x0 [0087.227] SetWindowLongW (hWnd=0x8006c, nIndex=-20, dwNewLong=589824) returned 590080 [0087.227] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0x7c, wParam=0xffffffec, lParam=0x19e7ac) returned 0x0 [0087.228] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0x7d, wParam=0xffffffec, lParam=0x19e7ac) returned 0x0 [0087.228] SetWindowPos (hWnd=0x8006c, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0087.228] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0x46, wParam=0x0, lParam=0x19e7c4) returned 0x0 [0087.228] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0x83, wParam=0x1, lParam=0x19e79c) returned 0x0 [0087.231] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0087.232] GetWindowPlacement (in: hWnd=0x8006c, lpwndpl=0x19e50c | out: lpwndpl=0x19e50c) returned 1 [0087.232] GetClientRect (in: hWnd=0x8006c, lpRect=0x19e4b8 | out: lpRect=0x19e4b8) returned 1 [0087.232] GetWindowTextLengthW (hWnd=0x8006c) returned 5 [0087.232] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0087.232] GetSystemMetrics (nIndex=42) returned 0 [0087.232] GetWindowTextW (in: hWnd=0x8006c, lpString=0x19e384, nMaxCount=6 | out: lpString="Lasan") returned 5 [0087.232] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0xd, wParam=0x6, lParam=0x19e384) returned 0x5 [0087.232] GetClientRect (in: hWnd=0x8006c, lpRect=0x19e3c0 | out: lpRect=0x19e3c0) returned 1 [0087.232] GetCurrentObject (hdc=0x60100ce, type=0x1) returned 0xb00017 [0087.233] GetCurrentObject (hdc=0x60100ce, type=0x2) returned 0x900010 [0087.233] GetCurrentObject (hdc=0x60100ce, type=0x7) returned 0x5f050652 [0087.233] GetCurrentObject (hdc=0x60100ce, type=0x6) returned 0x8a01c2 [0087.233] SaveDC (hdc=0x60100ce) returned 1 [0087.233] GetNearestColor (hdc=0x60100ce, color=0xf0f0f0) returned 0xf0f0f0 [0087.233] CreateSolidBrush (color=0xf0f0f0) returned 0x781007b7 [0087.233] FillRect (hDC=0x60100ce, lprc=0x19e260, hbr=0x781007b7) returned 1 [0087.233] DeleteObject (ho=0x781007b7) returned 1 [0087.233] RestoreDC (hdc=0x60100ce, nSavedDC=-1) returned 1 [0087.233] GetWindowPlacement (in: hWnd=0x8006c, lpwndpl=0x19e4f0 | out: lpwndpl=0x19e4f0) returned 1 [0087.233] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0x47, wParam=0x0, lParam=0x19e7c4) returned 0x0 [0087.233] GetClientRect (in: hWnd=0x8006c, lpRect=0x19e4a0 | out: lpRect=0x19e4a0) returned 1 [0087.233] GetWindowRect (in: hWnd=0x8006c, lpRect=0x19e4a0 | out: lpRect=0x19e4a0) returned 1 [0087.234] RedrawWindow (hWnd=0x8006c, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0087.234] GetSystemMenu (hWnd=0x8006c, bRevert=0) returned 0xe00db [0087.234] GetWindowPlacement (in: hWnd=0x8006c, lpwndpl=0x19e7fc | out: lpwndpl=0x19e7fc) returned 1 [0087.234] EnableMenuItem (hMenu=0xe00db, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0087.234] EnableMenuItem (hMenu=0xe00db, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0087.234] EnableMenuItem (hMenu=0xe00db, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0087.234] EnableMenuItem (hMenu=0xe00db, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0087.234] EnableMenuItem (hMenu=0xe00db, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0087.235] SetWindowLongW (hWnd=0x302ca, nIndex=-8, dwNewLong=524396) returned 458862 [0087.249] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\SystemConfig.txt", nBufferLength=0x105, lpBuffer=0x19e438, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\SystemConfig.txt", lpFilePart=0x0) returned 0x20 [0087.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e8ec) returned 1 [0087.249] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\SystemConfig.txt" (normalized: "c:\\users\\fd1hvy\\systemconfig.txt"), fInfoLevelId=0x0, lpFileInformation=0x19e968 | out: lpFileInformation=0x19e968*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xae6122c9, ftCreationTime.dwHighDateTime=0x1d5dffe, ftLastAccessTime.dwLowDateTime=0xae6122c9, ftLastAccessTime.dwHighDateTime=0x1d5dffe, ftLastWriteTime.dwLowDateTime=0xae6384f0, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0xf)) returned 1 [0087.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e8e8) returned 1 [0087.252] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0087.252] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.0.app.0.141b42a_r10_ad1", lpWindowName="TimerNativeWindow", dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x502b8 [0087.252] SetWindowLongW (hWnd=0x502b8, nIndex=-4, dwNewLong=1948909888) returned 33115158 [0087.252] GetWindowLongW (hWnd=0x502b8, nIndex=-4) returned 1948909888 [0087.253] SetWindowLongW (hWnd=0x502b8, nIndex=-4, dwNewLong=33115310) returned 1948909888 [0087.253] GetWindowLongW (hWnd=0x502b8, nIndex=-4) returned 33115310 [0087.253] GetWindowLongW (hWnd=0x502b8, nIndex=-16) returned 79691776 [0087.253] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x502b8, Msg=0x24, wParam=0x0, lParam=0x19e364) returned 0x0 [0087.253] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x502b8, Msg=0x81, wParam=0x0, lParam=0x19e358) returned 0x1 [0087.253] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x502b8, Msg=0x83, wParam=0x0, lParam=0x19e344) returned 0x0 [0087.254] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x502b8, Msg=0x1, wParam=0x0, lParam=0x19e358) returned 0x0 [0087.255] SetTimer (hWnd=0x502b8, nIDEvent=0x1, uElapse=0x2710, lpTimerFunc=0x0) returned 0x1 [0087.256] GetWindowThreadProcessId (in: hWnd=0x8006c, lpdwProcessId=0x19e998 | out: lpdwProcessId=0x19e998) returned 0xfb0 [0087.256] GetCurrentThreadId () returned 0xfb0 [0087.256] RegisterClipboardFormatW (lpszFormat="WindowsForms12_ThreadCallbackMessage") returned 0xc1a1 [0087.257] PostMessageW (hWnd=0x8006c, Msg=0xc1a1, wParam=0x0, lParam=0x0) returned 1 [0087.257] GetWindowTextLengthW (hWnd=0x8006c) returned 5 [0087.257] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0087.257] GetSystemMetrics (nIndex=42) returned 0 [0087.257] GetWindowTextW (in: hWnd=0x8006c, lpString=0x19e918, nMaxCount=6 | out: lpString="Lasan") returned 5 [0087.257] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0xd, wParam=0x6, lParam=0x19e918) returned 0x5 [0087.259] PeekMessageW (in: lpMsg=0x19ee98, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee98) returned 1 [0087.259] IsWindowUnicode (hWnd=0xa02b6) returned 1 [0087.260] GetMessageW (in: lpMsg=0x19ee98, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19ee98) returned 1 [0087.263] TranslateMessage (lpMsg=0x19ee98) returned 0 [0087.263] DispatchMessageW (lpMsg=0x19ee98) returned 0x0 [0087.263] PeekMessageW (in: lpMsg=0x19ee98, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee98) returned 1 [0087.263] IsWindowUnicode (hWnd=0x8006c) returned 1 [0087.263] GetMessageW (in: lpMsg=0x19ee98, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19ee98) returned 1 [0087.263] TranslateMessage (lpMsg=0x19ee98) returned 0 [0087.263] DispatchMessageW (lpMsg=0x19ee98) returned 0x0 [0087.264] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0x46, wParam=0x0, lParam=0x19ebec) returned 0x0 [0087.264] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0x83, wParam=0x1, lParam=0x19ebc4) returned 0x0 [0087.265] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0087.266] GetWindowPlacement (in: hWnd=0x8006c, lpwndpl=0x19e934 | out: lpwndpl=0x19e934) returned 1 [0087.266] GetClientRect (in: hWnd=0x8006c, lpRect=0x19e8e0 | out: lpRect=0x19e8e0) returned 1 [0087.266] GetWindowTextLengthW (hWnd=0x8006c) returned 5 [0087.266] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0087.266] GetSystemMetrics (nIndex=42) returned 0 [0087.266] GetWindowTextW (in: hWnd=0x8006c, lpString=0x19e7ac, nMaxCount=6 | out: lpString="Lasan") returned 5 [0087.266] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0xd, wParam=0x6, lParam=0x19e7ac) returned 0x5 [0087.266] GetClientRect (in: hWnd=0x8006c, lpRect=0x19e7e8 | out: lpRect=0x19e7e8) returned 1 [0087.266] GetCurrentObject (hdc=0x17010523, type=0x1) returned 0xb00017 [0087.266] GetCurrentObject (hdc=0x17010523, type=0x2) returned 0x900010 [0087.266] GetCurrentObject (hdc=0x17010523, type=0x7) returned 0x5f050652 [0087.266] GetCurrentObject (hdc=0x17010523, type=0x6) returned 0x8a01c2 [0087.266] SaveDC (hdc=0x17010523) returned 1 [0087.266] GetNearestColor (hdc=0x17010523, color=0xf0f0f0) returned 0xf0f0f0 [0087.266] CreateSolidBrush (color=0xf0f0f0) returned 0x791007b7 [0087.266] FillRect (hDC=0x17010523, lprc=0x19e688, hbr=0x791007b7) returned 1 [0087.266] DeleteObject (ho=0x791007b7) returned 1 [0087.266] RestoreDC (hdc=0x17010523, nSavedDC=-1) returned 1 [0087.267] GetWindowPlacement (in: hWnd=0x8006c, lpwndpl=0x19e918 | out: lpwndpl=0x19e918) returned 1 [0087.267] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0x47, wParam=0x0, lParam=0x19ebec) returned 0x0 [0087.267] GetClientRect (in: hWnd=0x8006c, lpRect=0x19e8c8 | out: lpRect=0x19e8c8) returned 1 [0087.267] GetWindowRect (in: hWnd=0x8006c, lpRect=0x19e8c8 | out: lpRect=0x19e8c8) returned 1 [0087.268] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0x83, wParam=0x1, lParam=0x19e704) returned 0x0 [0087.269] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0087.270] GetWindowPlacement (in: hWnd=0x8006c, lpwndpl=0x19e474 | out: lpwndpl=0x19e474) returned 1 [0087.270] GetClientRect (in: hWnd=0x8006c, lpRect=0x19e420 | out: lpRect=0x19e420) returned 1 [0087.270] GetWindowTextLengthW (hWnd=0x8006c) returned 5 [0087.270] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0087.270] GetSystemMetrics (nIndex=42) returned 0 [0087.270] GetWindowTextW (in: hWnd=0x8006c, lpString=0x19e2ec, nMaxCount=6 | out: lpString="Lasan") returned 5 [0087.270] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0xd, wParam=0x6, lParam=0x19e2ec) returned 0x5 [0087.270] GetClientRect (in: hWnd=0x8006c, lpRect=0x19e328 | out: lpRect=0x19e328) returned 1 [0087.270] GetCurrentObject (hdc=0x60100ce, type=0x1) returned 0xb00017 [0087.270] GetCurrentObject (hdc=0x60100ce, type=0x2) returned 0x900010 [0087.270] GetCurrentObject (hdc=0x60100ce, type=0x7) returned 0x5f050652 [0087.270] GetCurrentObject (hdc=0x60100ce, type=0x6) returned 0x8a01c2 [0087.270] SaveDC (hdc=0x60100ce) returned 1 [0087.270] GetNearestColor (hdc=0x60100ce, color=0xf0f0f0) returned 0xf0f0f0 [0087.270] CreateSolidBrush (color=0xf0f0f0) returned 0x7a1007b7 [0087.270] FillRect (hDC=0x60100ce, lprc=0x19e1c8, hbr=0x7a1007b7) returned 1 [0087.270] DeleteObject (ho=0x7a1007b7) returned 1 [0087.271] RestoreDC (hdc=0x60100ce, nSavedDC=-1) returned 1 [0087.271] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0087.271] PeekMessageW (in: lpMsg=0x19ee98, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee98) returned 1 [0087.271] IsWindowUnicode (hWnd=0x90036) returned 1 [0087.271] GetMessageW (in: lpMsg=0x19ee98, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19ee98) returned 1 [0087.271] TranslateMessage (lpMsg=0x19ee98) returned 0 [0087.271] DispatchMessageW (lpMsg=0x19ee98) returned 0x0 [0087.271] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x90036, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0087.271] PeekMessageW (in: lpMsg=0x19ee98, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee98) returned 1 [0087.271] IsWindowUnicode (hWnd=0x8006c) returned 1 [0087.271] GetMessageW (in: lpMsg=0x19ee98, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19ee98) returned 1 [0087.271] TranslateMessage (lpMsg=0x19ee98) returned 0 [0087.271] DispatchMessageW (lpMsg=0x19ee98) returned 0x0 [0087.272] PeekMessageW (in: lpMsg=0x19ee98, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee98) returned 1 [0087.273] IsWindowUnicode (hWnd=0x8006c) returned 1 [0087.273] GetMessageW (in: lpMsg=0x19ee98, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19ee98) returned 1 [0087.273] TranslateMessage (lpMsg=0x19ee98) returned 0 [0087.273] DispatchMessageW (lpMsg=0x19ee98) returned 0x0 [0087.273] BeginPaint (in: hWnd=0x8006c, lpPaint=0x19e908 | out: lpPaint=0x19e908) returned 0x60100ce [0087.274] GdipCreateHalftonePalette () returned 0xffffffff87080521 [0087.274] SelectPalette (hdc=0x60100ce, hPal=0x87080521, bForceBkgd=1) returned 0x88000b [0087.274] GetWindowTextLengthW (hWnd=0x8006c) returned 5 [0087.274] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0087.274] GetSystemMetrics (nIndex=42) returned 0 [0087.274] GetWindowTextW (in: hWnd=0x8006c, lpString=0x19e8a4, nMaxCount=6 | out: lpString="Lasan") returned 5 [0087.274] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0xd, wParam=0x6, lParam=0x19e8a4) returned 0x5 [0087.275] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0x87080521 [0087.275] EndPaint (hWnd=0x8006c, lpPaint=0x19e904) returned 1 [0087.275] PeekMessageW (in: lpMsg=0x19ee98, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee98) returned 1 [0087.275] IsWindowUnicode (hWnd=0xa02b6) returned 1 [0087.275] GetMessageW (in: lpMsg=0x19ee98, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19ee98) returned 1 [0087.275] TranslateMessage (lpMsg=0x19ee98) returned 0 [0087.275] DispatchMessageW (lpMsg=0x19ee98) returned 0x0 [0087.275] PeekMessageW (in: lpMsg=0x19ee98, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee98) returned 0 [0087.275] PeekMessageW (in: lpMsg=0x19ee98, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee98) returned 0 [0091.771] PeekMessageW (in: lpMsg=0x19ee98, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee98) returned 0 [0091.772] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x90036, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0091.772] PeekMessageW (in: lpMsg=0x19ee98, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee98) returned 0 [0091.772] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0091.772] WaitMessage () returned 1 [0091.773] PeekMessageW (in: lpMsg=0x19ee98, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee98) returned 0 [0091.773] PeekMessageW (in: lpMsg=0x19ee98, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee98) returned 0 [0091.775] NtdllDefWindowProc_W (hWnd=0x7006e, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0091.775] WaitMessage () returned 1 [0097.252] PeekMessageW (in: lpMsg=0x19ee98, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee98) returned 1 [0097.252] IsWindowUnicode (hWnd=0x502b8) returned 1 [0097.252] GetMessageW (in: lpMsg=0x19ee98, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19ee98) returned 1 [0097.252] TranslateMessage (lpMsg=0x19ee98) returned 0 [0097.252] DispatchMessageW (lpMsg=0x19ee98) returned 0x0 [0097.290] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\SystemConfig.txt", nBufferLength=0x105, lpBuffer=0x19e504, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\SystemConfig.txt", lpFilePart=0x0) returned 0x20 [0097.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea48) returned 1 [0097.290] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\SystemConfig.txt" (normalized: "c:\\users\\fd1hvy\\systemconfig.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x46c [0097.290] GetFileType (hFile=0x46c) returned 0x1 [0097.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea44) returned 1 [0097.290] GetFileType (hFile=0x46c) returned 0x1 [0097.290] ReadFile (in: hFile=0x46c, lpBuffer=0x2435140, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19eaf0, lpOverlapped=0x0 | out: lpBuffer=0x2435140*, lpNumberOfBytesRead=0x19eaf0*=0xf, lpOverlapped=0x0) returned 1 [0097.291] ReadFile (in: hFile=0x46c, lpBuffer=0x2435140, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19eaf0, lpOverlapped=0x0 | out: lpBuffer=0x2435140*, lpNumberOfBytesRead=0x19eaf0*=0x0, lpOverlapped=0x0) returned 1 [0097.291] CloseHandle (hObject=0x46c) returned 1 [0097.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb18) returned 1 [0097.339] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0097.340] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\*", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xae6122c9, ftLastAccessTime.dwHighDateTime=0x1d5dffe, ftLastWriteTime.dwLowDateTime=0xae6122c9, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63c2b8 [0097.341] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xae6122c9, ftLastAccessTime.dwHighDateTime=0x1d5dffe, ftLastWriteTime.dwLowDateTime=0xae6122c9, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.341] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b6b2ca0, ftCreationTime.dwHighDateTime=0x1d5d248, ftLastAccessTime.dwLowDateTime=0xc6e24620, ftLastAccessTime.dwHighDateTime=0x1d5cf0d, ftLastWriteTime.dwLowDateTime=0xc6e24620, ftLastWriteTime.dwHighDateTime=0x1d5cf0d, nFileSizeHigh=0x0, nFileSizeLow=0x11aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0PyxImamnzpnnlXsC.png", cAlternateFileName="0PYXIM~1.PNG")) returned 1 [0097.341] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2e92b0, ftCreationTime.dwHighDateTime=0x1d5c89e, ftLastAccessTime.dwLowDateTime=0x801da250, ftLastAccessTime.dwHighDateTime=0x1d5cd93, ftLastWriteTime.dwLowDateTime=0x801da250, ftLastWriteTime.dwHighDateTime=0x1d5cd93, nFileSizeHigh=0x0, nFileSizeLow=0x6dc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="5MAH_Nf8-Boj9I iF0s.jpg", cAlternateFileName="5MAH_N~1.JPG")) returned 1 [0097.341] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23a573d0, ftCreationTime.dwHighDateTime=0x1d5d70d, ftLastAccessTime.dwLowDateTime=0xaef60440, ftLastAccessTime.dwHighDateTime=0x1d5d5f5, ftLastWriteTime.dwLowDateTime=0xaef60440, ftLastWriteTime.dwHighDateTime=0x1d5d5f5, nFileSizeHigh=0x0, nFileSizeLow=0xdd7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="6qi2I1lMUhi4s2_YT6u.gif", cAlternateFileName="6QI2I1~1.GIF")) returned 1 [0097.341] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1695bee0, ftCreationTime.dwHighDateTime=0x1d5d4d6, ftLastAccessTime.dwLowDateTime=0x44acc210, ftLastAccessTime.dwHighDateTime=0x1d5d373, ftLastWriteTime.dwLowDateTime=0x44acc210, ftLastWriteTime.dwHighDateTime=0x1d5d373, nFileSizeHigh=0x0, nFileSizeLow=0xc872, dwReserved0=0x0, dwReserved1=0x0, cFileName="8S4W3.wav", cAlternateFileName="")) returned 1 [0097.342] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7566f70, ftCreationTime.dwHighDateTime=0x1d5d6fb, ftLastAccessTime.dwLowDateTime=0x50082620, ftLastAccessTime.dwHighDateTime=0x1d5d640, ftLastWriteTime.dwLowDateTime=0x50082620, ftLastWriteTime.dwHighDateTime=0x1d5d640, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLshZEoEdxfL", cAlternateFileName="BLSHZE~1")) returned 1 [0097.342] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb877ee90, ftCreationTime.dwHighDateTime=0x1d5d3fa, ftLastAccessTime.dwLowDateTime=0x689c100, ftLastAccessTime.dwHighDateTime=0x1d5d5ac, ftLastWriteTime.dwLowDateTime=0x689c100, ftLastWriteTime.dwHighDateTime=0x1d5d5ac, nFileSizeHigh=0x0, nFileSizeLow=0xdc8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CgiIWgFcMnK2hFhEou9.gif", cAlternateFileName="CGIIWG~1.GIF")) returned 1 [0097.342] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26352930, ftCreationTime.dwHighDateTime=0x1d5ccb6, ftLastAccessTime.dwLowDateTime=0xfe3dda10, ftLastAccessTime.dwHighDateTime=0x1d5ceb0, ftLastWriteTime.dwLowDateTime=0xfe3dda10, ftLastWriteTime.dwHighDateTime=0x1d5ceb0, nFileSizeHigh=0x0, nFileSizeLow=0x1876d, dwReserved0=0x0, dwReserved1=0x0, cFileName="CYdHs9.pptx", cAlternateFileName="CYDHS9~1.PPT")) returned 1 [0097.342] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0097.342] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84ccd000, ftCreationTime.dwHighDateTime=0x1d5dffe, ftLastAccessTime.dwLowDateTime=0x85656680, ftLastAccessTime.dwHighDateTime=0x1d5dffe, ftLastWriteTime.dwLowDateTime=0x839ba300, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x56000, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRV.exe", cAlternateFileName="")) returned 1 [0097.342] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb6787b0, ftCreationTime.dwHighDateTime=0x1d5cac2, ftLastAccessTime.dwLowDateTime=0xbccb9890, ftLastAccessTime.dwHighDateTime=0x1d5c886, ftLastWriteTime.dwLowDateTime=0xbccb9890, ftLastWriteTime.dwHighDateTime=0x1d5c886, nFileSizeHigh=0x0, nFileSizeLow=0x15db7, dwReserved0=0x0, dwReserved1=0x0, cFileName="dVxUJ_SaiaupncGJ.gif", cAlternateFileName="DVXUJ_~1.GIF")) returned 1 [0097.342] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2e440e0, ftCreationTime.dwHighDateTime=0x1d5d6b0, ftLastAccessTime.dwLowDateTime=0xc6100b30, ftLastAccessTime.dwHighDateTime=0x1d5d622, ftLastWriteTime.dwLowDateTime=0xc6100b30, ftLastWriteTime.dwHighDateTime=0x1d5d622, nFileSizeHigh=0x0, nFileSizeLow=0xbfb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="GN_A1wx0NO-T5FHJ.pptx", cAlternateFileName="GN_A1W~1.PPT")) returned 1 [0097.342] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3a73700, ftCreationTime.dwHighDateTime=0x1d5d647, ftLastAccessTime.dwLowDateTime=0x57e3fe40, ftLastAccessTime.dwHighDateTime=0x1d5d5c9, ftLastWriteTime.dwLowDateTime=0x57e3fe40, ftLastWriteTime.dwHighDateTime=0x1d5d5c9, nFileSizeHigh=0x0, nFileSizeLow=0xdd8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="hKCzQJG5cKgcGNji.pptx", cAlternateFileName="HKCZQJ~1.PPT")) returned 1 [0097.343] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9d200, ftCreationTime.dwHighDateTime=0x1d5ced9, ftLastAccessTime.dwLowDateTime=0x14d9f9a0, ftLastAccessTime.dwHighDateTime=0x1d5c7e7, ftLastWriteTime.dwLowDateTime=0x14d9f9a0, ftLastWriteTime.dwHighDateTime=0x1d5c7e7, nFileSizeHigh=0x0, nFileSizeLow=0x105b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="iSvHdiCc4Z7.rtf", cAlternateFileName="ISVHDI~1.RTF")) returned 1 [0097.343] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63fe62c0, ftCreationTime.dwHighDateTime=0x1d5cf65, ftLastAccessTime.dwLowDateTime=0x46425dd0, ftLastAccessTime.dwHighDateTime=0x1d5d2d1, ftLastWriteTime.dwLowDateTime=0x46425dd0, ftLastWriteTime.dwHighDateTime=0x1d5d2d1, nFileSizeHigh=0x0, nFileSizeLow=0x1676a, dwReserved0=0x0, dwReserved1=0x0, cFileName="j-lHYz39UC3KNr4.flv", cAlternateFileName="J-LHYZ~1.FLV")) returned 1 [0097.343] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c75c560, ftCreationTime.dwHighDateTime=0x1d5ce56, ftLastAccessTime.dwLowDateTime=0x5e2654c0, ftLastAccessTime.dwHighDateTime=0x1d5d35c, ftLastWriteTime.dwLowDateTime=0x5e2654c0, ftLastWriteTime.dwHighDateTime=0x1d5d35c, nFileSizeHigh=0x0, nFileSizeLow=0x1331b, dwReserved0=0x0, dwReserved1=0x0, cFileName="jPhN88Kh3isgHJIo4.wav", cAlternateFileName="JPHN88~1.WAV")) returned 1 [0097.343] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa43cd440, ftCreationTime.dwHighDateTime=0x1d5d2d3, ftLastAccessTime.dwLowDateTime=0x9520bfa0, ftLastAccessTime.dwHighDateTime=0x1d5d812, ftLastWriteTime.dwLowDateTime=0x9520bfa0, ftLastWriteTime.dwHighDateTime=0x1d5d812, nFileSizeHigh=0x0, nFileSizeLow=0x16e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="JtvltXcORW8xUgrR.mp3", cAlternateFileName="JTVLTX~1.MP3")) returned 1 [0097.343] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a878650, ftCreationTime.dwHighDateTime=0x1d5d7cd, ftLastAccessTime.dwLowDateTime=0xc79f64f0, ftLastAccessTime.dwHighDateTime=0x1d5c9c5, ftLastWriteTime.dwLowDateTime=0xc79f64f0, ftLastWriteTime.dwHighDateTime=0x1d5c9c5, nFileSizeHigh=0x0, nFileSizeLow=0xb86b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lr15ZC5LRJQT.bmp", cAlternateFileName="LR15ZC~1.BMP")) returned 1 [0097.343] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21fe3b70, ftCreationTime.dwHighDateTime=0x1d5d668, ftLastAccessTime.dwLowDateTime=0x2ead3310, ftLastAccessTime.dwHighDateTime=0x1d5cfe9, ftLastWriteTime.dwLowDateTime=0x2ead3310, ftLastWriteTime.dwHighDateTime=0x1d5cfe9, nFileSizeHigh=0x0, nFileSizeLow=0x4bf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="M6VYK6E.odp", cAlternateFileName="")) returned 1 [0097.344] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d3c7520, ftCreationTime.dwHighDateTime=0x1d5d5c7, ftLastAccessTime.dwLowDateTime=0x7734a9b0, ftLastAccessTime.dwHighDateTime=0x1d5d0ac, ftLastWriteTime.dwLowDateTime=0x7734a9b0, ftLastWriteTime.dwHighDateTime=0x1d5d0ac, nFileSizeHigh=0x0, nFileSizeLow=0x85f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="mM 7m6k.bmp", cAlternateFileName="MM7M6K~1.BMP")) returned 1 [0097.344] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd89a6e80, ftCreationTime.dwHighDateTime=0x1d5d668, ftLastAccessTime.dwLowDateTime=0xf22bdf70, ftLastAccessTime.dwHighDateTime=0x1d5ca9f, ftLastWriteTime.dwLowDateTime=0xf22bdf70, ftLastWriteTime.dwHighDateTime=0x1d5ca9f, nFileSizeHigh=0x0, nFileSizeLow=0x10e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTeOoyOlzE1Yo.swf", cAlternateFileName="MTEOOY~1.SWF")) returned 1 [0097.344] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x657984d0, ftCreationTime.dwHighDateTime=0x1d5ce17, ftLastAccessTime.dwLowDateTime=0xb5f78460, ftLastAccessTime.dwHighDateTime=0x1d5d4ee, ftLastWriteTime.dwLowDateTime=0xb5f78460, ftLastWriteTime.dwHighDateTime=0x1d5d4ee, nFileSizeHigh=0x0, nFileSizeLow=0xf018, dwReserved0=0x0, dwReserved1=0x0, cFileName="n_j4UI6iCHD.rtf", cAlternateFileName="N_J4UI~1.RTF")) returned 1 [0097.344] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae6122c9, ftCreationTime.dwHighDateTime=0x1d5dffe, ftLastAccessTime.dwLowDateTime=0xae6122c9, ftLastAccessTime.dwHighDateTime=0x1d5dffe, ftLastWriteTime.dwLowDateTime=0xae6122c9, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x23, dwReserved0=0x0, dwReserved1=0x0, cFileName="Password.txt", cAlternateFileName="")) returned 1 [0097.344] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14346b50, ftCreationTime.dwHighDateTime=0x1d5c91a, ftLastAccessTime.dwLowDateTime=0xe7c74a90, ftLastAccessTime.dwHighDateTime=0x1d5d690, ftLastWriteTime.dwLowDateTime=0xe7c74a90, ftLastWriteTime.dwHighDateTime=0x1d5d690, nFileSizeHigh=0x0, nFileSizeLow=0x7566, dwReserved0=0x0, dwReserved1=0x0, cFileName="rqmLDSWQs1 o.mp3", cAlternateFileName="RQMLDS~1.MP3")) returned 1 [0097.344] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1060620, ftCreationTime.dwHighDateTime=0x1d5c92a, ftLastAccessTime.dwLowDateTime=0x79150510, ftLastAccessTime.dwHighDateTime=0x1d5cdd0, ftLastWriteTime.dwLowDateTime=0x79150510, ftLastWriteTime.dwHighDateTime=0x1d5cdd0, nFileSizeHigh=0x0, nFileSizeLow=0x14a27, dwReserved0=0x0, dwReserved1=0x0, cFileName="rTvcVL9G-LDnr.bmp", cAlternateFileName="RTVCVL~1.BMP")) returned 1 [0097.344] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacf8ff50, ftCreationTime.dwHighDateTime=0x1d5d161, ftLastAccessTime.dwLowDateTime=0xa87e9250, ftLastAccessTime.dwHighDateTime=0x1d5d715, ftLastWriteTime.dwLowDateTime=0xa87e9250, ftLastWriteTime.dwHighDateTime=0x1d5d715, nFileSizeHigh=0x0, nFileSizeLow=0xc0a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ss0TL1 KrYvXDdwYC.m4a", cAlternateFileName="SS0TL1~1.M4A")) returned 1 [0097.345] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdc4b8b0, ftCreationTime.dwHighDateTime=0x1d5d486, ftLastAccessTime.dwLowDateTime=0x6f23dd00, ftLastAccessTime.dwHighDateTime=0x1d5cfb1, ftLastWriteTime.dwLowDateTime=0x6f23dd00, ftLastWriteTime.dwHighDateTime=0x1d5cfb1, nFileSizeHigh=0x0, nFileSizeLow=0x14011, dwReserved0=0x0, dwReserved1=0x0, cFileName="t31IX.bmp", cAlternateFileName="")) returned 1 [0097.345] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf33a44c0, ftCreationTime.dwHighDateTime=0x1d5c887, ftLastAccessTime.dwLowDateTime=0x10b48540, ftLastAccessTime.dwHighDateTime=0x1d5d01e, ftLastWriteTime.dwLowDateTime=0x10b48540, ftLastWriteTime.dwHighDateTime=0x1d5d01e, nFileSizeHigh=0x0, nFileSizeLow=0x1f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="w3c1.avi", cAlternateFileName="")) returned 1 [0097.345] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa42cab10, ftCreationTime.dwHighDateTime=0x1d5d71a, ftLastAccessTime.dwLowDateTime=0x6ab5e230, ftLastAccessTime.dwHighDateTime=0x1d5d55c, ftLastWriteTime.dwLowDateTime=0x6ab5e230, ftLastWriteTime.dwHighDateTime=0x1d5d55c, nFileSizeHigh=0x0, nFileSizeLow=0xd2a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="wFVf.flv", cAlternateFileName="")) returned 1 [0097.345] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33dbfc70, ftCreationTime.dwHighDateTime=0x1d5d52c, ftLastAccessTime.dwLowDateTime=0x188abbc0, ftLastAccessTime.dwHighDateTime=0x1d5cbfc, ftLastWriteTime.dwLowDateTime=0x188abbc0, ftLastWriteTime.dwHighDateTime=0x1d5cbfc, nFileSizeHigh=0x0, nFileSizeLow=0x1852d, dwReserved0=0x0, dwReserved1=0x0, cFileName="WIdeLSdU4ixNHV55bM1R.swf", cAlternateFileName="WIDELS~1.SWF")) returned 1 [0097.345] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe17fb080, ftCreationTime.dwHighDateTime=0x1d5c931, ftLastAccessTime.dwLowDateTime=0x2d88a4d0, ftLastAccessTime.dwHighDateTime=0x1d5d5be, ftLastWriteTime.dwLowDateTime=0x2d88a4d0, ftLastWriteTime.dwHighDateTime=0x1d5d5be, nFileSizeHigh=0x0, nFileSizeLow=0xdd27, dwReserved0=0x0, dwReserved1=0x0, cFileName="xacwniH0UtpM0Xyaez1.wav", cAlternateFileName="XACWNI~1.WAV")) returned 1 [0097.345] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b85f0d0, ftCreationTime.dwHighDateTime=0x1d5ced6, ftLastAccessTime.dwLowDateTime=0xed863cd0, ftLastAccessTime.dwHighDateTime=0x1d5cafa, ftLastWriteTime.dwLowDateTime=0xed863cd0, ftLastWriteTime.dwHighDateTime=0x1d5cafa, nFileSizeHigh=0x0, nFileSizeLow=0x15e75, dwReserved0=0x0, dwReserved1=0x0, cFileName="XuxPlwVpcC.csv", cAlternateFileName="XUXPLW~1.CSV")) returned 1 [0097.365] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92184340, ftCreationTime.dwHighDateTime=0x1d5ccdd, ftLastAccessTime.dwLowDateTime=0xf66be290, ftLastAccessTime.dwHighDateTime=0x1d5cd9e, ftLastWriteTime.dwLowDateTime=0xf66be290, ftLastWriteTime.dwHighDateTime=0x1d5cd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7946, dwReserved0=0x0, dwReserved1=0x0, cFileName="yixXz XJ.mp3", cAlternateFileName="YIXXZX~1.MP3")) returned 1 [0097.365] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d004da0, ftCreationTime.dwHighDateTime=0x1d5d4a2, ftLastAccessTime.dwLowDateTime=0x427d18b0, ftLastAccessTime.dwHighDateTime=0x1d5cd50, ftLastWriteTime.dwLowDateTime=0x427d18b0, ftLastWriteTime.dwHighDateTime=0x1d5cd50, nFileSizeHigh=0x0, nFileSizeLow=0x43c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="zyAaunS1QrA.mkv", cAlternateFileName="ZYAAUN~1.MKV")) returned 1 [0097.365] FindNextFileW (in: hFindFile=0x63c2b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0097.365] FindClose (in: hFindFile=0x63c2b8 | out: hFindFile=0x63c2b8) returned 1 [0097.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ead4) returned 1 [0097.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eae0) returned 1 [0097.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb18) returned 1 [0097.366] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0097.366] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\*", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xae6122c9, ftLastAccessTime.dwHighDateTime=0x1d5dffe, ftLastWriteTime.dwLowDateTime=0xae6122c9, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63c3b8 [0097.366] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xae6122c9, ftLastAccessTime.dwHighDateTime=0x1d5dffe, ftLastWriteTime.dwLowDateTime=0xae6122c9, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.367] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b6b2ca0, ftCreationTime.dwHighDateTime=0x1d5d248, ftLastAccessTime.dwLowDateTime=0xc6e24620, ftLastAccessTime.dwHighDateTime=0x1d5cf0d, ftLastWriteTime.dwLowDateTime=0xc6e24620, ftLastWriteTime.dwHighDateTime=0x1d5cf0d, nFileSizeHigh=0x0, nFileSizeLow=0x11aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0PyxImamnzpnnlXsC.png", cAlternateFileName="0PYXIM~1.PNG")) returned 1 [0097.367] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2e92b0, ftCreationTime.dwHighDateTime=0x1d5c89e, ftLastAccessTime.dwLowDateTime=0x801da250, ftLastAccessTime.dwHighDateTime=0x1d5cd93, ftLastWriteTime.dwLowDateTime=0x801da250, ftLastWriteTime.dwHighDateTime=0x1d5cd93, nFileSizeHigh=0x0, nFileSizeLow=0x6dc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="5MAH_Nf8-Boj9I iF0s.jpg", cAlternateFileName="5MAH_N~1.JPG")) returned 1 [0097.367] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23a573d0, ftCreationTime.dwHighDateTime=0x1d5d70d, ftLastAccessTime.dwLowDateTime=0xaef60440, ftLastAccessTime.dwHighDateTime=0x1d5d5f5, ftLastWriteTime.dwLowDateTime=0xaef60440, ftLastWriteTime.dwHighDateTime=0x1d5d5f5, nFileSizeHigh=0x0, nFileSizeLow=0xdd7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="6qi2I1lMUhi4s2_YT6u.gif", cAlternateFileName="6QI2I1~1.GIF")) returned 1 [0097.367] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1695bee0, ftCreationTime.dwHighDateTime=0x1d5d4d6, ftLastAccessTime.dwLowDateTime=0x44acc210, ftLastAccessTime.dwHighDateTime=0x1d5d373, ftLastWriteTime.dwLowDateTime=0x44acc210, ftLastWriteTime.dwHighDateTime=0x1d5d373, nFileSizeHigh=0x0, nFileSizeLow=0xc872, dwReserved0=0x0, dwReserved1=0x0, cFileName="8S4W3.wav", cAlternateFileName="")) returned 1 [0097.367] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7566f70, ftCreationTime.dwHighDateTime=0x1d5d6fb, ftLastAccessTime.dwLowDateTime=0x50082620, ftLastAccessTime.dwHighDateTime=0x1d5d640, ftLastWriteTime.dwLowDateTime=0x50082620, ftLastWriteTime.dwHighDateTime=0x1d5d640, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLshZEoEdxfL", cAlternateFileName="BLSHZE~1")) returned 1 [0097.367] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb877ee90, ftCreationTime.dwHighDateTime=0x1d5d3fa, ftLastAccessTime.dwLowDateTime=0x689c100, ftLastAccessTime.dwHighDateTime=0x1d5d5ac, ftLastWriteTime.dwLowDateTime=0x689c100, ftLastWriteTime.dwHighDateTime=0x1d5d5ac, nFileSizeHigh=0x0, nFileSizeLow=0xdc8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CgiIWgFcMnK2hFhEou9.gif", cAlternateFileName="CGIIWG~1.GIF")) returned 1 [0097.368] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26352930, ftCreationTime.dwHighDateTime=0x1d5ccb6, ftLastAccessTime.dwLowDateTime=0xfe3dda10, ftLastAccessTime.dwHighDateTime=0x1d5ceb0, ftLastWriteTime.dwLowDateTime=0xfe3dda10, ftLastWriteTime.dwHighDateTime=0x1d5ceb0, nFileSizeHigh=0x0, nFileSizeLow=0x1876d, dwReserved0=0x0, dwReserved1=0x0, cFileName="CYdHs9.pptx", cAlternateFileName="CYDHS9~1.PPT")) returned 1 [0097.368] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0097.368] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84ccd000, ftCreationTime.dwHighDateTime=0x1d5dffe, ftLastAccessTime.dwLowDateTime=0x85656680, ftLastAccessTime.dwHighDateTime=0x1d5dffe, ftLastWriteTime.dwLowDateTime=0x839ba300, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x56000, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRV.exe", cAlternateFileName="")) returned 1 [0097.368] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb6787b0, ftCreationTime.dwHighDateTime=0x1d5cac2, ftLastAccessTime.dwLowDateTime=0xbccb9890, ftLastAccessTime.dwHighDateTime=0x1d5c886, ftLastWriteTime.dwLowDateTime=0xbccb9890, ftLastWriteTime.dwHighDateTime=0x1d5c886, nFileSizeHigh=0x0, nFileSizeLow=0x15db7, dwReserved0=0x0, dwReserved1=0x0, cFileName="dVxUJ_SaiaupncGJ.gif", cAlternateFileName="DVXUJ_~1.GIF")) returned 1 [0097.368] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2e440e0, ftCreationTime.dwHighDateTime=0x1d5d6b0, ftLastAccessTime.dwLowDateTime=0xc6100b30, ftLastAccessTime.dwHighDateTime=0x1d5d622, ftLastWriteTime.dwLowDateTime=0xc6100b30, ftLastWriteTime.dwHighDateTime=0x1d5d622, nFileSizeHigh=0x0, nFileSizeLow=0xbfb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="GN_A1wx0NO-T5FHJ.pptx", cAlternateFileName="GN_A1W~1.PPT")) returned 1 [0097.368] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3a73700, ftCreationTime.dwHighDateTime=0x1d5d647, ftLastAccessTime.dwLowDateTime=0x57e3fe40, ftLastAccessTime.dwHighDateTime=0x1d5d5c9, ftLastWriteTime.dwLowDateTime=0x57e3fe40, ftLastWriteTime.dwHighDateTime=0x1d5d5c9, nFileSizeHigh=0x0, nFileSizeLow=0xdd8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="hKCzQJG5cKgcGNji.pptx", cAlternateFileName="HKCZQJ~1.PPT")) returned 1 [0097.369] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9d200, ftCreationTime.dwHighDateTime=0x1d5ced9, ftLastAccessTime.dwLowDateTime=0x14d9f9a0, ftLastAccessTime.dwHighDateTime=0x1d5c7e7, ftLastWriteTime.dwLowDateTime=0x14d9f9a0, ftLastWriteTime.dwHighDateTime=0x1d5c7e7, nFileSizeHigh=0x0, nFileSizeLow=0x105b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="iSvHdiCc4Z7.rtf", cAlternateFileName="ISVHDI~1.RTF")) returned 1 [0097.369] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63fe62c0, ftCreationTime.dwHighDateTime=0x1d5cf65, ftLastAccessTime.dwLowDateTime=0x46425dd0, ftLastAccessTime.dwHighDateTime=0x1d5d2d1, ftLastWriteTime.dwLowDateTime=0x46425dd0, ftLastWriteTime.dwHighDateTime=0x1d5d2d1, nFileSizeHigh=0x0, nFileSizeLow=0x1676a, dwReserved0=0x0, dwReserved1=0x0, cFileName="j-lHYz39UC3KNr4.flv", cAlternateFileName="J-LHYZ~1.FLV")) returned 1 [0097.369] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c75c560, ftCreationTime.dwHighDateTime=0x1d5ce56, ftLastAccessTime.dwLowDateTime=0x5e2654c0, ftLastAccessTime.dwHighDateTime=0x1d5d35c, ftLastWriteTime.dwLowDateTime=0x5e2654c0, ftLastWriteTime.dwHighDateTime=0x1d5d35c, nFileSizeHigh=0x0, nFileSizeLow=0x1331b, dwReserved0=0x0, dwReserved1=0x0, cFileName="jPhN88Kh3isgHJIo4.wav", cAlternateFileName="JPHN88~1.WAV")) returned 1 [0097.369] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa43cd440, ftCreationTime.dwHighDateTime=0x1d5d2d3, ftLastAccessTime.dwLowDateTime=0x9520bfa0, ftLastAccessTime.dwHighDateTime=0x1d5d812, ftLastWriteTime.dwLowDateTime=0x9520bfa0, ftLastWriteTime.dwHighDateTime=0x1d5d812, nFileSizeHigh=0x0, nFileSizeLow=0x16e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="JtvltXcORW8xUgrR.mp3", cAlternateFileName="JTVLTX~1.MP3")) returned 1 [0097.369] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a878650, ftCreationTime.dwHighDateTime=0x1d5d7cd, ftLastAccessTime.dwLowDateTime=0xc79f64f0, ftLastAccessTime.dwHighDateTime=0x1d5c9c5, ftLastWriteTime.dwLowDateTime=0xc79f64f0, ftLastWriteTime.dwHighDateTime=0x1d5c9c5, nFileSizeHigh=0x0, nFileSizeLow=0xb86b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lr15ZC5LRJQT.bmp", cAlternateFileName="LR15ZC~1.BMP")) returned 1 [0097.369] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21fe3b70, ftCreationTime.dwHighDateTime=0x1d5d668, ftLastAccessTime.dwLowDateTime=0x2ead3310, ftLastAccessTime.dwHighDateTime=0x1d5cfe9, ftLastWriteTime.dwLowDateTime=0x2ead3310, ftLastWriteTime.dwHighDateTime=0x1d5cfe9, nFileSizeHigh=0x0, nFileSizeLow=0x4bf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="M6VYK6E.odp", cAlternateFileName="")) returned 1 [0097.369] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d3c7520, ftCreationTime.dwHighDateTime=0x1d5d5c7, ftLastAccessTime.dwLowDateTime=0x7734a9b0, ftLastAccessTime.dwHighDateTime=0x1d5d0ac, ftLastWriteTime.dwLowDateTime=0x7734a9b0, ftLastWriteTime.dwHighDateTime=0x1d5d0ac, nFileSizeHigh=0x0, nFileSizeLow=0x85f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="mM 7m6k.bmp", cAlternateFileName="MM7M6K~1.BMP")) returned 1 [0097.370] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd89a6e80, ftCreationTime.dwHighDateTime=0x1d5d668, ftLastAccessTime.dwLowDateTime=0xf22bdf70, ftLastAccessTime.dwHighDateTime=0x1d5ca9f, ftLastWriteTime.dwLowDateTime=0xf22bdf70, ftLastWriteTime.dwHighDateTime=0x1d5ca9f, nFileSizeHigh=0x0, nFileSizeLow=0x10e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTeOoyOlzE1Yo.swf", cAlternateFileName="MTEOOY~1.SWF")) returned 1 [0097.370] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x657984d0, ftCreationTime.dwHighDateTime=0x1d5ce17, ftLastAccessTime.dwLowDateTime=0xb5f78460, ftLastAccessTime.dwHighDateTime=0x1d5d4ee, ftLastWriteTime.dwLowDateTime=0xb5f78460, ftLastWriteTime.dwHighDateTime=0x1d5d4ee, nFileSizeHigh=0x0, nFileSizeLow=0xf018, dwReserved0=0x0, dwReserved1=0x0, cFileName="n_j4UI6iCHD.rtf", cAlternateFileName="N_J4UI~1.RTF")) returned 1 [0097.370] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae6122c9, ftCreationTime.dwHighDateTime=0x1d5dffe, ftLastAccessTime.dwLowDateTime=0xae6122c9, ftLastAccessTime.dwHighDateTime=0x1d5dffe, ftLastWriteTime.dwLowDateTime=0xae6122c9, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x23, dwReserved0=0x0, dwReserved1=0x0, cFileName="Password.txt", cAlternateFileName="")) returned 1 [0097.370] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14346b50, ftCreationTime.dwHighDateTime=0x1d5c91a, ftLastAccessTime.dwLowDateTime=0xe7c74a90, ftLastAccessTime.dwHighDateTime=0x1d5d690, ftLastWriteTime.dwLowDateTime=0xe7c74a90, ftLastWriteTime.dwHighDateTime=0x1d5d690, nFileSizeHigh=0x0, nFileSizeLow=0x7566, dwReserved0=0x0, dwReserved1=0x0, cFileName="rqmLDSWQs1 o.mp3", cAlternateFileName="RQMLDS~1.MP3")) returned 1 [0097.370] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1060620, ftCreationTime.dwHighDateTime=0x1d5c92a, ftLastAccessTime.dwLowDateTime=0x79150510, ftLastAccessTime.dwHighDateTime=0x1d5cdd0, ftLastWriteTime.dwLowDateTime=0x79150510, ftLastWriteTime.dwHighDateTime=0x1d5cdd0, nFileSizeHigh=0x0, nFileSizeLow=0x14a27, dwReserved0=0x0, dwReserved1=0x0, cFileName="rTvcVL9G-LDnr.bmp", cAlternateFileName="RTVCVL~1.BMP")) returned 1 [0097.370] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacf8ff50, ftCreationTime.dwHighDateTime=0x1d5d161, ftLastAccessTime.dwLowDateTime=0xa87e9250, ftLastAccessTime.dwHighDateTime=0x1d5d715, ftLastWriteTime.dwLowDateTime=0xa87e9250, ftLastWriteTime.dwHighDateTime=0x1d5d715, nFileSizeHigh=0x0, nFileSizeLow=0xc0a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ss0TL1 KrYvXDdwYC.m4a", cAlternateFileName="SS0TL1~1.M4A")) returned 1 [0097.371] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdc4b8b0, ftCreationTime.dwHighDateTime=0x1d5d486, ftLastAccessTime.dwLowDateTime=0x6f23dd00, ftLastAccessTime.dwHighDateTime=0x1d5cfb1, ftLastWriteTime.dwLowDateTime=0x6f23dd00, ftLastWriteTime.dwHighDateTime=0x1d5cfb1, nFileSizeHigh=0x0, nFileSizeLow=0x14011, dwReserved0=0x0, dwReserved1=0x0, cFileName="t31IX.bmp", cAlternateFileName="")) returned 1 [0097.371] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf33a44c0, ftCreationTime.dwHighDateTime=0x1d5c887, ftLastAccessTime.dwLowDateTime=0x10b48540, ftLastAccessTime.dwHighDateTime=0x1d5d01e, ftLastWriteTime.dwLowDateTime=0x10b48540, ftLastWriteTime.dwHighDateTime=0x1d5d01e, nFileSizeHigh=0x0, nFileSizeLow=0x1f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="w3c1.avi", cAlternateFileName="")) returned 1 [0097.371] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa42cab10, ftCreationTime.dwHighDateTime=0x1d5d71a, ftLastAccessTime.dwLowDateTime=0x6ab5e230, ftLastAccessTime.dwHighDateTime=0x1d5d55c, ftLastWriteTime.dwLowDateTime=0x6ab5e230, ftLastWriteTime.dwHighDateTime=0x1d5d55c, nFileSizeHigh=0x0, nFileSizeLow=0xd2a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="wFVf.flv", cAlternateFileName="")) returned 1 [0097.371] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33dbfc70, ftCreationTime.dwHighDateTime=0x1d5d52c, ftLastAccessTime.dwLowDateTime=0x188abbc0, ftLastAccessTime.dwHighDateTime=0x1d5cbfc, ftLastWriteTime.dwLowDateTime=0x188abbc0, ftLastWriteTime.dwHighDateTime=0x1d5cbfc, nFileSizeHigh=0x0, nFileSizeLow=0x1852d, dwReserved0=0x0, dwReserved1=0x0, cFileName="WIdeLSdU4ixNHV55bM1R.swf", cAlternateFileName="WIDELS~1.SWF")) returned 1 [0097.371] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe17fb080, ftCreationTime.dwHighDateTime=0x1d5c931, ftLastAccessTime.dwLowDateTime=0x2d88a4d0, ftLastAccessTime.dwHighDateTime=0x1d5d5be, ftLastWriteTime.dwLowDateTime=0x2d88a4d0, ftLastWriteTime.dwHighDateTime=0x1d5d5be, nFileSizeHigh=0x0, nFileSizeLow=0xdd27, dwReserved0=0x0, dwReserved1=0x0, cFileName="xacwniH0UtpM0Xyaez1.wav", cAlternateFileName="XACWNI~1.WAV")) returned 1 [0097.372] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b85f0d0, ftCreationTime.dwHighDateTime=0x1d5ced6, ftLastAccessTime.dwLowDateTime=0xed863cd0, ftLastAccessTime.dwHighDateTime=0x1d5cafa, ftLastWriteTime.dwLowDateTime=0xed863cd0, ftLastWriteTime.dwHighDateTime=0x1d5cafa, nFileSizeHigh=0x0, nFileSizeLow=0x15e75, dwReserved0=0x0, dwReserved1=0x0, cFileName="XuxPlwVpcC.csv", cAlternateFileName="XUXPLW~1.CSV")) returned 1 [0097.372] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92184340, ftCreationTime.dwHighDateTime=0x1d5ccdd, ftLastAccessTime.dwLowDateTime=0xf66be290, ftLastAccessTime.dwHighDateTime=0x1d5cd9e, ftLastWriteTime.dwLowDateTime=0xf66be290, ftLastWriteTime.dwHighDateTime=0x1d5cd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7946, dwReserved0=0x0, dwReserved1=0x0, cFileName="yixXz XJ.mp3", cAlternateFileName="YIXXZX~1.MP3")) returned 1 [0097.372] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d004da0, ftCreationTime.dwHighDateTime=0x1d5d4a2, ftLastAccessTime.dwLowDateTime=0x427d18b0, ftLastAccessTime.dwHighDateTime=0x1d5cd50, ftLastWriteTime.dwLowDateTime=0x427d18b0, ftLastWriteTime.dwHighDateTime=0x1d5cd50, nFileSizeHigh=0x0, nFileSizeLow=0x43c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="zyAaunS1QrA.mkv", cAlternateFileName="ZYAAUN~1.MKV")) returned 1 [0097.372] FindNextFileW (in: hFindFile=0x63c3b8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d004da0, ftCreationTime.dwHighDateTime=0x1d5d4a2, ftLastAccessTime.dwLowDateTime=0x427d18b0, ftLastAccessTime.dwHighDateTime=0x1d5cd50, ftLastWriteTime.dwLowDateTime=0x427d18b0, ftLastWriteTime.dwHighDateTime=0x1d5cd50, nFileSizeHigh=0x0, nFileSizeLow=0x43c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="zyAaunS1QrA.mkv", cAlternateFileName="ZYAAUN~1.MKV")) returned 0 [0097.372] FindClose (in: hFindFile=0x63c3b8 | out: hFindFile=0x63c3b8) returned 1 [0097.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ead4) returned 1 [0097.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eae0) returned 1 [0097.407] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\0PyxImamnzpnnlXsC.png", nBufferLength=0x105, lpBuffer=0x19e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\0PyxImamnzpnnlXsC.png", lpFilePart=0x0) returned 0x2d [0097.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea04) returned 1 [0097.407] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\0PyxImamnzpnnlXsC.png" (normalized: "c:\\users\\fd1hvy\\desktop\\0pyximamnzpnnlxsc.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x46c [0097.407] GetFileType (hFile=0x46c) returned 0x1 [0097.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea00) returned 1 [0097.407] GetFileType (hFile=0x46c) returned 0x1 [0097.407] GetFileSize (in: hFile=0x46c, lpFileSizeHigh=0x19eb00 | out: lpFileSizeHigh=0x19eb00*=0x0) returned 0x11aa0 [0097.457] ReadFile (in: hFile=0x46c, lpBuffer=0x243cb80, nNumberOfBytesToRead=0x11aa0, lpNumberOfBytesRead=0x19eaac, lpOverlapped=0x0 | out: lpBuffer=0x243cb80*, lpNumberOfBytesRead=0x19eaac*=0x11aa0, lpOverlapped=0x0) returned 1 [0097.458] CloseHandle (hObject=0x46c) returned 1 [0097.487] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x19e454, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0097.487] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x19e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0097.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e96c) returned 1 [0097.487] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19e9e8 | out: lpFileInformation=0x19e9e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0097.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e968) returned 1 [0097.642] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x19e8c4 | out: pfEnabled=0x19e8c4) returned 0x0 [0098.452] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\0PyxImamnzpnnlXsC.png", nBufferLength=0x105, lpBuffer=0x19e4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\0PyxImamnzpnnlXsC.png", lpFilePart=0x0) returned 0x2d [0098.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9ec) returned 1 [0098.452] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\0PyxImamnzpnnlXsC.png" (normalized: "c:\\users\\fd1hvy\\desktop\\0pyximamnzpnnlxsc.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x470 [0098.454] GetFileType (hFile=0x470) returned 0x1 [0098.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e8) returned 1 [0098.454] GetFileType (hFile=0x470) returned 0x1 [0098.454] WriteFile (in: hFile=0x470, lpBuffer=0x24ee560*, nNumberOfBytesToWrite=0x11ab0, lpNumberOfBytesWritten=0x19ea9c, lpOverlapped=0x0 | out: lpBuffer=0x24ee560*, lpNumberOfBytesWritten=0x19ea9c*=0x11ab0, lpOverlapped=0x0) returned 1 [0098.492] CloseHandle (hObject=0x470) returned 1 [0098.544] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\0PyxImamnzpnnlXsC.png", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\0PyxImamnzpnnlXsC.png", lpFilePart=0x0) returned 0x2d [0098.544] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\0PyxImamnzpnnlXsC.png.lasan", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\0PyxImamnzpnnlXsC.png.lasan", lpFilePart=0x0) returned 0x33 [0098.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0098.544] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\0PyxImamnzpnnlXsC.png" (normalized: "c:\\users\\fd1hvy\\desktop\\0pyximamnzpnnlxsc.png"), fInfoLevelId=0x0, lpFileInformation=0x19eafc | out: lpFileInformation=0x19eafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b6b2ca0, ftCreationTime.dwHighDateTime=0x1d5d248, ftLastAccessTime.dwLowDateTime=0xc6e24620, ftLastAccessTime.dwHighDateTime=0x1d5cf0d, ftLastWriteTime.dwLowDateTime=0xc04f7a09, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x11ab0)) returned 1 [0098.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea7c) returned 1 [0098.545] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\0PyxImamnzpnnlXsC.png" (normalized: "c:\\users\\fd1hvy\\desktop\\0pyximamnzpnnlxsc.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\0PyxImamnzpnnlXsC.png.lasan" (normalized: "c:\\users\\fd1hvy\\desktop\\0pyximamnzpnnlxsc.png.lasan")) returned 1 [0098.597] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\5MAH_Nf8-Boj9I iF0s.jpg", nBufferLength=0x105, lpBuffer=0x19e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\5MAH_Nf8-Boj9I iF0s.jpg", lpFilePart=0x0) returned 0x2f [0098.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea04) returned 1 [0098.597] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\5MAH_Nf8-Boj9I iF0s.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\5mah_nf8-boj9i if0s.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x470 [0098.598] GetFileType (hFile=0x470) returned 0x1 [0098.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea00) returned 1 [0098.598] GetFileType (hFile=0x470) returned 0x1 [0098.598] GetFileSize (in: hFile=0x470, lpFileSizeHigh=0x19eb00 | out: lpFileSizeHigh=0x19eb00*=0x0) returned 0x6dc2 [0098.599] ReadFile (in: hFile=0x470, lpBuffer=0x2501014, nNumberOfBytesToRead=0x6dc2, lpNumberOfBytesRead=0x19eaac, lpOverlapped=0x0 | out: lpBuffer=0x2501014*, lpNumberOfBytesRead=0x19eaac*=0x6dc2, lpOverlapped=0x0) returned 1 [0098.599] CloseHandle (hObject=0x470) returned 1 [0098.716] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\5MAH_Nf8-Boj9I iF0s.jpg", nBufferLength=0x105, lpBuffer=0x19e4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\5MAH_Nf8-Boj9I iF0s.jpg", lpFilePart=0x0) returned 0x2f [0098.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9ec) returned 1 [0098.716] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\5MAH_Nf8-Boj9I iF0s.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\5mah_nf8-boj9i if0s.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x470 [0098.770] GetFileType (hFile=0x470) returned 0x1 [0098.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e8) returned 1 [0098.770] GetFileType (hFile=0x470) returned 0x1 [0098.770] WriteFile (in: hFile=0x470, lpBuffer=0x2570310*, nNumberOfBytesToWrite=0x6dd0, lpNumberOfBytesWritten=0x19ea9c, lpOverlapped=0x0 | out: lpBuffer=0x2570310*, lpNumberOfBytesWritten=0x19ea9c*=0x6dd0, lpOverlapped=0x0) returned 1 [0098.771] CloseHandle (hObject=0x470) returned 1 [0098.815] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\5MAH_Nf8-Boj9I iF0s.jpg", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\5MAH_Nf8-Boj9I iF0s.jpg", lpFilePart=0x0) returned 0x2f [0098.816] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\5MAH_Nf8-Boj9I iF0s.jpg.lasan", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\5MAH_Nf8-Boj9I iF0s.jpg.lasan", lpFilePart=0x0) returned 0x35 [0098.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0098.816] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\5MAH_Nf8-Boj9I iF0s.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\5mah_nf8-boj9i if0s.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19eafc | out: lpFileInformation=0x19eafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2e92b0, ftCreationTime.dwHighDateTime=0x1d5c89e, ftLastAccessTime.dwLowDateTime=0x801da250, ftLastAccessTime.dwHighDateTime=0x1d5cd93, ftLastWriteTime.dwLowDateTime=0xc07a5c2e, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x6dd0)) returned 1 [0098.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea7c) returned 1 [0098.816] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\5MAH_Nf8-Boj9I iF0s.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\5mah_nf8-boj9i if0s.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\5MAH_Nf8-Boj9I iF0s.jpg.lasan" (normalized: "c:\\users\\fd1hvy\\desktop\\5mah_nf8-boj9i if0s.jpg.lasan")) returned 1 [0099.132] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\CYdHs9.pptx", nBufferLength=0x105, lpBuffer=0x19e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\CYdHs9.pptx", lpFilePart=0x0) returned 0x23 [0099.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea04) returned 1 [0099.132] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\CYdHs9.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\cydhs9.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x470 [0099.132] GetFileType (hFile=0x470) returned 0x1 [0099.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea00) returned 1 [0099.132] GetFileType (hFile=0x470) returned 0x1 [0099.132] GetFileSize (in: hFile=0x470, lpFileSizeHigh=0x19eb00 | out: lpFileSizeHigh=0x19eb00*=0x0) returned 0x1876d [0099.133] ReadFile (in: hFile=0x470, lpBuffer=0x345c608, nNumberOfBytesToRead=0x1876d, lpNumberOfBytesRead=0x19eaac, lpOverlapped=0x0 | out: lpBuffer=0x345c608*, lpNumberOfBytesRead=0x19eaac*=0x1876d, lpOverlapped=0x0) returned 1 [0099.135] CloseHandle (hObject=0x470) returned 1 [0099.403] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\CYdHs9.pptx", nBufferLength=0x105, lpBuffer=0x19e4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\CYdHs9.pptx", lpFilePart=0x0) returned 0x23 [0099.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9ec) returned 1 [0099.403] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\CYdHs9.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\cydhs9.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0099.405] GetFileType (hFile=0x430) returned 0x1 [0099.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e8) returned 1 [0099.405] GetFileType (hFile=0x430) returned 0x1 [0099.405] WriteFile (in: hFile=0x430, lpBuffer=0x34d6b78*, nNumberOfBytesToWrite=0x18770, lpNumberOfBytesWritten=0x19ea9c, lpOverlapped=0x0 | out: lpBuffer=0x34d6b78*, lpNumberOfBytesWritten=0x19ea9c*=0x18770, lpOverlapped=0x0) returned 1 [0099.407] CloseHandle (hObject=0x430) returned 1 [0099.410] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\CYdHs9.pptx", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\CYdHs9.pptx", lpFilePart=0x0) returned 0x23 [0099.410] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\CYdHs9.pptx.lasan", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\CYdHs9.pptx.lasan", lpFilePart=0x0) returned 0x29 [0099.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0099.410] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\CYdHs9.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\cydhs9.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19eafc | out: lpFileInformation=0x19eafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26352930, ftCreationTime.dwHighDateTime=0x1d5ccb6, ftLastAccessTime.dwLowDateTime=0xfe3dda10, ftLastAccessTime.dwHighDateTime=0x1d5ceb0, ftLastWriteTime.dwLowDateTime=0xc0dadedb, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x18770)) returned 1 [0099.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea7c) returned 1 [0099.410] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\CYdHs9.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\cydhs9.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\CYdHs9.pptx.lasan" (normalized: "c:\\users\\fd1hvy\\desktop\\cydhs9.pptx.lasan")) returned 1 [0099.411] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GN_A1wx0NO-T5FHJ.pptx", nBufferLength=0x105, lpBuffer=0x19e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\GN_A1wx0NO-T5FHJ.pptx", lpFilePart=0x0) returned 0x2d [0099.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea04) returned 1 [0099.411] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\GN_A1wx0NO-T5FHJ.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\gn_a1wx0no-t5fhj.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0099.411] GetFileType (hFile=0x430) returned 0x1 [0099.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea00) returned 1 [0099.411] GetFileType (hFile=0x430) returned 0x1 [0099.411] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eb00 | out: lpFileSizeHigh=0x19eb00*=0x0) returned 0xbfb2 [0099.412] ReadFile (in: hFile=0x430, lpBuffer=0x23fed14, nNumberOfBytesToRead=0xbfb2, lpNumberOfBytesRead=0x19eaac, lpOverlapped=0x0 | out: lpBuffer=0x23fed14*, lpNumberOfBytesRead=0x19eaac*=0xbfb2, lpOverlapped=0x0) returned 1 [0099.412] CloseHandle (hObject=0x430) returned 1 [0099.510] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GN_A1wx0NO-T5FHJ.pptx", nBufferLength=0x105, lpBuffer=0x19e4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\GN_A1wx0NO-T5FHJ.pptx", lpFilePart=0x0) returned 0x2d [0099.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9ec) returned 1 [0099.510] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\GN_A1wx0NO-T5FHJ.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\gn_a1wx0no-t5fhj.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0099.512] GetFileType (hFile=0x430) returned 0x1 [0099.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e8) returned 1 [0099.512] GetFileType (hFile=0x430) returned 0x1 [0099.512] WriteFile (in: hFile=0x430, lpBuffer=0x246fbb0*, nNumberOfBytesToWrite=0xbfc0, lpNumberOfBytesWritten=0x19ea9c, lpOverlapped=0x0 | out: lpBuffer=0x246fbb0*, lpNumberOfBytesWritten=0x19ea9c*=0xbfc0, lpOverlapped=0x0) returned 1 [0099.513] CloseHandle (hObject=0x430) returned 1 [0099.515] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GN_A1wx0NO-T5FHJ.pptx", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\GN_A1wx0NO-T5FHJ.pptx", lpFilePart=0x0) returned 0x2d [0099.515] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GN_A1wx0NO-T5FHJ.pptx.lasan", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\GN_A1wx0NO-T5FHJ.pptx.lasan", lpFilePart=0x0) returned 0x33 [0099.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0099.516] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GN_A1wx0NO-T5FHJ.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\gn_a1wx0no-t5fhj.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19eafc | out: lpFileInformation=0x19eafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2e440e0, ftCreationTime.dwHighDateTime=0x1d5d6b0, ftLastAccessTime.dwLowDateTime=0xc6100b30, ftLastAccessTime.dwHighDateTime=0x1d5d622, ftLastWriteTime.dwLowDateTime=0xc0eb9add, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0xbfc0)) returned 1 [0099.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea7c) returned 1 [0099.516] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\GN_A1wx0NO-T5FHJ.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\gn_a1wx0no-t5fhj.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\GN_A1wx0NO-T5FHJ.pptx.lasan" (normalized: "c:\\users\\fd1hvy\\desktop\\gn_a1wx0no-t5fhj.pptx.lasan")) returned 1 [0099.516] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hKCzQJG5cKgcGNji.pptx", nBufferLength=0x105, lpBuffer=0x19e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\hKCzQJG5cKgcGNji.pptx", lpFilePart=0x0) returned 0x2d [0099.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea04) returned 1 [0099.516] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\hKCzQJG5cKgcGNji.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\hkczqjg5ckgcgnji.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0099.517] GetFileType (hFile=0x430) returned 0x1 [0099.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea00) returned 1 [0099.517] GetFileType (hFile=0x430) returned 0x1 [0099.517] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eb00 | out: lpFileSizeHigh=0x19eb00*=0x0) returned 0xdd8b [0099.517] ReadFile (in: hFile=0x430, lpBuffer=0x247bef8, nNumberOfBytesToRead=0xdd8b, lpNumberOfBytesRead=0x19eaac, lpOverlapped=0x0 | out: lpBuffer=0x247bef8*, lpNumberOfBytesRead=0x19eaac*=0xdd8b, lpOverlapped=0x0) returned 1 [0099.517] CloseHandle (hObject=0x430) returned 1 [0099.535] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hKCzQJG5cKgcGNji.pptx", nBufferLength=0x105, lpBuffer=0x19e4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\hKCzQJG5cKgcGNji.pptx", lpFilePart=0x0) returned 0x2d [0099.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9ec) returned 1 [0099.535] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\hKCzQJG5cKgcGNji.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\hkczqjg5ckgcgnji.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0099.537] GetFileType (hFile=0x430) returned 0x1 [0099.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e8) returned 1 [0099.537] GetFileType (hFile=0x430) returned 0x1 [0099.537] WriteFile (in: hFile=0x430, lpBuffer=0x24f25a8*, nNumberOfBytesToWrite=0xdd90, lpNumberOfBytesWritten=0x19ea9c, lpOverlapped=0x0 | out: lpBuffer=0x24f25a8*, lpNumberOfBytesWritten=0x19ea9c*=0xdd90, lpOverlapped=0x0) returned 1 [0099.538] CloseHandle (hObject=0x430) returned 1 [0099.540] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hKCzQJG5cKgcGNji.pptx", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\hKCzQJG5cKgcGNji.pptx", lpFilePart=0x0) returned 0x2d [0099.540] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hKCzQJG5cKgcGNji.pptx.lasan", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\hKCzQJG5cKgcGNji.pptx.lasan", lpFilePart=0x0) returned 0x33 [0099.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0099.540] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hKCzQJG5cKgcGNji.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\hkczqjg5ckgcgnji.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19eafc | out: lpFileInformation=0x19eafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3a73700, ftCreationTime.dwHighDateTime=0x1d5d647, ftLastAccessTime.dwLowDateTime=0x57e3fe40, ftLastAccessTime.dwHighDateTime=0x1d5d5c9, ftLastWriteTime.dwLowDateTime=0xc0edf0cd, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0xdd90)) returned 1 [0099.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea7c) returned 1 [0099.608] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\hKCzQJG5cKgcGNji.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\hkczqjg5ckgcgnji.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\hKCzQJG5cKgcGNji.pptx.lasan" (normalized: "c:\\users\\fd1hvy\\desktop\\hkczqjg5ckgcgnji.pptx.lasan")) returned 1 [0099.609] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\iSvHdiCc4Z7.rtf", nBufferLength=0x105, lpBuffer=0x19e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\iSvHdiCc4Z7.rtf", lpFilePart=0x0) returned 0x27 [0099.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea04) returned 1 [0099.609] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\iSvHdiCc4Z7.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\isvhdicc4z7.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0099.609] GetFileType (hFile=0x430) returned 0x1 [0099.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea00) returned 1 [0099.609] GetFileType (hFile=0x430) returned 0x1 [0099.609] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eb00 | out: lpFileSizeHigh=0x19eb00*=0x0) returned 0x105b1 [0099.609] ReadFile (in: hFile=0x430, lpBuffer=0x25006a8, nNumberOfBytesToRead=0x105b1, lpNumberOfBytesRead=0x19eaac, lpOverlapped=0x0 | out: lpBuffer=0x25006a8*, lpNumberOfBytesRead=0x19eaac*=0x105b1, lpOverlapped=0x0) returned 1 [0099.610] CloseHandle (hObject=0x430) returned 1 [0099.630] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\iSvHdiCc4Z7.rtf", nBufferLength=0x105, lpBuffer=0x19e4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\iSvHdiCc4Z7.rtf", lpFilePart=0x0) returned 0x27 [0099.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9ec) returned 1 [0099.631] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\iSvHdiCc4Z7.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\isvhdicc4z7.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0099.632] GetFileType (hFile=0x430) returned 0x1 [0099.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e8) returned 1 [0099.632] GetFileType (hFile=0x430) returned 0x1 [0099.632] WriteFile (in: hFile=0x430, lpBuffer=0x257e5e8*, nNumberOfBytesToWrite=0x105c0, lpNumberOfBytesWritten=0x19ea9c, lpOverlapped=0x0 | out: lpBuffer=0x257e5e8*, lpNumberOfBytesWritten=0x19ea9c*=0x105c0, lpOverlapped=0x0) returned 1 [0099.634] CloseHandle (hObject=0x430) returned 1 [0099.637] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\iSvHdiCc4Z7.rtf", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\iSvHdiCc4Z7.rtf", lpFilePart=0x0) returned 0x27 [0099.637] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\iSvHdiCc4Z7.rtf.lasan", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\iSvHdiCc4Z7.rtf.lasan", lpFilePart=0x0) returned 0x2d [0099.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0099.637] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\iSvHdiCc4Z7.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\isvhdicc4z7.rtf"), fInfoLevelId=0x0, lpFileInformation=0x19eafc | out: lpFileInformation=0x19eafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9d200, ftCreationTime.dwHighDateTime=0x1d5ced9, ftLastAccessTime.dwLowDateTime=0x14d9f9a0, ftLastAccessTime.dwHighDateTime=0x1d5c7e7, ftLastWriteTime.dwLowDateTime=0xc0fea314, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x105c0)) returned 1 [0099.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea7c) returned 1 [0099.637] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\iSvHdiCc4Z7.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\isvhdicc4z7.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\iSvHdiCc4Z7.rtf.lasan" (normalized: "c:\\users\\fd1hvy\\desktop\\isvhdicc4z7.rtf.lasan")) returned 1 [0099.638] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\JtvltXcORW8xUgrR.mp3", nBufferLength=0x105, lpBuffer=0x19e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\JtvltXcORW8xUgrR.mp3", lpFilePart=0x0) returned 0x2c [0099.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea04) returned 1 [0099.638] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\JtvltXcORW8xUgrR.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\jtvltxcorw8xugrr.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0099.638] GetFileType (hFile=0x430) returned 0x1 [0099.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea00) returned 1 [0099.639] GetFileType (hFile=0x430) returned 0x1 [0099.639] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eb00 | out: lpFileSizeHigh=0x19eb00*=0x0) returned 0x16e60 [0099.639] ReadFile (in: hFile=0x430, lpBuffer=0x3543928, nNumberOfBytesToRead=0x16e60, lpNumberOfBytesRead=0x19eaac, lpOverlapped=0x0 | out: lpBuffer=0x3543928*, lpNumberOfBytesRead=0x19eaac*=0x16e60, lpOverlapped=0x0) returned 1 [0099.641] CloseHandle (hObject=0x430) returned 1 [0099.741] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\JtvltXcORW8xUgrR.mp3", nBufferLength=0x105, lpBuffer=0x19e4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\JtvltXcORW8xUgrR.mp3", lpFilePart=0x0) returned 0x2c [0099.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9ec) returned 1 [0099.741] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\JtvltXcORW8xUgrR.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\jtvltxcorw8xugrr.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0099.742] GetFileType (hFile=0x430) returned 0x1 [0099.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e8) returned 1 [0099.742] GetFileType (hFile=0x430) returned 0x1 [0099.743] WriteFile (in: hFile=0x430, lpBuffer=0x35b6188*, nNumberOfBytesToWrite=0x16e70, lpNumberOfBytesWritten=0x19ea9c, lpOverlapped=0x0 | out: lpBuffer=0x35b6188*, lpNumberOfBytesWritten=0x19ea9c*=0x16e70, lpOverlapped=0x0) returned 1 [0099.745] CloseHandle (hObject=0x430) returned 1 [0099.748] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\JtvltXcORW8xUgrR.mp3", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\JtvltXcORW8xUgrR.mp3", lpFilePart=0x0) returned 0x2c [0099.748] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\JtvltXcORW8xUgrR.mp3.lasan", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\JtvltXcORW8xUgrR.mp3.lasan", lpFilePart=0x0) returned 0x32 [0099.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0099.748] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\JtvltXcORW8xUgrR.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\jtvltxcorw8xugrr.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19eafc | out: lpFileInformation=0x19eafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa43cd440, ftCreationTime.dwHighDateTime=0x1d5d2d3, ftLastAccessTime.dwLowDateTime=0x9520bfa0, ftLastAccessTime.dwHighDateTime=0x1d5d812, ftLastWriteTime.dwLowDateTime=0xc10f519b, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x16e70)) returned 1 [0099.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea7c) returned 1 [0099.748] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\JtvltXcORW8xUgrR.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\jtvltxcorw8xugrr.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\JtvltXcORW8xUgrR.mp3.lasan" (normalized: "c:\\users\\fd1hvy\\desktop\\jtvltxcorw8xugrr.mp3.lasan")) returned 1 [0099.749] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\n_j4UI6iCHD.rtf", nBufferLength=0x105, lpBuffer=0x19e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\n_j4UI6iCHD.rtf", lpFilePart=0x0) returned 0x27 [0099.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea04) returned 1 [0099.749] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\n_j4UI6iCHD.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\n_j4ui6ichd.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0099.749] GetFileType (hFile=0x430) returned 0x1 [0099.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea00) returned 1 [0099.749] GetFileType (hFile=0x430) returned 0x1 [0099.749] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eb00 | out: lpFileSizeHigh=0x19eb00*=0x0) returned 0xf018 [0099.751] ReadFile (in: hFile=0x430, lpBuffer=0x25dc0f0, nNumberOfBytesToRead=0xf018, lpNumberOfBytesRead=0x19eaac, lpOverlapped=0x0 | out: lpBuffer=0x25dc0f0*, lpNumberOfBytesRead=0x19eaac*=0xf018, lpOverlapped=0x0) returned 1 [0099.751] CloseHandle (hObject=0x430) returned 1 [0099.828] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\n_j4UI6iCHD.rtf", nBufferLength=0x105, lpBuffer=0x19e4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\n_j4UI6iCHD.rtf", lpFilePart=0x0) returned 0x27 [0099.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9ec) returned 1 [0099.828] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\n_j4UI6iCHD.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\n_j4ui6ichd.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0099.829] GetFileType (hFile=0x430) returned 0x1 [0099.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e8) returned 1 [0099.829] GetFileType (hFile=0x430) returned 0x1 [0099.829] WriteFile (in: hFile=0x430, lpBuffer=0x2655f4c*, nNumberOfBytesToWrite=0xf020, lpNumberOfBytesWritten=0x19ea9c, lpOverlapped=0x0 | out: lpBuffer=0x2655f4c*, lpNumberOfBytesWritten=0x19ea9c*=0xf020, lpOverlapped=0x0) returned 1 [0099.831] CloseHandle (hObject=0x430) returned 1 [0099.834] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\n_j4UI6iCHD.rtf", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\n_j4UI6iCHD.rtf", lpFilePart=0x0) returned 0x27 [0099.834] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\n_j4UI6iCHD.rtf.lasan", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\n_j4UI6iCHD.rtf.lasan", lpFilePart=0x0) returned 0x2d [0099.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0099.834] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\n_j4UI6iCHD.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\n_j4ui6ichd.rtf"), fInfoLevelId=0x0, lpFileInformation=0x19eafc | out: lpFileInformation=0x19eafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x657984d0, ftCreationTime.dwHighDateTime=0x1d5ce17, ftLastAccessTime.dwLowDateTime=0xb5f78460, ftLastAccessTime.dwHighDateTime=0x1d5d4ee, ftLastWriteTime.dwLowDateTime=0xc11b3db9, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0xf020)) returned 1 [0099.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea7c) returned 1 [0099.834] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\n_j4UI6iCHD.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\n_j4ui6ichd.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\n_j4UI6iCHD.rtf.lasan" (normalized: "c:\\users\\fd1hvy\\desktop\\n_j4ui6ichd.rtf.lasan")) returned 1 [0099.835] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Password.txt", nBufferLength=0x105, lpBuffer=0x19e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Password.txt", lpFilePart=0x0) returned 0x24 [0099.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea04) returned 1 [0099.835] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Password.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\password.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0099.835] GetFileType (hFile=0x430) returned 0x1 [0099.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea00) returned 1 [0099.835] GetFileType (hFile=0x430) returned 0x1 [0099.835] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eb00 | out: lpFileSizeHigh=0x19eb00*=0x0) returned 0x23 [0099.835] ReadFile (in: hFile=0x430, lpBuffer=0x26652c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19eaac, lpOverlapped=0x0 | out: lpBuffer=0x26652c8*, lpNumberOfBytesRead=0x19eaac*=0x23, lpOverlapped=0x0) returned 1 [0099.835] CloseHandle (hObject=0x430) returned 1 [0100.038] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Password.txt", nBufferLength=0x105, lpBuffer=0x19e4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Password.txt", lpFilePart=0x0) returned 0x24 [0100.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9ec) returned 1 [0100.038] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Password.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\password.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0100.039] GetFileType (hFile=0x430) returned 0x1 [0100.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e8) returned 1 [0100.039] GetFileType (hFile=0x430) returned 0x1 [0100.039] WriteFile (in: hFile=0x430, lpBuffer=0x26b332c*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x19ea70, lpOverlapped=0x0 | out: lpBuffer=0x26b332c*, lpNumberOfBytesWritten=0x19ea70*=0x30, lpOverlapped=0x0) returned 1 [0100.040] CloseHandle (hObject=0x430) returned 1 [0100.041] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Password.txt", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Password.txt", lpFilePart=0x0) returned 0x24 [0100.041] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Password.txt.lasan", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Password.txt.lasan", lpFilePart=0x0) returned 0x2a [0100.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0100.041] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Password.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\password.txt"), fInfoLevelId=0x0, lpFileInformation=0x19eafc | out: lpFileInformation=0x19eafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae6122c9, ftCreationTime.dwHighDateTime=0x1d5dffe, ftLastAccessTime.dwLowDateTime=0xae6122c9, ftLastAccessTime.dwHighDateTime=0x1d5dffe, ftLastWriteTime.dwLowDateTime=0xc13ca2c9, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x30)) returned 1 [0100.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea7c) returned 1 [0100.041] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\Password.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\password.txt"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\Password.txt.lasan" (normalized: "c:\\users\\fd1hvy\\desktop\\password.txt.lasan")) returned 1 [0100.043] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\rqmLDSWQs1 o.mp3", nBufferLength=0x105, lpBuffer=0x19e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\rqmLDSWQs1 o.mp3", lpFilePart=0x0) returned 0x28 [0100.043] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea04) returned 1 [0100.043] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\rqmLDSWQs1 o.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\rqmldswqs1 o.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0100.043] GetFileType (hFile=0x430) returned 0x1 [0100.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea00) returned 1 [0100.043] GetFileType (hFile=0x430) returned 0x1 [0100.043] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eb00 | out: lpFileSizeHigh=0x19eb00*=0x0) returned 0x7566 [0100.044] ReadFile (in: hFile=0x430, lpBuffer=0x26b4578, nNumberOfBytesToRead=0x7566, lpNumberOfBytesRead=0x19eaac, lpOverlapped=0x0 | out: lpBuffer=0x26b4578*, lpNumberOfBytesRead=0x19eaac*=0x7566, lpOverlapped=0x0) returned 1 [0100.044] CloseHandle (hObject=0x430) returned 1 [0100.068] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\rqmLDSWQs1 o.mp3", nBufferLength=0x105, lpBuffer=0x19e4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\rqmLDSWQs1 o.mp3", lpFilePart=0x0) returned 0x28 [0100.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9ec) returned 1 [0100.068] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\rqmLDSWQs1 o.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\rqmldswqs1 o.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0100.069] GetFileType (hFile=0x430) returned 0x1 [0100.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e8) returned 1 [0100.069] GetFileType (hFile=0x430) returned 0x1 [0100.069] WriteFile (in: hFile=0x430, lpBuffer=0x2725e94*, nNumberOfBytesToWrite=0x7570, lpNumberOfBytesWritten=0x19ea9c, lpOverlapped=0x0 | out: lpBuffer=0x2725e94*, lpNumberOfBytesWritten=0x19ea9c*=0x7570, lpOverlapped=0x0) returned 1 [0100.070] CloseHandle (hObject=0x430) returned 1 [0100.121] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\rqmLDSWQs1 o.mp3", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\rqmLDSWQs1 o.mp3", lpFilePart=0x0) returned 0x28 [0100.121] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\rqmLDSWQs1 o.mp3.lasan", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\rqmLDSWQs1 o.mp3.lasan", lpFilePart=0x0) returned 0x2e [0100.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0100.121] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\rqmLDSWQs1 o.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\rqmldswqs1 o.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19eafc | out: lpFileInformation=0x19eafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14346b50, ftCreationTime.dwHighDateTime=0x1d5c91a, ftLastAccessTime.dwLowDateTime=0xe7c74a90, ftLastAccessTime.dwHighDateTime=0x1d5d690, ftLastWriteTime.dwLowDateTime=0xc1488a6e, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x7570)) returned 1 [0100.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea7c) returned 1 [0100.122] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\rqmLDSWQs1 o.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\rqmldswqs1 o.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\rqmLDSWQs1 o.mp3.lasan" (normalized: "c:\\users\\fd1hvy\\desktop\\rqmldswqs1 o.mp3.lasan")) returned 1 [0100.122] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuxPlwVpcC.csv", nBufferLength=0x105, lpBuffer=0x19e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuxPlwVpcC.csv", lpFilePart=0x0) returned 0x26 [0100.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea04) returned 1 [0100.123] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuxPlwVpcC.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\xuxplwvpcc.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0100.123] GetFileType (hFile=0x430) returned 0x1 [0100.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea00) returned 1 [0100.123] GetFileType (hFile=0x430) returned 0x1 [0100.123] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eb00 | out: lpFileSizeHigh=0x19eb00*=0x0) returned 0x15e75 [0100.124] ReadFile (in: hFile=0x430, lpBuffer=0x35eb058, nNumberOfBytesToRead=0x15e75, lpNumberOfBytesRead=0x19eaac, lpOverlapped=0x0 | out: lpBuffer=0x35eb058*, lpNumberOfBytesRead=0x19eaac*=0x15e75, lpOverlapped=0x0) returned 1 [0100.125] CloseHandle (hObject=0x430) returned 1 [0100.152] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuxPlwVpcC.csv", nBufferLength=0x105, lpBuffer=0x19e4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuxPlwVpcC.csv", lpFilePart=0x0) returned 0x26 [0100.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9ec) returned 1 [0100.152] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuxPlwVpcC.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\xuxplwvpcc.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0100.154] GetFileType (hFile=0x430) returned 0x1 [0100.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e8) returned 1 [0100.154] GetFileType (hFile=0x430) returned 0x1 [0100.154] WriteFile (in: hFile=0x430, lpBuffer=0x3658910*, nNumberOfBytesToWrite=0x15e80, lpNumberOfBytesWritten=0x19ea9c, lpOverlapped=0x0 | out: lpBuffer=0x3658910*, lpNumberOfBytesWritten=0x19ea9c*=0x15e80, lpOverlapped=0x0) returned 1 [0100.156] CloseHandle (hObject=0x430) returned 1 [0100.159] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuxPlwVpcC.csv", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuxPlwVpcC.csv", lpFilePart=0x0) returned 0x26 [0100.159] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuxPlwVpcC.csv.lasan", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\XuxPlwVpcC.csv.lasan", lpFilePart=0x0) returned 0x2c [0100.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0100.159] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XuxPlwVpcC.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\xuxplwvpcc.csv"), fInfoLevelId=0x0, lpFileInformation=0x19eafc | out: lpFileInformation=0x19eafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b85f0d0, ftCreationTime.dwHighDateTime=0x1d5ced6, ftLastAccessTime.dwLowDateTime=0xed863cd0, ftLastAccessTime.dwHighDateTime=0x1d5cafa, ftLastWriteTime.dwLowDateTime=0xc14d4f0a, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x15e80)) returned 1 [0100.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea7c) returned 1 [0100.159] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\XuxPlwVpcC.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\xuxplwvpcc.csv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\XuxPlwVpcC.csv.lasan" (normalized: "c:\\users\\fd1hvy\\desktop\\xuxplwvpcc.csv.lasan")) returned 1 [0100.160] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\yixXz XJ.mp3", nBufferLength=0x105, lpBuffer=0x19e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\yixXz XJ.mp3", lpFilePart=0x0) returned 0x24 [0100.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea04) returned 1 [0100.160] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\yixXz XJ.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\yixxz xj.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0100.160] GetFileType (hFile=0x430) returned 0x1 [0100.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea00) returned 1 [0100.160] GetFileType (hFile=0x430) returned 0x1 [0100.160] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eb00 | out: lpFileSizeHigh=0x19eb00*=0x0) returned 0x7946 [0100.161] ReadFile (in: hFile=0x430, lpBuffer=0x277a918, nNumberOfBytesToRead=0x7946, lpNumberOfBytesRead=0x19eaac, lpOverlapped=0x0 | out: lpBuffer=0x277a918*, lpNumberOfBytesRead=0x19eaac*=0x7946, lpOverlapped=0x0) returned 1 [0100.161] CloseHandle (hObject=0x430) returned 1 [0100.332] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\yixXz XJ.mp3", nBufferLength=0x105, lpBuffer=0x19e4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\yixXz XJ.mp3", lpFilePart=0x0) returned 0x24 [0100.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9ec) returned 1 [0100.333] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\yixXz XJ.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\yixxz xj.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0100.335] GetFileType (hFile=0x430) returned 0x1 [0100.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e8) returned 1 [0100.335] GetFileType (hFile=0x430) returned 0x1 [0100.335] WriteFile (in: hFile=0x430, lpBuffer=0x23f2b60*, nNumberOfBytesToWrite=0x7950, lpNumberOfBytesWritten=0x19ea9c, lpOverlapped=0x0 | out: lpBuffer=0x23f2b60*, lpNumberOfBytesWritten=0x19ea9c*=0x7950, lpOverlapped=0x0) returned 1 [0100.337] CloseHandle (hObject=0x430) returned 1 [0100.339] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\yixXz XJ.mp3", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\yixXz XJ.mp3", lpFilePart=0x0) returned 0x24 [0100.339] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\yixXz XJ.mp3.lasan", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\yixXz XJ.mp3.lasan", lpFilePart=0x0) returned 0x2a [0100.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0100.339] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\yixXz XJ.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\yixxz xj.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19eafc | out: lpFileInformation=0x19eafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92184340, ftCreationTime.dwHighDateTime=0x1d5ccdd, ftLastAccessTime.dwLowDateTime=0xf66be290, ftLastAccessTime.dwHighDateTime=0x1d5cd9e, ftLastWriteTime.dwLowDateTime=0xc16a1da4, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x7950)) returned 1 [0100.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea7c) returned 1 [0100.339] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\yixXz XJ.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\yixxz xj.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\yixXz XJ.mp3.lasan" (normalized: "c:\\users\\fd1hvy\\desktop\\yixxz xj.mp3.lasan")) returned 1 [0100.340] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\zyAaunS1QrA.mkv", nBufferLength=0x105, lpBuffer=0x19e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\zyAaunS1QrA.mkv", lpFilePart=0x0) returned 0x27 [0100.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea04) returned 1 [0100.340] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\zyAaunS1QrA.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\zyaauns1qra.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0100.340] GetFileType (hFile=0x430) returned 0x1 [0100.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea00) returned 1 [0100.340] GetFileType (hFile=0x430) returned 0x1 [0100.340] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eb00 | out: lpFileSizeHigh=0x19eb00*=0x0) returned 0x43c4 [0100.340] ReadFile (in: hFile=0x430, lpBuffer=0x23fa7d0, nNumberOfBytesToRead=0x43c4, lpNumberOfBytesRead=0x19eaac, lpOverlapped=0x0 | out: lpBuffer=0x23fa7d0*, lpNumberOfBytesRead=0x19eaac*=0x43c4, lpOverlapped=0x0) returned 1 [0100.341] CloseHandle (hObject=0x430) returned 1 [0100.360] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\zyAaunS1QrA.mkv", nBufferLength=0x105, lpBuffer=0x19e4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\zyAaunS1QrA.mkv", lpFilePart=0x0) returned 0x27 [0100.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9ec) returned 1 [0100.360] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\zyAaunS1QrA.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\zyaauns1qra.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0100.361] GetFileType (hFile=0x430) returned 0x1 [0100.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e8) returned 1 [0100.362] GetFileType (hFile=0x430) returned 0x1 [0100.362] WriteFile (in: hFile=0x430, lpBuffer=0x245ca24*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x19ea9c, lpOverlapped=0x0 | out: lpBuffer=0x245ca24*, lpNumberOfBytesWritten=0x19ea9c*=0x43d0, lpOverlapped=0x0) returned 1 [0100.363] CloseHandle (hObject=0x430) returned 1 [0100.364] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\zyAaunS1QrA.mkv", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\zyAaunS1QrA.mkv", lpFilePart=0x0) returned 0x27 [0100.364] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\zyAaunS1QrA.mkv.lasan", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\zyAaunS1QrA.mkv.lasan", lpFilePart=0x0) returned 0x2d [0100.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0100.364] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\zyAaunS1QrA.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\zyaauns1qra.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19eafc | out: lpFileInformation=0x19eafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d004da0, ftCreationTime.dwHighDateTime=0x1d5d4a2, ftLastAccessTime.dwLowDateTime=0x427d18b0, ftLastAccessTime.dwHighDateTime=0x1d5cd50, ftLastWriteTime.dwLowDateTime=0xc16d40d3, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x43d0)) returned 1 [0100.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea7c) returned 1 [0100.364] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\zyAaunS1QrA.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\zyaauns1qra.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\zyAaunS1QrA.mkv.lasan" (normalized: "c:\\users\\fd1hvy\\desktop\\zyaauns1qra.mkv.lasan")) returned 1 [0100.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eacc) returned 1 [0100.365] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL", lpFilePart=0x0) returned 0x24 [0100.365] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\*", lpFindFileData=0x19e7f4 | out: lpFindFileData=0x19e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7566f70, ftCreationTime.dwHighDateTime=0x1d5d6fb, ftLastAccessTime.dwLowDateTime=0x50082620, ftLastAccessTime.dwHighDateTime=0x1d5d640, ftLastWriteTime.dwLowDateTime=0x50082620, ftLastWriteTime.dwHighDateTime=0x1d5d640, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6337a8 [0100.365] FindNextFileW (in: hFindFile=0x6337a8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7566f70, ftCreationTime.dwHighDateTime=0x1d5d6fb, ftLastAccessTime.dwLowDateTime=0x50082620, ftLastAccessTime.dwHighDateTime=0x1d5d640, ftLastWriteTime.dwLowDateTime=0x50082620, ftLastWriteTime.dwHighDateTime=0x1d5d640, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.365] FindNextFileW (in: hFindFile=0x6337a8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88669eb0, ftCreationTime.dwHighDateTime=0x1d5d470, ftLastAccessTime.dwLowDateTime=0xa0823ea0, ftLastAccessTime.dwHighDateTime=0x1d5ce30, ftLastWriteTime.dwLowDateTime=0xa0823ea0, ftLastWriteTime.dwHighDateTime=0x1d5ce30, nFileSizeHigh=0x0, nFileSizeLow=0x14a35, dwReserved0=0x0, dwReserved1=0x0, cFileName="-ZK -qQ3MxH.xls", cAlternateFileName="-ZK-QQ~1.XLS")) returned 1 [0100.366] FindNextFileW (in: hFindFile=0x6337a8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4131a5b0, ftCreationTime.dwHighDateTime=0x1d5cbcb, ftLastAccessTime.dwLowDateTime=0x1c5083c0, ftLastAccessTime.dwHighDateTime=0x1d5d728, ftLastWriteTime.dwLowDateTime=0x1c5083c0, ftLastWriteTime.dwHighDateTime=0x1d5d728, nFileSizeHigh=0x0, nFileSizeLow=0x1134a, dwReserved0=0x0, dwReserved1=0x0, cFileName="7FYn-NVE24VSBP4lUm6z.mp4", cAlternateFileName="7FYN-N~1.MP4")) returned 1 [0100.366] FindNextFileW (in: hFindFile=0x6337a8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f353660, ftCreationTime.dwHighDateTime=0x1d5c891, ftLastAccessTime.dwLowDateTime=0xd72834b0, ftLastAccessTime.dwHighDateTime=0x1d5cd03, ftLastWriteTime.dwLowDateTime=0xd72834b0, ftLastWriteTime.dwHighDateTime=0x1d5cd03, nFileSizeHigh=0x0, nFileSizeLow=0xb004, dwReserved0=0x0, dwReserved1=0x0, cFileName="7LovXA69caL.mp3", cAlternateFileName="7LOVXA~1.MP3")) returned 1 [0100.366] FindNextFileW (in: hFindFile=0x6337a8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8407010, ftCreationTime.dwHighDateTime=0x1d5cc20, ftLastAccessTime.dwLowDateTime=0x75ff5520, ftLastAccessTime.dwHighDateTime=0x1d5d1f8, ftLastWriteTime.dwLowDateTime=0x75ff5520, ftLastWriteTime.dwHighDateTime=0x1d5d1f8, nFileSizeHigh=0x0, nFileSizeLow=0x13bd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="FNPWIDk.m4a", cAlternateFileName="")) returned 1 [0100.366] FindNextFileW (in: hFindFile=0x6337a8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaec4be0, ftCreationTime.dwHighDateTime=0x1d5d062, ftLastAccessTime.dwLowDateTime=0xc2efd170, ftLastAccessTime.dwHighDateTime=0x1d5ca87, ftLastWriteTime.dwLowDateTime=0xc2efd170, ftLastWriteTime.dwHighDateTime=0x1d5ca87, nFileSizeHigh=0x0, nFileSizeLow=0xd48a, dwReserved0=0x0, dwReserved1=0x0, cFileName="KRXeGgoAmgWs.rtf", cAlternateFileName="KRXEGG~1.RTF")) returned 1 [0100.366] FindNextFileW (in: hFindFile=0x6337a8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7947eda0, ftCreationTime.dwHighDateTime=0x1d5c87a, ftLastAccessTime.dwLowDateTime=0x44f5e2e0, ftLastAccessTime.dwHighDateTime=0x1d5d48d, ftLastWriteTime.dwLowDateTime=0x44f5e2e0, ftLastWriteTime.dwHighDateTime=0x1d5d48d, nFileSizeHigh=0x0, nFileSizeLow=0x70fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="laqnFsvSz.ods", cAlternateFileName="LAQNFS~1.ODS")) returned 1 [0100.366] FindNextFileW (in: hFindFile=0x6337a8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x573ff7b0, ftCreationTime.dwHighDateTime=0x1d5d7da, ftLastAccessTime.dwLowDateTime=0x6a657610, ftLastAccessTime.dwHighDateTime=0x1d5d54d, ftLastWriteTime.dwLowDateTime=0x6a657610, ftLastWriteTime.dwHighDateTime=0x1d5d54d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="U04MlmW17YgixuRnLG2", cAlternateFileName="U04MLM~1")) returned 1 [0100.366] FindNextFileW (in: hFindFile=0x6337a8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x578c1910, ftCreationTime.dwHighDateTime=0x1d5d33e, ftLastAccessTime.dwLowDateTime=0xa4be9970, ftLastAccessTime.dwHighDateTime=0x1d5cc67, ftLastWriteTime.dwLowDateTime=0xa4be9970, ftLastWriteTime.dwHighDateTime=0x1d5cc67, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WY8_EheJNNFvgBiLqw", cAlternateFileName="WY8_EH~1")) returned 1 [0100.367] FindNextFileW (in: hFindFile=0x6337a8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x578c1910, ftCreationTime.dwHighDateTime=0x1d5d33e, ftLastAccessTime.dwLowDateTime=0xa4be9970, ftLastAccessTime.dwHighDateTime=0x1d5cc67, ftLastWriteTime.dwLowDateTime=0xa4be9970, ftLastWriteTime.dwHighDateTime=0x1d5cc67, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WY8_EheJNNFvgBiLqw", cAlternateFileName="WY8_EH~1")) returned 0 [0100.367] FindClose (in: hFindFile=0x6337a8 | out: hFindFile=0x6337a8) returned 1 [0100.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea88) returned 1 [0100.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea94) returned 1 [0100.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eacc) returned 1 [0100.367] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL", lpFilePart=0x0) returned 0x24 [0100.367] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\*", lpFindFileData=0x19e7f4 | out: lpFindFileData=0x19e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7566f70, ftCreationTime.dwHighDateTime=0x1d5d6fb, ftLastAccessTime.dwLowDateTime=0x50082620, ftLastAccessTime.dwHighDateTime=0x1d5d640, ftLastWriteTime.dwLowDateTime=0x50082620, ftLastWriteTime.dwHighDateTime=0x1d5d640, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6339a8 [0100.367] FindNextFileW (in: hFindFile=0x6339a8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7566f70, ftCreationTime.dwHighDateTime=0x1d5d6fb, ftLastAccessTime.dwLowDateTime=0x50082620, ftLastAccessTime.dwHighDateTime=0x1d5d640, ftLastWriteTime.dwLowDateTime=0x50082620, ftLastWriteTime.dwHighDateTime=0x1d5d640, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.367] FindNextFileW (in: hFindFile=0x6339a8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88669eb0, ftCreationTime.dwHighDateTime=0x1d5d470, ftLastAccessTime.dwLowDateTime=0xa0823ea0, ftLastAccessTime.dwHighDateTime=0x1d5ce30, ftLastWriteTime.dwLowDateTime=0xa0823ea0, ftLastWriteTime.dwHighDateTime=0x1d5ce30, nFileSizeHigh=0x0, nFileSizeLow=0x14a35, dwReserved0=0x0, dwReserved1=0x0, cFileName="-ZK -qQ3MxH.xls", cAlternateFileName="-ZK-QQ~1.XLS")) returned 1 [0100.367] FindNextFileW (in: hFindFile=0x6339a8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4131a5b0, ftCreationTime.dwHighDateTime=0x1d5cbcb, ftLastAccessTime.dwLowDateTime=0x1c5083c0, ftLastAccessTime.dwHighDateTime=0x1d5d728, ftLastWriteTime.dwLowDateTime=0x1c5083c0, ftLastWriteTime.dwHighDateTime=0x1d5d728, nFileSizeHigh=0x0, nFileSizeLow=0x1134a, dwReserved0=0x0, dwReserved1=0x0, cFileName="7FYn-NVE24VSBP4lUm6z.mp4", cAlternateFileName="7FYN-N~1.MP4")) returned 1 [0100.368] FindNextFileW (in: hFindFile=0x6339a8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f353660, ftCreationTime.dwHighDateTime=0x1d5c891, ftLastAccessTime.dwLowDateTime=0xd72834b0, ftLastAccessTime.dwHighDateTime=0x1d5cd03, ftLastWriteTime.dwLowDateTime=0xd72834b0, ftLastWriteTime.dwHighDateTime=0x1d5cd03, nFileSizeHigh=0x0, nFileSizeLow=0xb004, dwReserved0=0x0, dwReserved1=0x0, cFileName="7LovXA69caL.mp3", cAlternateFileName="7LOVXA~1.MP3")) returned 1 [0100.368] FindNextFileW (in: hFindFile=0x6339a8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8407010, ftCreationTime.dwHighDateTime=0x1d5cc20, ftLastAccessTime.dwLowDateTime=0x75ff5520, ftLastAccessTime.dwHighDateTime=0x1d5d1f8, ftLastWriteTime.dwLowDateTime=0x75ff5520, ftLastWriteTime.dwHighDateTime=0x1d5d1f8, nFileSizeHigh=0x0, nFileSizeLow=0x13bd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="FNPWIDk.m4a", cAlternateFileName="")) returned 1 [0100.368] FindNextFileW (in: hFindFile=0x6339a8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaec4be0, ftCreationTime.dwHighDateTime=0x1d5d062, ftLastAccessTime.dwLowDateTime=0xc2efd170, ftLastAccessTime.dwHighDateTime=0x1d5ca87, ftLastWriteTime.dwLowDateTime=0xc2efd170, ftLastWriteTime.dwHighDateTime=0x1d5ca87, nFileSizeHigh=0x0, nFileSizeLow=0xd48a, dwReserved0=0x0, dwReserved1=0x0, cFileName="KRXeGgoAmgWs.rtf", cAlternateFileName="KRXEGG~1.RTF")) returned 1 [0100.368] FindNextFileW (in: hFindFile=0x6339a8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7947eda0, ftCreationTime.dwHighDateTime=0x1d5c87a, ftLastAccessTime.dwLowDateTime=0x44f5e2e0, ftLastAccessTime.dwHighDateTime=0x1d5d48d, ftLastWriteTime.dwLowDateTime=0x44f5e2e0, ftLastWriteTime.dwHighDateTime=0x1d5d48d, nFileSizeHigh=0x0, nFileSizeLow=0x70fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="laqnFsvSz.ods", cAlternateFileName="LAQNFS~1.ODS")) returned 1 [0100.368] FindNextFileW (in: hFindFile=0x6339a8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x573ff7b0, ftCreationTime.dwHighDateTime=0x1d5d7da, ftLastAccessTime.dwLowDateTime=0x6a657610, ftLastAccessTime.dwHighDateTime=0x1d5d54d, ftLastWriteTime.dwLowDateTime=0x6a657610, ftLastWriteTime.dwHighDateTime=0x1d5d54d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="U04MlmW17YgixuRnLG2", cAlternateFileName="U04MLM~1")) returned 1 [0100.368] FindNextFileW (in: hFindFile=0x6339a8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x578c1910, ftCreationTime.dwHighDateTime=0x1d5d33e, ftLastAccessTime.dwLowDateTime=0xa4be9970, ftLastAccessTime.dwHighDateTime=0x1d5cc67, ftLastWriteTime.dwLowDateTime=0xa4be9970, ftLastWriteTime.dwHighDateTime=0x1d5cc67, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WY8_EheJNNFvgBiLqw", cAlternateFileName="WY8_EH~1")) returned 1 [0100.369] FindNextFileW (in: hFindFile=0x6339a8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0100.369] FindClose (in: hFindFile=0x6339a8 | out: hFindFile=0x6339a8) returned 1 [0100.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea88) returned 1 [0100.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea94) returned 1 [0100.369] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\-ZK -qQ3MxH.xls", nBufferLength=0x105, lpBuffer=0x19e474, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\-ZK -qQ3MxH.xls", lpFilePart=0x0) returned 0x34 [0100.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9b8) returned 1 [0100.369] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\-ZK -qQ3MxH.xls" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\-zk -qq3mxh.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0100.369] GetFileType (hFile=0x430) returned 0x1 [0100.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9b4) returned 1 [0100.369] GetFileType (hFile=0x430) returned 0x1 [0100.369] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eab4 | out: lpFileSizeHigh=0x19eab4*=0x0) returned 0x14a35 [0100.369] ReadFile (in: hFile=0x430, lpBuffer=0x2463864, nNumberOfBytesToRead=0x14a35, lpNumberOfBytesRead=0x19ea60, lpOverlapped=0x0 | out: lpBuffer=0x2463864*, lpNumberOfBytesRead=0x19ea60*=0x14a35, lpOverlapped=0x0) returned 1 [0100.370] CloseHandle (hObject=0x430) returned 1 [0100.442] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\-ZK -qQ3MxH.xls", nBufferLength=0x105, lpBuffer=0x19e45c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\-ZK -qQ3MxH.xls", lpFilePart=0x0) returned 0x34 [0100.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9a0) returned 1 [0100.442] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\-ZK -qQ3MxH.xls" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\-zk -qq3mxh.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0100.443] GetFileType (hFile=0x430) returned 0x1 [0100.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e99c) returned 1 [0100.443] GetFileType (hFile=0x430) returned 0x1 [0100.443] WriteFile (in: hFile=0x430, lpBuffer=0x24ee524*, nNumberOfBytesToWrite=0x14a40, lpNumberOfBytesWritten=0x19ea50, lpOverlapped=0x0 | out: lpBuffer=0x24ee524*, lpNumberOfBytesWritten=0x19ea50*=0x14a40, lpOverlapped=0x0) returned 1 [0100.445] CloseHandle (hObject=0x430) returned 1 [0100.450] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\-ZK -qQ3MxH.xls", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\-ZK -qQ3MxH.xls", lpFilePart=0x0) returned 0x34 [0100.450] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\-ZK -qQ3MxH.xls.lasan", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\-ZK -qQ3MxH.xls.lasan", lpFilePart=0x0) returned 0x3a [0100.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea34) returned 1 [0100.450] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\-ZK -qQ3MxH.xls" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\-zk -qq3mxh.xls"), fInfoLevelId=0x0, lpFileInformation=0x19eab0 | out: lpFileInformation=0x19eab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88669eb0, ftCreationTime.dwHighDateTime=0x1d5d470, ftLastAccessTime.dwLowDateTime=0xa0823ea0, ftLastAccessTime.dwHighDateTime=0x1d5ce30, ftLastWriteTime.dwLowDateTime=0xc1792f83, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x14a40)) returned 1 [0100.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea30) returned 1 [0100.451] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\-ZK -qQ3MxH.xls" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\-zk -qq3mxh.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\-ZK -qQ3MxH.xls.lasan" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\-zk -qq3mxh.xls.lasan")) returned 1 [0100.451] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\7FYn-NVE24VSBP4lUm6z.mp4", nBufferLength=0x105, lpBuffer=0x19e474, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\7FYn-NVE24VSBP4lUm6z.mp4", lpFilePart=0x0) returned 0x3d [0100.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9b8) returned 1 [0100.451] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\7FYn-NVE24VSBP4lUm6z.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\7fyn-nve24vsbp4lum6z.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0100.451] GetFileType (hFile=0x430) returned 0x1 [0100.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9b4) returned 1 [0100.451] GetFileType (hFile=0x430) returned 0x1 [0100.451] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eab4 | out: lpFileSizeHigh=0x19eab4*=0x0) returned 0x1134a [0100.452] ReadFile (in: hFile=0x430, lpBuffer=0x2503348, nNumberOfBytesToRead=0x1134a, lpNumberOfBytesRead=0x19ea60, lpOverlapped=0x0 | out: lpBuffer=0x2503348*, lpNumberOfBytesRead=0x19ea60*=0x1134a, lpOverlapped=0x0) returned 1 [0100.452] CloseHandle (hObject=0x430) returned 1 [0100.533] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\7FYn-NVE24VSBP4lUm6z.mp4", nBufferLength=0x105, lpBuffer=0x19e45c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\7FYn-NVE24VSBP4lUm6z.mp4", lpFilePart=0x0) returned 0x3d [0100.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9a0) returned 1 [0100.533] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\7FYn-NVE24VSBP4lUm6z.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\7fyn-nve24vsbp4lum6z.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0100.534] GetFileType (hFile=0x430) returned 0x1 [0100.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e99c) returned 1 [0100.534] GetFileType (hFile=0x430) returned 0x1 [0100.534] WriteFile (in: hFile=0x430, lpBuffer=0x23dc140*, nNumberOfBytesToWrite=0x11350, lpNumberOfBytesWritten=0x19ea50, lpOverlapped=0x0 | out: lpBuffer=0x23dc140*, lpNumberOfBytesWritten=0x19ea50*=0x11350, lpOverlapped=0x0) returned 1 [0100.536] CloseHandle (hObject=0x430) returned 1 [0100.538] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\7FYn-NVE24VSBP4lUm6z.mp4", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\7FYn-NVE24VSBP4lUm6z.mp4", lpFilePart=0x0) returned 0x3d [0100.538] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\7FYn-NVE24VSBP4lUm6z.mp4.lasan", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\7FYn-NVE24VSBP4lUm6z.mp4.lasan", lpFilePart=0x0) returned 0x43 [0100.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea34) returned 1 [0100.538] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\7FYn-NVE24VSBP4lUm6z.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\7fyn-nve24vsbp4lum6z.mp4"), fInfoLevelId=0x0, lpFileInformation=0x19eab0 | out: lpFileInformation=0x19eab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4131a5b0, ftCreationTime.dwHighDateTime=0x1d5cbcb, ftLastAccessTime.dwLowDateTime=0x1c5083c0, ftLastAccessTime.dwHighDateTime=0x1d5d728, ftLastWriteTime.dwLowDateTime=0xc1878574, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x11350)) returned 1 [0100.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea30) returned 1 [0100.538] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\7FYn-NVE24VSBP4lUm6z.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\7fyn-nve24vsbp4lum6z.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\7FYn-NVE24VSBP4lUm6z.mp4.lasan" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\7fyn-nve24vsbp4lum6z.mp4.lasan")) returned 1 [0100.539] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\7LovXA69caL.mp3", nBufferLength=0x105, lpBuffer=0x19e474, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\7LovXA69caL.mp3", lpFilePart=0x0) returned 0x34 [0100.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9b8) returned 1 [0100.539] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\7LovXA69caL.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\7lovxa69cal.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0100.539] GetFileType (hFile=0x430) returned 0x1 [0100.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9b4) returned 1 [0100.539] GetFileType (hFile=0x430) returned 0x1 [0100.539] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eab4 | out: lpFileSizeHigh=0x19eab4*=0x0) returned 0xb004 [0100.540] ReadFile (in: hFile=0x430, lpBuffer=0x23ed8a4, nNumberOfBytesToRead=0xb004, lpNumberOfBytesRead=0x19ea60, lpOverlapped=0x0 | out: lpBuffer=0x23ed8a4*, lpNumberOfBytesRead=0x19ea60*=0xb004, lpOverlapped=0x0) returned 1 [0100.540] CloseHandle (hObject=0x430) returned 1 [0100.638] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\7LovXA69caL.mp3", nBufferLength=0x105, lpBuffer=0x19e45c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\7LovXA69caL.mp3", lpFilePart=0x0) returned 0x34 [0100.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9a0) returned 1 [0100.638] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\7LovXA69caL.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\7lovxa69cal.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0100.639] GetFileType (hFile=0x430) returned 0x1 [0100.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e99c) returned 1 [0100.639] GetFileType (hFile=0x430) returned 0x1 [0100.639] WriteFile (in: hFile=0x430, lpBuffer=0x245b82c*, nNumberOfBytesToWrite=0xb010, lpNumberOfBytesWritten=0x19ea50, lpOverlapped=0x0 | out: lpBuffer=0x245b82c*, lpNumberOfBytesWritten=0x19ea50*=0xb010, lpOverlapped=0x0) returned 1 [0100.641] CloseHandle (hObject=0x430) returned 1 [0100.646] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\7LovXA69caL.mp3", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\7LovXA69caL.mp3", lpFilePart=0x0) returned 0x34 [0100.646] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\7LovXA69caL.mp3.lasan", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\7LovXA69caL.mp3.lasan", lpFilePart=0x0) returned 0x3a [0100.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea34) returned 1 [0100.647] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\7LovXA69caL.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\7lovxa69cal.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19eab0 | out: lpFileInformation=0x19eab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f353660, ftCreationTime.dwHighDateTime=0x1d5c891, ftLastAccessTime.dwLowDateTime=0xd72834b0, ftLastAccessTime.dwHighDateTime=0x1d5cd03, ftLastWriteTime.dwLowDateTime=0xc1982ea5, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0xb010)) returned 1 [0100.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea30) returned 1 [0100.647] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\7LovXA69caL.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\7lovxa69cal.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\7LovXA69caL.mp3.lasan" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\7lovxa69cal.mp3.lasan")) returned 1 [0100.647] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\KRXeGgoAmgWs.rtf", nBufferLength=0x105, lpBuffer=0x19e474, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\KRXeGgoAmgWs.rtf", lpFilePart=0x0) returned 0x35 [0100.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9b8) returned 1 [0100.648] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\KRXeGgoAmgWs.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\krxeggoamgws.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0100.648] GetFileType (hFile=0x430) returned 0x1 [0100.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9b4) returned 1 [0100.648] GetFileType (hFile=0x430) returned 0x1 [0100.648] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eab4 | out: lpFileSizeHigh=0x19eab4*=0x0) returned 0xd48a [0100.648] ReadFile (in: hFile=0x430, lpBuffer=0x2466c18, nNumberOfBytesToRead=0xd48a, lpNumberOfBytesRead=0x19ea60, lpOverlapped=0x0 | out: lpBuffer=0x2466c18*, lpNumberOfBytesRead=0x19ea60*=0xd48a, lpOverlapped=0x0) returned 1 [0100.648] CloseHandle (hObject=0x430) returned 1 [0100.712] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\KRXeGgoAmgWs.rtf", nBufferLength=0x105, lpBuffer=0x19e45c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\KRXeGgoAmgWs.rtf", lpFilePart=0x0) returned 0x35 [0100.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9a0) returned 1 [0100.713] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\KRXeGgoAmgWs.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\krxeggoamgws.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0100.714] GetFileType (hFile=0x430) returned 0x1 [0100.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e99c) returned 1 [0100.714] GetFileType (hFile=0x430) returned 0x1 [0100.714] WriteFile (in: hFile=0x430, lpBuffer=0x24db7c8*, nNumberOfBytesToWrite=0xd490, lpNumberOfBytesWritten=0x19ea50, lpOverlapped=0x0 | out: lpBuffer=0x24db7c8*, lpNumberOfBytesWritten=0x19ea50*=0xd490, lpOverlapped=0x0) returned 1 [0100.716] CloseHandle (hObject=0x430) returned 1 [0100.718] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\KRXeGgoAmgWs.rtf", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\KRXeGgoAmgWs.rtf", lpFilePart=0x0) returned 0x35 [0100.718] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\KRXeGgoAmgWs.rtf.lasan", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\KRXeGgoAmgWs.rtf.lasan", lpFilePart=0x0) returned 0x3b [0100.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea34) returned 1 [0100.718] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\KRXeGgoAmgWs.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\krxeggoamgws.rtf"), fInfoLevelId=0x0, lpFileInformation=0x19eab0 | out: lpFileInformation=0x19eab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaec4be0, ftCreationTime.dwHighDateTime=0x1d5d062, ftLastAccessTime.dwLowDateTime=0xc2efd170, ftLastAccessTime.dwHighDateTime=0x1d5ca87, ftLastWriteTime.dwLowDateTime=0xc1a1b7bf, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0xd490)) returned 1 [0100.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea30) returned 1 [0100.718] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\KRXeGgoAmgWs.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\krxeggoamgws.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\KRXeGgoAmgWs.rtf.lasan" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\krxeggoamgws.rtf.lasan")) returned 1 [0100.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0100.719] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2", lpFilePart=0x0) returned 0x38 [0100.719] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\*", lpFindFileData=0x19e7a8 | out: lpFindFileData=0x19e7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x573ff7b0, ftCreationTime.dwHighDateTime=0x1d5d7da, ftLastAccessTime.dwLowDateTime=0x6a657610, ftLastAccessTime.dwHighDateTime=0x1d5d54d, ftLastWriteTime.dwLowDateTime=0x6a657610, ftLastWriteTime.dwHighDateTime=0x1d5d54d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6337a8 [0100.719] FindNextFileW (in: hFindFile=0x6337a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x573ff7b0, ftCreationTime.dwHighDateTime=0x1d5d7da, ftLastAccessTime.dwLowDateTime=0x6a657610, ftLastAccessTime.dwHighDateTime=0x1d5d54d, ftLastWriteTime.dwLowDateTime=0x6a657610, ftLastWriteTime.dwHighDateTime=0x1d5d54d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.719] FindNextFileW (in: hFindFile=0x6337a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe17d4e80, ftCreationTime.dwHighDateTime=0x1d5d732, ftLastAccessTime.dwLowDateTime=0xdddb5110, ftLastAccessTime.dwHighDateTime=0x1d5d0ba, ftLastWriteTime.dwLowDateTime=0xdddb5110, ftLastWriteTime.dwHighDateTime=0x1d5d0ba, nFileSizeHigh=0x0, nFileSizeLow=0x14537, dwReserved0=0x0, dwReserved1=0x0, cFileName="-Xrn5nM_5LKJ-VVDu.wav", cAlternateFileName="-XRN5N~1.WAV")) returned 1 [0100.719] FindNextFileW (in: hFindFile=0x6337a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ae60c90, ftCreationTime.dwHighDateTime=0x1d5cbb6, ftLastAccessTime.dwLowDateTime=0x58292000, ftLastAccessTime.dwHighDateTime=0x1d5d057, ftLastWriteTime.dwLowDateTime=0x58292000, ftLastWriteTime.dwHighDateTime=0x1d5d057, nFileSizeHigh=0x0, nFileSizeLow=0x3146, dwReserved0=0x0, dwReserved1=0x0, cFileName="3KPg0WtyYSGggvxE5PN.pps", cAlternateFileName="3KPG0W~1.PPS")) returned 1 [0100.719] FindNextFileW (in: hFindFile=0x6337a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65d896e0, ftCreationTime.dwHighDateTime=0x1d5d63d, ftLastAccessTime.dwLowDateTime=0x53ae84e0, ftLastAccessTime.dwHighDateTime=0x1d5cae7, ftLastWriteTime.dwLowDateTime=0x53ae84e0, ftLastWriteTime.dwHighDateTime=0x1d5cae7, nFileSizeHigh=0x0, nFileSizeLow=0x6a88, dwReserved0=0x0, dwReserved1=0x0, cFileName="68LjFMNM n9B6bGr1nJj.flv", cAlternateFileName="68LJFM~1.FLV")) returned 1 [0100.720] FindNextFileW (in: hFindFile=0x6337a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x823c25e0, ftCreationTime.dwHighDateTime=0x1d5cf9e, ftLastAccessTime.dwLowDateTime=0xb5cff160, ftLastAccessTime.dwHighDateTime=0x1d5cbe9, ftLastWriteTime.dwLowDateTime=0xb5cff160, ftLastWriteTime.dwHighDateTime=0x1d5cbe9, nFileSizeHigh=0x0, nFileSizeLow=0x1fd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AsN5974QwMCVpOmG.jpg", cAlternateFileName="ASN597~1.JPG")) returned 1 [0100.720] FindNextFileW (in: hFindFile=0x6337a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82922c0, ftCreationTime.dwHighDateTime=0x1d5d012, ftLastAccessTime.dwLowDateTime=0xad290520, ftLastAccessTime.dwHighDateTime=0x1d5cde1, ftLastWriteTime.dwLowDateTime=0xad290520, ftLastWriteTime.dwHighDateTime=0x1d5cde1, nFileSizeHigh=0x0, nFileSizeLow=0x1522f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOXDj0n4wjoypdH3.pdf", cAlternateFileName="DOXDJ0~1.PDF")) returned 1 [0100.720] FindNextFileW (in: hFindFile=0x6337a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d107270, ftCreationTime.dwHighDateTime=0x1d5d03d, ftLastAccessTime.dwLowDateTime=0xed190cb0, ftLastAccessTime.dwHighDateTime=0x1d5d148, ftLastWriteTime.dwLowDateTime=0xed190cb0, ftLastWriteTime.dwHighDateTime=0x1d5d148, nFileSizeHigh=0x0, nFileSizeLow=0xf887, dwReserved0=0x0, dwReserved1=0x0, cFileName="e4FKmXF3ZEy.bmp", cAlternateFileName="E4FKMX~1.BMP")) returned 1 [0100.720] FindNextFileW (in: hFindFile=0x6337a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef61b770, ftCreationTime.dwHighDateTime=0x1d5cec7, ftLastAccessTime.dwLowDateTime=0x5acbb170, ftLastAccessTime.dwHighDateTime=0x1d5d3f3, ftLastWriteTime.dwLowDateTime=0x5acbb170, ftLastWriteTime.dwHighDateTime=0x1d5d3f3, nFileSizeHigh=0x0, nFileSizeLow=0x15cce, dwReserved0=0x0, dwReserved1=0x0, cFileName="eDZc_saggj7anCy5.png", cAlternateFileName="EDZC_S~1.PNG")) returned 1 [0100.720] FindNextFileW (in: hFindFile=0x6337a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21e2e630, ftCreationTime.dwHighDateTime=0x1d5d010, ftLastAccessTime.dwLowDateTime=0x402e6e20, ftLastAccessTime.dwHighDateTime=0x1d5d27c, ftLastWriteTime.dwLowDateTime=0x402e6e20, ftLastWriteTime.dwHighDateTime=0x1d5d27c, nFileSizeHigh=0x0, nFileSizeLow=0x2fed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lf5N9R5q.avi", cAlternateFileName="")) returned 1 [0100.720] FindNextFileW (in: hFindFile=0x6337a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c843870, ftCreationTime.dwHighDateTime=0x1d5cd52, ftLastAccessTime.dwLowDateTime=0x875a54b0, ftLastAccessTime.dwHighDateTime=0x1d5ca31, ftLastWriteTime.dwLowDateTime=0x875a54b0, ftLastWriteTime.dwHighDateTime=0x1d5ca31, nFileSizeHigh=0x0, nFileSizeLow=0xc7bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Op5yMy_-lFKYO-9CTq.swf", cAlternateFileName="OP5YMY~1.SWF")) returned 1 [0100.720] FindNextFileW (in: hFindFile=0x6337a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8887c800, ftCreationTime.dwHighDateTime=0x1d5cd2d, ftLastAccessTime.dwLowDateTime=0xec9b7040, ftLastAccessTime.dwHighDateTime=0x1d5ca4d, ftLastWriteTime.dwLowDateTime=0xec9b7040, ftLastWriteTime.dwHighDateTime=0x1d5ca4d, nFileSizeHigh=0x0, nFileSizeLow=0x508f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PxRh7kya3fl.png", cAlternateFileName="PXRH7K~1.PNG")) returned 1 [0100.721] FindNextFileW (in: hFindFile=0x6337a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45814d0, ftCreationTime.dwHighDateTime=0x1d5caa5, ftLastAccessTime.dwLowDateTime=0xcb877b50, ftLastAccessTime.dwHighDateTime=0x1d5ca17, ftLastWriteTime.dwLowDateTime=0xcb877b50, ftLastWriteTime.dwHighDateTime=0x1d5ca17, nFileSizeHigh=0x0, nFileSizeLow=0x1881f, dwReserved0=0x0, dwReserved1=0x0, cFileName="rXrPLSgWfe6n.ppt", cAlternateFileName="RXRPLS~1.PPT")) returned 1 [0100.721] FindNextFileW (in: hFindFile=0x6337a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95477990, ftCreationTime.dwHighDateTime=0x1d5c900, ftLastAccessTime.dwLowDateTime=0xca4b4230, ftLastAccessTime.dwHighDateTime=0x1d5cff3, ftLastWriteTime.dwLowDateTime=0xca4b4230, ftLastWriteTime.dwHighDateTime=0x1d5cff3, nFileSizeHigh=0x0, nFileSizeLow=0x161f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="TXEYOMbRJZ8KA3x_j-79.mp4", cAlternateFileName="TXEYOM~1.MP4")) returned 1 [0100.721] FindNextFileW (in: hFindFile=0x6337a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0100.721] FindClose (in: hFindFile=0x6337a8 | out: hFindFile=0x6337a8) returned 1 [0100.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea3c) returned 1 [0100.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea48) returned 1 [0100.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0100.721] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2", lpFilePart=0x0) returned 0x38 [0100.721] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\*", lpFindFileData=0x19e7a8 | out: lpFindFileData=0x19e7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x573ff7b0, ftCreationTime.dwHighDateTime=0x1d5d7da, ftLastAccessTime.dwLowDateTime=0x6a657610, ftLastAccessTime.dwHighDateTime=0x1d5d54d, ftLastWriteTime.dwLowDateTime=0x6a657610, ftLastWriteTime.dwHighDateTime=0x1d5d54d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6339a8 [0100.721] FindNextFileW (in: hFindFile=0x6339a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x573ff7b0, ftCreationTime.dwHighDateTime=0x1d5d7da, ftLastAccessTime.dwLowDateTime=0x6a657610, ftLastAccessTime.dwHighDateTime=0x1d5d54d, ftLastWriteTime.dwLowDateTime=0x6a657610, ftLastWriteTime.dwHighDateTime=0x1d5d54d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.722] FindNextFileW (in: hFindFile=0x6339a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe17d4e80, ftCreationTime.dwHighDateTime=0x1d5d732, ftLastAccessTime.dwLowDateTime=0xdddb5110, ftLastAccessTime.dwHighDateTime=0x1d5d0ba, ftLastWriteTime.dwLowDateTime=0xdddb5110, ftLastWriteTime.dwHighDateTime=0x1d5d0ba, nFileSizeHigh=0x0, nFileSizeLow=0x14537, dwReserved0=0x0, dwReserved1=0x0, cFileName="-Xrn5nM_5LKJ-VVDu.wav", cAlternateFileName="-XRN5N~1.WAV")) returned 1 [0100.722] FindNextFileW (in: hFindFile=0x6339a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ae60c90, ftCreationTime.dwHighDateTime=0x1d5cbb6, ftLastAccessTime.dwLowDateTime=0x58292000, ftLastAccessTime.dwHighDateTime=0x1d5d057, ftLastWriteTime.dwLowDateTime=0x58292000, ftLastWriteTime.dwHighDateTime=0x1d5d057, nFileSizeHigh=0x0, nFileSizeLow=0x3146, dwReserved0=0x0, dwReserved1=0x0, cFileName="3KPg0WtyYSGggvxE5PN.pps", cAlternateFileName="3KPG0W~1.PPS")) returned 1 [0100.722] FindNextFileW (in: hFindFile=0x6339a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65d896e0, ftCreationTime.dwHighDateTime=0x1d5d63d, ftLastAccessTime.dwLowDateTime=0x53ae84e0, ftLastAccessTime.dwHighDateTime=0x1d5cae7, ftLastWriteTime.dwLowDateTime=0x53ae84e0, ftLastWriteTime.dwHighDateTime=0x1d5cae7, nFileSizeHigh=0x0, nFileSizeLow=0x6a88, dwReserved0=0x0, dwReserved1=0x0, cFileName="68LjFMNM n9B6bGr1nJj.flv", cAlternateFileName="68LJFM~1.FLV")) returned 1 [0100.722] FindNextFileW (in: hFindFile=0x6339a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x823c25e0, ftCreationTime.dwHighDateTime=0x1d5cf9e, ftLastAccessTime.dwLowDateTime=0xb5cff160, ftLastAccessTime.dwHighDateTime=0x1d5cbe9, ftLastWriteTime.dwLowDateTime=0xb5cff160, ftLastWriteTime.dwHighDateTime=0x1d5cbe9, nFileSizeHigh=0x0, nFileSizeLow=0x1fd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AsN5974QwMCVpOmG.jpg", cAlternateFileName="ASN597~1.JPG")) returned 1 [0100.722] FindNextFileW (in: hFindFile=0x6339a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82922c0, ftCreationTime.dwHighDateTime=0x1d5d012, ftLastAccessTime.dwLowDateTime=0xad290520, ftLastAccessTime.dwHighDateTime=0x1d5cde1, ftLastWriteTime.dwLowDateTime=0xad290520, ftLastWriteTime.dwHighDateTime=0x1d5cde1, nFileSizeHigh=0x0, nFileSizeLow=0x1522f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOXDj0n4wjoypdH3.pdf", cAlternateFileName="DOXDJ0~1.PDF")) returned 1 [0100.722] FindNextFileW (in: hFindFile=0x6339a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d107270, ftCreationTime.dwHighDateTime=0x1d5d03d, ftLastAccessTime.dwLowDateTime=0xed190cb0, ftLastAccessTime.dwHighDateTime=0x1d5d148, ftLastWriteTime.dwLowDateTime=0xed190cb0, ftLastWriteTime.dwHighDateTime=0x1d5d148, nFileSizeHigh=0x0, nFileSizeLow=0xf887, dwReserved0=0x0, dwReserved1=0x0, cFileName="e4FKmXF3ZEy.bmp", cAlternateFileName="E4FKMX~1.BMP")) returned 1 [0100.723] FindNextFileW (in: hFindFile=0x6339a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef61b770, ftCreationTime.dwHighDateTime=0x1d5cec7, ftLastAccessTime.dwLowDateTime=0x5acbb170, ftLastAccessTime.dwHighDateTime=0x1d5d3f3, ftLastWriteTime.dwLowDateTime=0x5acbb170, ftLastWriteTime.dwHighDateTime=0x1d5d3f3, nFileSizeHigh=0x0, nFileSizeLow=0x15cce, dwReserved0=0x0, dwReserved1=0x0, cFileName="eDZc_saggj7anCy5.png", cAlternateFileName="EDZC_S~1.PNG")) returned 1 [0100.723] FindNextFileW (in: hFindFile=0x6339a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21e2e630, ftCreationTime.dwHighDateTime=0x1d5d010, ftLastAccessTime.dwLowDateTime=0x402e6e20, ftLastAccessTime.dwHighDateTime=0x1d5d27c, ftLastWriteTime.dwLowDateTime=0x402e6e20, ftLastWriteTime.dwHighDateTime=0x1d5d27c, nFileSizeHigh=0x0, nFileSizeLow=0x2fed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lf5N9R5q.avi", cAlternateFileName="")) returned 1 [0100.723] FindNextFileW (in: hFindFile=0x6339a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c843870, ftCreationTime.dwHighDateTime=0x1d5cd52, ftLastAccessTime.dwLowDateTime=0x875a54b0, ftLastAccessTime.dwHighDateTime=0x1d5ca31, ftLastWriteTime.dwLowDateTime=0x875a54b0, ftLastWriteTime.dwHighDateTime=0x1d5ca31, nFileSizeHigh=0x0, nFileSizeLow=0xc7bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Op5yMy_-lFKYO-9CTq.swf", cAlternateFileName="OP5YMY~1.SWF")) returned 1 [0100.723] FindNextFileW (in: hFindFile=0x6339a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8887c800, ftCreationTime.dwHighDateTime=0x1d5cd2d, ftLastAccessTime.dwLowDateTime=0xec9b7040, ftLastAccessTime.dwHighDateTime=0x1d5ca4d, ftLastWriteTime.dwLowDateTime=0xec9b7040, ftLastWriteTime.dwHighDateTime=0x1d5ca4d, nFileSizeHigh=0x0, nFileSizeLow=0x508f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PxRh7kya3fl.png", cAlternateFileName="PXRH7K~1.PNG")) returned 1 [0100.723] FindNextFileW (in: hFindFile=0x6339a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45814d0, ftCreationTime.dwHighDateTime=0x1d5caa5, ftLastAccessTime.dwLowDateTime=0xcb877b50, ftLastAccessTime.dwHighDateTime=0x1d5ca17, ftLastWriteTime.dwLowDateTime=0xcb877b50, ftLastWriteTime.dwHighDateTime=0x1d5ca17, nFileSizeHigh=0x0, nFileSizeLow=0x1881f, dwReserved0=0x0, dwReserved1=0x0, cFileName="rXrPLSgWfe6n.ppt", cAlternateFileName="RXRPLS~1.PPT")) returned 1 [0100.723] FindNextFileW (in: hFindFile=0x6339a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95477990, ftCreationTime.dwHighDateTime=0x1d5c900, ftLastAccessTime.dwLowDateTime=0xca4b4230, ftLastAccessTime.dwHighDateTime=0x1d5cff3, ftLastWriteTime.dwLowDateTime=0xca4b4230, ftLastWriteTime.dwHighDateTime=0x1d5cff3, nFileSizeHigh=0x0, nFileSizeLow=0x161f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="TXEYOMbRJZ8KA3x_j-79.mp4", cAlternateFileName="TXEYOM~1.MP4")) returned 1 [0100.724] FindNextFileW (in: hFindFile=0x6339a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95477990, ftCreationTime.dwHighDateTime=0x1d5c900, ftLastAccessTime.dwLowDateTime=0xca4b4230, ftLastAccessTime.dwHighDateTime=0x1d5cff3, ftLastWriteTime.dwLowDateTime=0xca4b4230, ftLastWriteTime.dwHighDateTime=0x1d5cff3, nFileSizeHigh=0x0, nFileSizeLow=0x161f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="TXEYOMbRJZ8KA3x_j-79.mp4", cAlternateFileName="TXEYOM~1.MP4")) returned 0 [0100.724] FindClose (in: hFindFile=0x6339a8 | out: hFindFile=0x6339a8) returned 1 [0100.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea3c) returned 1 [0100.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea48) returned 1 [0100.724] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\AsN5974QwMCVpOmG.jpg", nBufferLength=0x105, lpBuffer=0x19e428, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\AsN5974QwMCVpOmG.jpg", lpFilePart=0x0) returned 0x4d [0100.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e96c) returned 1 [0100.724] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\AsN5974QwMCVpOmG.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\u04mlmw17ygixurnlg2\\asn5974qwmcvpomg.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0100.724] GetFileType (hFile=0x430) returned 0x1 [0100.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e968) returned 1 [0100.724] GetFileType (hFile=0x430) returned 0x1 [0100.724] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19ea68 | out: lpFileSizeHigh=0x19ea68*=0x0) returned 0x1fd0 [0100.724] ReadFile (in: hFile=0x430, lpBuffer=0x24ed0c4, nNumberOfBytesToRead=0x1fd0, lpNumberOfBytesRead=0x19ea14, lpOverlapped=0x0 | out: lpBuffer=0x24ed0c4*, lpNumberOfBytesRead=0x19ea14*=0x1fd0, lpOverlapped=0x0) returned 1 [0100.724] CloseHandle (hObject=0x430) returned 1 [0100.740] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\AsN5974QwMCVpOmG.jpg", nBufferLength=0x105, lpBuffer=0x19e410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\AsN5974QwMCVpOmG.jpg", lpFilePart=0x0) returned 0x4d [0100.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e954) returned 1 [0100.740] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\AsN5974QwMCVpOmG.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\u04mlmw17ygixurnlg2\\asn5974qwmcvpomg.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0100.741] GetFileType (hFile=0x430) returned 0x1 [0100.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e950) returned 1 [0100.741] GetFileType (hFile=0x430) returned 0x1 [0100.741] WriteFile (in: hFile=0x430, lpBuffer=0x2543e0c*, nNumberOfBytesToWrite=0x1fe0, lpNumberOfBytesWritten=0x19ea04, lpOverlapped=0x0 | out: lpBuffer=0x2543e0c*, lpNumberOfBytesWritten=0x19ea04*=0x1fe0, lpOverlapped=0x0) returned 1 [0100.745] CloseHandle (hObject=0x430) returned 1 [0100.746] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\AsN5974QwMCVpOmG.jpg", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\AsN5974QwMCVpOmG.jpg", lpFilePart=0x0) returned 0x4d [0100.746] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\AsN5974QwMCVpOmG.jpg.lasan", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\AsN5974QwMCVpOmG.jpg.lasan", lpFilePart=0x0) returned 0x53 [0100.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9e8) returned 1 [0100.746] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\AsN5974QwMCVpOmG.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\u04mlmw17ygixurnlg2\\asn5974qwmcvpomg.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ea64 | out: lpFileInformation=0x19ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x823c25e0, ftCreationTime.dwHighDateTime=0x1d5cf9e, ftLastAccessTime.dwLowDateTime=0xb5cff160, ftLastAccessTime.dwHighDateTime=0x1d5cbe9, ftLastWriteTime.dwLowDateTime=0xc1a67e35, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x1fe0)) returned 1 [0100.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e4) returned 1 [0100.746] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\AsN5974QwMCVpOmG.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\u04mlmw17ygixurnlg2\\asn5974qwmcvpomg.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\AsN5974QwMCVpOmG.jpg.lasan" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\u04mlmw17ygixurnlg2\\asn5974qwmcvpomg.jpg.lasan")) returned 1 [0100.747] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\eDZc_saggj7anCy5.png", nBufferLength=0x105, lpBuffer=0x19e428, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\eDZc_saggj7anCy5.png", lpFilePart=0x0) returned 0x4d [0100.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e96c) returned 1 [0100.747] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\eDZc_saggj7anCy5.png" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\u04mlmw17ygixurnlg2\\edzc_saggj7ancy5.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0100.747] GetFileType (hFile=0x430) returned 0x1 [0100.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e968) returned 1 [0100.747] GetFileType (hFile=0x430) returned 0x1 [0100.747] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19ea68 | out: lpFileSizeHigh=0x19ea68*=0x0) returned 0x15cce [0100.747] ReadFile (in: hFile=0x430, lpBuffer=0x33e3208, nNumberOfBytesToRead=0x15cce, lpNumberOfBytesRead=0x19ea14, lpOverlapped=0x0 | out: lpBuffer=0x33e3208*, lpNumberOfBytesRead=0x19ea14*=0x15cce, lpOverlapped=0x0) returned 1 [0100.748] CloseHandle (hObject=0x430) returned 1 [0100.816] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\eDZc_saggj7anCy5.png", nBufferLength=0x105, lpBuffer=0x19e410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\eDZc_saggj7anCy5.png", lpFilePart=0x0) returned 0x4d [0100.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e954) returned 1 [0100.817] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\eDZc_saggj7anCy5.png" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\u04mlmw17ygixurnlg2\\edzc_saggj7ancy5.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0100.818] GetFileType (hFile=0x430) returned 0x1 [0100.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e950) returned 1 [0100.818] GetFileType (hFile=0x430) returned 0x1 [0100.818] WriteFile (in: hFile=0x430, lpBuffer=0x347a728*, nNumberOfBytesToWrite=0x15cd0, lpNumberOfBytesWritten=0x19ea04, lpOverlapped=0x0 | out: lpBuffer=0x347a728*, lpNumberOfBytesWritten=0x19ea04*=0x15cd0, lpOverlapped=0x0) returned 1 [0100.820] CloseHandle (hObject=0x430) returned 1 [0100.823] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\eDZc_saggj7anCy5.png", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\eDZc_saggj7anCy5.png", lpFilePart=0x0) returned 0x4d [0100.823] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\eDZc_saggj7anCy5.png.lasan", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\eDZc_saggj7anCy5.png.lasan", lpFilePart=0x0) returned 0x53 [0100.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9e8) returned 1 [0100.823] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\eDZc_saggj7anCy5.png" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\u04mlmw17ygixurnlg2\\edzc_saggj7ancy5.png"), fInfoLevelId=0x0, lpFileInformation=0x19ea64 | out: lpFileInformation=0x19ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef61b770, ftCreationTime.dwHighDateTime=0x1d5cec7, ftLastAccessTime.dwLowDateTime=0x5acbb170, ftLastAccessTime.dwHighDateTime=0x1d5d3f3, ftLastWriteTime.dwLowDateTime=0xc1b26846, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x15cd0)) returned 1 [0100.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e4) returned 1 [0100.823] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\eDZc_saggj7anCy5.png" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\u04mlmw17ygixurnlg2\\edzc_saggj7ancy5.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\eDZc_saggj7anCy5.png.lasan" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\u04mlmw17ygixurnlg2\\edzc_saggj7ancy5.png.lasan")) returned 1 [0100.824] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\PxRh7kya3fl.png", nBufferLength=0x105, lpBuffer=0x19e428, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\PxRh7kya3fl.png", lpFilePart=0x0) returned 0x48 [0100.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e96c) returned 1 [0100.824] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\PxRh7kya3fl.png" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\u04mlmw17ygixurnlg2\\pxrh7kya3fl.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0100.824] GetFileType (hFile=0x430) returned 0x1 [0100.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e968) returned 1 [0100.824] GetFileType (hFile=0x430) returned 0x1 [0100.824] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19ea68 | out: lpFileSizeHigh=0x19ea68*=0x0) returned 0x508f [0100.824] ReadFile (in: hFile=0x430, lpBuffer=0x25935b8, nNumberOfBytesToRead=0x508f, lpNumberOfBytesRead=0x19ea14, lpOverlapped=0x0 | out: lpBuffer=0x25935b8*, lpNumberOfBytesRead=0x19ea14*=0x508f, lpOverlapped=0x0) returned 1 [0100.824] CloseHandle (hObject=0x430) returned 1 [0101.061] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\PxRh7kya3fl.png", nBufferLength=0x105, lpBuffer=0x19e410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\PxRh7kya3fl.png", lpFilePart=0x0) returned 0x48 [0101.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e954) returned 1 [0101.061] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\PxRh7kya3fl.png" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\u04mlmw17ygixurnlg2\\pxrh7kya3fl.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0101.113] GetFileType (hFile=0x430) returned 0x1 [0101.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e950) returned 1 [0101.113] GetFileType (hFile=0x430) returned 0x1 [0101.113] WriteFile (in: hFile=0x430, lpBuffer=0x25f9674*, nNumberOfBytesToWrite=0x5090, lpNumberOfBytesWritten=0x19ea04, lpOverlapped=0x0 | out: lpBuffer=0x25f9674*, lpNumberOfBytesWritten=0x19ea04*=0x5090, lpOverlapped=0x0) returned 1 [0101.115] CloseHandle (hObject=0x430) returned 1 [0101.116] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\PxRh7kya3fl.png", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\PxRh7kya3fl.png", lpFilePart=0x0) returned 0x48 [0101.116] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\PxRh7kya3fl.png.lasan", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\PxRh7kya3fl.png.lasan", lpFilePart=0x0) returned 0x4e [0101.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9e8) returned 1 [0101.116] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\PxRh7kya3fl.png" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\u04mlmw17ygixurnlg2\\pxrh7kya3fl.png"), fInfoLevelId=0x0, lpFileInformation=0x19ea64 | out: lpFileInformation=0x19ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8887c800, ftCreationTime.dwHighDateTime=0x1d5cd2d, ftLastAccessTime.dwLowDateTime=0xec9b7040, ftLastAccessTime.dwHighDateTime=0x1d5ca4d, ftLastWriteTime.dwLowDateTime=0xc1dfb515, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x5090)) returned 1 [0101.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e4) returned 1 [0101.116] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\PxRh7kya3fl.png" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\u04mlmw17ygixurnlg2\\pxrh7kya3fl.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\PxRh7kya3fl.png.lasan" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\u04mlmw17ygixurnlg2\\pxrh7kya3fl.png.lasan")) returned 1 [0101.117] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\rXrPLSgWfe6n.ppt", nBufferLength=0x105, lpBuffer=0x19e428, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\rXrPLSgWfe6n.ppt", lpFilePart=0x0) returned 0x49 [0101.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e96c) returned 1 [0101.117] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\rXrPLSgWfe6n.ppt" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\u04mlmw17ygixurnlg2\\rxrplsgwfe6n.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0101.117] GetFileType (hFile=0x430) returned 0x1 [0101.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e968) returned 1 [0101.117] GetFileType (hFile=0x430) returned 0x1 [0101.117] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19ea68 | out: lpFileSizeHigh=0x19ea68*=0x0) returned 0x1881f [0101.118] ReadFile (in: hFile=0x430, lpBuffer=0x3490418, nNumberOfBytesToRead=0x1881f, lpNumberOfBytesRead=0x19ea14, lpOverlapped=0x0 | out: lpBuffer=0x3490418*, lpNumberOfBytesRead=0x19ea14*=0x1881f, lpOverlapped=0x0) returned 1 [0101.119] CloseHandle (hObject=0x430) returned 1 [0101.143] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\rXrPLSgWfe6n.ppt", nBufferLength=0x105, lpBuffer=0x19e410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\rXrPLSgWfe6n.ppt", lpFilePart=0x0) returned 0x49 [0101.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e954) returned 1 [0101.143] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\rXrPLSgWfe6n.ppt" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\u04mlmw17ygixurnlg2\\rxrplsgwfe6n.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0101.145] GetFileType (hFile=0x430) returned 0x1 [0101.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e950) returned 1 [0101.145] GetFileType (hFile=0x430) returned 0x1 [0101.145] WriteFile (in: hFile=0x430, lpBuffer=0x350acf8*, nNumberOfBytesToWrite=0x18820, lpNumberOfBytesWritten=0x19ea04, lpOverlapped=0x0 | out: lpBuffer=0x350acf8*, lpNumberOfBytesWritten=0x19ea04*=0x18820, lpOverlapped=0x0) returned 1 [0101.147] CloseHandle (hObject=0x430) returned 1 [0101.150] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\rXrPLSgWfe6n.ppt", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\rXrPLSgWfe6n.ppt", lpFilePart=0x0) returned 0x49 [0101.150] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\rXrPLSgWfe6n.ppt.lasan", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\rXrPLSgWfe6n.ppt.lasan", lpFilePart=0x0) returned 0x4f [0101.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9e8) returned 1 [0101.150] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\rXrPLSgWfe6n.ppt" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\u04mlmw17ygixurnlg2\\rxrplsgwfe6n.ppt"), fInfoLevelId=0x0, lpFileInformation=0x19ea64 | out: lpFileInformation=0x19ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45814d0, ftCreationTime.dwHighDateTime=0x1d5caa5, ftLastAccessTime.dwLowDateTime=0xcb877b50, ftLastAccessTime.dwHighDateTime=0x1d5ca17, ftLastWriteTime.dwLowDateTime=0xc1e47e24, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x18820)) returned 1 [0101.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e4) returned 1 [0101.150] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\rXrPLSgWfe6n.ppt" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\u04mlmw17ygixurnlg2\\rxrplsgwfe6n.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\rXrPLSgWfe6n.ppt.lasan" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\u04mlmw17ygixurnlg2\\rxrplsgwfe6n.ppt.lasan")) returned 1 [0101.151] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\TXEYOMbRJZ8KA3x_j-79.mp4", nBufferLength=0x105, lpBuffer=0x19e428, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\TXEYOMbRJZ8KA3x_j-79.mp4", lpFilePart=0x0) returned 0x51 [0101.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e96c) returned 1 [0101.151] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\TXEYOMbRJZ8KA3x_j-79.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\u04mlmw17ygixurnlg2\\txeyombrjz8ka3x_j-79.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0101.151] GetFileType (hFile=0x430) returned 0x1 [0101.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e968) returned 1 [0101.151] GetFileType (hFile=0x430) returned 0x1 [0101.151] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19ea68 | out: lpFileSizeHigh=0x19ea68*=0x0) returned 0x161f2 [0101.152] ReadFile (in: hFile=0x430, lpBuffer=0x3523538, nNumberOfBytesToRead=0x161f2, lpNumberOfBytesRead=0x19ea14, lpOverlapped=0x0 | out: lpBuffer=0x3523538*, lpNumberOfBytesRead=0x19ea14*=0x161f2, lpOverlapped=0x0) returned 1 [0101.153] CloseHandle (hObject=0x430) returned 1 [0101.518] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\TXEYOMbRJZ8KA3x_j-79.mp4", nBufferLength=0x105, lpBuffer=0x19e410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\TXEYOMbRJZ8KA3x_j-79.mp4", lpFilePart=0x0) returned 0x51 [0101.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e954) returned 1 [0101.518] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\TXEYOMbRJZ8KA3x_j-79.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\u04mlmw17ygixurnlg2\\txeyombrjz8ka3x_j-79.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0101.575] GetFileType (hFile=0x430) returned 0x1 [0101.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e950) returned 1 [0101.575] GetFileType (hFile=0x430) returned 0x1 [0101.575] WriteFile (in: hFile=0x430, lpBuffer=0x3591f68*, nNumberOfBytesToWrite=0x16200, lpNumberOfBytesWritten=0x19ea04, lpOverlapped=0x0 | out: lpBuffer=0x3591f68*, lpNumberOfBytesWritten=0x19ea04*=0x16200, lpOverlapped=0x0) returned 1 [0101.577] CloseHandle (hObject=0x430) returned 1 [0101.627] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\TXEYOMbRJZ8KA3x_j-79.mp4", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\TXEYOMbRJZ8KA3x_j-79.mp4", lpFilePart=0x0) returned 0x51 [0101.627] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\TXEYOMbRJZ8KA3x_j-79.mp4.lasan", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\TXEYOMbRJZ8KA3x_j-79.mp4.lasan", lpFilePart=0x0) returned 0x57 [0101.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9e8) returned 1 [0101.627] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\TXEYOMbRJZ8KA3x_j-79.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\u04mlmw17ygixurnlg2\\txeyombrjz8ka3x_j-79.mp4"), fInfoLevelId=0x0, lpFileInformation=0x19ea64 | out: lpFileInformation=0x19ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95477990, ftCreationTime.dwHighDateTime=0x1d5c900, ftLastAccessTime.dwLowDateTime=0xca4b4230, ftLastAccessTime.dwHighDateTime=0x1d5cff3, ftLastWriteTime.dwLowDateTime=0xc2273d84, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x16200)) returned 1 [0101.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e4) returned 1 [0101.627] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\TXEYOMbRJZ8KA3x_j-79.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\u04mlmw17ygixurnlg2\\txeyombrjz8ka3x_j-79.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\U04MlmW17YgixuRnLG2\\TXEYOMbRJZ8KA3x_j-79.mp4.lasan" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\u04mlmw17ygixurnlg2\\txeyombrjz8ka3x_j-79.mp4.lasan")) returned 1 [0101.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0101.720] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\WY8_EheJNNFvgBiLqw", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\WY8_EheJNNFvgBiLqw", lpFilePart=0x0) returned 0x37 [0101.720] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\WY8_EheJNNFvgBiLqw\\*", lpFindFileData=0x19e7a8 | out: lpFindFileData=0x19e7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x578c1910, ftCreationTime.dwHighDateTime=0x1d5d33e, ftLastAccessTime.dwLowDateTime=0xa4be9970, ftLastAccessTime.dwHighDateTime=0x1d5cc67, ftLastWriteTime.dwLowDateTime=0xa4be9970, ftLastWriteTime.dwHighDateTime=0x1d5cc67, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6337a8 [0101.720] FindNextFileW (in: hFindFile=0x6337a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x578c1910, ftCreationTime.dwHighDateTime=0x1d5d33e, ftLastAccessTime.dwLowDateTime=0xa4be9970, ftLastAccessTime.dwHighDateTime=0x1d5cc67, ftLastWriteTime.dwLowDateTime=0xa4be9970, ftLastWriteTime.dwHighDateTime=0x1d5cc67, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.721] FindNextFileW (in: hFindFile=0x6337a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52a3f2b0, ftCreationTime.dwHighDateTime=0x1d5cd58, ftLastAccessTime.dwLowDateTime=0xb898d50, ftLastAccessTime.dwHighDateTime=0x1d5c9e7, ftLastWriteTime.dwLowDateTime=0xb898d50, ftLastWriteTime.dwHighDateTime=0x1d5c9e7, nFileSizeHigh=0x0, nFileSizeLow=0x9492, dwReserved0=0x0, dwReserved1=0x0, cFileName="0z98MH.jpg", cAlternateFileName="")) returned 1 [0101.721] FindNextFileW (in: hFindFile=0x6337a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x544b240, ftCreationTime.dwHighDateTime=0x1d5ca45, ftLastAccessTime.dwLowDateTime=0xc64d00f0, ftLastAccessTime.dwHighDateTime=0x1d5d521, ftLastWriteTime.dwLowDateTime=0xc64d00f0, ftLastWriteTime.dwHighDateTime=0x1d5d521, nFileSizeHigh=0x0, nFileSizeLow=0xab06, dwReserved0=0x0, dwReserved1=0x0, cFileName="cewMua1k_Xm6PWw.mp4", cAlternateFileName="CEWMUA~1.MP4")) returned 1 [0101.721] FindNextFileW (in: hFindFile=0x6337a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4ad5c90, ftCreationTime.dwHighDateTime=0x1d5d470, ftLastAccessTime.dwLowDateTime=0xc1407510, ftLastAccessTime.dwHighDateTime=0x1d5c919, ftLastWriteTime.dwLowDateTime=0xc1407510, ftLastWriteTime.dwHighDateTime=0x1d5c919, nFileSizeHigh=0x0, nFileSizeLow=0x455c, dwReserved0=0x0, dwReserved1=0x0, cFileName="s3BVfZKRPbG7cAl a.bmp", cAlternateFileName="S3BVFZ~1.BMP")) returned 1 [0101.721] FindNextFileW (in: hFindFile=0x6337a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0101.721] FindClose (in: hFindFile=0x6337a8 | out: hFindFile=0x6337a8) returned 1 [0101.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea3c) returned 1 [0101.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea48) returned 1 [0101.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0101.721] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\WY8_EheJNNFvgBiLqw", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\WY8_EheJNNFvgBiLqw", lpFilePart=0x0) returned 0x37 [0101.721] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\WY8_EheJNNFvgBiLqw\\*", lpFindFileData=0x19e7a8 | out: lpFindFileData=0x19e7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x578c1910, ftCreationTime.dwHighDateTime=0x1d5d33e, ftLastAccessTime.dwLowDateTime=0xa4be9970, ftLastAccessTime.dwHighDateTime=0x1d5cc67, ftLastWriteTime.dwLowDateTime=0xa4be9970, ftLastWriteTime.dwHighDateTime=0x1d5cc67, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x633568 [0101.722] FindNextFileW (in: hFindFile=0x633568, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x578c1910, ftCreationTime.dwHighDateTime=0x1d5d33e, ftLastAccessTime.dwLowDateTime=0xa4be9970, ftLastAccessTime.dwHighDateTime=0x1d5cc67, ftLastWriteTime.dwLowDateTime=0xa4be9970, ftLastWriteTime.dwHighDateTime=0x1d5cc67, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.722] FindNextFileW (in: hFindFile=0x633568, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52a3f2b0, ftCreationTime.dwHighDateTime=0x1d5cd58, ftLastAccessTime.dwLowDateTime=0xb898d50, ftLastAccessTime.dwHighDateTime=0x1d5c9e7, ftLastWriteTime.dwLowDateTime=0xb898d50, ftLastWriteTime.dwHighDateTime=0x1d5c9e7, nFileSizeHigh=0x0, nFileSizeLow=0x9492, dwReserved0=0x0, dwReserved1=0x0, cFileName="0z98MH.jpg", cAlternateFileName="")) returned 1 [0101.722] FindNextFileW (in: hFindFile=0x633568, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x544b240, ftCreationTime.dwHighDateTime=0x1d5ca45, ftLastAccessTime.dwLowDateTime=0xc64d00f0, ftLastAccessTime.dwHighDateTime=0x1d5d521, ftLastWriteTime.dwLowDateTime=0xc64d00f0, ftLastWriteTime.dwHighDateTime=0x1d5d521, nFileSizeHigh=0x0, nFileSizeLow=0xab06, dwReserved0=0x0, dwReserved1=0x0, cFileName="cewMua1k_Xm6PWw.mp4", cAlternateFileName="CEWMUA~1.MP4")) returned 1 [0101.722] FindNextFileW (in: hFindFile=0x633568, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4ad5c90, ftCreationTime.dwHighDateTime=0x1d5d470, ftLastAccessTime.dwLowDateTime=0xc1407510, ftLastAccessTime.dwHighDateTime=0x1d5c919, ftLastWriteTime.dwLowDateTime=0xc1407510, ftLastWriteTime.dwHighDateTime=0x1d5c919, nFileSizeHigh=0x0, nFileSizeLow=0x455c, dwReserved0=0x0, dwReserved1=0x0, cFileName="s3BVfZKRPbG7cAl a.bmp", cAlternateFileName="S3BVFZ~1.BMP")) returned 1 [0101.722] FindNextFileW (in: hFindFile=0x633568, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4ad5c90, ftCreationTime.dwHighDateTime=0x1d5d470, ftLastAccessTime.dwLowDateTime=0xc1407510, ftLastAccessTime.dwHighDateTime=0x1d5c919, ftLastWriteTime.dwLowDateTime=0xc1407510, ftLastWriteTime.dwHighDateTime=0x1d5c919, nFileSizeHigh=0x0, nFileSizeLow=0x455c, dwReserved0=0x0, dwReserved1=0x0, cFileName="s3BVfZKRPbG7cAl a.bmp", cAlternateFileName="S3BVFZ~1.BMP")) returned 0 [0101.722] FindClose (in: hFindFile=0x633568 | out: hFindFile=0x633568) returned 1 [0101.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea3c) returned 1 [0101.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea48) returned 1 [0101.723] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\WY8_EheJNNFvgBiLqw\\0z98MH.jpg", nBufferLength=0x105, lpBuffer=0x19e428, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\WY8_EheJNNFvgBiLqw\\0z98MH.jpg", lpFilePart=0x0) returned 0x42 [0101.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e96c) returned 1 [0101.723] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\WY8_EheJNNFvgBiLqw\\0z98MH.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\wy8_ehejnnfvgbilqw\\0z98mh.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0101.723] GetFileType (hFile=0x430) returned 0x1 [0101.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e968) returned 1 [0101.723] GetFileType (hFile=0x430) returned 0x1 [0101.723] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19ea68 | out: lpFileSizeHigh=0x19ea68*=0x0) returned 0x9492 [0101.723] ReadFile (in: hFile=0x430, lpBuffer=0x23f648c, nNumberOfBytesToRead=0x9492, lpNumberOfBytesRead=0x19ea14, lpOverlapped=0x0 | out: lpBuffer=0x23f648c*, lpNumberOfBytesRead=0x19ea14*=0x9492, lpOverlapped=0x0) returned 1 [0101.723] CloseHandle (hObject=0x430) returned 1 [0101.793] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\WY8_EheJNNFvgBiLqw\\0z98MH.jpg", nBufferLength=0x105, lpBuffer=0x19e410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\WY8_EheJNNFvgBiLqw\\0z98MH.jpg", lpFilePart=0x0) returned 0x42 [0101.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e954) returned 1 [0101.793] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\WY8_EheJNNFvgBiLqw\\0z98MH.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\wy8_ehejnnfvgbilqw\\0z98mh.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0101.832] GetFileType (hFile=0x430) returned 0x1 [0101.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e950) returned 1 [0101.832] GetFileType (hFile=0x430) returned 0x1 [0101.832] WriteFile (in: hFile=0x430, lpBuffer=0x2471af4*, nNumberOfBytesToWrite=0x94a0, lpNumberOfBytesWritten=0x19ea04, lpOverlapped=0x0 | out: lpBuffer=0x2471af4*, lpNumberOfBytesWritten=0x19ea04*=0x94a0, lpOverlapped=0x0) returned 1 [0101.833] CloseHandle (hObject=0x430) returned 1 [0102.016] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\WY8_EheJNNFvgBiLqw\\0z98MH.jpg", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\WY8_EheJNNFvgBiLqw\\0z98MH.jpg", lpFilePart=0x0) returned 0x42 [0102.016] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\WY8_EheJNNFvgBiLqw\\0z98MH.jpg.lasan", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\WY8_EheJNNFvgBiLqw\\0z98MH.jpg.lasan", lpFilePart=0x0) returned 0x48 [0102.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9e8) returned 1 [0102.016] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\WY8_EheJNNFvgBiLqw\\0z98MH.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\wy8_ehejnnfvgbilqw\\0z98mh.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ea64 | out: lpFileInformation=0x19ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52a3f2b0, ftCreationTime.dwHighDateTime=0x1d5cd58, ftLastAccessTime.dwLowDateTime=0xb898d50, ftLastAccessTime.dwHighDateTime=0x1d5c9e7, ftLastWriteTime.dwLowDateTime=0xc24d61a1, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x94a0)) returned 1 [0102.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e4) returned 1 [0102.016] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\WY8_EheJNNFvgBiLqw\\0z98MH.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\wy8_ehejnnfvgbilqw\\0z98mh.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\WY8_EheJNNFvgBiLqw\\0z98MH.jpg.lasan" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\wy8_ehejnnfvgbilqw\\0z98mh.jpg.lasan")) returned 1 [0102.127] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\WY8_EheJNNFvgBiLqw\\cewMua1k_Xm6PWw.mp4", nBufferLength=0x105, lpBuffer=0x19e428, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\WY8_EheJNNFvgBiLqw\\cewMua1k_Xm6PWw.mp4", lpFilePart=0x0) returned 0x4b [0102.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e96c) returned 1 [0102.127] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\WY8_EheJNNFvgBiLqw\\cewMua1k_Xm6PWw.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\wy8_ehejnnfvgbilqw\\cewmua1k_xm6pww.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0102.127] GetFileType (hFile=0x430) returned 0x1 [0102.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e968) returned 1 [0102.127] GetFileType (hFile=0x430) returned 0x1 [0102.127] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19ea68 | out: lpFileSizeHigh=0x19ea68*=0x0) returned 0xab06 [0102.127] ReadFile (in: hFile=0x430, lpBuffer=0x247b3f0, nNumberOfBytesToRead=0xab06, lpNumberOfBytesRead=0x19ea14, lpOverlapped=0x0 | out: lpBuffer=0x247b3f0*, lpNumberOfBytesRead=0x19ea14*=0xab06, lpOverlapped=0x0) returned 1 [0102.128] CloseHandle (hObject=0x430) returned 1 [0102.146] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\WY8_EheJNNFvgBiLqw\\cewMua1k_Xm6PWw.mp4", nBufferLength=0x105, lpBuffer=0x19e410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\WY8_EheJNNFvgBiLqw\\cewMua1k_Xm6PWw.mp4", lpFilePart=0x0) returned 0x4b [0102.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e954) returned 1 [0102.146] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\WY8_EheJNNFvgBiLqw\\cewMua1k_Xm6PWw.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\wy8_ehejnnfvgbilqw\\cewmua1k_xm6pww.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0102.189] GetFileType (hFile=0x430) returned 0x1 [0102.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e950) returned 1 [0102.189] GetFileType (hFile=0x430) returned 0x1 [0102.189] WriteFile (in: hFile=0x430, lpBuffer=0x24e8320*, nNumberOfBytesToWrite=0xab10, lpNumberOfBytesWritten=0x19ea04, lpOverlapped=0x0 | out: lpBuffer=0x24e8320*, lpNumberOfBytesWritten=0x19ea04*=0xab10, lpOverlapped=0x0) returned 1 [0102.190] CloseHandle (hObject=0x430) returned 1 [0102.238] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\WY8_EheJNNFvgBiLqw\\cewMua1k_Xm6PWw.mp4", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\WY8_EheJNNFvgBiLqw\\cewMua1k_Xm6PWw.mp4", lpFilePart=0x0) returned 0x4b [0102.238] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\WY8_EheJNNFvgBiLqw\\cewMua1k_Xm6PWw.mp4.lasan", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\WY8_EheJNNFvgBiLqw\\cewMua1k_Xm6PWw.mp4.lasan", lpFilePart=0x0) returned 0x51 [0102.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9e8) returned 1 [0102.238] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\WY8_EheJNNFvgBiLqw\\cewMua1k_Xm6PWw.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\wy8_ehejnnfvgbilqw\\cewmua1k_xm6pww.mp4"), fInfoLevelId=0x0, lpFileInformation=0x19ea64 | out: lpFileInformation=0x19ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x544b240, ftCreationTime.dwHighDateTime=0x1d5ca45, ftLastAccessTime.dwLowDateTime=0xc64d00f0, ftLastAccessTime.dwHighDateTime=0x1d5d521, ftLastWriteTime.dwLowDateTime=0xc28437f4, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0xab10)) returned 1 [0102.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e4) returned 1 [0102.239] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\WY8_EheJNNFvgBiLqw\\cewMua1k_Xm6PWw.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\wy8_ehejnnfvgbilqw\\cewmua1k_xm6pww.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\BLshZEoEdxfL\\WY8_EheJNNFvgBiLqw\\cewMua1k_Xm6PWw.mp4.lasan" (normalized: "c:\\users\\fd1hvy\\desktop\\blshzeoedxfl\\wy8_ehejnnfvgbilqw\\cewmua1k_xm6pww.mp4.lasan")) returned 1 [0102.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb18) returned 1 [0102.330] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads", lpFilePart=0x0) returned 0x19 [0102.330] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\*", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6334a8 [0102.331] FindNextFileW (in: hFindFile=0x6334a8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.331] FindNextFileW (in: hFindFile=0x6334a8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0102.331] FindNextFileW (in: hFindFile=0x6334a8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0102.331] FindClose (in: hFindFile=0x6334a8 | out: hFindFile=0x6334a8) returned 1 [0102.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ead4) returned 1 [0102.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eae0) returned 1 [0102.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb18) returned 1 [0102.331] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads", lpFilePart=0x0) returned 0x19 [0102.331] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\*", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6339e8 [0102.332] FindNextFileW (in: hFindFile=0x6339e8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.332] FindNextFileW (in: hFindFile=0x6339e8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0102.332] FindNextFileW (in: hFindFile=0x6339e8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0102.332] FindClose (in: hFindFile=0x6339e8 | out: hFindFile=0x6339e8) returned 1 [0102.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ead4) returned 1 [0102.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eae0) returned 1 [0102.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb18) returned 1 [0102.332] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0102.332] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3a202261, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3a202261, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x633768 [0102.333] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3a202261, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3a202261, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.333] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x358053b0, ftCreationTime.dwHighDateTime=0x1d5d747, ftLastAccessTime.dwLowDateTime=0x9f51c30, ftLastAccessTime.dwHighDateTime=0x1d5d35f, ftLastWriteTime.dwLowDateTime=0x9f51c30, ftLastWriteTime.dwHighDateTime=0x1d5d35f, nFileSizeHigh=0x0, nFileSizeLow=0x9bf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="12FZPWCsCxOvjgNVW.ppt", cAlternateFileName="12FZPW~1.PPT")) returned 1 [0102.333] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65b04cc0, ftCreationTime.dwHighDateTime=0x1d5664f, ftLastAccessTime.dwLowDateTime=0x89debc20, ftLastAccessTime.dwHighDateTime=0x1d5733e, ftLastWriteTime.dwLowDateTime=0x89debc20, ftLastWriteTime.dwHighDateTime=0x1d5733e, nFileSizeHigh=0x0, nFileSizeLow=0x12297, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jxmQYGeuPol.xlsx", cAlternateFileName="5JXMQY~1.XLS")) returned 1 [0102.333] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27628170, ftCreationTime.dwHighDateTime=0x1d574d9, ftLastAccessTime.dwLowDateTime=0x6999cee0, ftLastAccessTime.dwHighDateTime=0x1d5b944, ftLastWriteTime.dwLowDateTime=0x6999cee0, ftLastWriteTime.dwHighDateTime=0x1d5b944, nFileSizeHigh=0x0, nFileSizeLow=0x157da, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hxQ_OAXcQjB.docx", cAlternateFileName="6HXQ_O~1.DOC")) returned 1 [0102.333] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84fcfa80, ftCreationTime.dwHighDateTime=0x1d5a423, ftLastAccessTime.dwLowDateTime=0xb900c2d0, ftLastAccessTime.dwHighDateTime=0x1d56b9d, ftLastWriteTime.dwLowDateTime=0xb900c2d0, ftLastWriteTime.dwHighDateTime=0x1d56b9d, nFileSizeHigh=0x0, nFileSizeLow=0x1a0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="9Ma4CFdKcEjClGXS0.docx", cAlternateFileName="9MA4CF~1.DOC")) returned 1 [0102.333] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcea2a560, ftCreationTime.dwHighDateTime=0x1d58a9a, ftLastAccessTime.dwLowDateTime=0x3bb91b60, ftLastAccessTime.dwHighDateTime=0x1d5c8f4, ftLastWriteTime.dwLowDateTime=0x3bb91b60, ftLastWriteTime.dwHighDateTime=0x1d5c8f4, nFileSizeHigh=0x0, nFileSizeLow=0xfc2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="9OQME9S1N.docx", cAlternateFileName="9OQME9~1.DOC")) returned 1 [0102.334] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbabde590, ftCreationTime.dwHighDateTime=0x1d5c2a4, ftLastAccessTime.dwLowDateTime=0xa8b3a140, ftLastAccessTime.dwHighDateTime=0x1d5b0a3, ftLastWriteTime.dwLowDateTime=0xa8b3a140, ftLastWriteTime.dwHighDateTime=0x1d5b0a3, nFileSizeHigh=0x0, nFileSizeLow=0xbd58, dwReserved0=0x0, dwReserved1=0x0, cFileName="A _xtsgB1x.docx", cAlternateFileName="A_XTSG~1.DOC")) returned 1 [0102.334] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x672db10, ftCreationTime.dwHighDateTime=0x1d54f0c, ftLastAccessTime.dwLowDateTime=0xe7f6d8a0, ftLastAccessTime.dwHighDateTime=0x1d5981f, ftLastWriteTime.dwLowDateTime=0xe7f6d8a0, ftLastWriteTime.dwHighDateTime=0x1d5981f, nFileSizeHigh=0x0, nFileSizeLow=0x7add, dwReserved0=0x0, dwReserved1=0x0, cFileName="bOmL2WdN13pN8.docx", cAlternateFileName="BOML2W~1.DOC")) returned 1 [0102.334] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f483db0, ftCreationTime.dwHighDateTime=0x1d593a8, ftLastAccessTime.dwLowDateTime=0xddbc5530, ftLastAccessTime.dwHighDateTime=0x1d5b5d0, ftLastWriteTime.dwLowDateTime=0xddbc5530, ftLastWriteTime.dwHighDateTime=0x1d5b5d0, nFileSizeHigh=0x0, nFileSizeLow=0xe117, dwReserved0=0x0, dwReserved1=0x0, cFileName="CG2rkK9xVO9ZxF2nx.pptx", cAlternateFileName="CG2RKK~1.PPT")) returned 1 [0102.334] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x9daec75b, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x55000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb", cAlternateFileName="DATABA~1.ACC")) returned 1 [0102.334] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440c5760, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440c5760, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0102.334] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cf0ab00, ftCreationTime.dwHighDateTime=0x1d598d7, ftLastAccessTime.dwLowDateTime=0x6518f1d0, ftLastAccessTime.dwHighDateTime=0x1d5c712, ftLastWriteTime.dwLowDateTime=0x6518f1d0, ftLastWriteTime.dwHighDateTime=0x1d5c712, nFileSizeHigh=0x0, nFileSizeLow=0xd24c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dh9Bq8pY5WvnuXxq.xlsx", cAlternateFileName="DH9BQ8~1.XLS")) returned 1 [0102.334] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc03febd0, ftCreationTime.dwHighDateTime=0x1d5d31b, ftLastAccessTime.dwLowDateTime=0x6e7a9600, ftLastAccessTime.dwHighDateTime=0x1d5ca11, ftLastWriteTime.dwLowDateTime=0x6e7a9600, ftLastWriteTime.dwHighDateTime=0x1d5ca11, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eXvjMrV71XpFKNFKbtW", cAlternateFileName="EXVJMR~1")) returned 1 [0102.334] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x466b8fe0, ftCreationTime.dwHighDateTime=0x1d5ce1f, ftLastAccessTime.dwLowDateTime=0xe1463c20, ftLastAccessTime.dwHighDateTime=0x1d5cb01, ftLastWriteTime.dwLowDateTime=0xe1463c20, ftLastWriteTime.dwHighDateTime=0x1d5cb01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fFPcv0oTW7 vKBUYV", cAlternateFileName="FFPCV0~1")) returned 1 [0102.335] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcf2f810, ftCreationTime.dwHighDateTime=0x1d59afe, ftLastAccessTime.dwLowDateTime=0x109568d0, ftLastAccessTime.dwHighDateTime=0x1d5d5e2, ftLastWriteTime.dwLowDateTime=0x109568d0, ftLastWriteTime.dwHighDateTime=0x1d5d5e2, nFileSizeHigh=0x0, nFileSizeLow=0x3e66, dwReserved0=0x0, dwReserved1=0x0, cFileName="jiWH0alu BAsHtuDbk.pptx", cAlternateFileName="JIWH0A~1.PPT")) returned 1 [0102.335] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x730a4830, ftCreationTime.dwHighDateTime=0x1d5b163, ftLastAccessTime.dwLowDateTime=0x5e258520, ftLastAccessTime.dwHighDateTime=0x1d569d7, ftLastWriteTime.dwLowDateTime=0x5e258520, ftLastWriteTime.dwHighDateTime=0x1d569d7, nFileSizeHigh=0x0, nFileSizeLow=0xd084, dwReserved0=0x0, dwReserved1=0x0, cFileName="l8vyzvCdPldH.xlsx", cAlternateFileName="L8VYZV~1.XLS")) returned 1 [0102.335] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ccbcc10, ftCreationTime.dwHighDateTime=0x1d58e29, ftLastAccessTime.dwLowDateTime=0xffe8a8e0, ftLastAccessTime.dwHighDateTime=0x1d5630d, ftLastWriteTime.dwLowDateTime=0xffe8a8e0, ftLastWriteTime.dwHighDateTime=0x1d5630d, nFileSizeHigh=0x0, nFileSizeLow=0x2ebf, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAUH-U.pptx", cAlternateFileName="LAUH-U~1.PPT")) returned 1 [0102.335] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ae44020, ftCreationTime.dwHighDateTime=0x1d55567, ftLastAccessTime.dwLowDateTime=0x4b49b40, ftLastAccessTime.dwHighDateTime=0x1d58b4f, ftLastWriteTime.dwLowDateTime=0x4b49b40, ftLastWriteTime.dwHighDateTime=0x1d58b4f, nFileSizeHigh=0x0, nFileSizeLow=0x1896c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MabdW6JFta.pptx", cAlternateFileName="MABDW6~1.PPT")) returned 1 [0102.335] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0102.335] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0102.336] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0102.336] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0102.336] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa985bc10, ftCreationTime.dwHighDateTime=0x1d5d115, ftLastAccessTime.dwLowDateTime=0xa1610ba0, ftLastAccessTime.dwHighDateTime=0x1d5d36f, ftLastWriteTime.dwLowDateTime=0xa1610ba0, ftLastWriteTime.dwHighDateTime=0x1d5d36f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="og53NkPAOf", cAlternateFileName="OG53NK~1")) returned 1 [0102.336] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0102.336] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdf3bff0, ftCreationTime.dwHighDateTime=0x1d5bed1, ftLastAccessTime.dwLowDateTime=0x16ab2da0, ftLastAccessTime.dwHighDateTime=0x1d5cf2e, ftLastWriteTime.dwLowDateTime=0x16ab2da0, ftLastWriteTime.dwHighDateTime=0x1d5cf2e, nFileSizeHigh=0x0, nFileSizeLow=0xf070, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="w3buaTMe7.xlsx", cAlternateFileName="W3BUAT~1.XLS")) returned 1 [0102.336] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x235d9bc0, ftCreationTime.dwHighDateTime=0x1d555b0, ftLastAccessTime.dwLowDateTime=0x7f36cab0, ftLastAccessTime.dwHighDateTime=0x1d5b81c, ftLastWriteTime.dwLowDateTime=0x7f36cab0, ftLastWriteTime.dwHighDateTime=0x1d5b81c, nFileSizeHigh=0x0, nFileSizeLow=0x1057, dwReserved0=0x0, dwReserved1=0x0, cFileName="WmnNFz7FetlMoAUqf.xlsx", cAlternateFileName="WMNNFZ~1.XLS")) returned 1 [0102.337] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x353da810, ftCreationTime.dwHighDateTime=0x1d5b65b, ftLastAccessTime.dwLowDateTime=0x964ceb70, ftLastAccessTime.dwHighDateTime=0x1d5815e, ftLastWriteTime.dwLowDateTime=0x964ceb70, ftLastWriteTime.dwHighDateTime=0x1d5815e, nFileSizeHigh=0x0, nFileSizeLow=0x4a20, dwReserved0=0x0, dwReserved1=0x0, cFileName="xRb3A98tFUu7Nu.pptx", cAlternateFileName="XRB3A9~1.PPT")) returned 1 [0102.337] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa29365c0, ftCreationTime.dwHighDateTime=0x1d5cc4b, ftLastAccessTime.dwLowDateTime=0x38c042c0, ftLastAccessTime.dwHighDateTime=0x1d5c96d, ftLastWriteTime.dwLowDateTime=0x38c042c0, ftLastWriteTime.dwHighDateTime=0x1d5c96d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_D0TfTj_TXFm1W", cAlternateFileName="_D0TFT~1")) returned 1 [0102.337] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa29365c0, ftCreationTime.dwHighDateTime=0x1d5cc4b, ftLastAccessTime.dwLowDateTime=0x38c042c0, ftLastAccessTime.dwHighDateTime=0x1d5c96d, ftLastWriteTime.dwLowDateTime=0x38c042c0, ftLastWriteTime.dwHighDateTime=0x1d5c96d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_D0TfTj_TXFm1W", cAlternateFileName="_D0TFT~1")) returned 0 [0102.337] FindClose (in: hFindFile=0x633768 | out: hFindFile=0x633768) returned 1 [0102.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ead4) returned 1 [0102.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eae0) returned 1 [0102.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb18) returned 1 [0102.337] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0102.337] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x19e840 | out: lpFindFileData=0x19e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3a202261, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3a202261, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6338a8 [0102.338] FindNextFileW (in: hFindFile=0x6338a8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3a202261, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3a202261, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.338] FindNextFileW (in: hFindFile=0x6338a8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x358053b0, ftCreationTime.dwHighDateTime=0x1d5d747, ftLastAccessTime.dwLowDateTime=0x9f51c30, ftLastAccessTime.dwHighDateTime=0x1d5d35f, ftLastWriteTime.dwLowDateTime=0x9f51c30, ftLastWriteTime.dwHighDateTime=0x1d5d35f, nFileSizeHigh=0x0, nFileSizeLow=0x9bf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="12FZPWCsCxOvjgNVW.ppt", cAlternateFileName="12FZPW~1.PPT")) returned 1 [0102.338] FindNextFileW (in: hFindFile=0x6338a8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65b04cc0, ftCreationTime.dwHighDateTime=0x1d5664f, ftLastAccessTime.dwLowDateTime=0x89debc20, ftLastAccessTime.dwHighDateTime=0x1d5733e, ftLastWriteTime.dwLowDateTime=0x89debc20, ftLastWriteTime.dwHighDateTime=0x1d5733e, nFileSizeHigh=0x0, nFileSizeLow=0x12297, dwReserved0=0x0, dwReserved1=0x0, cFileName="5jxmQYGeuPol.xlsx", cAlternateFileName="5JXMQY~1.XLS")) returned 1 [0102.338] FindNextFileW (in: hFindFile=0x6338a8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27628170, ftCreationTime.dwHighDateTime=0x1d574d9, ftLastAccessTime.dwLowDateTime=0x6999cee0, ftLastAccessTime.dwHighDateTime=0x1d5b944, ftLastWriteTime.dwLowDateTime=0x6999cee0, ftLastWriteTime.dwHighDateTime=0x1d5b944, nFileSizeHigh=0x0, nFileSizeLow=0x157da, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hxQ_OAXcQjB.docx", cAlternateFileName="6HXQ_O~1.DOC")) returned 1 [0102.338] FindNextFileW (in: hFindFile=0x6338a8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84fcfa80, ftCreationTime.dwHighDateTime=0x1d5a423, ftLastAccessTime.dwLowDateTime=0xb900c2d0, ftLastAccessTime.dwHighDateTime=0x1d56b9d, ftLastWriteTime.dwLowDateTime=0xb900c2d0, ftLastWriteTime.dwHighDateTime=0x1d56b9d, nFileSizeHigh=0x0, nFileSizeLow=0x1a0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="9Ma4CFdKcEjClGXS0.docx", cAlternateFileName="9MA4CF~1.DOC")) returned 1 [0102.338] FindNextFileW (in: hFindFile=0x6338a8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcea2a560, ftCreationTime.dwHighDateTime=0x1d58a9a, ftLastAccessTime.dwLowDateTime=0x3bb91b60, ftLastAccessTime.dwHighDateTime=0x1d5c8f4, ftLastWriteTime.dwLowDateTime=0x3bb91b60, ftLastWriteTime.dwHighDateTime=0x1d5c8f4, nFileSizeHigh=0x0, nFileSizeLow=0xfc2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="9OQME9S1N.docx", cAlternateFileName="9OQME9~1.DOC")) returned 1 [0102.339] FindNextFileW (in: hFindFile=0x6338a8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbabde590, ftCreationTime.dwHighDateTime=0x1d5c2a4, ftLastAccessTime.dwLowDateTime=0xa8b3a140, ftLastAccessTime.dwHighDateTime=0x1d5b0a3, ftLastWriteTime.dwLowDateTime=0xa8b3a140, ftLastWriteTime.dwHighDateTime=0x1d5b0a3, nFileSizeHigh=0x0, nFileSizeLow=0xbd58, dwReserved0=0x0, dwReserved1=0x0, cFileName="A _xtsgB1x.docx", cAlternateFileName="A_XTSG~1.DOC")) returned 1 [0102.339] FindNextFileW (in: hFindFile=0x6338a8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x672db10, ftCreationTime.dwHighDateTime=0x1d54f0c, ftLastAccessTime.dwLowDateTime=0xe7f6d8a0, ftLastAccessTime.dwHighDateTime=0x1d5981f, ftLastWriteTime.dwLowDateTime=0xe7f6d8a0, ftLastWriteTime.dwHighDateTime=0x1d5981f, nFileSizeHigh=0x0, nFileSizeLow=0x7add, dwReserved0=0x0, dwReserved1=0x0, cFileName="bOmL2WdN13pN8.docx", cAlternateFileName="BOML2W~1.DOC")) returned 1 [0102.339] FindNextFileW (in: hFindFile=0x6338a8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f483db0, ftCreationTime.dwHighDateTime=0x1d593a8, ftLastAccessTime.dwLowDateTime=0xddbc5530, ftLastAccessTime.dwHighDateTime=0x1d5b5d0, ftLastWriteTime.dwLowDateTime=0xddbc5530, ftLastWriteTime.dwHighDateTime=0x1d5b5d0, nFileSizeHigh=0x0, nFileSizeLow=0xe117, dwReserved0=0x0, dwReserved1=0x0, cFileName="CG2rkK9xVO9ZxF2nx.pptx", cAlternateFileName="CG2RKK~1.PPT")) returned 1 [0102.339] FindNextFileW (in: hFindFile=0x6338a8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x9daec75b, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x55000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb", cAlternateFileName="DATABA~1.ACC")) returned 1 [0102.339] FindNextFileW (in: hFindFile=0x6338a8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440c5760, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440c5760, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0102.339] FindNextFileW (in: hFindFile=0x6338a8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cf0ab00, ftCreationTime.dwHighDateTime=0x1d598d7, ftLastAccessTime.dwLowDateTime=0x6518f1d0, ftLastAccessTime.dwHighDateTime=0x1d5c712, ftLastWriteTime.dwLowDateTime=0x6518f1d0, ftLastWriteTime.dwHighDateTime=0x1d5c712, nFileSizeHigh=0x0, nFileSizeLow=0xd24c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dh9Bq8pY5WvnuXxq.xlsx", cAlternateFileName="DH9BQ8~1.XLS")) returned 1 [0102.340] FindNextFileW (in: hFindFile=0x6338a8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc03febd0, ftCreationTime.dwHighDateTime=0x1d5d31b, ftLastAccessTime.dwLowDateTime=0x6e7a9600, ftLastAccessTime.dwHighDateTime=0x1d5ca11, ftLastWriteTime.dwLowDateTime=0x6e7a9600, ftLastWriteTime.dwHighDateTime=0x1d5ca11, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eXvjMrV71XpFKNFKbtW", cAlternateFileName="EXVJMR~1")) returned 1 [0102.340] FindNextFileW (in: hFindFile=0x6338a8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x466b8fe0, ftCreationTime.dwHighDateTime=0x1d5ce1f, ftLastAccessTime.dwLowDateTime=0xe1463c20, ftLastAccessTime.dwHighDateTime=0x1d5cb01, ftLastWriteTime.dwLowDateTime=0xe1463c20, ftLastWriteTime.dwHighDateTime=0x1d5cb01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fFPcv0oTW7 vKBUYV", cAlternateFileName="FFPCV0~1")) returned 1 [0102.340] FindNextFileW (in: hFindFile=0x6338a8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcf2f810, ftCreationTime.dwHighDateTime=0x1d59afe, ftLastAccessTime.dwLowDateTime=0x109568d0, ftLastAccessTime.dwHighDateTime=0x1d5d5e2, ftLastWriteTime.dwLowDateTime=0x109568d0, ftLastWriteTime.dwHighDateTime=0x1d5d5e2, nFileSizeHigh=0x0, nFileSizeLow=0x3e66, dwReserved0=0x0, dwReserved1=0x0, cFileName="jiWH0alu BAsHtuDbk.pptx", cAlternateFileName="JIWH0A~1.PPT")) returned 1 [0102.340] FindNextFileW (in: hFindFile=0x6338a8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x730a4830, ftCreationTime.dwHighDateTime=0x1d5b163, ftLastAccessTime.dwLowDateTime=0x5e258520, ftLastAccessTime.dwHighDateTime=0x1d569d7, ftLastWriteTime.dwLowDateTime=0x5e258520, ftLastWriteTime.dwHighDateTime=0x1d569d7, nFileSizeHigh=0x0, nFileSizeLow=0xd084, dwReserved0=0x0, dwReserved1=0x0, cFileName="l8vyzvCdPldH.xlsx", cAlternateFileName="L8VYZV~1.XLS")) returned 1 [0102.340] FindNextFileW (in: hFindFile=0x6338a8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ccbcc10, ftCreationTime.dwHighDateTime=0x1d58e29, ftLastAccessTime.dwLowDateTime=0xffe8a8e0, ftLastAccessTime.dwHighDateTime=0x1d5630d, ftLastWriteTime.dwLowDateTime=0xffe8a8e0, ftLastWriteTime.dwHighDateTime=0x1d5630d, nFileSizeHigh=0x0, nFileSizeLow=0x2ebf, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAUH-U.pptx", cAlternateFileName="LAUH-U~1.PPT")) returned 1 [0102.340] FindNextFileW (in: hFindFile=0x6338a8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ae44020, ftCreationTime.dwHighDateTime=0x1d55567, ftLastAccessTime.dwLowDateTime=0x4b49b40, ftLastAccessTime.dwHighDateTime=0x1d58b4f, ftLastWriteTime.dwLowDateTime=0x4b49b40, ftLastWriteTime.dwHighDateTime=0x1d58b4f, nFileSizeHigh=0x0, nFileSizeLow=0x1896c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MabdW6JFta.pptx", cAlternateFileName="MABDW6~1.PPT")) returned 1 [0102.340] FindNextFileW (in: hFindFile=0x6338a8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0102.341] FindNextFileW (in: hFindFile=0x6338a8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0102.341] FindNextFileW (in: hFindFile=0x6338a8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0102.341] FindNextFileW (in: hFindFile=0x6338a8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0102.341] FindNextFileW (in: hFindFile=0x6338a8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa985bc10, ftCreationTime.dwHighDateTime=0x1d5d115, ftLastAccessTime.dwLowDateTime=0xa1610ba0, ftLastAccessTime.dwHighDateTime=0x1d5d36f, ftLastWriteTime.dwLowDateTime=0xa1610ba0, ftLastWriteTime.dwHighDateTime=0x1d5d36f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="og53NkPAOf", cAlternateFileName="OG53NK~1")) returned 1 [0102.341] FindNextFileW (in: hFindFile=0x6338a8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0102.341] FindNextFileW (in: hFindFile=0x6338a8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdf3bff0, ftCreationTime.dwHighDateTime=0x1d5bed1, ftLastAccessTime.dwLowDateTime=0x16ab2da0, ftLastAccessTime.dwHighDateTime=0x1d5cf2e, ftLastWriteTime.dwLowDateTime=0x16ab2da0, ftLastWriteTime.dwHighDateTime=0x1d5cf2e, nFileSizeHigh=0x0, nFileSizeLow=0xf070, dwReserved0=0x0, dwReserved1=0x0, cFileName="w3buaTMe7.xlsx", cAlternateFileName="W3BUAT~1.XLS")) returned 1 [0102.341] FindNextFileW (in: hFindFile=0x6338a8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x235d9bc0, ftCreationTime.dwHighDateTime=0x1d555b0, ftLastAccessTime.dwLowDateTime=0x7f36cab0, ftLastAccessTime.dwHighDateTime=0x1d5b81c, ftLastWriteTime.dwLowDateTime=0x7f36cab0, ftLastWriteTime.dwHighDateTime=0x1d5b81c, nFileSizeHigh=0x0, nFileSizeLow=0x1057, dwReserved0=0x0, dwReserved1=0x0, cFileName="WmnNFz7FetlMoAUqf.xlsx", cAlternateFileName="WMNNFZ~1.XLS")) returned 1 [0102.342] FindNextFileW (in: hFindFile=0x6338a8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x353da810, ftCreationTime.dwHighDateTime=0x1d5b65b, ftLastAccessTime.dwLowDateTime=0x964ceb70, ftLastAccessTime.dwHighDateTime=0x1d5815e, ftLastWriteTime.dwLowDateTime=0x964ceb70, ftLastWriteTime.dwHighDateTime=0x1d5815e, nFileSizeHigh=0x0, nFileSizeLow=0x4a20, dwReserved0=0x0, dwReserved1=0x0, cFileName="xRb3A98tFUu7Nu.pptx", cAlternateFileName="XRB3A9~1.PPT")) returned 1 [0102.342] FindNextFileW (in: hFindFile=0x6338a8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa29365c0, ftCreationTime.dwHighDateTime=0x1d5cc4b, ftLastAccessTime.dwLowDateTime=0x38c042c0, ftLastAccessTime.dwHighDateTime=0x1d5c96d, ftLastWriteTime.dwLowDateTime=0x38c042c0, ftLastWriteTime.dwHighDateTime=0x1d5c96d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_D0TfTj_TXFm1W", cAlternateFileName="_D0TFT~1")) returned 1 [0102.342] FindNextFileW (in: hFindFile=0x6338a8, lpFindFileData=0x19e84c | out: lpFindFileData=0x19e84c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0102.342] FindClose (in: hFindFile=0x6338a8 | out: hFindFile=0x6338a8) returned 1 [0102.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ead4) returned 1 [0102.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eae0) returned 1 [0102.342] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\12FZPWCsCxOvjgNVW.ppt", nBufferLength=0x105, lpBuffer=0x19e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\12FZPWCsCxOvjgNVW.ppt", lpFilePart=0x0) returned 0x2f [0102.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea04) returned 1 [0102.342] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\12FZPWCsCxOvjgNVW.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\12fzpwcscxovjgnvw.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0102.342] GetFileType (hFile=0x430) returned 0x1 [0102.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea00) returned 1 [0102.343] GetFileType (hFile=0x430) returned 0x1 [0102.343] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eb00 | out: lpFileSizeHigh=0x19eb00*=0x0) returned 0x9bf3 [0102.343] ReadFile (in: hFile=0x430, lpBuffer=0x24f9708, nNumberOfBytesToRead=0x9bf3, lpNumberOfBytesRead=0x19eaac, lpOverlapped=0x0 | out: lpBuffer=0x24f9708*, lpNumberOfBytesRead=0x19eaac*=0x9bf3, lpOverlapped=0x0) returned 1 [0102.343] CloseHandle (hObject=0x430) returned 1 [0102.423] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\12FZPWCsCxOvjgNVW.ppt", nBufferLength=0x105, lpBuffer=0x19e4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\12FZPWCsCxOvjgNVW.ppt", lpFilePart=0x0) returned 0x2f [0102.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9ec) returned 1 [0102.423] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\12FZPWCsCxOvjgNVW.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\12fzpwcscxovjgnvw.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0102.424] GetFileType (hFile=0x430) returned 0x1 [0102.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e8) returned 1 [0102.424] GetFileType (hFile=0x430) returned 0x1 [0102.424] WriteFile (in: hFile=0x430, lpBuffer=0x25770f4*, nNumberOfBytesToWrite=0x9c00, lpNumberOfBytesWritten=0x19ea9c, lpOverlapped=0x0 | out: lpBuffer=0x25770f4*, lpNumberOfBytesWritten=0x19ea9c*=0x9c00, lpOverlapped=0x0) returned 1 [0102.426] CloseHandle (hObject=0x430) returned 1 [0102.427] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\12FZPWCsCxOvjgNVW.ppt", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\12FZPWCsCxOvjgNVW.ppt", lpFilePart=0x0) returned 0x2f [0102.427] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\12FZPWCsCxOvjgNVW.ppt.lasan", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\12FZPWCsCxOvjgNVW.ppt.lasan", lpFilePart=0x0) returned 0x35 [0102.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0102.428] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\12FZPWCsCxOvjgNVW.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\12fzpwcscxovjgnvw.ppt"), fInfoLevelId=0x0, lpFileInformation=0x19eafc | out: lpFileInformation=0x19eafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x358053b0, ftCreationTime.dwHighDateTime=0x1d5d747, ftLastAccessTime.dwLowDateTime=0x9f51c30, ftLastAccessTime.dwHighDateTime=0x1d5d35f, ftLastWriteTime.dwLowDateTime=0xc2a7fab5, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x9c00)) returned 1 [0102.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea7c) returned 1 [0102.428] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\12FZPWCsCxOvjgNVW.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\12fzpwcscxovjgnvw.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\12FZPWCsCxOvjgNVW.ppt.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\12fzpwcscxovjgnvw.ppt.lasan")) returned 1 [0102.428] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\5jxmQYGeuPol.xlsx", nBufferLength=0x105, lpBuffer=0x19e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\5jxmQYGeuPol.xlsx", lpFilePart=0x0) returned 0x2b [0102.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea04) returned 1 [0102.428] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\5jxmQYGeuPol.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\5jxmqygeupol.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0102.428] GetFileType (hFile=0x430) returned 0x1 [0102.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea00) returned 1 [0102.429] GetFileType (hFile=0x430) returned 0x1 [0102.429] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eb00 | out: lpFileSizeHigh=0x19eb00*=0x0) returned 0x12297 [0102.429] ReadFile (in: hFile=0x430, lpBuffer=0x2581080, nNumberOfBytesToRead=0x12297, lpNumberOfBytesRead=0x19eaac, lpOverlapped=0x0 | out: lpBuffer=0x2581080*, lpNumberOfBytesRead=0x19eaac*=0x12297, lpOverlapped=0x0) returned 1 [0102.429] CloseHandle (hObject=0x430) returned 1 [0102.530] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\5jxmQYGeuPol.xlsx", nBufferLength=0x105, lpBuffer=0x19e4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\5jxmQYGeuPol.xlsx", lpFilePart=0x0) returned 0x2b [0102.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9ec) returned 1 [0102.530] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\5jxmQYGeuPol.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\5jxmqygeupol.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0102.531] GetFileType (hFile=0x430) returned 0x1 [0102.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e8) returned 1 [0102.531] GetFileType (hFile=0x430) returned 0x1 [0102.531] WriteFile (in: hFile=0x430, lpBuffer=0x2416b8c*, nNumberOfBytesToWrite=0x122a0, lpNumberOfBytesWritten=0x19ea9c, lpOverlapped=0x0 | out: lpBuffer=0x2416b8c*, lpNumberOfBytesWritten=0x19ea9c*=0x122a0, lpOverlapped=0x0) returned 1 [0102.533] CloseHandle (hObject=0x430) returned 1 [0102.536] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\5jxmQYGeuPol.xlsx", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\5jxmQYGeuPol.xlsx", lpFilePart=0x0) returned 0x2b [0102.536] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\5jxmQYGeuPol.xlsx.lasan", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\5jxmQYGeuPol.xlsx.lasan", lpFilePart=0x0) returned 0x31 [0102.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0102.536] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\5jxmQYGeuPol.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\5jxmqygeupol.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19eafc | out: lpFileInformation=0x19eafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65b04cc0, ftCreationTime.dwHighDateTime=0x1d5664f, ftLastAccessTime.dwLowDateTime=0x89debc20, ftLastAccessTime.dwHighDateTime=0x1d5733e, ftLastWriteTime.dwLowDateTime=0xc2b8ab5d, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x122a0)) returned 1 [0102.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea7c) returned 1 [0102.536] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\5jxmQYGeuPol.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\5jxmqygeupol.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\5jxmQYGeuPol.xlsx.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\5jxmqygeupol.xlsx.lasan")) returned 1 [0102.537] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\6hxQ_OAXcQjB.docx", nBufferLength=0x105, lpBuffer=0x19e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\6hxQ_OAXcQjB.docx", lpFilePart=0x0) returned 0x2b [0102.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea04) returned 1 [0102.537] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\6hxQ_OAXcQjB.docx" (normalized: "c:\\users\\fd1hvy\\documents\\6hxq_oaxcqjb.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0102.537] GetFileType (hFile=0x430) returned 0x1 [0102.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea00) returned 1 [0102.537] GetFileType (hFile=0x430) returned 0x1 [0102.537] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eb00 | out: lpFileSizeHigh=0x19eb00*=0x0) returned 0x157da [0102.538] ReadFile (in: hFile=0x430, lpBuffer=0x35e1ce8, nNumberOfBytesToRead=0x157da, lpNumberOfBytesRead=0x19eaac, lpOverlapped=0x0 | out: lpBuffer=0x35e1ce8*, lpNumberOfBytesRead=0x19eaac*=0x157da, lpOverlapped=0x0) returned 1 [0102.539] CloseHandle (hObject=0x430) returned 1 [0102.643] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\6hxQ_OAXcQjB.docx", nBufferLength=0x105, lpBuffer=0x19e4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\6hxQ_OAXcQjB.docx", lpFilePart=0x0) returned 0x2b [0102.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9ec) returned 1 [0102.643] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\6hxQ_OAXcQjB.docx" (normalized: "c:\\users\\fd1hvy\\documents\\6hxq_oaxcqjb.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0102.644] GetFileType (hFile=0x430) returned 0x1 [0102.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e8) returned 1 [0102.645] GetFileType (hFile=0x430) returned 0x1 [0102.645] WriteFile (in: hFile=0x430, lpBuffer=0x364d480*, nNumberOfBytesToWrite=0x157e0, lpNumberOfBytesWritten=0x19ea9c, lpOverlapped=0x0 | out: lpBuffer=0x364d480*, lpNumberOfBytesWritten=0x19ea9c*=0x157e0, lpOverlapped=0x0) returned 1 [0102.647] CloseHandle (hObject=0x430) returned 1 [0102.649] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\6hxQ_OAXcQjB.docx", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\6hxQ_OAXcQjB.docx", lpFilePart=0x0) returned 0x2b [0102.649] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\6hxQ_OAXcQjB.docx.lasan", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\6hxQ_OAXcQjB.docx.lasan", lpFilePart=0x0) returned 0x31 [0102.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0102.649] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\6hxQ_OAXcQjB.docx" (normalized: "c:\\users\\fd1hvy\\documents\\6hxq_oaxcqjb.docx"), fInfoLevelId=0x0, lpFileInformation=0x19eafc | out: lpFileInformation=0x19eafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27628170, ftCreationTime.dwHighDateTime=0x1d574d9, ftLastAccessTime.dwLowDateTime=0x6999cee0, ftLastAccessTime.dwHighDateTime=0x1d5b944, ftLastWriteTime.dwLowDateTime=0xc2c95bff, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x157e0)) returned 1 [0102.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea7c) returned 1 [0102.650] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\6hxQ_OAXcQjB.docx" (normalized: "c:\\users\\fd1hvy\\documents\\6hxq_oaxcqjb.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\6hxQ_OAXcQjB.docx.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\6hxq_oaxcqjb.docx.lasan")) returned 1 [0102.650] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9Ma4CFdKcEjClGXS0.docx", nBufferLength=0x105, lpBuffer=0x19e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9Ma4CFdKcEjClGXS0.docx", lpFilePart=0x0) returned 0x30 [0102.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea04) returned 1 [0102.650] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\9Ma4CFdKcEjClGXS0.docx" (normalized: "c:\\users\\fd1hvy\\documents\\9ma4cfdkcejclgxs0.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0102.650] GetFileType (hFile=0x430) returned 0x1 [0102.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea00) returned 1 [0102.650] GetFileType (hFile=0x430) returned 0x1 [0102.650] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eb00 | out: lpFileSizeHigh=0x19eb00*=0x0) returned 0x1a0d [0102.651] ReadFile (in: hFile=0x430, lpBuffer=0x247645c, nNumberOfBytesToRead=0x1a0d, lpNumberOfBytesRead=0x19eaac, lpOverlapped=0x0 | out: lpBuffer=0x247645c*, lpNumberOfBytesRead=0x19eaac*=0x1a0d, lpOverlapped=0x0) returned 1 [0102.651] CloseHandle (hObject=0x430) returned 1 [0102.701] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9Ma4CFdKcEjClGXS0.docx", nBufferLength=0x105, lpBuffer=0x19e4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9Ma4CFdKcEjClGXS0.docx", lpFilePart=0x0) returned 0x30 [0102.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9ec) returned 1 [0102.701] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\9Ma4CFdKcEjClGXS0.docx" (normalized: "c:\\users\\fd1hvy\\documents\\9ma4cfdkcejclgxs0.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0102.702] GetFileType (hFile=0x430) returned 0x1 [0102.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e8) returned 1 [0102.702] GetFileType (hFile=0x430) returned 0x1 [0102.702] WriteFile (in: hFile=0x430, lpBuffer=0x24cb498*, nNumberOfBytesToWrite=0x1a10, lpNumberOfBytesWritten=0x19ea9c, lpOverlapped=0x0 | out: lpBuffer=0x24cb498*, lpNumberOfBytesWritten=0x19ea9c*=0x1a10, lpOverlapped=0x0) returned 1 [0102.703] CloseHandle (hObject=0x430) returned 1 [0102.704] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9Ma4CFdKcEjClGXS0.docx", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9Ma4CFdKcEjClGXS0.docx", lpFilePart=0x0) returned 0x30 [0102.704] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9Ma4CFdKcEjClGXS0.docx.lasan", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9Ma4CFdKcEjClGXS0.docx.lasan", lpFilePart=0x0) returned 0x36 [0102.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0102.704] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9Ma4CFdKcEjClGXS0.docx" (normalized: "c:\\users\\fd1hvy\\documents\\9ma4cfdkcejclgxs0.docx"), fInfoLevelId=0x0, lpFileInformation=0x19eafc | out: lpFileInformation=0x19eafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84fcfa80, ftCreationTime.dwHighDateTime=0x1d5a423, ftLastAccessTime.dwLowDateTime=0xb900c2d0, ftLastAccessTime.dwHighDateTime=0x1d56b9d, ftLastWriteTime.dwLowDateTime=0xc2d2e541, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x1a10)) returned 1 [0102.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea7c) returned 1 [0102.704] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\9Ma4CFdKcEjClGXS0.docx" (normalized: "c:\\users\\fd1hvy\\documents\\9ma4cfdkcejclgxs0.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\9Ma4CFdKcEjClGXS0.docx.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\9ma4cfdkcejclgxs0.docx.lasan")) returned 1 [0102.705] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9OQME9S1N.docx", nBufferLength=0x105, lpBuffer=0x19e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9OQME9S1N.docx", lpFilePart=0x0) returned 0x28 [0102.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea04) returned 1 [0102.705] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\9OQME9S1N.docx" (normalized: "c:\\users\\fd1hvy\\documents\\9oqme9s1n.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0102.705] GetFileType (hFile=0x430) returned 0x1 [0102.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea00) returned 1 [0102.705] GetFileType (hFile=0x430) returned 0x1 [0102.705] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eb00 | out: lpFileSizeHigh=0x19eb00*=0x0) returned 0xfc2d [0102.706] ReadFile (in: hFile=0x430, lpBuffer=0x24cd240, nNumberOfBytesToRead=0xfc2d, lpNumberOfBytesRead=0x19eaac, lpOverlapped=0x0 | out: lpBuffer=0x24cd240*, lpNumberOfBytesRead=0x19eaac*=0xfc2d, lpOverlapped=0x0) returned 1 [0102.706] CloseHandle (hObject=0x430) returned 1 [0102.724] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9OQME9S1N.docx", nBufferLength=0x105, lpBuffer=0x19e4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9OQME9S1N.docx", lpFilePart=0x0) returned 0x28 [0102.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9ec) returned 1 [0102.724] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\9OQME9S1N.docx" (normalized: "c:\\users\\fd1hvy\\documents\\9oqme9s1n.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0102.725] GetFileType (hFile=0x430) returned 0x1 [0102.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e8) returned 1 [0102.726] GetFileType (hFile=0x430) returned 0x1 [0102.726] WriteFile (in: hFile=0x430, lpBuffer=0x25494d0*, nNumberOfBytesToWrite=0xfc30, lpNumberOfBytesWritten=0x19ea9c, lpOverlapped=0x0 | out: lpBuffer=0x25494d0*, lpNumberOfBytesWritten=0x19ea9c*=0xfc30, lpOverlapped=0x0) returned 1 [0102.727] CloseHandle (hObject=0x430) returned 1 [0102.729] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9OQME9S1N.docx", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9OQME9S1N.docx", lpFilePart=0x0) returned 0x28 [0102.729] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9OQME9S1N.docx.lasan", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9OQME9S1N.docx.lasan", lpFilePart=0x0) returned 0x2e [0102.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0102.729] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9OQME9S1N.docx" (normalized: "c:\\users\\fd1hvy\\documents\\9oqme9s1n.docx"), fInfoLevelId=0x0, lpFileInformation=0x19eafc | out: lpFileInformation=0x19eafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcea2a560, ftCreationTime.dwHighDateTime=0x1d58a9a, ftLastAccessTime.dwLowDateTime=0x3bb91b60, ftLastAccessTime.dwHighDateTime=0x1d5c8f4, ftLastWriteTime.dwLowDateTime=0xc2d547e3, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0xfc30)) returned 1 [0102.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea7c) returned 1 [0102.730] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\9OQME9S1N.docx" (normalized: "c:\\users\\fd1hvy\\documents\\9oqme9s1n.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\9OQME9S1N.docx.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\9oqme9s1n.docx.lasan")) returned 1 [0102.730] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\A _xtsgB1x.docx", nBufferLength=0x105, lpBuffer=0x19e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\A _xtsgB1x.docx", lpFilePart=0x0) returned 0x29 [0102.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea04) returned 1 [0102.730] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\A _xtsgB1x.docx" (normalized: "c:\\users\\fd1hvy\\documents\\a _xtsgb1x.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0102.730] GetFileType (hFile=0x430) returned 0x1 [0102.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea00) returned 1 [0102.730] GetFileType (hFile=0x430) returned 0x1 [0102.730] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eb00 | out: lpFileSizeHigh=0x19eb00*=0x0) returned 0xbd58 [0102.731] ReadFile (in: hFile=0x430, lpBuffer=0x2559448, nNumberOfBytesToRead=0xbd58, lpNumberOfBytesRead=0x19eaac, lpOverlapped=0x0 | out: lpBuffer=0x2559448*, lpNumberOfBytesRead=0x19eaac*=0xbd58, lpOverlapped=0x0) returned 1 [0102.731] CloseHandle (hObject=0x430) returned 1 [0102.791] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\A _xtsgB1x.docx", nBufferLength=0x105, lpBuffer=0x19e4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\A _xtsgB1x.docx", lpFilePart=0x0) returned 0x29 [0102.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9ec) returned 1 [0102.791] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\A _xtsgB1x.docx" (normalized: "c:\\users\\fd1hvy\\documents\\a _xtsgb1x.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0102.793] GetFileType (hFile=0x430) returned 0x1 [0102.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e8) returned 1 [0102.793] GetFileType (hFile=0x430) returned 0x1 [0102.793] WriteFile (in: hFile=0x430, lpBuffer=0x25c9a64*, nNumberOfBytesToWrite=0xbd60, lpNumberOfBytesWritten=0x19ea9c, lpOverlapped=0x0 | out: lpBuffer=0x25c9a64*, lpNumberOfBytesWritten=0x19ea9c*=0xbd60, lpOverlapped=0x0) returned 1 [0102.794] CloseHandle (hObject=0x430) returned 1 [0102.796] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\A _xtsgB1x.docx", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\A _xtsgB1x.docx", lpFilePart=0x0) returned 0x29 [0102.796] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\A _xtsgB1x.docx.lasan", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\A _xtsgB1x.docx.lasan", lpFilePart=0x0) returned 0x2f [0102.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0102.796] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\A _xtsgB1x.docx" (normalized: "c:\\users\\fd1hvy\\documents\\a _xtsgb1x.docx"), fInfoLevelId=0x0, lpFileInformation=0x19eafc | out: lpFileInformation=0x19eafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbabde590, ftCreationTime.dwHighDateTime=0x1d5c2a4, ftLastAccessTime.dwLowDateTime=0xa8b3a140, ftLastAccessTime.dwHighDateTime=0x1d5b0a3, ftLastWriteTime.dwLowDateTime=0xc2ded10b, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0xbd60)) returned 1 [0102.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea7c) returned 1 [0102.796] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\A _xtsgB1x.docx" (normalized: "c:\\users\\fd1hvy\\documents\\a _xtsgb1x.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\A _xtsgB1x.docx.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\a _xtsgb1x.docx.lasan")) returned 1 [0102.798] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\bOmL2WdN13pN8.docx", nBufferLength=0x105, lpBuffer=0x19e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\bOmL2WdN13pN8.docx", lpFilePart=0x0) returned 0x2c [0102.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea04) returned 1 [0102.798] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\bOmL2WdN13pN8.docx" (normalized: "c:\\users\\fd1hvy\\documents\\boml2wdn13pn8.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0102.798] GetFileType (hFile=0x430) returned 0x1 [0102.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea00) returned 1 [0102.798] GetFileType (hFile=0x430) returned 0x1 [0102.798] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eb00 | out: lpFileSizeHigh=0x19eb00*=0x0) returned 0x7add [0102.798] ReadFile (in: hFile=0x430, lpBuffer=0x25d5b1c, nNumberOfBytesToRead=0x7add, lpNumberOfBytesRead=0x19eaac, lpOverlapped=0x0 | out: lpBuffer=0x25d5b1c*, lpNumberOfBytesRead=0x19eaac*=0x7add, lpOverlapped=0x0) returned 1 [0102.799] CloseHandle (hObject=0x430) returned 1 [0103.040] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\bOmL2WdN13pN8.docx", nBufferLength=0x105, lpBuffer=0x19e4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\bOmL2WdN13pN8.docx", lpFilePart=0x0) returned 0x2c [0103.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9ec) returned 1 [0103.040] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\bOmL2WdN13pN8.docx" (normalized: "c:\\users\\fd1hvy\\documents\\boml2wdn13pn8.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0103.043] GetFileType (hFile=0x430) returned 0x1 [0103.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e8) returned 1 [0103.043] GetFileType (hFile=0x430) returned 0x1 [0103.043] WriteFile (in: hFile=0x430, lpBuffer=0x243e7b8*, nNumberOfBytesToWrite=0x7ae0, lpNumberOfBytesWritten=0x19ea9c, lpOverlapped=0x0 | out: lpBuffer=0x243e7b8*, lpNumberOfBytesWritten=0x19ea9c*=0x7ae0, lpOverlapped=0x0) returned 1 [0103.044] CloseHandle (hObject=0x430) returned 1 [0103.046] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\bOmL2WdN13pN8.docx", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\bOmL2WdN13pN8.docx", lpFilePart=0x0) returned 0x2c [0103.046] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\bOmL2WdN13pN8.docx.lasan", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\bOmL2WdN13pN8.docx.lasan", lpFilePart=0x0) returned 0x32 [0103.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0103.046] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\bOmL2WdN13pN8.docx" (normalized: "c:\\users\\fd1hvy\\documents\\boml2wdn13pn8.docx"), fInfoLevelId=0x0, lpFileInformation=0x19eafc | out: lpFileInformation=0x19eafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x672db10, ftCreationTime.dwHighDateTime=0x1d54f0c, ftLastAccessTime.dwLowDateTime=0xe7f6d8a0, ftLastAccessTime.dwHighDateTime=0x1d5981f, ftLastWriteTime.dwLowDateTime=0xc304f748, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x7ae0)) returned 1 [0103.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea7c) returned 1 [0103.046] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\bOmL2WdN13pN8.docx" (normalized: "c:\\users\\fd1hvy\\documents\\boml2wdn13pn8.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\bOmL2WdN13pN8.docx.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\boml2wdn13pn8.docx.lasan")) returned 1 [0103.080] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\CG2rkK9xVO9ZxF2nx.pptx", nBufferLength=0x105, lpBuffer=0x19e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\CG2rkK9xVO9ZxF2nx.pptx", lpFilePart=0x0) returned 0x30 [0103.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea04) returned 1 [0103.080] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\CG2rkK9xVO9ZxF2nx.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\cg2rkk9xvo9zxf2nx.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0103.080] GetFileType (hFile=0x430) returned 0x1 [0103.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea00) returned 1 [0103.080] GetFileType (hFile=0x430) returned 0x1 [0103.080] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eb00 | out: lpFileSizeHigh=0x19eb00*=0x0) returned 0xe117 [0103.080] ReadFile (in: hFile=0x430, lpBuffer=0x2446628, nNumberOfBytesToRead=0xe117, lpNumberOfBytesRead=0x19eaac, lpOverlapped=0x0 | out: lpBuffer=0x2446628*, lpNumberOfBytesRead=0x19eaac*=0xe117, lpOverlapped=0x0) returned 1 [0103.081] CloseHandle (hObject=0x430) returned 1 [0103.109] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\CG2rkK9xVO9ZxF2nx.pptx", nBufferLength=0x105, lpBuffer=0x19e4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\CG2rkK9xVO9ZxF2nx.pptx", lpFilePart=0x0) returned 0x30 [0103.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9ec) returned 1 [0103.109] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\CG2rkK9xVO9ZxF2nx.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\cg2rkk9xvo9zxf2nx.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0103.111] GetFileType (hFile=0x430) returned 0x1 [0103.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e8) returned 1 [0103.111] GetFileType (hFile=0x430) returned 0x1 [0103.111] WriteFile (in: hFile=0x430, lpBuffer=0x24bd8e4*, nNumberOfBytesToWrite=0xe120, lpNumberOfBytesWritten=0x19ea9c, lpOverlapped=0x0 | out: lpBuffer=0x24bd8e4*, lpNumberOfBytesWritten=0x19ea9c*=0xe120, lpOverlapped=0x0) returned 1 [0103.112] CloseHandle (hObject=0x430) returned 1 [0103.114] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\CG2rkK9xVO9ZxF2nx.pptx", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\CG2rkK9xVO9ZxF2nx.pptx", lpFilePart=0x0) returned 0x30 [0103.114] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\CG2rkK9xVO9ZxF2nx.pptx.lasan", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\CG2rkK9xVO9ZxF2nx.pptx.lasan", lpFilePart=0x0) returned 0x36 [0103.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0103.114] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\CG2rkK9xVO9ZxF2nx.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\cg2rkk9xvo9zxf2nx.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19eafc | out: lpFileInformation=0x19eafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f483db0, ftCreationTime.dwHighDateTime=0x1d593a8, ftLastAccessTime.dwLowDateTime=0xddbc5530, ftLastAccessTime.dwHighDateTime=0x1d5b5d0, ftLastWriteTime.dwLowDateTime=0xc310e233, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0xe120)) returned 1 [0103.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea7c) returned 1 [0103.115] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\CG2rkK9xVO9ZxF2nx.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\cg2rkk9xvo9zxf2nx.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\CG2rkK9xVO9ZxF2nx.pptx.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\cg2rkk9xvo9zxf2nx.pptx.lasan")) returned 1 [0103.115] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Dh9Bq8pY5WvnuXxq.xlsx", nBufferLength=0x105, lpBuffer=0x19e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Dh9Bq8pY5WvnuXxq.xlsx", lpFilePart=0x0) returned 0x2f [0103.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea04) returned 1 [0103.115] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Dh9Bq8pY5WvnuXxq.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\dh9bq8py5wvnuxxq.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0103.116] GetFileType (hFile=0x430) returned 0x1 [0103.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea00) returned 1 [0103.116] GetFileType (hFile=0x430) returned 0x1 [0103.116] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eb00 | out: lpFileSizeHigh=0x19eb00*=0x0) returned 0xd24c [0103.116] ReadFile (in: hFile=0x430, lpBuffer=0x24cbde8, nNumberOfBytesToRead=0xd24c, lpNumberOfBytesRead=0x19eaac, lpOverlapped=0x0 | out: lpBuffer=0x24cbde8*, lpNumberOfBytesRead=0x19eaac*=0xd24c, lpOverlapped=0x0) returned 1 [0103.116] CloseHandle (hObject=0x430) returned 1 [0103.177] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Dh9Bq8pY5WvnuXxq.xlsx", nBufferLength=0x105, lpBuffer=0x19e4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Dh9Bq8pY5WvnuXxq.xlsx", lpFilePart=0x0) returned 0x2f [0103.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9ec) returned 1 [0103.177] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Dh9Bq8pY5WvnuXxq.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\dh9bq8py5wvnuxxq.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0103.178] GetFileType (hFile=0x430) returned 0x1 [0103.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e8) returned 1 [0103.178] GetFileType (hFile=0x430) returned 0x1 [0103.178] WriteFile (in: hFile=0x430, lpBuffer=0x25402d4*, nNumberOfBytesToWrite=0xd250, lpNumberOfBytesWritten=0x19ea9c, lpOverlapped=0x0 | out: lpBuffer=0x25402d4*, lpNumberOfBytesWritten=0x19ea9c*=0xd250, lpOverlapped=0x0) returned 1 [0103.180] CloseHandle (hObject=0x430) returned 1 [0103.182] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Dh9Bq8pY5WvnuXxq.xlsx", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Dh9Bq8pY5WvnuXxq.xlsx", lpFilePart=0x0) returned 0x2f [0103.182] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Dh9Bq8pY5WvnuXxq.xlsx.lasan", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Dh9Bq8pY5WvnuXxq.xlsx.lasan", lpFilePart=0x0) returned 0x35 [0103.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0103.182] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Dh9Bq8pY5WvnuXxq.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\dh9bq8py5wvnuxxq.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19eafc | out: lpFileInformation=0x19eafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cf0ab00, ftCreationTime.dwHighDateTime=0x1d598d7, ftLastAccessTime.dwLowDateTime=0x6518f1d0, ftLastAccessTime.dwHighDateTime=0x1d5c712, ftLastWriteTime.dwLowDateTime=0xc31a6b9e, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0xd250)) returned 1 [0103.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea7c) returned 1 [0103.182] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Dh9Bq8pY5WvnuXxq.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\dh9bq8py5wvnuxxq.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Dh9Bq8pY5WvnuXxq.xlsx.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\dh9bq8py5wvnuxxq.xlsx.lasan")) returned 1 [0103.183] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\jiWH0alu BAsHtuDbk.pptx", nBufferLength=0x105, lpBuffer=0x19e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\jiWH0alu BAsHtuDbk.pptx", lpFilePart=0x0) returned 0x31 [0103.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea04) returned 1 [0103.183] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jiWH0alu BAsHtuDbk.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\jiwh0alu bashtudbk.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0103.183] GetFileType (hFile=0x430) returned 0x1 [0103.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea00) returned 1 [0103.183] GetFileType (hFile=0x430) returned 0x1 [0103.183] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eb00 | out: lpFileSizeHigh=0x19eb00*=0x0) returned 0x3e66 [0103.183] ReadFile (in: hFile=0x430, lpBuffer=0x254d8c8, nNumberOfBytesToRead=0x3e66, lpNumberOfBytesRead=0x19eaac, lpOverlapped=0x0 | out: lpBuffer=0x254d8c8*, lpNumberOfBytesRead=0x19eaac*=0x3e66, lpOverlapped=0x0) returned 1 [0103.183] CloseHandle (hObject=0x430) returned 1 [0103.199] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\jiWH0alu BAsHtuDbk.pptx", nBufferLength=0x105, lpBuffer=0x19e4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\jiWH0alu BAsHtuDbk.pptx", lpFilePart=0x0) returned 0x31 [0103.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9ec) returned 1 [0103.199] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jiWH0alu BAsHtuDbk.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\jiwh0alu bashtudbk.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0103.200] GetFileType (hFile=0x430) returned 0x1 [0103.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e8) returned 1 [0103.200] GetFileType (hFile=0x430) returned 0x1 [0103.200] WriteFile (in: hFile=0x430, lpBuffer=0x25adee4*, nNumberOfBytesToWrite=0x3e70, lpNumberOfBytesWritten=0x19ea9c, lpOverlapped=0x0 | out: lpBuffer=0x25adee4*, lpNumberOfBytesWritten=0x19ea9c*=0x3e70, lpOverlapped=0x0) returned 1 [0103.202] CloseHandle (hObject=0x430) returned 1 [0103.256] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\jiWH0alu BAsHtuDbk.pptx", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\jiWH0alu BAsHtuDbk.pptx", lpFilePart=0x0) returned 0x31 [0103.256] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\jiWH0alu BAsHtuDbk.pptx.lasan", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\jiWH0alu BAsHtuDbk.pptx.lasan", lpFilePart=0x0) returned 0x37 [0103.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0103.256] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\jiWH0alu BAsHtuDbk.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\jiwh0alu bashtudbk.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19eafc | out: lpFileInformation=0x19eafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcf2f810, ftCreationTime.dwHighDateTime=0x1d59afe, ftLastAccessTime.dwLowDateTime=0x109568d0, ftLastAccessTime.dwHighDateTime=0x1d5d5e2, ftLastWriteTime.dwLowDateTime=0xc3265905, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x3e70)) returned 1 [0103.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea7c) returned 1 [0103.256] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\jiWH0alu BAsHtuDbk.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\jiwh0alu bashtudbk.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\jiWH0alu BAsHtuDbk.pptx.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\jiwh0alu bashtudbk.pptx.lasan")) returned 1 [0103.257] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\l8vyzvCdPldH.xlsx", nBufferLength=0x105, lpBuffer=0x19e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\l8vyzvCdPldH.xlsx", lpFilePart=0x0) returned 0x2b [0103.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea04) returned 1 [0103.257] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\l8vyzvCdPldH.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\l8vyzvcdpldh.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0103.257] GetFileType (hFile=0x430) returned 0x1 [0103.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea00) returned 1 [0103.257] GetFileType (hFile=0x430) returned 0x1 [0103.257] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eb00 | out: lpFileSizeHigh=0x19eb00*=0x0) returned 0xd084 [0103.257] ReadFile (in: hFile=0x430, lpBuffer=0x25b20f4, nNumberOfBytesToRead=0xd084, lpNumberOfBytesRead=0x19eaac, lpOverlapped=0x0 | out: lpBuffer=0x25b20f4*, lpNumberOfBytesRead=0x19eaac*=0xd084, lpOverlapped=0x0) returned 1 [0103.258] CloseHandle (hObject=0x430) returned 1 [0103.358] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\l8vyzvCdPldH.xlsx", nBufferLength=0x105, lpBuffer=0x19e4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\l8vyzvCdPldH.xlsx", lpFilePart=0x0) returned 0x2b [0103.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9ec) returned 1 [0103.359] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\l8vyzvCdPldH.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\l8vyzvcdpldh.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0103.361] GetFileType (hFile=0x430) returned 0x1 [0103.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e8) returned 1 [0103.361] GetFileType (hFile=0x430) returned 0x1 [0103.361] WriteFile (in: hFile=0x430, lpBuffer=0x2406f30*, nNumberOfBytesToWrite=0xd090, lpNumberOfBytesWritten=0x19ea9c, lpOverlapped=0x0 | out: lpBuffer=0x2406f30*, lpNumberOfBytesWritten=0x19ea9c*=0xd090, lpOverlapped=0x0) returned 1 [0103.362] CloseHandle (hObject=0x430) returned 1 [0103.364] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\l8vyzvCdPldH.xlsx", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\l8vyzvCdPldH.xlsx", lpFilePart=0x0) returned 0x2b [0103.364] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\l8vyzvCdPldH.xlsx.lasan", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\l8vyzvCdPldH.xlsx.lasan", lpFilePart=0x0) returned 0x31 [0103.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0103.364] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\l8vyzvCdPldH.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\l8vyzvcdpldh.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19eafc | out: lpFileInformation=0x19eafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x730a4830, ftCreationTime.dwHighDateTime=0x1d5b163, ftLastAccessTime.dwLowDateTime=0x5e258520, ftLastAccessTime.dwHighDateTime=0x1d569d7, ftLastWriteTime.dwLowDateTime=0xc33707a6, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0xd090)) returned 1 [0103.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea7c) returned 1 [0103.365] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\l8vyzvCdPldH.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\l8vyzvcdpldh.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\l8vyzvCdPldH.xlsx.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\l8vyzvcdpldh.xlsx.lasan")) returned 1 [0103.365] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\LAUH-U.pptx", nBufferLength=0x105, lpBuffer=0x19e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\LAUH-U.pptx", lpFilePart=0x0) returned 0x25 [0103.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea04) returned 1 [0103.365] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\LAUH-U.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\lauh-u.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0103.365] GetFileType (hFile=0x430) returned 0x1 [0103.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea00) returned 1 [0103.365] GetFileType (hFile=0x430) returned 0x1 [0103.365] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eb00 | out: lpFileSizeHigh=0x19eb00*=0x0) returned 0x2ebf [0103.366] ReadFile (in: hFile=0x430, lpBuffer=0x241430c, nNumberOfBytesToRead=0x2ebf, lpNumberOfBytesRead=0x19eaac, lpOverlapped=0x0 | out: lpBuffer=0x241430c*, lpNumberOfBytesRead=0x19eaac*=0x2ebf, lpOverlapped=0x0) returned 1 [0103.366] CloseHandle (hObject=0x430) returned 1 [0103.398] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\LAUH-U.pptx", nBufferLength=0x105, lpBuffer=0x19e4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\LAUH-U.pptx", lpFilePart=0x0) returned 0x25 [0103.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9ec) returned 1 [0103.398] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\LAUH-U.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\lauh-u.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0103.403] GetFileType (hFile=0x430) returned 0x1 [0103.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e8) returned 1 [0103.403] GetFileType (hFile=0x430) returned 0x1 [0103.403] WriteFile (in: hFile=0x430, lpBuffer=0x246fc14*, nNumberOfBytesToWrite=0x2ec0, lpNumberOfBytesWritten=0x19ea9c, lpOverlapped=0x0 | out: lpBuffer=0x246fc14*, lpNumberOfBytesWritten=0x19ea9c*=0x2ec0, lpOverlapped=0x0) returned 1 [0103.404] CloseHandle (hObject=0x430) returned 1 [0103.405] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\LAUH-U.pptx", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\LAUH-U.pptx", lpFilePart=0x0) returned 0x25 [0103.405] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\LAUH-U.pptx.lasan", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\LAUH-U.pptx.lasan", lpFilePart=0x0) returned 0x2b [0103.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0103.405] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\LAUH-U.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\lauh-u.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19eafc | out: lpFileInformation=0x19eafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ccbcc10, ftCreationTime.dwHighDateTime=0x1d58e29, ftLastAccessTime.dwLowDateTime=0xffe8a8e0, ftLastAccessTime.dwHighDateTime=0x1d5630d, ftLastWriteTime.dwLowDateTime=0xc33bce56, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x2ec0)) returned 1 [0103.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea7c) returned 1 [0103.405] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\LAUH-U.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\lauh-u.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\LAUH-U.pptx.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\lauh-u.pptx.lasan")) returned 1 [0103.406] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\MabdW6JFta.pptx", nBufferLength=0x105, lpBuffer=0x19e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\MabdW6JFta.pptx", lpFilePart=0x0) returned 0x29 [0103.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea04) returned 1 [0103.406] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\MabdW6JFta.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\mabdw6jfta.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0103.406] GetFileType (hFile=0x430) returned 0x1 [0103.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea00) returned 1 [0103.406] GetFileType (hFile=0x430) returned 0x1 [0103.406] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eb00 | out: lpFileSizeHigh=0x19eb00*=0x0) returned 0x1896c [0103.406] ReadFile (in: hFile=0x430, lpBuffer=0x339f608, nNumberOfBytesToRead=0x1896c, lpNumberOfBytesRead=0x19eaac, lpOverlapped=0x0 | out: lpBuffer=0x339f608*, lpNumberOfBytesRead=0x19eaac*=0x1896c, lpOverlapped=0x0) returned 1 [0103.407] CloseHandle (hObject=0x430) returned 1 [0103.488] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\MabdW6JFta.pptx", nBufferLength=0x105, lpBuffer=0x19e4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\MabdW6JFta.pptx", lpFilePart=0x0) returned 0x29 [0103.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9ec) returned 1 [0103.488] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\MabdW6JFta.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\mabdw6jfta.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0103.490] GetFileType (hFile=0x430) returned 0x1 [0103.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e8) returned 1 [0103.490] GetFileType (hFile=0x430) returned 0x1 [0103.490] WriteFile (in: hFile=0x430, lpBuffer=0x33f9be8*, nNumberOfBytesToWrite=0x18970, lpNumberOfBytesWritten=0x19ea9c, lpOverlapped=0x0 | out: lpBuffer=0x33f9be8*, lpNumberOfBytesWritten=0x19ea9c*=0x18970, lpOverlapped=0x0) returned 1 [0103.492] CloseHandle (hObject=0x430) returned 1 [0103.495] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\MabdW6JFta.pptx", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\MabdW6JFta.pptx", lpFilePart=0x0) returned 0x29 [0103.495] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\MabdW6JFta.pptx.lasan", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\MabdW6JFta.pptx.lasan", lpFilePart=0x0) returned 0x2f [0103.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0103.495] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\MabdW6JFta.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\mabdw6jfta.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19eafc | out: lpFileInformation=0x19eafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ae44020, ftCreationTime.dwHighDateTime=0x1d55567, ftLastAccessTime.dwLowDateTime=0x4b49b40, ftLastAccessTime.dwHighDateTime=0x1d58b4f, ftLastWriteTime.dwLowDateTime=0xc34a1ccc, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x18970)) returned 1 [0103.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea7c) returned 1 [0103.495] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\MabdW6JFta.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\mabdw6jfta.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\MabdW6JFta.pptx.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\mabdw6jfta.pptx.lasan")) returned 1 [0103.496] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\w3buaTMe7.xlsx", nBufferLength=0x105, lpBuffer=0x19e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\w3buaTMe7.xlsx", lpFilePart=0x0) returned 0x28 [0103.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea04) returned 1 [0103.496] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\w3buaTMe7.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\w3buatme7.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0103.496] GetFileType (hFile=0x430) returned 0x1 [0103.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea00) returned 1 [0103.496] GetFileType (hFile=0x430) returned 0x1 [0103.496] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eb00 | out: lpFileSizeHigh=0x19eb00*=0x0) returned 0xf070 [0103.497] ReadFile (in: hFile=0x430, lpBuffer=0x24bff2c, nNumberOfBytesToRead=0xf070, lpNumberOfBytesRead=0x19eaac, lpOverlapped=0x0 | out: lpBuffer=0x24bff2c*, lpNumberOfBytesRead=0x19eaac*=0xf070, lpOverlapped=0x0) returned 1 [0103.497] CloseHandle (hObject=0x430) returned 1 [0103.516] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\w3buaTMe7.xlsx", nBufferLength=0x105, lpBuffer=0x19e4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\w3buaTMe7.xlsx", lpFilePart=0x0) returned 0x28 [0103.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9ec) returned 1 [0103.517] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\w3buaTMe7.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\w3buatme7.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0103.518] GetFileType (hFile=0x430) returned 0x1 [0103.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e8) returned 1 [0103.518] GetFileType (hFile=0x430) returned 0x1 [0103.518] WriteFile (in: hFile=0x430, lpBuffer=0x2539ea8*, nNumberOfBytesToWrite=0xf080, lpNumberOfBytesWritten=0x19ea9c, lpOverlapped=0x0 | out: lpBuffer=0x2539ea8*, lpNumberOfBytesWritten=0x19ea9c*=0xf080, lpOverlapped=0x0) returned 1 [0103.520] CloseHandle (hObject=0x430) returned 1 [0103.522] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\w3buaTMe7.xlsx", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\w3buaTMe7.xlsx", lpFilePart=0x0) returned 0x28 [0103.522] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\w3buaTMe7.xlsx.lasan", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\w3buaTMe7.xlsx.lasan", lpFilePart=0x0) returned 0x2e [0103.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0103.522] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\w3buaTMe7.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\w3buatme7.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19eafc | out: lpFileInformation=0x19eafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdf3bff0, ftCreationTime.dwHighDateTime=0x1d5bed1, ftLastAccessTime.dwLowDateTime=0x16ab2da0, ftLastAccessTime.dwHighDateTime=0x1d5cf2e, ftLastWriteTime.dwLowDateTime=0xc34ee2a6, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0xf080)) returned 1 [0103.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea7c) returned 1 [0103.522] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\w3buaTMe7.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\w3buatme7.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\w3buaTMe7.xlsx.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\w3buatme7.xlsx.lasan")) returned 1 [0103.523] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\WmnNFz7FetlMoAUqf.xlsx", nBufferLength=0x105, lpBuffer=0x19e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\WmnNFz7FetlMoAUqf.xlsx", lpFilePart=0x0) returned 0x30 [0103.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea04) returned 1 [0103.523] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\WmnNFz7FetlMoAUqf.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\wmnnfz7fetlmoauqf.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0103.523] GetFileType (hFile=0x430) returned 0x1 [0103.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea00) returned 1 [0103.523] GetFileType (hFile=0x430) returned 0x1 [0103.523] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eb00 | out: lpFileSizeHigh=0x19eb00*=0x0) returned 0x1057 [0103.523] ReadFile (in: hFile=0x430, lpBuffer=0x2549290, nNumberOfBytesToRead=0x1057, lpNumberOfBytesRead=0x19eaac, lpOverlapped=0x0 | out: lpBuffer=0x2549290*, lpNumberOfBytesRead=0x19eaac*=0x1057, lpOverlapped=0x0) returned 1 [0103.523] CloseHandle (hObject=0x430) returned 1 [0103.619] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\WmnNFz7FetlMoAUqf.xlsx", nBufferLength=0x105, lpBuffer=0x19e4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\WmnNFz7FetlMoAUqf.xlsx", lpFilePart=0x0) returned 0x30 [0103.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9ec) returned 1 [0103.619] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\WmnNFz7FetlMoAUqf.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\wmnnfz7fetlmoauqf.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0103.620] GetFileType (hFile=0x430) returned 0x1 [0103.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e8) returned 1 [0103.620] GetFileType (hFile=0x430) returned 0x1 [0103.620] WriteFile (in: hFile=0x430, lpBuffer=0x259b25c*, nNumberOfBytesToWrite=0x1060, lpNumberOfBytesWritten=0x19ea9c, lpOverlapped=0x0 | out: lpBuffer=0x259b25c*, lpNumberOfBytesWritten=0x19ea9c*=0x1060, lpOverlapped=0x0) returned 1 [0103.621] CloseHandle (hObject=0x430) returned 1 [0103.622] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\WmnNFz7FetlMoAUqf.xlsx", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\WmnNFz7FetlMoAUqf.xlsx", lpFilePart=0x0) returned 0x30 [0103.622] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\WmnNFz7FetlMoAUqf.xlsx.lasan", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\WmnNFz7FetlMoAUqf.xlsx.lasan", lpFilePart=0x0) returned 0x36 [0103.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0103.623] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\WmnNFz7FetlMoAUqf.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\wmnnfz7fetlmoauqf.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19eafc | out: lpFileInformation=0x19eafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x235d9bc0, ftCreationTime.dwHighDateTime=0x1d555b0, ftLastAccessTime.dwLowDateTime=0x7f36cab0, ftLastAccessTime.dwHighDateTime=0x1d5b81c, ftLastWriteTime.dwLowDateTime=0xc35d2c67, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x1060)) returned 1 [0103.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea7c) returned 1 [0103.623] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\WmnNFz7FetlMoAUqf.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\wmnnfz7fetlmoauqf.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\WmnNFz7FetlMoAUqf.xlsx.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\wmnnfz7fetlmoauqf.xlsx.lasan")) returned 1 [0103.623] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xRb3A98tFUu7Nu.pptx", nBufferLength=0x105, lpBuffer=0x19e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\xRb3A98tFUu7Nu.pptx", lpFilePart=0x0) returned 0x2d [0103.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea04) returned 1 [0103.623] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\xRb3A98tFUu7Nu.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\xrb3a98tfuu7nu.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0103.623] GetFileType (hFile=0x430) returned 0x1 [0103.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea00) returned 1 [0103.624] GetFileType (hFile=0x430) returned 0x1 [0103.624] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eb00 | out: lpFileSizeHigh=0x19eb00*=0x0) returned 0x4a20 [0103.624] ReadFile (in: hFile=0x430, lpBuffer=0x259c664, nNumberOfBytesToRead=0x4a20, lpNumberOfBytesRead=0x19eaac, lpOverlapped=0x0 | out: lpBuffer=0x259c664*, lpNumberOfBytesRead=0x19eaac*=0x4a20, lpOverlapped=0x0) returned 1 [0103.624] CloseHandle (hObject=0x430) returned 1 [0103.738] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xRb3A98tFUu7Nu.pptx", nBufferLength=0x105, lpBuffer=0x19e4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\xRb3A98tFUu7Nu.pptx", lpFilePart=0x0) returned 0x2d [0103.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9ec) returned 1 [0103.738] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\xRb3A98tFUu7Nu.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\xrb3a98tfuu7nu.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0103.739] GetFileType (hFile=0x430) returned 0x1 [0103.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e8) returned 1 [0103.739] GetFileType (hFile=0x430) returned 0x1 [0103.739] WriteFile (in: hFile=0x430, lpBuffer=0x24055b4*, nNumberOfBytesToWrite=0x4a30, lpNumberOfBytesWritten=0x19ea9c, lpOverlapped=0x0 | out: lpBuffer=0x24055b4*, lpNumberOfBytesWritten=0x19ea9c*=0x4a30, lpOverlapped=0x0) returned 1 [0103.741] CloseHandle (hObject=0x430) returned 1 [0103.742] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xRb3A98tFUu7Nu.pptx", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\xRb3A98tFUu7Nu.pptx", lpFilePart=0x0) returned 0x2d [0103.742] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xRb3A98tFUu7Nu.pptx.lasan", nBufferLength=0x105, lpBuffer=0x19e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\xRb3A98tFUu7Nu.pptx.lasan", lpFilePart=0x0) returned 0x33 [0103.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0103.743] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xRb3A98tFUu7Nu.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\xrb3a98tfuu7nu.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19eafc | out: lpFileInformation=0x19eafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x353da810, ftCreationTime.dwHighDateTime=0x1d5b65b, ftLastAccessTime.dwLowDateTime=0x964ceb70, ftLastAccessTime.dwHighDateTime=0x1d5815e, ftLastWriteTime.dwLowDateTime=0xc3704061, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x4a30)) returned 1 [0103.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea7c) returned 1 [0103.743] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\xRb3A98tFUu7Nu.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\xrb3a98tfuu7nu.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\xRb3A98tFUu7Nu.pptx.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\xrb3a98tfuu7nu.pptx.lasan")) returned 1 [0103.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eacc) returned 1 [0103.743] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW", lpFilePart=0x0) returned 0x2d [0103.743] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\*", lpFindFileData=0x19e7f4 | out: lpFindFileData=0x19e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc03febd0, ftCreationTime.dwHighDateTime=0x1d5d31b, ftLastAccessTime.dwLowDateTime=0x6e7a9600, ftLastAccessTime.dwHighDateTime=0x1d5ca11, ftLastWriteTime.dwLowDateTime=0x6e7a9600, ftLastWriteTime.dwHighDateTime=0x1d5ca11, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x633768 [0103.744] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc03febd0, ftCreationTime.dwHighDateTime=0x1d5d31b, ftLastAccessTime.dwLowDateTime=0x6e7a9600, ftLastAccessTime.dwHighDateTime=0x1d5ca11, ftLastWriteTime.dwLowDateTime=0x6e7a9600, ftLastWriteTime.dwHighDateTime=0x1d5ca11, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.744] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x955aee30, ftCreationTime.dwHighDateTime=0x1d5d34b, ftLastAccessTime.dwLowDateTime=0xee0198d0, ftLastAccessTime.dwHighDateTime=0x1d5d2c5, ftLastWriteTime.dwLowDateTime=0xee0198d0, ftLastWriteTime.dwHighDateTime=0x1d5d2c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADdE74cJ", cAlternateFileName="")) returned 1 [0103.744] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c74130, ftCreationTime.dwHighDateTime=0x1d5c9a7, ftLastAccessTime.dwLowDateTime=0xc25ea280, ftLastAccessTime.dwHighDateTime=0x1d5d3de, ftLastWriteTime.dwLowDateTime=0xc25ea280, ftLastWriteTime.dwHighDateTime=0x1d5d3de, nFileSizeHigh=0x0, nFileSizeLow=0x1116a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BHroneeAJhOG.docx", cAlternateFileName="BHRONE~1.DOC")) returned 1 [0103.744] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a3108e0, ftCreationTime.dwHighDateTime=0x1d5d388, ftLastAccessTime.dwLowDateTime=0xd10720a0, ftLastAccessTime.dwHighDateTime=0x1d5ca74, ftLastWriteTime.dwLowDateTime=0xd10720a0, ftLastWriteTime.dwHighDateTime=0x1d5ca74, nFileSizeHigh=0x0, nFileSizeLow=0xb8a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="jdcAEn.odt", cAlternateFileName="")) returned 1 [0103.744] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x104595a0, ftCreationTime.dwHighDateTime=0x1d5d4e6, ftLastAccessTime.dwLowDateTime=0xa5970200, ftLastAccessTime.dwHighDateTime=0x1d5ca4c, ftLastWriteTime.dwLowDateTime=0xa5970200, ftLastWriteTime.dwHighDateTime=0x1d5ca4c, nFileSizeHigh=0x0, nFileSizeLow=0xbe6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="KIK r-4Ohb_PPd5STNTL.pps", cAlternateFileName="KIKR-4~1.PPS")) returned 1 [0103.744] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f6f62c0, ftCreationTime.dwHighDateTime=0x1d5cce3, ftLastAccessTime.dwLowDateTime=0xcd163f0, ftLastAccessTime.dwHighDateTime=0x1d5d58a, ftLastWriteTime.dwLowDateTime=0xcd163f0, ftLastWriteTime.dwHighDateTime=0x1d5d58a, nFileSizeHigh=0x0, nFileSizeLow=0x66a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZuttBxWSW.doc", cAlternateFileName="ZUTTBX~1.DOC")) returned 1 [0103.745] FindNextFileW (in: hFindFile=0x633768, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0103.745] FindClose (in: hFindFile=0x633768 | out: hFindFile=0x633768) returned 1 [0103.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea88) returned 1 [0103.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea94) returned 1 [0103.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eacc) returned 1 [0103.745] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW", lpFilePart=0x0) returned 0x2d [0103.745] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\*", lpFindFileData=0x19e7f4 | out: lpFindFileData=0x19e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc03febd0, ftCreationTime.dwHighDateTime=0x1d5d31b, ftLastAccessTime.dwLowDateTime=0x6e7a9600, ftLastAccessTime.dwHighDateTime=0x1d5ca11, ftLastWriteTime.dwLowDateTime=0x6e7a9600, ftLastWriteTime.dwHighDateTime=0x1d5ca11, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6334a8 [0103.745] FindNextFileW (in: hFindFile=0x6334a8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc03febd0, ftCreationTime.dwHighDateTime=0x1d5d31b, ftLastAccessTime.dwLowDateTime=0x6e7a9600, ftLastAccessTime.dwHighDateTime=0x1d5ca11, ftLastWriteTime.dwLowDateTime=0x6e7a9600, ftLastWriteTime.dwHighDateTime=0x1d5ca11, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.745] FindNextFileW (in: hFindFile=0x6334a8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x955aee30, ftCreationTime.dwHighDateTime=0x1d5d34b, ftLastAccessTime.dwLowDateTime=0xee0198d0, ftLastAccessTime.dwHighDateTime=0x1d5d2c5, ftLastWriteTime.dwLowDateTime=0xee0198d0, ftLastWriteTime.dwHighDateTime=0x1d5d2c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADdE74cJ", cAlternateFileName="")) returned 1 [0103.745] FindNextFileW (in: hFindFile=0x6334a8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c74130, ftCreationTime.dwHighDateTime=0x1d5c9a7, ftLastAccessTime.dwLowDateTime=0xc25ea280, ftLastAccessTime.dwHighDateTime=0x1d5d3de, ftLastWriteTime.dwLowDateTime=0xc25ea280, ftLastWriteTime.dwHighDateTime=0x1d5d3de, nFileSizeHigh=0x0, nFileSizeLow=0x1116a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BHroneeAJhOG.docx", cAlternateFileName="BHRONE~1.DOC")) returned 1 [0103.746] FindNextFileW (in: hFindFile=0x6334a8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a3108e0, ftCreationTime.dwHighDateTime=0x1d5d388, ftLastAccessTime.dwLowDateTime=0xd10720a0, ftLastAccessTime.dwHighDateTime=0x1d5ca74, ftLastWriteTime.dwLowDateTime=0xd10720a0, ftLastWriteTime.dwHighDateTime=0x1d5ca74, nFileSizeHigh=0x0, nFileSizeLow=0xb8a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="jdcAEn.odt", cAlternateFileName="")) returned 1 [0103.746] FindNextFileW (in: hFindFile=0x6334a8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x104595a0, ftCreationTime.dwHighDateTime=0x1d5d4e6, ftLastAccessTime.dwLowDateTime=0xa5970200, ftLastAccessTime.dwHighDateTime=0x1d5ca4c, ftLastWriteTime.dwLowDateTime=0xa5970200, ftLastWriteTime.dwHighDateTime=0x1d5ca4c, nFileSizeHigh=0x0, nFileSizeLow=0xbe6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="KIK r-4Ohb_PPd5STNTL.pps", cAlternateFileName="KIKR-4~1.PPS")) returned 1 [0103.746] FindNextFileW (in: hFindFile=0x6334a8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f6f62c0, ftCreationTime.dwHighDateTime=0x1d5cce3, ftLastAccessTime.dwLowDateTime=0xcd163f0, ftLastAccessTime.dwHighDateTime=0x1d5d58a, ftLastWriteTime.dwLowDateTime=0xcd163f0, ftLastWriteTime.dwHighDateTime=0x1d5d58a, nFileSizeHigh=0x0, nFileSizeLow=0x66a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZuttBxWSW.doc", cAlternateFileName="ZUTTBX~1.DOC")) returned 1 [0103.746] FindNextFileW (in: hFindFile=0x6334a8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f6f62c0, ftCreationTime.dwHighDateTime=0x1d5cce3, ftLastAccessTime.dwLowDateTime=0xcd163f0, ftLastAccessTime.dwHighDateTime=0x1d5d58a, ftLastWriteTime.dwLowDateTime=0xcd163f0, ftLastWriteTime.dwHighDateTime=0x1d5d58a, nFileSizeHigh=0x0, nFileSizeLow=0x66a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZuttBxWSW.doc", cAlternateFileName="ZUTTBX~1.DOC")) returned 0 [0103.746] FindClose (in: hFindFile=0x6334a8 | out: hFindFile=0x6334a8) returned 1 [0103.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea88) returned 1 [0103.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea94) returned 1 [0103.746] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\BHroneeAJhOG.docx", nBufferLength=0x105, lpBuffer=0x19e474, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\BHroneeAJhOG.docx", lpFilePart=0x0) returned 0x3f [0103.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9b8) returned 1 [0103.747] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\BHroneeAJhOG.docx" (normalized: "c:\\users\\fd1hvy\\documents\\exvjmrv71xpfknfkbtw\\bhroneeajhog.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0103.747] GetFileType (hFile=0x430) returned 0x1 [0103.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9b4) returned 1 [0103.747] GetFileType (hFile=0x430) returned 0x1 [0103.747] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eab4 | out: lpFileSizeHigh=0x19eab4*=0x0) returned 0x1116a [0103.747] ReadFile (in: hFile=0x430, lpBuffer=0x240c3ac, nNumberOfBytesToRead=0x1116a, lpNumberOfBytesRead=0x19ea60, lpOverlapped=0x0 | out: lpBuffer=0x240c3ac*, lpNumberOfBytesRead=0x19ea60*=0x1116a, lpOverlapped=0x0) returned 1 [0103.747] CloseHandle (hObject=0x430) returned 1 [0103.817] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\BHroneeAJhOG.docx", nBufferLength=0x105, lpBuffer=0x19e45c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\BHroneeAJhOG.docx", lpFilePart=0x0) returned 0x3f [0103.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9a0) returned 1 [0103.817] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\BHroneeAJhOG.docx" (normalized: "c:\\users\\fd1hvy\\documents\\exvjmrv71xpfknfkbtw\\bhroneeajhog.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0103.819] GetFileType (hFile=0x430) returned 0x1 [0103.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e99c) returned 1 [0103.819] GetFileType (hFile=0x430) returned 0x1 [0103.819] WriteFile (in: hFile=0x430, lpBuffer=0x248c758*, nNumberOfBytesToWrite=0x11170, lpNumberOfBytesWritten=0x19ea50, lpOverlapped=0x0 | out: lpBuffer=0x248c758*, lpNumberOfBytesWritten=0x19ea50*=0x11170, lpOverlapped=0x0) returned 1 [0103.821] CloseHandle (hObject=0x430) returned 1 [0103.823] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\BHroneeAJhOG.docx", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\BHroneeAJhOG.docx", lpFilePart=0x0) returned 0x3f [0103.823] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\BHroneeAJhOG.docx.lasan", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\BHroneeAJhOG.docx.lasan", lpFilePart=0x0) returned 0x45 [0103.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea34) returned 1 [0103.823] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\BHroneeAJhOG.docx" (normalized: "c:\\users\\fd1hvy\\documents\\exvjmrv71xpfknfkbtw\\bhroneeajhog.docx"), fInfoLevelId=0x0, lpFileInformation=0x19eab0 | out: lpFileInformation=0x19eab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c74130, ftCreationTime.dwHighDateTime=0x1d5c9a7, ftLastAccessTime.dwLowDateTime=0xc25ea280, ftLastAccessTime.dwHighDateTime=0x1d5d3de, ftLastWriteTime.dwLowDateTime=0xc37c2b85, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x11170)) returned 1 [0103.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea30) returned 1 [0103.823] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\BHroneeAJhOG.docx" (normalized: "c:\\users\\fd1hvy\\documents\\exvjmrv71xpfknfkbtw\\bhroneeajhog.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\BHroneeAJhOG.docx.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\exvjmrv71xpfknfkbtw\\bhroneeajhog.docx.lasan")) returned 1 [0103.824] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\jdcAEn.odt", nBufferLength=0x105, lpBuffer=0x19e474, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\jdcAEn.odt", lpFilePart=0x0) returned 0x38 [0103.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9b8) returned 1 [0103.824] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\jdcAEn.odt" (normalized: "c:\\users\\fd1hvy\\documents\\exvjmrv71xpfknfkbtw\\jdcaen.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0103.824] GetFileType (hFile=0x430) returned 0x1 [0103.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9b4) returned 1 [0103.824] GetFileType (hFile=0x430) returned 0x1 [0103.824] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eab4 | out: lpFileSizeHigh=0x19eab4*=0x0) returned 0xb8a2 [0103.824] ReadFile (in: hFile=0x430, lpBuffer=0x249dcdc, nNumberOfBytesToRead=0xb8a2, lpNumberOfBytesRead=0x19ea60, lpOverlapped=0x0 | out: lpBuffer=0x249dcdc*, lpNumberOfBytesRead=0x19ea60*=0xb8a2, lpOverlapped=0x0) returned 1 [0103.825] CloseHandle (hObject=0x430) returned 1 [0103.843] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\jdcAEn.odt", nBufferLength=0x105, lpBuffer=0x19e45c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\jdcAEn.odt", lpFilePart=0x0) returned 0x38 [0103.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9a0) returned 1 [0103.843] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\jdcAEn.odt" (normalized: "c:\\users\\fd1hvy\\documents\\exvjmrv71xpfknfkbtw\\jdcaen.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0103.964] GetFileType (hFile=0x430) returned 0x1 [0103.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e99c) returned 1 [0103.964] GetFileType (hFile=0x430) returned 0x1 [0103.964] WriteFile (in: hFile=0x430, lpBuffer=0x250d4ec*, nNumberOfBytesToWrite=0xb8b0, lpNumberOfBytesWritten=0x19ea50, lpOverlapped=0x0 | out: lpBuffer=0x250d4ec*, lpNumberOfBytesWritten=0x19ea50*=0xb8b0, lpOverlapped=0x0) returned 1 [0103.966] CloseHandle (hObject=0x430) returned 1 [0103.968] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\jdcAEn.odt", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\jdcAEn.odt", lpFilePart=0x0) returned 0x38 [0103.968] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\jdcAEn.odt.lasan", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\jdcAEn.odt.lasan", lpFilePart=0x0) returned 0x3e [0103.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea34) returned 1 [0103.968] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\jdcAEn.odt" (normalized: "c:\\users\\fd1hvy\\documents\\exvjmrv71xpfknfkbtw\\jdcaen.odt"), fInfoLevelId=0x0, lpFileInformation=0x19eab0 | out: lpFileInformation=0x19eab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a3108e0, ftCreationTime.dwHighDateTime=0x1d5d388, ftLastAccessTime.dwLowDateTime=0xd10720a0, ftLastAccessTime.dwHighDateTime=0x1d5ca74, ftLastWriteTime.dwLowDateTime=0xc391a133, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0xb8b0)) returned 1 [0103.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea30) returned 1 [0103.968] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\jdcAEn.odt" (normalized: "c:\\users\\fd1hvy\\documents\\exvjmrv71xpfknfkbtw\\jdcaen.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\jdcAEn.odt.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\exvjmrv71xpfknfkbtw\\jdcaen.odt.lasan")) returned 1 [0103.969] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\ZuttBxWSW.doc", nBufferLength=0x105, lpBuffer=0x19e474, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\ZuttBxWSW.doc", lpFilePart=0x0) returned 0x3b [0103.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9b8) returned 1 [0103.969] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\ZuttBxWSW.doc" (normalized: "c:\\users\\fd1hvy\\documents\\exvjmrv71xpfknfkbtw\\zuttbxwsw.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0103.969] GetFileType (hFile=0x430) returned 0x1 [0103.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9b4) returned 1 [0103.969] GetFileType (hFile=0x430) returned 0x1 [0103.969] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eab4 | out: lpFileSizeHigh=0x19eab4*=0x0) returned 0x66a0 [0103.969] ReadFile (in: hFile=0x430, lpBuffer=0x2519194, nNumberOfBytesToRead=0x66a0, lpNumberOfBytesRead=0x19ea60, lpOverlapped=0x0 | out: lpBuffer=0x2519194*, lpNumberOfBytesRead=0x19ea60*=0x66a0, lpOverlapped=0x0) returned 1 [0103.969] CloseHandle (hObject=0x430) returned 1 [0103.986] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\ZuttBxWSW.doc", nBufferLength=0x105, lpBuffer=0x19e45c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\ZuttBxWSW.doc", lpFilePart=0x0) returned 0x3b [0103.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9a0) returned 1 [0103.986] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\ZuttBxWSW.doc" (normalized: "c:\\users\\fd1hvy\\documents\\exvjmrv71xpfknfkbtw\\zuttbxwsw.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0103.987] GetFileType (hFile=0x430) returned 0x1 [0103.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e99c) returned 1 [0103.987] GetFileType (hFile=0x430) returned 0x1 [0103.987] WriteFile (in: hFile=0x430, lpBuffer=0x25860ec*, nNumberOfBytesToWrite=0x66b0, lpNumberOfBytesWritten=0x19ea50, lpOverlapped=0x0 | out: lpBuffer=0x25860ec*, lpNumberOfBytesWritten=0x19ea50*=0x66b0, lpOverlapped=0x0) returned 1 [0103.988] CloseHandle (hObject=0x430) returned 1 [0103.990] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\ZuttBxWSW.doc", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\ZuttBxWSW.doc", lpFilePart=0x0) returned 0x3b [0103.990] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\ZuttBxWSW.doc.lasan", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\ZuttBxWSW.doc.lasan", lpFilePart=0x0) returned 0x41 [0103.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea34) returned 1 [0103.990] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\ZuttBxWSW.doc" (normalized: "c:\\users\\fd1hvy\\documents\\exvjmrv71xpfknfkbtw\\zuttbxwsw.doc"), fInfoLevelId=0x0, lpFileInformation=0x19eab0 | out: lpFileInformation=0x19eab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f6f62c0, ftCreationTime.dwHighDateTime=0x1d5cce3, ftLastAccessTime.dwLowDateTime=0xcd163f0, ftLastAccessTime.dwHighDateTime=0x1d5d58a, ftLastWriteTime.dwLowDateTime=0xc39666c8, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x66b0)) returned 1 [0103.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea30) returned 1 [0103.990] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\ZuttBxWSW.doc" (normalized: "c:\\users\\fd1hvy\\documents\\exvjmrv71xpfknfkbtw\\zuttbxwsw.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\ZuttBxWSW.doc.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\exvjmrv71xpfknfkbtw\\zuttbxwsw.doc.lasan")) returned 1 [0103.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0103.991] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\ADdE74cJ", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\ADdE74cJ", lpFilePart=0x0) returned 0x36 [0103.991] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\ADdE74cJ\\*", lpFindFileData=0x19e7a8 | out: lpFindFileData=0x19e7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x955aee30, ftCreationTime.dwHighDateTime=0x1d5d34b, ftLastAccessTime.dwLowDateTime=0xee0198d0, ftLastAccessTime.dwHighDateTime=0x1d5d2c5, ftLastWriteTime.dwLowDateTime=0xee0198d0, ftLastWriteTime.dwHighDateTime=0x1d5d2c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x633928 [0103.991] FindNextFileW (in: hFindFile=0x633928, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x955aee30, ftCreationTime.dwHighDateTime=0x1d5d34b, ftLastAccessTime.dwLowDateTime=0xee0198d0, ftLastAccessTime.dwHighDateTime=0x1d5d2c5, ftLastWriteTime.dwLowDateTime=0xee0198d0, ftLastWriteTime.dwHighDateTime=0x1d5d2c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.992] FindNextFileW (in: hFindFile=0x633928, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x955aee30, ftCreationTime.dwHighDateTime=0x1d5d34b, ftLastAccessTime.dwLowDateTime=0xee0198d0, ftLastAccessTime.dwHighDateTime=0x1d5d2c5, ftLastWriteTime.dwLowDateTime=0xee0198d0, ftLastWriteTime.dwHighDateTime=0x1d5d2c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0103.992] FindClose (in: hFindFile=0x633928 | out: hFindFile=0x633928) returned 1 [0103.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea3c) returned 1 [0103.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea48) returned 1 [0103.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0103.992] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\ADdE74cJ", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\ADdE74cJ", lpFilePart=0x0) returned 0x36 [0103.992] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\eXvjMrV71XpFKNFKbtW\\ADdE74cJ\\*", lpFindFileData=0x19e7a8 | out: lpFindFileData=0x19e7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x955aee30, ftCreationTime.dwHighDateTime=0x1d5d34b, ftLastAccessTime.dwLowDateTime=0xee0198d0, ftLastAccessTime.dwHighDateTime=0x1d5d2c5, ftLastWriteTime.dwLowDateTime=0xee0198d0, ftLastWriteTime.dwHighDateTime=0x1d5d2c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6338e8 [0103.992] FindNextFileW (in: hFindFile=0x6338e8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x955aee30, ftCreationTime.dwHighDateTime=0x1d5d34b, ftLastAccessTime.dwLowDateTime=0xee0198d0, ftLastAccessTime.dwHighDateTime=0x1d5d2c5, ftLastWriteTime.dwLowDateTime=0xee0198d0, ftLastWriteTime.dwHighDateTime=0x1d5d2c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.992] FindNextFileW (in: hFindFile=0x6338e8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x955aee30, ftCreationTime.dwHighDateTime=0x1d5d34b, ftLastAccessTime.dwLowDateTime=0xee0198d0, ftLastAccessTime.dwHighDateTime=0x1d5d2c5, ftLastWriteTime.dwLowDateTime=0xee0198d0, ftLastWriteTime.dwHighDateTime=0x1d5d2c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0103.992] FindClose (in: hFindFile=0x6338e8 | out: hFindFile=0x6338e8) returned 1 [0103.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea3c) returned 1 [0103.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea48) returned 1 [0103.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eacc) returned 1 [0103.993] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV", lpFilePart=0x0) returned 0x2b [0103.993] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\*", lpFindFileData=0x19e7f4 | out: lpFindFileData=0x19e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x466b8fe0, ftCreationTime.dwHighDateTime=0x1d5ce1f, ftLastAccessTime.dwLowDateTime=0xe1463c20, ftLastAccessTime.dwHighDateTime=0x1d5cb01, ftLastWriteTime.dwLowDateTime=0xe1463c20, ftLastWriteTime.dwHighDateTime=0x1d5cb01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x633568 [0103.993] FindNextFileW (in: hFindFile=0x633568, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x466b8fe0, ftCreationTime.dwHighDateTime=0x1d5ce1f, ftLastAccessTime.dwLowDateTime=0xe1463c20, ftLastAccessTime.dwHighDateTime=0x1d5cb01, ftLastWriteTime.dwLowDateTime=0xe1463c20, ftLastWriteTime.dwHighDateTime=0x1d5cb01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.993] FindNextFileW (in: hFindFile=0x633568, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7528b50, ftCreationTime.dwHighDateTime=0x1d5cfe3, ftLastAccessTime.dwLowDateTime=0xb42cb5f0, ftLastAccessTime.dwHighDateTime=0x1d5d5df, ftLastWriteTime.dwLowDateTime=0xb42cb5f0, ftLastWriteTime.dwHighDateTime=0x1d5d5df, nFileSizeHigh=0x0, nFileSizeLow=0x14275, dwReserved0=0x0, dwReserved1=0x0, cFileName="mqjun0S3-3.csv", cAlternateFileName="MQJUN0~1.CSV")) returned 1 [0103.993] FindNextFileW (in: hFindFile=0x633568, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac29d90, ftCreationTime.dwHighDateTime=0x1d5c8df, ftLastAccessTime.dwLowDateTime=0xf6b4d8c0, ftLastAccessTime.dwHighDateTime=0x1d5d5bd, ftLastWriteTime.dwLowDateTime=0xf6b4d8c0, ftLastWriteTime.dwHighDateTime=0x1d5d5bd, nFileSizeHigh=0x0, nFileSizeLow=0x18f3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qje6hHtO5OlzxiYOe.pptx", cAlternateFileName="QJE6HH~1.PPT")) returned 1 [0103.993] FindNextFileW (in: hFindFile=0x633568, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65e76340, ftCreationTime.dwHighDateTime=0x1d5d4e5, ftLastAccessTime.dwLowDateTime=0x2509b470, ftLastAccessTime.dwHighDateTime=0x1d5cca9, ftLastWriteTime.dwLowDateTime=0x2509b470, ftLastWriteTime.dwHighDateTime=0x1d5cca9, nFileSizeHigh=0x0, nFileSizeLow=0xc936, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z dQO.rtf", cAlternateFileName="ZDQO~1.RTF")) returned 1 [0103.994] FindNextFileW (in: hFindFile=0x633568, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0103.994] FindClose (in: hFindFile=0x633568 | out: hFindFile=0x633568) returned 1 [0103.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea88) returned 1 [0103.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea94) returned 1 [0103.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eacc) returned 1 [0103.994] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV", lpFilePart=0x0) returned 0x2b [0103.994] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\*", lpFindFileData=0x19e7f4 | out: lpFindFileData=0x19e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x466b8fe0, ftCreationTime.dwHighDateTime=0x1d5ce1f, ftLastAccessTime.dwLowDateTime=0xe1463c20, ftLastAccessTime.dwHighDateTime=0x1d5cb01, ftLastWriteTime.dwLowDateTime=0xe1463c20, ftLastWriteTime.dwHighDateTime=0x1d5cb01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x633568 [0103.994] FindNextFileW (in: hFindFile=0x633568, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x466b8fe0, ftCreationTime.dwHighDateTime=0x1d5ce1f, ftLastAccessTime.dwLowDateTime=0xe1463c20, ftLastAccessTime.dwHighDateTime=0x1d5cb01, ftLastWriteTime.dwLowDateTime=0xe1463c20, ftLastWriteTime.dwHighDateTime=0x1d5cb01, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.994] FindNextFileW (in: hFindFile=0x633568, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7528b50, ftCreationTime.dwHighDateTime=0x1d5cfe3, ftLastAccessTime.dwLowDateTime=0xb42cb5f0, ftLastAccessTime.dwHighDateTime=0x1d5d5df, ftLastWriteTime.dwLowDateTime=0xb42cb5f0, ftLastWriteTime.dwHighDateTime=0x1d5d5df, nFileSizeHigh=0x0, nFileSizeLow=0x14275, dwReserved0=0x0, dwReserved1=0x0, cFileName="mqjun0S3-3.csv", cAlternateFileName="MQJUN0~1.CSV")) returned 1 [0103.995] FindNextFileW (in: hFindFile=0x633568, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac29d90, ftCreationTime.dwHighDateTime=0x1d5c8df, ftLastAccessTime.dwLowDateTime=0xf6b4d8c0, ftLastAccessTime.dwHighDateTime=0x1d5d5bd, ftLastWriteTime.dwLowDateTime=0xf6b4d8c0, ftLastWriteTime.dwHighDateTime=0x1d5d5bd, nFileSizeHigh=0x0, nFileSizeLow=0x18f3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qje6hHtO5OlzxiYOe.pptx", cAlternateFileName="QJE6HH~1.PPT")) returned 1 [0103.995] FindNextFileW (in: hFindFile=0x633568, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65e76340, ftCreationTime.dwHighDateTime=0x1d5d4e5, ftLastAccessTime.dwLowDateTime=0x2509b470, ftLastAccessTime.dwHighDateTime=0x1d5cca9, ftLastWriteTime.dwLowDateTime=0x2509b470, ftLastWriteTime.dwHighDateTime=0x1d5cca9, nFileSizeHigh=0x0, nFileSizeLow=0xc936, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z dQO.rtf", cAlternateFileName="ZDQO~1.RTF")) returned 1 [0103.995] FindNextFileW (in: hFindFile=0x633568, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65e76340, ftCreationTime.dwHighDateTime=0x1d5d4e5, ftLastAccessTime.dwLowDateTime=0x2509b470, ftLastAccessTime.dwHighDateTime=0x1d5cca9, ftLastWriteTime.dwLowDateTime=0x2509b470, ftLastWriteTime.dwHighDateTime=0x1d5cca9, nFileSizeHigh=0x0, nFileSizeLow=0xc936, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z dQO.rtf", cAlternateFileName="ZDQO~1.RTF")) returned 0 [0103.995] FindClose (in: hFindFile=0x633568 | out: hFindFile=0x633568) returned 1 [0103.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea88) returned 1 [0103.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea94) returned 1 [0103.995] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\mqjun0S3-3.csv", nBufferLength=0x105, lpBuffer=0x19e474, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\mqjun0S3-3.csv", lpFilePart=0x0) returned 0x3a [0103.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9b8) returned 1 [0103.995] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\mqjun0S3-3.csv" (normalized: "c:\\users\\fd1hvy\\documents\\ffpcv0otw7 vkbuyv\\mqjun0s3-3.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0103.995] GetFileType (hFile=0x430) returned 0x1 [0103.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9b4) returned 1 [0103.996] GetFileType (hFile=0x430) returned 0x1 [0103.996] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eab4 | out: lpFileSizeHigh=0x19eab4*=0x0) returned 0x14275 [0103.996] ReadFile (in: hFile=0x430, lpBuffer=0x258f77c, nNumberOfBytesToRead=0x14275, lpNumberOfBytesRead=0x19ea60, lpOverlapped=0x0 | out: lpBuffer=0x258f77c*, lpNumberOfBytesRead=0x19ea60*=0x14275, lpOverlapped=0x0) returned 1 [0103.996] CloseHandle (hObject=0x430) returned 1 [0104.150] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\mqjun0S3-3.csv", nBufferLength=0x105, lpBuffer=0x19e45c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\mqjun0S3-3.csv", lpFilePart=0x0) returned 0x3a [0104.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9a0) returned 1 [0104.150] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\mqjun0S3-3.csv" (normalized: "c:\\users\\fd1hvy\\documents\\ffpcv0otw7 vkbuyv\\mqjun0s3-3.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0104.152] GetFileType (hFile=0x430) returned 0x1 [0104.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e99c) returned 1 [0104.152] GetFileType (hFile=0x430) returned 0x1 [0104.152] WriteFile (in: hFile=0x430, lpBuffer=0x2436d6c*, nNumberOfBytesToWrite=0x14280, lpNumberOfBytesWritten=0x19ea50, lpOverlapped=0x0 | out: lpBuffer=0x2436d6c*, lpNumberOfBytesWritten=0x19ea50*=0x14280, lpOverlapped=0x0) returned 1 [0104.154] CloseHandle (hObject=0x430) returned 1 [0104.156] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\mqjun0S3-3.csv", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\mqjun0S3-3.csv", lpFilePart=0x0) returned 0x3a [0104.156] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\mqjun0S3-3.csv.lasan", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\mqjun0S3-3.csv.lasan", lpFilePart=0x0) returned 0x40 [0104.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea34) returned 1 [0104.156] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\mqjun0S3-3.csv" (normalized: "c:\\users\\fd1hvy\\documents\\ffpcv0otw7 vkbuyv\\mqjun0s3-3.csv"), fInfoLevelId=0x0, lpFileInformation=0x19eab0 | out: lpFileInformation=0x19eab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7528b50, ftCreationTime.dwHighDateTime=0x1d5cfe3, ftLastAccessTime.dwLowDateTime=0xb42cb5f0, ftLastAccessTime.dwHighDateTime=0x1d5d5df, ftLastWriteTime.dwLowDateTime=0xc3ae3f88, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x14280)) returned 1 [0104.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea30) returned 1 [0104.156] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\mqjun0S3-3.csv" (normalized: "c:\\users\\fd1hvy\\documents\\ffpcv0otw7 vkbuyv\\mqjun0s3-3.csv"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\mqjun0S3-3.csv.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\ffpcv0otw7 vkbuyv\\mqjun0s3-3.csv.lasan")) returned 1 [0104.157] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\Qje6hHtO5OlzxiYOe.pptx", nBufferLength=0x105, lpBuffer=0x19e474, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\Qje6hHtO5OlzxiYOe.pptx", lpFilePart=0x0) returned 0x42 [0104.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9b8) returned 1 [0104.157] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\Qje6hHtO5OlzxiYOe.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ffpcv0otw7 vkbuyv\\qje6hhto5olzxiyoe.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0104.157] GetFileType (hFile=0x430) returned 0x1 [0104.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9b4) returned 1 [0104.157] GetFileType (hFile=0x430) returned 0x1 [0104.157] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eab4 | out: lpFileSizeHigh=0x19eab4*=0x0) returned 0x18f3e [0104.158] ReadFile (in: hFile=0x430, lpBuffer=0x34e9dc8, nNumberOfBytesToRead=0x18f3e, lpNumberOfBytesRead=0x19ea60, lpOverlapped=0x0 | out: lpBuffer=0x34e9dc8*, lpNumberOfBytesRead=0x19ea60*=0x18f3e, lpOverlapped=0x0) returned 1 [0104.160] CloseHandle (hObject=0x430) returned 1 [0104.184] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\Qje6hHtO5OlzxiYOe.pptx", nBufferLength=0x105, lpBuffer=0x19e45c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\Qje6hHtO5OlzxiYOe.pptx", lpFilePart=0x0) returned 0x42 [0104.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9a0) returned 1 [0104.184] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\Qje6hHtO5OlzxiYOe.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ffpcv0otw7 vkbuyv\\qje6hhto5olzxiyoe.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0104.186] GetFileType (hFile=0x430) returned 0x1 [0104.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e99c) returned 1 [0104.186] GetFileType (hFile=0x430) returned 0x1 [0104.186] WriteFile (in: hFile=0x430, lpBuffer=0x3566a48*, nNumberOfBytesToWrite=0x18f40, lpNumberOfBytesWritten=0x19ea50, lpOverlapped=0x0 | out: lpBuffer=0x3566a48*, lpNumberOfBytesWritten=0x19ea50*=0x18f40, lpOverlapped=0x0) returned 1 [0104.237] CloseHandle (hObject=0x430) returned 1 [0104.240] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\Qje6hHtO5OlzxiYOe.pptx", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\Qje6hHtO5OlzxiYOe.pptx", lpFilePart=0x0) returned 0x42 [0104.240] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\Qje6hHtO5OlzxiYOe.pptx.lasan", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\Qje6hHtO5OlzxiYOe.pptx.lasan", lpFilePart=0x0) returned 0x48 [0104.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea34) returned 1 [0104.240] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\Qje6hHtO5OlzxiYOe.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ffpcv0otw7 vkbuyv\\qje6hhto5olzxiyoe.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19eab0 | out: lpFileInformation=0x19eab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac29d90, ftCreationTime.dwHighDateTime=0x1d5c8df, ftLastAccessTime.dwLowDateTime=0xf6b4d8c0, ftLastAccessTime.dwHighDateTime=0x1d5d5bd, ftLastWriteTime.dwLowDateTime=0xc3bc8add, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x18f40)) returned 1 [0104.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea30) returned 1 [0104.241] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\Qje6hHtO5OlzxiYOe.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ffpcv0otw7 vkbuyv\\qje6hhto5olzxiyoe.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\Qje6hHtO5OlzxiYOe.pptx.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\ffpcv0otw7 vkbuyv\\qje6hhto5olzxiyoe.pptx.lasan")) returned 1 [0104.242] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\Z dQO.rtf", nBufferLength=0x105, lpBuffer=0x19e474, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\Z dQO.rtf", lpFilePart=0x0) returned 0x35 [0104.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9b8) returned 1 [0104.242] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\Z dQO.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ffpcv0otw7 vkbuyv\\z dqo.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0104.242] GetFileType (hFile=0x430) returned 0x1 [0104.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9b4) returned 1 [0104.242] GetFileType (hFile=0x430) returned 0x1 [0104.242] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eab4 | out: lpFileSizeHigh=0x19eab4*=0x0) returned 0xc936 [0104.242] ReadFile (in: hFile=0x430, lpBuffer=0x2498788, nNumberOfBytesToRead=0xc936, lpNumberOfBytesRead=0x19ea60, lpOverlapped=0x0 | out: lpBuffer=0x2498788*, lpNumberOfBytesRead=0x19ea60*=0xc936, lpOverlapped=0x0) returned 1 [0104.243] CloseHandle (hObject=0x430) returned 1 [0104.261] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\Z dQO.rtf", nBufferLength=0x105, lpBuffer=0x19e45c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\Z dQO.rtf", lpFilePart=0x0) returned 0x35 [0104.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9a0) returned 1 [0104.261] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\Z dQO.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ffpcv0otw7 vkbuyv\\z dqo.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0104.262] GetFileType (hFile=0x430) returned 0x1 [0104.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e99c) returned 1 [0104.262] GetFileType (hFile=0x430) returned 0x1 [0104.262] WriteFile (in: hFile=0x430, lpBuffer=0x250b148*, nNumberOfBytesToWrite=0xc940, lpNumberOfBytesWritten=0x19ea50, lpOverlapped=0x0 | out: lpBuffer=0x250b148*, lpNumberOfBytesWritten=0x19ea50*=0xc940, lpOverlapped=0x0) returned 1 [0104.264] CloseHandle (hObject=0x430) returned 1 [0104.266] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\Z dQO.rtf", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\Z dQO.rtf", lpFilePart=0x0) returned 0x35 [0104.267] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\Z dQO.rtf.lasan", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\Z dQO.rtf.lasan", lpFilePart=0x0) returned 0x3b [0104.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea34) returned 1 [0104.267] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\Z dQO.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ffpcv0otw7 vkbuyv\\z dqo.rtf"), fInfoLevelId=0x0, lpFileInformation=0x19eab0 | out: lpFileInformation=0x19eab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65e76340, ftCreationTime.dwHighDateTime=0x1d5d4e5, ftLastAccessTime.dwLowDateTime=0x2509b470, ftLastAccessTime.dwHighDateTime=0x1d5cca9, ftLastWriteTime.dwLowDateTime=0xc3c15d0e, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0xc940)) returned 1 [0104.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea30) returned 1 [0104.267] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\Z dQO.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ffpcv0otw7 vkbuyv\\z dqo.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\fFPcv0oTW7 vKBUYV\\Z dQO.rtf.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\ffpcv0otw7 vkbuyv\\z dqo.rtf.lasan")) returned 1 [0104.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eacc) returned 1 [0104.267] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Music", lpFilePart=0x0) returned 0x22 [0104.268] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Music\\*", lpFindFileData=0x19e7f4 | out: lpFindFileData=0x19e7f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0104.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea90) returned 1 [0104.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eacc) returned 1 [0104.332] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Pictures", lpFilePart=0x0) returned 0x25 [0104.332] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Pictures\\*", lpFindFileData=0x19e7f4 | out: lpFindFileData=0x19e7f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0104.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea90) returned 1 [0104.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eacc) returned 1 [0104.335] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes", lpFilePart=0x0) returned 0x23 [0104.335] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*", lpFindFileData=0x19e7f4 | out: lpFindFileData=0x19e7f4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6335e8 [0104.336] FindNextFileW (in: hFindFile=0x6335e8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.337] FindNextFileW (in: hFindFile=0x6335e8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0104.337] FindNextFileW (in: hFindFile=0x6335e8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1a0f60e, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1a0f60e, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites.vssx", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0104.337] FindNextFileW (in: hFindFile=0x6335e8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0104.337] FindNextFileW (in: hFindFile=0x6335e8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0 [0104.337] FindClose (in: hFindFile=0x6335e8 | out: hFindFile=0x6335e8) returned 1 [0104.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea88) returned 1 [0104.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea94) returned 1 [0104.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eacc) returned 1 [0104.337] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes", lpFilePart=0x0) returned 0x23 [0104.337] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*", lpFindFileData=0x19e7f4 | out: lpFindFileData=0x19e7f4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x633668 [0104.338] FindNextFileW (in: hFindFile=0x633668, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.338] FindNextFileW (in: hFindFile=0x633668, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0104.338] FindNextFileW (in: hFindFile=0x633668, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1a0f60e, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1a0f60e, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites.vssx", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0104.338] FindNextFileW (in: hFindFile=0x633668, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0104.338] FindNextFileW (in: hFindFile=0x633668, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0104.338] FindClose (in: hFindFile=0x633668 | out: hFindFile=0x633668) returned 1 [0104.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea88) returned 1 [0104.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea94) returned 1 [0104.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0104.339] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x2c [0104.339] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x19e7a8 | out: lpFindFileData=0x19e7a8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6339a8 [0104.340] FindNextFileW (in: hFindFile=0x6339a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.340] FindNextFileW (in: hFindFile=0x6339a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0104.340] FindNextFileW (in: hFindFile=0x6339a8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0104.340] FindClose (in: hFindFile=0x6339a8 | out: hFindFile=0x6339a8) returned 1 [0104.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea3c) returned 1 [0104.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea48) returned 1 [0104.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0104.340] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x2c [0104.340] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x19e7a8 | out: lpFindFileData=0x19e7a8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6338e8 [0104.340] FindNextFileW (in: hFindFile=0x6338e8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.341] FindNextFileW (in: hFindFile=0x6338e8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0104.341] FindNextFileW (in: hFindFile=0x6338e8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0104.341] FindClose (in: hFindFile=0x6338e8 | out: hFindFile=0x6338e8) returned 1 [0104.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea3c) returned 1 [0104.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea48) returned 1 [0104.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eacc) returned 1 [0104.341] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Videos", lpFilePart=0x0) returned 0x23 [0104.341] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Videos\\*", lpFindFileData=0x19e7f4 | out: lpFindFileData=0x19e7f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0104.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea90) returned 1 [0104.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eacc) returned 1 [0104.343] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf", lpFilePart=0x0) returned 0x24 [0104.343] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\*", lpFindFileData=0x19e7f4 | out: lpFindFileData=0x19e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa985bc10, ftCreationTime.dwHighDateTime=0x1d5d115, ftLastAccessTime.dwLowDateTime=0xa1610ba0, ftLastAccessTime.dwHighDateTime=0x1d5d36f, ftLastWriteTime.dwLowDateTime=0xa1610ba0, ftLastWriteTime.dwHighDateTime=0x1d5d36f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6335e8 [0104.343] FindNextFileW (in: hFindFile=0x6335e8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa985bc10, ftCreationTime.dwHighDateTime=0x1d5d115, ftLastAccessTime.dwLowDateTime=0xa1610ba0, ftLastAccessTime.dwHighDateTime=0x1d5d36f, ftLastWriteTime.dwLowDateTime=0xa1610ba0, ftLastWriteTime.dwHighDateTime=0x1d5d36f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.343] FindNextFileW (in: hFindFile=0x6335e8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30090b40, ftCreationTime.dwHighDateTime=0x1d5cf75, ftLastAccessTime.dwLowDateTime=0x2e6b5f30, ftLastAccessTime.dwHighDateTime=0x1d5cfd5, ftLastWriteTime.dwLowDateTime=0x2e6b5f30, ftLastWriteTime.dwHighDateTime=0x1d5cfd5, nFileSizeHigh=0x0, nFileSizeLow=0xf05a, dwReserved0=0x0, dwReserved1=0x0, cFileName="9oZTTRM4G.pdf", cAlternateFileName="9OZTTR~1.PDF")) returned 1 [0104.344] FindNextFileW (in: hFindFile=0x6335e8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14767570, ftCreationTime.dwHighDateTime=0x1d5d4e3, ftLastAccessTime.dwLowDateTime=0x931b0bd0, ftLastAccessTime.dwHighDateTime=0x1d5d726, ftLastWriteTime.dwLowDateTime=0x931b0bd0, ftLastWriteTime.dwHighDateTime=0x1d5d726, nFileSizeHigh=0x0, nFileSizeLow=0x8c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ahdNjq1kq-8QA.odt", cAlternateFileName="AHDNJQ~1.ODT")) returned 1 [0104.344] FindNextFileW (in: hFindFile=0x6335e8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18d70e90, ftCreationTime.dwHighDateTime=0x1d5d5e2, ftLastAccessTime.dwLowDateTime=0x47a00030, ftLastAccessTime.dwHighDateTime=0x1d5cfeb, ftLastWriteTime.dwLowDateTime=0x47a00030, ftLastWriteTime.dwHighDateTime=0x1d5cfeb, nFileSizeHigh=0x0, nFileSizeLow=0x13cd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bx2QtU.odt", cAlternateFileName="")) returned 1 [0104.344] FindNextFileW (in: hFindFile=0x6335e8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x933c4980, ftCreationTime.dwHighDateTime=0x1d5c7fe, ftLastAccessTime.dwLowDateTime=0x7e3c47a0, ftLastAccessTime.dwHighDateTime=0x1d5cbb0, ftLastWriteTime.dwLowDateTime=0x7e3c47a0, ftLastWriteTime.dwHighDateTime=0x1d5cbb0, nFileSizeHigh=0x0, nFileSizeLow=0xb8af, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_9oHH.odp", cAlternateFileName="")) returned 1 [0104.345] FindNextFileW (in: hFindFile=0x6335e8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6a22970, ftCreationTime.dwHighDateTime=0x1d5cd0a, ftLastAccessTime.dwLowDateTime=0x66d7bbb0, ftLastAccessTime.dwHighDateTime=0x1d5caea, ftLastWriteTime.dwLowDateTime=0x66d7bbb0, ftLastWriteTime.dwHighDateTime=0x1d5caea, nFileSizeHigh=0x0, nFileSizeLow=0x3fa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="HwfkvzWo.xls", cAlternateFileName="")) returned 1 [0104.345] FindNextFileW (in: hFindFile=0x6335e8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a878e30, ftCreationTime.dwHighDateTime=0x1d5d21f, ftLastAccessTime.dwLowDateTime=0xcfb38dc0, ftLastAccessTime.dwHighDateTime=0x1d5d036, ftLastWriteTime.dwLowDateTime=0xcfb38dc0, ftLastWriteTime.dwHighDateTime=0x1d5d036, nFileSizeHigh=0x0, nFileSizeLow=0xeb9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="l-Nqcvz7S5g.ods", cAlternateFileName="L-NQCV~1.ODS")) returned 1 [0104.345] FindNextFileW (in: hFindFile=0x6335e8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43fdc320, ftCreationTime.dwHighDateTime=0x1d5cc7d, ftLastAccessTime.dwLowDateTime=0xd8cb87e0, ftLastAccessTime.dwHighDateTime=0x1d5d62c, ftLastWriteTime.dwLowDateTime=0xd8cb87e0, ftLastWriteTime.dwHighDateTime=0x1d5d62c, nFileSizeHigh=0x0, nFileSizeLow=0x4289, dwReserved0=0x0, dwReserved1=0x0, cFileName="PQaRd2qhvv-E05.xlsx", cAlternateFileName="PQARD2~1.XLS")) returned 1 [0104.345] FindNextFileW (in: hFindFile=0x6335e8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0104.345] FindClose (in: hFindFile=0x6335e8 | out: hFindFile=0x6335e8) returned 1 [0104.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea88) returned 1 [0104.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea94) returned 1 [0104.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eacc) returned 1 [0104.345] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf", lpFilePart=0x0) returned 0x24 [0104.345] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\*", lpFindFileData=0x19e7f4 | out: lpFindFileData=0x19e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa985bc10, ftCreationTime.dwHighDateTime=0x1d5d115, ftLastAccessTime.dwLowDateTime=0xa1610ba0, ftLastAccessTime.dwHighDateTime=0x1d5d36f, ftLastWriteTime.dwLowDateTime=0xa1610ba0, ftLastWriteTime.dwHighDateTime=0x1d5d36f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x633b28 [0104.346] FindNextFileW (in: hFindFile=0x633b28, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa985bc10, ftCreationTime.dwHighDateTime=0x1d5d115, ftLastAccessTime.dwLowDateTime=0xa1610ba0, ftLastAccessTime.dwHighDateTime=0x1d5d36f, ftLastWriteTime.dwLowDateTime=0xa1610ba0, ftLastWriteTime.dwHighDateTime=0x1d5d36f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.346] FindNextFileW (in: hFindFile=0x633b28, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30090b40, ftCreationTime.dwHighDateTime=0x1d5cf75, ftLastAccessTime.dwLowDateTime=0x2e6b5f30, ftLastAccessTime.dwHighDateTime=0x1d5cfd5, ftLastWriteTime.dwLowDateTime=0x2e6b5f30, ftLastWriteTime.dwHighDateTime=0x1d5cfd5, nFileSizeHigh=0x0, nFileSizeLow=0xf05a, dwReserved0=0x0, dwReserved1=0x0, cFileName="9oZTTRM4G.pdf", cAlternateFileName="9OZTTR~1.PDF")) returned 1 [0104.346] FindNextFileW (in: hFindFile=0x633b28, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14767570, ftCreationTime.dwHighDateTime=0x1d5d4e3, ftLastAccessTime.dwLowDateTime=0x931b0bd0, ftLastAccessTime.dwHighDateTime=0x1d5d726, ftLastWriteTime.dwLowDateTime=0x931b0bd0, ftLastWriteTime.dwHighDateTime=0x1d5d726, nFileSizeHigh=0x0, nFileSizeLow=0x8c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ahdNjq1kq-8QA.odt", cAlternateFileName="AHDNJQ~1.ODT")) returned 1 [0104.346] FindNextFileW (in: hFindFile=0x633b28, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18d70e90, ftCreationTime.dwHighDateTime=0x1d5d5e2, ftLastAccessTime.dwLowDateTime=0x47a00030, ftLastAccessTime.dwHighDateTime=0x1d5cfeb, ftLastWriteTime.dwLowDateTime=0x47a00030, ftLastWriteTime.dwHighDateTime=0x1d5cfeb, nFileSizeHigh=0x0, nFileSizeLow=0x13cd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bx2QtU.odt", cAlternateFileName="")) returned 1 [0104.346] FindNextFileW (in: hFindFile=0x633b28, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x933c4980, ftCreationTime.dwHighDateTime=0x1d5c7fe, ftLastAccessTime.dwLowDateTime=0x7e3c47a0, ftLastAccessTime.dwHighDateTime=0x1d5cbb0, ftLastWriteTime.dwLowDateTime=0x7e3c47a0, ftLastWriteTime.dwHighDateTime=0x1d5cbb0, nFileSizeHigh=0x0, nFileSizeLow=0xb8af, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_9oHH.odp", cAlternateFileName="")) returned 1 [0104.346] FindNextFileW (in: hFindFile=0x633b28, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6a22970, ftCreationTime.dwHighDateTime=0x1d5cd0a, ftLastAccessTime.dwLowDateTime=0x66d7bbb0, ftLastAccessTime.dwHighDateTime=0x1d5caea, ftLastWriteTime.dwLowDateTime=0x66d7bbb0, ftLastWriteTime.dwHighDateTime=0x1d5caea, nFileSizeHigh=0x0, nFileSizeLow=0x3fa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="HwfkvzWo.xls", cAlternateFileName="")) returned 1 [0104.347] FindNextFileW (in: hFindFile=0x633b28, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a878e30, ftCreationTime.dwHighDateTime=0x1d5d21f, ftLastAccessTime.dwLowDateTime=0xcfb38dc0, ftLastAccessTime.dwHighDateTime=0x1d5d036, ftLastWriteTime.dwLowDateTime=0xcfb38dc0, ftLastWriteTime.dwHighDateTime=0x1d5d036, nFileSizeHigh=0x0, nFileSizeLow=0xeb9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="l-Nqcvz7S5g.ods", cAlternateFileName="L-NQCV~1.ODS")) returned 1 [0104.347] FindNextFileW (in: hFindFile=0x633b28, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43fdc320, ftCreationTime.dwHighDateTime=0x1d5cc7d, ftLastAccessTime.dwLowDateTime=0xd8cb87e0, ftLastAccessTime.dwHighDateTime=0x1d5d62c, ftLastWriteTime.dwLowDateTime=0xd8cb87e0, ftLastWriteTime.dwHighDateTime=0x1d5d62c, nFileSizeHigh=0x0, nFileSizeLow=0x4289, dwReserved0=0x0, dwReserved1=0x0, cFileName="PQaRd2qhvv-E05.xlsx", cAlternateFileName="PQARD2~1.XLS")) returned 1 [0104.347] FindNextFileW (in: hFindFile=0x633b28, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43fdc320, ftCreationTime.dwHighDateTime=0x1d5cc7d, ftLastAccessTime.dwLowDateTime=0xd8cb87e0, ftLastAccessTime.dwHighDateTime=0x1d5d62c, ftLastWriteTime.dwLowDateTime=0xd8cb87e0, ftLastWriteTime.dwHighDateTime=0x1d5d62c, nFileSizeHigh=0x0, nFileSizeLow=0x4289, dwReserved0=0x0, dwReserved1=0x0, cFileName="PQaRd2qhvv-E05.xlsx", cAlternateFileName="PQARD2~1.XLS")) returned 0 [0104.347] FindClose (in: hFindFile=0x633b28 | out: hFindFile=0x633b28) returned 1 [0104.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea88) returned 1 [0104.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea94) returned 1 [0104.347] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\ahdNjq1kq-8QA.odt", nBufferLength=0x105, lpBuffer=0x19e474, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\ahdNjq1kq-8QA.odt", lpFilePart=0x0) returned 0x36 [0104.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9b8) returned 1 [0104.347] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\ahdNjq1kq-8QA.odt" (normalized: "c:\\users\\fd1hvy\\documents\\og53nkpaof\\ahdnjq1kq-8qa.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0104.347] GetFileType (hFile=0x430) returned 0x1 [0104.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9b4) returned 1 [0104.347] GetFileType (hFile=0x430) returned 0x1 [0104.348] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eab4 | out: lpFileSizeHigh=0x19eab4*=0x0) returned 0x8c9 [0104.348] ReadFile (in: hFile=0x430, lpBuffer=0x252098c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ea60, lpOverlapped=0x0 | out: lpBuffer=0x252098c*, lpNumberOfBytesRead=0x19ea60*=0x8c9, lpOverlapped=0x0) returned 1 [0104.348] CloseHandle (hObject=0x430) returned 1 [0104.449] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\ahdNjq1kq-8QA.odt", nBufferLength=0x105, lpBuffer=0x19e45c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\ahdNjq1kq-8QA.odt", lpFilePart=0x0) returned 0x36 [0104.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9a0) returned 1 [0104.449] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\ahdNjq1kq-8QA.odt" (normalized: "c:\\users\\fd1hvy\\documents\\og53nkpaof\\ahdnjq1kq-8qa.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0104.450] GetFileType (hFile=0x430) returned 0x1 [0104.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e99c) returned 1 [0104.450] GetFileType (hFile=0x430) returned 0x1 [0104.450] WriteFile (in: hFile=0x430, lpBuffer=0x25714a0*, nNumberOfBytesToWrite=0x8d0, lpNumberOfBytesWritten=0x19ea24, lpOverlapped=0x0 | out: lpBuffer=0x25714a0*, lpNumberOfBytesWritten=0x19ea24*=0x8d0, lpOverlapped=0x0) returned 1 [0104.451] CloseHandle (hObject=0x430) returned 1 [0104.452] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\ahdNjq1kq-8QA.odt", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\ahdNjq1kq-8QA.odt", lpFilePart=0x0) returned 0x36 [0104.452] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\ahdNjq1kq-8QA.odt.lasan", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\ahdNjq1kq-8QA.odt.lasan", lpFilePart=0x0) returned 0x3c [0104.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea34) returned 1 [0104.452] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\ahdNjq1kq-8QA.odt" (normalized: "c:\\users\\fd1hvy\\documents\\og53nkpaof\\ahdnjq1kq-8qa.odt"), fInfoLevelId=0x0, lpFileInformation=0x19eab0 | out: lpFileInformation=0x19eab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14767570, ftCreationTime.dwHighDateTime=0x1d5d4e3, ftLastAccessTime.dwLowDateTime=0x931b0bd0, ftLastAccessTime.dwHighDateTime=0x1d5d726, ftLastWriteTime.dwLowDateTime=0xc3dbae67, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x8d0)) returned 1 [0104.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea30) returned 1 [0104.452] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\ahdNjq1kq-8QA.odt" (normalized: "c:\\users\\fd1hvy\\documents\\og53nkpaof\\ahdnjq1kq-8qa.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\ahdNjq1kq-8QA.odt.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\og53nkpaof\\ahdnjq1kq-8qa.odt.lasan")) returned 1 [0104.453] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\Bx2QtU.odt", nBufferLength=0x105, lpBuffer=0x19e474, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\Bx2QtU.odt", lpFilePart=0x0) returned 0x2f [0104.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9b8) returned 1 [0104.453] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\Bx2QtU.odt" (normalized: "c:\\users\\fd1hvy\\documents\\og53nkpaof\\bx2qtu.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0104.453] GetFileType (hFile=0x430) returned 0x1 [0104.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9b4) returned 1 [0104.453] GetFileType (hFile=0x430) returned 0x1 [0104.453] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eab4 | out: lpFileSizeHigh=0x19eab4*=0x0) returned 0x13cd6 [0104.453] ReadFile (in: hFile=0x430, lpBuffer=0x2572758, nNumberOfBytesToRead=0x13cd6, lpNumberOfBytesRead=0x19ea60, lpOverlapped=0x0 | out: lpBuffer=0x2572758*, lpNumberOfBytesRead=0x19ea60*=0x13cd6, lpOverlapped=0x0) returned 1 [0104.454] CloseHandle (hObject=0x430) returned 1 [0104.521] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\Bx2QtU.odt", nBufferLength=0x105, lpBuffer=0x19e45c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\Bx2QtU.odt", lpFilePart=0x0) returned 0x2f [0104.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9a0) returned 1 [0104.521] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\Bx2QtU.odt" (normalized: "c:\\users\\fd1hvy\\documents\\og53nkpaof\\bx2qtu.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0104.523] GetFileType (hFile=0x430) returned 0x1 [0104.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e99c) returned 1 [0104.523] GetFileType (hFile=0x430) returned 0x1 [0104.523] WriteFile (in: hFile=0x430, lpBuffer=0x25fabf8*, nNumberOfBytesToWrite=0x13ce0, lpNumberOfBytesWritten=0x19ea50, lpOverlapped=0x0 | out: lpBuffer=0x25fabf8*, lpNumberOfBytesWritten=0x19ea50*=0x13ce0, lpOverlapped=0x0) returned 1 [0104.525] CloseHandle (hObject=0x430) returned 1 [0104.527] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\Bx2QtU.odt", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\Bx2QtU.odt", lpFilePart=0x0) returned 0x2f [0104.527] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\Bx2QtU.odt.lasan", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\Bx2QtU.odt.lasan", lpFilePart=0x0) returned 0x35 [0104.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea34) returned 1 [0104.527] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\Bx2QtU.odt" (normalized: "c:\\users\\fd1hvy\\documents\\og53nkpaof\\bx2qtu.odt"), fInfoLevelId=0x0, lpFileInformation=0x19eab0 | out: lpFileInformation=0x19eab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18d70e90, ftCreationTime.dwHighDateTime=0x1d5d5e2, ftLastAccessTime.dwLowDateTime=0x47a00030, ftLastAccessTime.dwHighDateTime=0x1d5cfeb, ftLastWriteTime.dwLowDateTime=0xc3e79d9d, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x13ce0)) returned 1 [0104.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea30) returned 1 [0104.527] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\Bx2QtU.odt" (normalized: "c:\\users\\fd1hvy\\documents\\og53nkpaof\\bx2qtu.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\Bx2QtU.odt.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\og53nkpaof\\bx2qtu.odt.lasan")) returned 1 [0104.528] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\HwfkvzWo.xls", nBufferLength=0x105, lpBuffer=0x19e474, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\HwfkvzWo.xls", lpFilePart=0x0) returned 0x31 [0104.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9b8) returned 1 [0104.528] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\HwfkvzWo.xls" (normalized: "c:\\users\\fd1hvy\\documents\\og53nkpaof\\hwfkvzwo.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0104.528] GetFileType (hFile=0x430) returned 0x1 [0104.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9b4) returned 1 [0104.528] GetFileType (hFile=0x430) returned 0x1 [0104.528] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eab4 | out: lpFileSizeHigh=0x19eab4*=0x0) returned 0x3fa2 [0104.580] ReadFile (in: hFile=0x430, lpBuffer=0x23e9f40, nNumberOfBytesToRead=0x3fa2, lpNumberOfBytesRead=0x19ea60, lpOverlapped=0x0 | out: lpBuffer=0x23e9f40*, lpNumberOfBytesRead=0x19ea60*=0x3fa2, lpOverlapped=0x0) returned 1 [0104.581] CloseHandle (hObject=0x430) returned 1 [0104.682] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\HwfkvzWo.xls", nBufferLength=0x105, lpBuffer=0x19e45c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\HwfkvzWo.xls", lpFilePart=0x0) returned 0x31 [0104.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9a0) returned 1 [0104.682] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\HwfkvzWo.xls" (normalized: "c:\\users\\fd1hvy\\documents\\og53nkpaof\\hwfkvzwo.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0104.683] GetFileType (hFile=0x430) returned 0x1 [0104.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e99c) returned 1 [0104.683] GetFileType (hFile=0x430) returned 0x1 [0104.683] WriteFile (in: hFile=0x430, lpBuffer=0x244acf8*, nNumberOfBytesToWrite=0x3fb0, lpNumberOfBytesWritten=0x19ea50, lpOverlapped=0x0 | out: lpBuffer=0x244acf8*, lpNumberOfBytesWritten=0x19ea50*=0x3fb0, lpOverlapped=0x0) returned 1 [0104.684] CloseHandle (hObject=0x430) returned 1 [0104.686] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\HwfkvzWo.xls", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\HwfkvzWo.xls", lpFilePart=0x0) returned 0x31 [0104.686] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\HwfkvzWo.xls.lasan", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\HwfkvzWo.xls.lasan", lpFilePart=0x0) returned 0x37 [0104.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea34) returned 1 [0104.686] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\HwfkvzWo.xls" (normalized: "c:\\users\\fd1hvy\\documents\\og53nkpaof\\hwfkvzwo.xls"), fInfoLevelId=0x0, lpFileInformation=0x19eab0 | out: lpFileInformation=0x19eab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6a22970, ftCreationTime.dwHighDateTime=0x1d5cd0a, ftLastAccessTime.dwLowDateTime=0x66d7bbb0, ftLastAccessTime.dwHighDateTime=0x1d5caea, ftLastWriteTime.dwLowDateTime=0xc3ff7202, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x3fb0)) returned 1 [0104.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea30) returned 1 [0104.686] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\HwfkvzWo.xls" (normalized: "c:\\users\\fd1hvy\\documents\\og53nkpaof\\hwfkvzwo.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\HwfkvzWo.xls.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\og53nkpaof\\hwfkvzwo.xls.lasan")) returned 1 [0104.687] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\PQaRd2qhvv-E05.xlsx", nBufferLength=0x105, lpBuffer=0x19e474, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\PQaRd2qhvv-E05.xlsx", lpFilePart=0x0) returned 0x38 [0104.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9b8) returned 1 [0104.687] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\PQaRd2qhvv-E05.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\og53nkpaof\\pqard2qhvv-e05.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0104.687] GetFileType (hFile=0x430) returned 0x1 [0104.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9b4) returned 1 [0104.687] GetFileType (hFile=0x430) returned 0x1 [0104.687] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eab4 | out: lpFileSizeHigh=0x19eab4*=0x0) returned 0x4289 [0104.687] ReadFile (in: hFile=0x430, lpBuffer=0x244f06c, nNumberOfBytesToRead=0x4289, lpNumberOfBytesRead=0x19ea60, lpOverlapped=0x0 | out: lpBuffer=0x244f06c*, lpNumberOfBytesRead=0x19ea60*=0x4289, lpOverlapped=0x0) returned 1 [0104.687] CloseHandle (hObject=0x430) returned 1 [0104.703] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\PQaRd2qhvv-E05.xlsx", nBufferLength=0x105, lpBuffer=0x19e45c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\PQaRd2qhvv-E05.xlsx", lpFilePart=0x0) returned 0x38 [0104.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9a0) returned 1 [0104.703] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\PQaRd2qhvv-E05.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\og53nkpaof\\pqard2qhvv-e05.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0104.705] GetFileType (hFile=0x430) returned 0x1 [0104.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e99c) returned 1 [0104.705] GetFileType (hFile=0x430) returned 0x1 [0104.705] WriteFile (in: hFile=0x430, lpBuffer=0x24b0b28*, nNumberOfBytesToWrite=0x4290, lpNumberOfBytesWritten=0x19ea50, lpOverlapped=0x0 | out: lpBuffer=0x24b0b28*, lpNumberOfBytesWritten=0x19ea50*=0x4290, lpOverlapped=0x0) returned 1 [0104.706] CloseHandle (hObject=0x430) returned 1 [0104.708] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\PQaRd2qhvv-E05.xlsx", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\PQaRd2qhvv-E05.xlsx", lpFilePart=0x0) returned 0x38 [0104.708] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\PQaRd2qhvv-E05.xlsx.lasan", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\PQaRd2qhvv-E05.xlsx.lasan", lpFilePart=0x0) returned 0x3e [0104.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea34) returned 1 [0104.708] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\PQaRd2qhvv-E05.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\og53nkpaof\\pqard2qhvv-e05.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19eab0 | out: lpFileInformation=0x19eab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43fdc320, ftCreationTime.dwHighDateTime=0x1d5cc7d, ftLastAccessTime.dwLowDateTime=0xd8cb87e0, ftLastAccessTime.dwHighDateTime=0x1d5d62c, ftLastWriteTime.dwLowDateTime=0xc4043998, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x4290)) returned 1 [0104.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea30) returned 1 [0104.708] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\PQaRd2qhvv-E05.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\og53nkpaof\\pqard2qhvv-e05.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\og53NkPAOf\\PQaRd2qhvv-E05.xlsx.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\og53nkpaof\\pqard2qhvv-e05.xlsx.lasan")) returned 1 [0104.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eacc) returned 1 [0104.709] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x27 [0104.709] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*", lpFindFileData=0x19e7f4 | out: lpFindFileData=0x19e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6337e8 [0104.710] FindNextFileW (in: hFindFile=0x6337e8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.711] FindNextFileW (in: hFindFile=0x6337e8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddbf9d33, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 1 [0104.711] FindNextFileW (in: hFindFile=0x6337e8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0104.711] FindClose (in: hFindFile=0x6337e8 | out: hFindFile=0x6337e8) returned 1 [0104.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea88) returned 1 [0104.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea94) returned 1 [0104.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eacc) returned 1 [0104.711] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x27 [0104.711] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*", lpFindFileData=0x19e7f4 | out: lpFindFileData=0x19e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6333a8 [0104.712] FindNextFileW (in: hFindFile=0x6333a8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.712] FindNextFileW (in: hFindFile=0x6333a8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddbf9d33, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 1 [0104.712] FindNextFileW (in: hFindFile=0x6333a8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddbf9d33, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 0 [0104.712] FindClose (in: hFindFile=0x6333a8 | out: hFindFile=0x6333a8) returned 1 [0104.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea88) returned 1 [0104.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea94) returned 1 [0104.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eacc) returned 1 [0104.712] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W", lpFilePart=0x0) returned 0x28 [0104.713] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\*", lpFindFileData=0x19e7f4 | out: lpFindFileData=0x19e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa29365c0, ftCreationTime.dwHighDateTime=0x1d5cc4b, ftLastAccessTime.dwLowDateTime=0x38c042c0, ftLastAccessTime.dwHighDateTime=0x1d5c96d, ftLastWriteTime.dwLowDateTime=0x38c042c0, ftLastWriteTime.dwHighDateTime=0x1d5c96d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x633ae8 [0104.713] FindNextFileW (in: hFindFile=0x633ae8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa29365c0, ftCreationTime.dwHighDateTime=0x1d5cc4b, ftLastAccessTime.dwLowDateTime=0x38c042c0, ftLastAccessTime.dwHighDateTime=0x1d5c96d, ftLastWriteTime.dwLowDateTime=0x38c042c0, ftLastWriteTime.dwHighDateTime=0x1d5c96d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.713] FindNextFileW (in: hFindFile=0x633ae8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeaa3b30, ftCreationTime.dwHighDateTime=0x1d5ced6, ftLastAccessTime.dwLowDateTime=0x1c9363a0, ftLastAccessTime.dwHighDateTime=0x1d5c947, ftLastWriteTime.dwLowDateTime=0x1c9363a0, ftLastWriteTime.dwHighDateTime=0x1d5c947, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="npsjwiD", cAlternateFileName="")) returned 1 [0104.713] FindNextFileW (in: hFindFile=0x633ae8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b32f6e0, ftCreationTime.dwHighDateTime=0x1d5cb97, ftLastAccessTime.dwLowDateTime=0xd9142a40, ftLastAccessTime.dwHighDateTime=0x1d5c9a2, ftLastWriteTime.dwLowDateTime=0xd9142a40, ftLastWriteTime.dwHighDateTime=0x1d5c9a2, nFileSizeHigh=0x0, nFileSizeLow=0x15253, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oacu8TyuIDUZsYf.pps", cAlternateFileName="OACU8T~1.PPS")) returned 1 [0104.714] FindNextFileW (in: hFindFile=0x633ae8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x129e8e70, ftCreationTime.dwHighDateTime=0x1d5cb9e, ftLastAccessTime.dwLowDateTime=0x6293fd90, ftLastAccessTime.dwHighDateTime=0x1d5d137, ftLastWriteTime.dwLowDateTime=0x6293fd90, ftLastWriteTime.dwHighDateTime=0x1d5d137, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qFAlS26m8ilmiqpho8c", cAlternateFileName="QFALS2~1")) returned 1 [0104.714] FindNextFileW (in: hFindFile=0x633ae8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa56b4780, ftCreationTime.dwHighDateTime=0x1d5d2e6, ftLastAccessTime.dwLowDateTime=0x705cf8e0, ftLastAccessTime.dwHighDateTime=0x1d5d6ba, ftLastWriteTime.dwLowDateTime=0x705cf8e0, ftLastWriteTime.dwHighDateTime=0x1d5d6ba, nFileSizeHigh=0x0, nFileSizeLow=0x9a8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="sn31xUbccjZGN.pptx", cAlternateFileName="SN31XU~1.PPT")) returned 1 [0104.714] FindNextFileW (in: hFindFile=0x633ae8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9ef4090, ftCreationTime.dwHighDateTime=0x1d5cd28, ftLastAccessTime.dwLowDateTime=0x2937bb10, ftLastAccessTime.dwHighDateTime=0x1d5d5db, ftLastWriteTime.dwLowDateTime=0x2937bb10, ftLastWriteTime.dwHighDateTime=0x1d5d5db, nFileSizeHigh=0x0, nFileSizeLow=0x66e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="vrBRfWRhNhPq3EdW.ppt", cAlternateFileName="VRBRFW~1.PPT")) returned 1 [0104.714] FindNextFileW (in: hFindFile=0x633ae8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd089620, ftCreationTime.dwHighDateTime=0x1d5d401, ftLastAccessTime.dwLowDateTime=0xb5348c80, ftLastAccessTime.dwHighDateTime=0x1d5cd2d, ftLastWriteTime.dwLowDateTime=0xb5348c80, ftLastWriteTime.dwHighDateTime=0x1d5cd2d, nFileSizeHigh=0x0, nFileSizeLow=0x7bb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="YGfgabH7Z.xls", cAlternateFileName="YGFGAB~1.XLS")) returned 1 [0104.714] FindNextFileW (in: hFindFile=0x633ae8, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0104.714] FindClose (in: hFindFile=0x633ae8 | out: hFindFile=0x633ae8) returned 1 [0104.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea88) returned 1 [0104.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea94) returned 1 [0104.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eacc) returned 1 [0104.715] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W", lpFilePart=0x0) returned 0x28 [0104.715] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\*", lpFindFileData=0x19e7f4 | out: lpFindFileData=0x19e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa29365c0, ftCreationTime.dwHighDateTime=0x1d5cc4b, ftLastAccessTime.dwLowDateTime=0x38c042c0, ftLastAccessTime.dwHighDateTime=0x1d5c96d, ftLastWriteTime.dwLowDateTime=0x38c042c0, ftLastWriteTime.dwHighDateTime=0x1d5c96d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x633a28 [0104.715] FindNextFileW (in: hFindFile=0x633a28, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa29365c0, ftCreationTime.dwHighDateTime=0x1d5cc4b, ftLastAccessTime.dwLowDateTime=0x38c042c0, ftLastAccessTime.dwHighDateTime=0x1d5c96d, ftLastWriteTime.dwLowDateTime=0x38c042c0, ftLastWriteTime.dwHighDateTime=0x1d5c96d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.715] FindNextFileW (in: hFindFile=0x633a28, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeaa3b30, ftCreationTime.dwHighDateTime=0x1d5ced6, ftLastAccessTime.dwLowDateTime=0x1c9363a0, ftLastAccessTime.dwHighDateTime=0x1d5c947, ftLastWriteTime.dwLowDateTime=0x1c9363a0, ftLastWriteTime.dwHighDateTime=0x1d5c947, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="npsjwiD", cAlternateFileName="")) returned 1 [0104.715] FindNextFileW (in: hFindFile=0x633a28, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b32f6e0, ftCreationTime.dwHighDateTime=0x1d5cb97, ftLastAccessTime.dwLowDateTime=0xd9142a40, ftLastAccessTime.dwHighDateTime=0x1d5c9a2, ftLastWriteTime.dwLowDateTime=0xd9142a40, ftLastWriteTime.dwHighDateTime=0x1d5c9a2, nFileSizeHigh=0x0, nFileSizeLow=0x15253, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oacu8TyuIDUZsYf.pps", cAlternateFileName="OACU8T~1.PPS")) returned 1 [0104.716] FindNextFileW (in: hFindFile=0x633a28, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x129e8e70, ftCreationTime.dwHighDateTime=0x1d5cb9e, ftLastAccessTime.dwLowDateTime=0x6293fd90, ftLastAccessTime.dwHighDateTime=0x1d5d137, ftLastWriteTime.dwLowDateTime=0x6293fd90, ftLastWriteTime.dwHighDateTime=0x1d5d137, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qFAlS26m8ilmiqpho8c", cAlternateFileName="QFALS2~1")) returned 1 [0104.716] FindNextFileW (in: hFindFile=0x633a28, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa56b4780, ftCreationTime.dwHighDateTime=0x1d5d2e6, ftLastAccessTime.dwLowDateTime=0x705cf8e0, ftLastAccessTime.dwHighDateTime=0x1d5d6ba, ftLastWriteTime.dwLowDateTime=0x705cf8e0, ftLastWriteTime.dwHighDateTime=0x1d5d6ba, nFileSizeHigh=0x0, nFileSizeLow=0x9a8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="sn31xUbccjZGN.pptx", cAlternateFileName="SN31XU~1.PPT")) returned 1 [0104.716] FindNextFileW (in: hFindFile=0x633a28, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9ef4090, ftCreationTime.dwHighDateTime=0x1d5cd28, ftLastAccessTime.dwLowDateTime=0x2937bb10, ftLastAccessTime.dwHighDateTime=0x1d5d5db, ftLastWriteTime.dwLowDateTime=0x2937bb10, ftLastWriteTime.dwHighDateTime=0x1d5d5db, nFileSizeHigh=0x0, nFileSizeLow=0x66e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="vrBRfWRhNhPq3EdW.ppt", cAlternateFileName="VRBRFW~1.PPT")) returned 1 [0104.716] FindNextFileW (in: hFindFile=0x633a28, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd089620, ftCreationTime.dwHighDateTime=0x1d5d401, ftLastAccessTime.dwLowDateTime=0xb5348c80, ftLastAccessTime.dwHighDateTime=0x1d5cd2d, ftLastWriteTime.dwLowDateTime=0xb5348c80, ftLastWriteTime.dwHighDateTime=0x1d5cd2d, nFileSizeHigh=0x0, nFileSizeLow=0x7bb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="YGfgabH7Z.xls", cAlternateFileName="YGFGAB~1.XLS")) returned 1 [0104.717] FindNextFileW (in: hFindFile=0x633a28, lpFindFileData=0x19e800 | out: lpFindFileData=0x19e800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd089620, ftCreationTime.dwHighDateTime=0x1d5d401, ftLastAccessTime.dwLowDateTime=0xb5348c80, ftLastAccessTime.dwHighDateTime=0x1d5cd2d, ftLastWriteTime.dwLowDateTime=0xb5348c80, ftLastWriteTime.dwHighDateTime=0x1d5cd2d, nFileSizeHigh=0x0, nFileSizeLow=0x7bb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="YGfgabH7Z.xls", cAlternateFileName="YGFGAB~1.XLS")) returned 0 [0104.717] FindClose (in: hFindFile=0x633a28 | out: hFindFile=0x633a28) returned 1 [0104.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea88) returned 1 [0104.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea94) returned 1 [0104.717] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\sn31xUbccjZGN.pptx", nBufferLength=0x105, lpBuffer=0x19e474, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\sn31xUbccjZGN.pptx", lpFilePart=0x0) returned 0x3b [0104.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9b8) returned 1 [0104.717] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\sn31xUbccjZGN.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\sn31xubccjzgn.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0104.717] GetFileType (hFile=0x430) returned 0x1 [0104.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9b4) returned 1 [0104.717] GetFileType (hFile=0x430) returned 0x1 [0104.717] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eab4 | out: lpFileSizeHigh=0x19eab4*=0x0) returned 0x9a8a [0104.718] ReadFile (in: hFile=0x430, lpBuffer=0x24b8710, nNumberOfBytesToRead=0x9a8a, lpNumberOfBytesRead=0x19ea60, lpOverlapped=0x0 | out: lpBuffer=0x24b8710*, lpNumberOfBytesRead=0x19ea60*=0x9a8a, lpOverlapped=0x0) returned 1 [0104.718] CloseHandle (hObject=0x430) returned 1 [0104.863] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\sn31xUbccjZGN.pptx", nBufferLength=0x105, lpBuffer=0x19e45c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\sn31xUbccjZGN.pptx", lpFilePart=0x0) returned 0x3b [0104.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9a0) returned 1 [0104.863] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\sn31xUbccjZGN.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\sn31xubccjzgn.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0104.864] GetFileType (hFile=0x430) returned 0x1 [0104.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e99c) returned 1 [0104.865] GetFileType (hFile=0x430) returned 0x1 [0104.865] WriteFile (in: hFile=0x430, lpBuffer=0x25359cc*, nNumberOfBytesToWrite=0x9a90, lpNumberOfBytesWritten=0x19ea50, lpOverlapped=0x0 | out: lpBuffer=0x25359cc*, lpNumberOfBytesWritten=0x19ea50*=0x9a90, lpOverlapped=0x0) returned 1 [0104.866] CloseHandle (hObject=0x430) returned 1 [0104.868] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\sn31xUbccjZGN.pptx", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\sn31xUbccjZGN.pptx", lpFilePart=0x0) returned 0x3b [0104.868] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\sn31xUbccjZGN.pptx.lasan", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\sn31xUbccjZGN.pptx.lasan", lpFilePart=0x0) returned 0x41 [0104.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea34) returned 1 [0104.868] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\sn31xUbccjZGN.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\sn31xubccjzgn.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19eab0 | out: lpFileInformation=0x19eab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa56b4780, ftCreationTime.dwHighDateTime=0x1d5d2e6, ftLastAccessTime.dwLowDateTime=0x705cf8e0, ftLastAccessTime.dwHighDateTime=0x1d5d6ba, ftLastWriteTime.dwLowDateTime=0xc41c0f35, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x9a90)) returned 1 [0104.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea30) returned 1 [0104.868] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\sn31xUbccjZGN.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\sn31xubccjzgn.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\sn31xUbccjZGN.pptx.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\sn31xubccjzgn.pptx.lasan")) returned 1 [0104.868] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\vrBRfWRhNhPq3EdW.ppt", nBufferLength=0x105, lpBuffer=0x19e474, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\vrBRfWRhNhPq3EdW.ppt", lpFilePart=0x0) returned 0x3d [0104.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9b8) returned 1 [0104.869] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\vrBRfWRhNhPq3EdW.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\vrbrfwrhnhpq3edw.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0104.869] GetFileType (hFile=0x430) returned 0x1 [0104.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9b4) returned 1 [0104.869] GetFileType (hFile=0x430) returned 0x1 [0104.869] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eab4 | out: lpFileSizeHigh=0x19eab4*=0x0) returned 0x66e4 [0104.869] ReadFile (in: hFile=0x430, lpBuffer=0x253f870, nNumberOfBytesToRead=0x66e4, lpNumberOfBytesRead=0x19ea60, lpOverlapped=0x0 | out: lpBuffer=0x253f870*, lpNumberOfBytesRead=0x19ea60*=0x66e4, lpOverlapped=0x0) returned 1 [0104.869] CloseHandle (hObject=0x430) returned 1 [0104.885] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\vrBRfWRhNhPq3EdW.ppt", nBufferLength=0x105, lpBuffer=0x19e45c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\vrBRfWRhNhPq3EdW.ppt", lpFilePart=0x0) returned 0x3d [0104.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9a0) returned 1 [0104.885] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\vrBRfWRhNhPq3EdW.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\vrbrfwrhnhpq3edw.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0104.886] GetFileType (hFile=0x430) returned 0x1 [0104.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e99c) returned 1 [0104.886] GetFileType (hFile=0x430) returned 0x1 [0104.886] WriteFile (in: hFile=0x430, lpBuffer=0x25ac908*, nNumberOfBytesToWrite=0x66f0, lpNumberOfBytesWritten=0x19ea50, lpOverlapped=0x0 | out: lpBuffer=0x25ac908*, lpNumberOfBytesWritten=0x19ea50*=0x66f0, lpOverlapped=0x0) returned 1 [0104.887] CloseHandle (hObject=0x430) returned 1 [0104.889] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\vrBRfWRhNhPq3EdW.ppt", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\vrBRfWRhNhPq3EdW.ppt", lpFilePart=0x0) returned 0x3d [0104.889] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\vrBRfWRhNhPq3EdW.ppt.lasan", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\vrBRfWRhNhPq3EdW.ppt.lasan", lpFilePart=0x0) returned 0x43 [0104.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea34) returned 1 [0104.889] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\vrBRfWRhNhPq3EdW.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\vrbrfwrhnhpq3edw.ppt"), fInfoLevelId=0x0, lpFileInformation=0x19eab0 | out: lpFileInformation=0x19eab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9ef4090, ftCreationTime.dwHighDateTime=0x1d5cd28, ftLastAccessTime.dwLowDateTime=0x2937bb10, ftLastAccessTime.dwHighDateTime=0x1d5d5db, ftLastWriteTime.dwLowDateTime=0xc41e738c, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x66f0)) returned 1 [0104.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea30) returned 1 [0104.889] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\vrBRfWRhNhPq3EdW.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\vrbrfwrhnhpq3edw.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\vrBRfWRhNhPq3EdW.ppt.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\vrbrfwrhnhpq3edw.ppt.lasan")) returned 1 [0104.890] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\YGfgabH7Z.xls", nBufferLength=0x105, lpBuffer=0x19e474, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\YGfgabH7Z.xls", lpFilePart=0x0) returned 0x36 [0104.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9b8) returned 1 [0104.890] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\YGfgabH7Z.xls" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\ygfgabh7z.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0104.890] GetFileType (hFile=0x430) returned 0x1 [0104.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9b4) returned 1 [0104.890] GetFileType (hFile=0x430) returned 0x1 [0104.890] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19eab4 | out: lpFileSizeHigh=0x19eab4*=0x0) returned 0x7bb7 [0104.890] ReadFile (in: hFile=0x430, lpBuffer=0x25b3404, nNumberOfBytesToRead=0x7bb7, lpNumberOfBytesRead=0x19ea60, lpOverlapped=0x0 | out: lpBuffer=0x25b3404*, lpNumberOfBytesRead=0x19ea60*=0x7bb7, lpOverlapped=0x0) returned 1 [0104.890] CloseHandle (hObject=0x430) returned 1 [0105.120] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\YGfgabH7Z.xls", nBufferLength=0x105, lpBuffer=0x19e45c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\YGfgabH7Z.xls", lpFilePart=0x0) returned 0x36 [0105.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9a0) returned 1 [0105.120] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\YGfgabH7Z.xls" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\ygfgabh7z.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0105.121] GetFileType (hFile=0x430) returned 0x1 [0105.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e99c) returned 1 [0105.121] GetFileType (hFile=0x430) returned 0x1 [0105.121] WriteFile (in: hFile=0x430, lpBuffer=0x242eaf4*, nNumberOfBytesToWrite=0x7bc0, lpNumberOfBytesWritten=0x19ea50, lpOverlapped=0x0 | out: lpBuffer=0x242eaf4*, lpNumberOfBytesWritten=0x19ea50*=0x7bc0, lpOverlapped=0x0) returned 1 [0105.122] CloseHandle (hObject=0x430) returned 1 [0105.124] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\YGfgabH7Z.xls", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\YGfgabH7Z.xls", lpFilePart=0x0) returned 0x36 [0105.124] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\YGfgabH7Z.xls.lasan", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\YGfgabH7Z.xls.lasan", lpFilePart=0x0) returned 0x3c [0105.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea34) returned 1 [0105.124] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\YGfgabH7Z.xls" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\ygfgabh7z.xls"), fInfoLevelId=0x0, lpFileInformation=0x19eab0 | out: lpFileInformation=0x19eab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd089620, ftCreationTime.dwHighDateTime=0x1d5d401, ftLastAccessTime.dwLowDateTime=0xb5348c80, ftLastAccessTime.dwHighDateTime=0x1d5cd2d, ftLastWriteTime.dwLowDateTime=0xc442349f, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x7bc0)) returned 1 [0105.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea30) returned 1 [0105.124] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\YGfgabH7Z.xls" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\ygfgabh7z.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\YGfgabH7Z.xls.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\ygfgabh7z.xls.lasan")) returned 1 [0105.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0105.125] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD", lpFilePart=0x0) returned 0x30 [0105.125] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\*", lpFindFileData=0x19e7a8 | out: lpFindFileData=0x19e7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeaa3b30, ftCreationTime.dwHighDateTime=0x1d5ced6, ftLastAccessTime.dwLowDateTime=0x1c9363a0, ftLastAccessTime.dwHighDateTime=0x1d5c947, ftLastWriteTime.dwLowDateTime=0x1c9363a0, ftLastWriteTime.dwHighDateTime=0x1d5c947, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6337e8 [0105.125] FindNextFileW (in: hFindFile=0x6337e8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeaa3b30, ftCreationTime.dwHighDateTime=0x1d5ced6, ftLastAccessTime.dwLowDateTime=0x1c9363a0, ftLastAccessTime.dwHighDateTime=0x1d5c947, ftLastWriteTime.dwLowDateTime=0x1c9363a0, ftLastWriteTime.dwHighDateTime=0x1d5c947, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.125] FindNextFileW (in: hFindFile=0x6337e8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d0cae90, ftCreationTime.dwHighDateTime=0x1d5c970, ftLastAccessTime.dwLowDateTime=0x24459f20, ftLastAccessTime.dwHighDateTime=0x1d5ca4e, ftLastWriteTime.dwLowDateTime=0x24459f20, ftLastWriteTime.dwHighDateTime=0x1d5ca4e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="-3Dtx57jhQbHP8_-Tyzz", cAlternateFileName="-3DTX5~1")) returned 1 [0105.126] FindNextFileW (in: hFindFile=0x6337e8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91e55590, ftCreationTime.dwHighDateTime=0x1d5d181, ftLastAccessTime.dwLowDateTime=0x52242340, ftLastAccessTime.dwHighDateTime=0x1d5cb06, ftLastWriteTime.dwLowDateTime=0x52242340, ftLastWriteTime.dwHighDateTime=0x1d5cb06, nFileSizeHigh=0x0, nFileSizeLow=0x816c, dwReserved0=0x0, dwReserved1=0x0, cFileName="7BuHmOxRv.ppt", cAlternateFileName="7BUHMO~1.PPT")) returned 1 [0105.126] FindNextFileW (in: hFindFile=0x6337e8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x740ffbc0, ftCreationTime.dwHighDateTime=0x1d5cc67, ftLastAccessTime.dwLowDateTime=0x84b6e360, ftLastAccessTime.dwHighDateTime=0x1d5c9cb, ftLastWriteTime.dwLowDateTime=0x84b6e360, ftLastWriteTime.dwHighDateTime=0x1d5c9cb, nFileSizeHigh=0x0, nFileSizeLow=0xa8c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="hDwGcS.csv", cAlternateFileName="")) returned 1 [0105.126] FindNextFileW (in: hFindFile=0x6337e8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0105.126] FindClose (in: hFindFile=0x6337e8 | out: hFindFile=0x6337e8) returned 1 [0105.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea3c) returned 1 [0105.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea48) returned 1 [0105.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0105.126] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD", lpFilePart=0x0) returned 0x30 [0105.126] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\*", lpFindFileData=0x19e7a8 | out: lpFindFileData=0x19e7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeaa3b30, ftCreationTime.dwHighDateTime=0x1d5ced6, ftLastAccessTime.dwLowDateTime=0x1c9363a0, ftLastAccessTime.dwHighDateTime=0x1d5c947, ftLastWriteTime.dwLowDateTime=0x1c9363a0, ftLastWriteTime.dwHighDateTime=0x1d5c947, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6337e8 [0105.127] FindNextFileW (in: hFindFile=0x6337e8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeaa3b30, ftCreationTime.dwHighDateTime=0x1d5ced6, ftLastAccessTime.dwLowDateTime=0x1c9363a0, ftLastAccessTime.dwHighDateTime=0x1d5c947, ftLastWriteTime.dwLowDateTime=0x1c9363a0, ftLastWriteTime.dwHighDateTime=0x1d5c947, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.127] FindNextFileW (in: hFindFile=0x6337e8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d0cae90, ftCreationTime.dwHighDateTime=0x1d5c970, ftLastAccessTime.dwLowDateTime=0x24459f20, ftLastAccessTime.dwHighDateTime=0x1d5ca4e, ftLastWriteTime.dwLowDateTime=0x24459f20, ftLastWriteTime.dwHighDateTime=0x1d5ca4e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="-3Dtx57jhQbHP8_-Tyzz", cAlternateFileName="-3DTX5~1")) returned 1 [0105.127] FindNextFileW (in: hFindFile=0x6337e8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91e55590, ftCreationTime.dwHighDateTime=0x1d5d181, ftLastAccessTime.dwLowDateTime=0x52242340, ftLastAccessTime.dwHighDateTime=0x1d5cb06, ftLastWriteTime.dwLowDateTime=0x52242340, ftLastWriteTime.dwHighDateTime=0x1d5cb06, nFileSizeHigh=0x0, nFileSizeLow=0x816c, dwReserved0=0x0, dwReserved1=0x0, cFileName="7BuHmOxRv.ppt", cAlternateFileName="7BUHMO~1.PPT")) returned 1 [0105.127] FindNextFileW (in: hFindFile=0x6337e8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x740ffbc0, ftCreationTime.dwHighDateTime=0x1d5cc67, ftLastAccessTime.dwLowDateTime=0x84b6e360, ftLastAccessTime.dwHighDateTime=0x1d5c9cb, ftLastWriteTime.dwLowDateTime=0x84b6e360, ftLastWriteTime.dwHighDateTime=0x1d5c9cb, nFileSizeHigh=0x0, nFileSizeLow=0xa8c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="hDwGcS.csv", cAlternateFileName="")) returned 1 [0105.127] FindNextFileW (in: hFindFile=0x6337e8, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x740ffbc0, ftCreationTime.dwHighDateTime=0x1d5cc67, ftLastAccessTime.dwLowDateTime=0x84b6e360, ftLastAccessTime.dwHighDateTime=0x1d5c9cb, ftLastWriteTime.dwLowDateTime=0x84b6e360, ftLastWriteTime.dwHighDateTime=0x1d5c9cb, nFileSizeHigh=0x0, nFileSizeLow=0xa8c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="hDwGcS.csv", cAlternateFileName="")) returned 0 [0105.127] FindClose (in: hFindFile=0x6337e8 | out: hFindFile=0x6337e8) returned 1 [0105.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea3c) returned 1 [0105.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea48) returned 1 [0105.127] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\7BuHmOxRv.ppt", nBufferLength=0x105, lpBuffer=0x19e428, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\7BuHmOxRv.ppt", lpFilePart=0x0) returned 0x3e [0105.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e96c) returned 1 [0105.128] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\7BuHmOxRv.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\npsjwid\\7buhmoxrv.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0105.128] GetFileType (hFile=0x430) returned 0x1 [0105.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e968) returned 1 [0105.128] GetFileType (hFile=0x430) returned 0x1 [0105.128] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19ea68 | out: lpFileSizeHigh=0x19ea68*=0x0) returned 0x816c [0105.128] ReadFile (in: hFile=0x430, lpBuffer=0x243854c, nNumberOfBytesToRead=0x816c, lpNumberOfBytesRead=0x19ea14, lpOverlapped=0x0 | out: lpBuffer=0x243854c*, lpNumberOfBytesRead=0x19ea14*=0x816c, lpOverlapped=0x0) returned 1 [0105.128] CloseHandle (hObject=0x430) returned 1 [0105.144] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\7BuHmOxRv.ppt", nBufferLength=0x105, lpBuffer=0x19e410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\7BuHmOxRv.ppt", lpFilePart=0x0) returned 0x3e [0105.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e954) returned 1 [0105.144] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\7BuHmOxRv.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\npsjwid\\7buhmoxrv.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0105.145] GetFileType (hFile=0x430) returned 0x1 [0105.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e950) returned 1 [0105.145] GetFileType (hFile=0x430) returned 0x1 [0105.145] WriteFile (in: hFile=0x430, lpBuffer=0x24adbc0*, nNumberOfBytesToWrite=0x8170, lpNumberOfBytesWritten=0x19ea04, lpOverlapped=0x0 | out: lpBuffer=0x24adbc0*, lpNumberOfBytesWritten=0x19ea04*=0x8170, lpOverlapped=0x0) returned 1 [0105.147] CloseHandle (hObject=0x430) returned 1 [0105.148] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\7BuHmOxRv.ppt", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\7BuHmOxRv.ppt", lpFilePart=0x0) returned 0x3e [0105.148] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\7BuHmOxRv.ppt.lasan", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\7BuHmOxRv.ppt.lasan", lpFilePart=0x0) returned 0x44 [0105.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9e8) returned 1 [0105.148] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\7BuHmOxRv.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\npsjwid\\7buhmoxrv.ppt"), fInfoLevelId=0x0, lpFileInformation=0x19ea64 | out: lpFileInformation=0x19ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91e55590, ftCreationTime.dwHighDateTime=0x1d5d181, ftLastAccessTime.dwLowDateTime=0x52242340, ftLastAccessTime.dwHighDateTime=0x1d5cb06, ftLastWriteTime.dwLowDateTime=0xc446f9cc, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x8170)) returned 1 [0105.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e4) returned 1 [0105.148] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\7BuHmOxRv.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\npsjwid\\7buhmoxrv.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\7BuHmOxRv.ppt.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\npsjwid\\7buhmoxrv.ppt.lasan")) returned 1 [0105.149] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\hDwGcS.csv", nBufferLength=0x105, lpBuffer=0x19e428, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\hDwGcS.csv", lpFilePart=0x0) returned 0x3b [0105.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e96c) returned 1 [0105.149] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\hDwGcS.csv" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\npsjwid\\hdwgcs.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0105.149] GetFileType (hFile=0x430) returned 0x1 [0105.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e968) returned 1 [0105.149] GetFileType (hFile=0x430) returned 0x1 [0105.149] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19ea68 | out: lpFileSizeHigh=0x19ea68*=0x0) returned 0xa8c8 [0105.149] ReadFile (in: hFile=0x430, lpBuffer=0x24b6140, nNumberOfBytesToRead=0xa8c8, lpNumberOfBytesRead=0x19ea14, lpOverlapped=0x0 | out: lpBuffer=0x24b6140*, lpNumberOfBytesRead=0x19ea14*=0xa8c8, lpOverlapped=0x0) returned 1 [0105.150] CloseHandle (hObject=0x430) returned 1 [0105.227] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\hDwGcS.csv", nBufferLength=0x105, lpBuffer=0x19e410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\hDwGcS.csv", lpFilePart=0x0) returned 0x3b [0105.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e954) returned 1 [0105.227] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\hDwGcS.csv" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\npsjwid\\hdwgcs.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0105.229] GetFileType (hFile=0x430) returned 0x1 [0105.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e950) returned 1 [0105.229] GetFileType (hFile=0x430) returned 0x1 [0105.229] WriteFile (in: hFile=0x430, lpBuffer=0x25229ac*, nNumberOfBytesToWrite=0xa8d0, lpNumberOfBytesWritten=0x19ea04, lpOverlapped=0x0 | out: lpBuffer=0x25229ac*, lpNumberOfBytesWritten=0x19ea04*=0xa8d0, lpOverlapped=0x0) returned 1 [0105.230] CloseHandle (hObject=0x430) returned 1 [0105.232] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\hDwGcS.csv", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\hDwGcS.csv", lpFilePart=0x0) returned 0x3b [0105.232] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\hDwGcS.csv.lasan", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\hDwGcS.csv.lasan", lpFilePart=0x0) returned 0x41 [0105.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9e8) returned 1 [0105.232] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\hDwGcS.csv" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\npsjwid\\hdwgcs.csv"), fInfoLevelId=0x0, lpFileInformation=0x19ea64 | out: lpFileInformation=0x19ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x740ffbc0, ftCreationTime.dwHighDateTime=0x1d5cc67, ftLastAccessTime.dwLowDateTime=0x84b6e360, ftLastAccessTime.dwHighDateTime=0x1d5c9cb, ftLastWriteTime.dwLowDateTime=0xc452e4e2, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0xa8d0)) returned 1 [0105.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e4) returned 1 [0105.232] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\hDwGcS.csv" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\npsjwid\\hdwgcs.csv"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\hDwGcS.csv.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\npsjwid\\hdwgcs.csv.lasan")) returned 1 [0105.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea34) returned 1 [0105.234] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz", nBufferLength=0x105, lpBuffer=0x19e4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz", lpFilePart=0x0) returned 0x45 [0105.234] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\*", lpFindFileData=0x19e75c | out: lpFindFileData=0x19e75c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d0cae90, ftCreationTime.dwHighDateTime=0x1d5c970, ftLastAccessTime.dwLowDateTime=0x24459f20, ftLastAccessTime.dwHighDateTime=0x1d5ca4e, ftLastWriteTime.dwLowDateTime=0x24459f20, ftLastWriteTime.dwHighDateTime=0x1d5ca4e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6337e8 [0105.235] FindNextFileW (in: hFindFile=0x6337e8, lpFindFileData=0x19e768 | out: lpFindFileData=0x19e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d0cae90, ftCreationTime.dwHighDateTime=0x1d5c970, ftLastAccessTime.dwLowDateTime=0x24459f20, ftLastAccessTime.dwHighDateTime=0x1d5ca4e, ftLastWriteTime.dwLowDateTime=0x24459f20, ftLastWriteTime.dwHighDateTime=0x1d5ca4e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.235] FindNextFileW (in: hFindFile=0x6337e8, lpFindFileData=0x19e768 | out: lpFindFileData=0x19e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48fe9770, ftCreationTime.dwHighDateTime=0x1d5cb59, ftLastAccessTime.dwLowDateTime=0x3c100920, ftLastAccessTime.dwHighDateTime=0x1d5c7f0, ftLastWriteTime.dwLowDateTime=0x3c100920, ftLastWriteTime.dwHighDateTime=0x1d5c7f0, nFileSizeHigh=0x0, nFileSizeLow=0x7e0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="0uvKlJ1ES8J.rtf", cAlternateFileName="0UVKLJ~1.RTF")) returned 1 [0105.235] FindNextFileW (in: hFindFile=0x6337e8, lpFindFileData=0x19e768 | out: lpFindFileData=0x19e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77e6b340, ftCreationTime.dwHighDateTime=0x1d5c967, ftLastAccessTime.dwLowDateTime=0x78268e00, ftLastAccessTime.dwHighDateTime=0x1d5c84c, ftLastWriteTime.dwLowDateTime=0x78268e00, ftLastWriteTime.dwHighDateTime=0x1d5c84c, nFileSizeHigh=0x0, nFileSizeLow=0x18de3, dwReserved0=0x0, dwReserved1=0x0, cFileName="1b8Yzk.pptx", cAlternateFileName="1B8YZK~1.PPT")) returned 1 [0105.235] FindNextFileW (in: hFindFile=0x6337e8, lpFindFileData=0x19e768 | out: lpFindFileData=0x19e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a0c89a0, ftCreationTime.dwHighDateTime=0x1d5cb9b, ftLastAccessTime.dwLowDateTime=0x8187af20, ftLastAccessTime.dwHighDateTime=0x1d5d421, ftLastWriteTime.dwLowDateTime=0x8187af20, ftLastWriteTime.dwHighDateTime=0x1d5d421, nFileSizeHigh=0x0, nFileSizeLow=0x713a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ct3gGzyJ jRsRQ7-K9.doc", cAlternateFileName="CT3GGZ~1.DOC")) returned 1 [0105.235] FindNextFileW (in: hFindFile=0x6337e8, lpFindFileData=0x19e768 | out: lpFindFileData=0x19e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6b8bf30, ftCreationTime.dwHighDateTime=0x1d5d801, ftLastAccessTime.dwLowDateTime=0xc0434760, ftLastAccessTime.dwHighDateTime=0x1d5cbed, ftLastWriteTime.dwLowDateTime=0xc0434760, ftLastWriteTime.dwHighDateTime=0x1d5cbed, nFileSizeHigh=0x0, nFileSizeLow=0x3477, dwReserved0=0x0, dwReserved1=0x0, cFileName="g3DIgT-M_hzBzY.csv", cAlternateFileName="G3DIGT~1.CSV")) returned 1 [0105.236] FindNextFileW (in: hFindFile=0x6337e8, lpFindFileData=0x19e768 | out: lpFindFileData=0x19e768*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0105.236] FindClose (in: hFindFile=0x6337e8 | out: hFindFile=0x6337e8) returned 1 [0105.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9f0) returned 1 [0105.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9fc) returned 1 [0105.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea34) returned 1 [0105.236] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz", nBufferLength=0x105, lpBuffer=0x19e4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz", lpFilePart=0x0) returned 0x45 [0105.236] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\*", lpFindFileData=0x19e75c | out: lpFindFileData=0x19e75c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d0cae90, ftCreationTime.dwHighDateTime=0x1d5c970, ftLastAccessTime.dwLowDateTime=0x24459f20, ftLastAccessTime.dwHighDateTime=0x1d5ca4e, ftLastWriteTime.dwLowDateTime=0x24459f20, ftLastWriteTime.dwHighDateTime=0x1d5ca4e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6337e8 [0105.236] FindNextFileW (in: hFindFile=0x6337e8, lpFindFileData=0x19e768 | out: lpFindFileData=0x19e768*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d0cae90, ftCreationTime.dwHighDateTime=0x1d5c970, ftLastAccessTime.dwLowDateTime=0x24459f20, ftLastAccessTime.dwHighDateTime=0x1d5ca4e, ftLastWriteTime.dwLowDateTime=0x24459f20, ftLastWriteTime.dwHighDateTime=0x1d5ca4e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.236] FindNextFileW (in: hFindFile=0x6337e8, lpFindFileData=0x19e768 | out: lpFindFileData=0x19e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48fe9770, ftCreationTime.dwHighDateTime=0x1d5cb59, ftLastAccessTime.dwLowDateTime=0x3c100920, ftLastAccessTime.dwHighDateTime=0x1d5c7f0, ftLastWriteTime.dwLowDateTime=0x3c100920, ftLastWriteTime.dwHighDateTime=0x1d5c7f0, nFileSizeHigh=0x0, nFileSizeLow=0x7e0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="0uvKlJ1ES8J.rtf", cAlternateFileName="0UVKLJ~1.RTF")) returned 1 [0105.237] FindNextFileW (in: hFindFile=0x6337e8, lpFindFileData=0x19e768 | out: lpFindFileData=0x19e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77e6b340, ftCreationTime.dwHighDateTime=0x1d5c967, ftLastAccessTime.dwLowDateTime=0x78268e00, ftLastAccessTime.dwHighDateTime=0x1d5c84c, ftLastWriteTime.dwLowDateTime=0x78268e00, ftLastWriteTime.dwHighDateTime=0x1d5c84c, nFileSizeHigh=0x0, nFileSizeLow=0x18de3, dwReserved0=0x0, dwReserved1=0x0, cFileName="1b8Yzk.pptx", cAlternateFileName="1B8YZK~1.PPT")) returned 1 [0105.237] FindNextFileW (in: hFindFile=0x6337e8, lpFindFileData=0x19e768 | out: lpFindFileData=0x19e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a0c89a0, ftCreationTime.dwHighDateTime=0x1d5cb9b, ftLastAccessTime.dwLowDateTime=0x8187af20, ftLastAccessTime.dwHighDateTime=0x1d5d421, ftLastWriteTime.dwLowDateTime=0x8187af20, ftLastWriteTime.dwHighDateTime=0x1d5d421, nFileSizeHigh=0x0, nFileSizeLow=0x713a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ct3gGzyJ jRsRQ7-K9.doc", cAlternateFileName="CT3GGZ~1.DOC")) returned 1 [0105.237] FindNextFileW (in: hFindFile=0x6337e8, lpFindFileData=0x19e768 | out: lpFindFileData=0x19e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6b8bf30, ftCreationTime.dwHighDateTime=0x1d5d801, ftLastAccessTime.dwLowDateTime=0xc0434760, ftLastAccessTime.dwHighDateTime=0x1d5cbed, ftLastWriteTime.dwLowDateTime=0xc0434760, ftLastWriteTime.dwHighDateTime=0x1d5cbed, nFileSizeHigh=0x0, nFileSizeLow=0x3477, dwReserved0=0x0, dwReserved1=0x0, cFileName="g3DIgT-M_hzBzY.csv", cAlternateFileName="G3DIGT~1.CSV")) returned 1 [0105.237] FindNextFileW (in: hFindFile=0x6337e8, lpFindFileData=0x19e768 | out: lpFindFileData=0x19e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6b8bf30, ftCreationTime.dwHighDateTime=0x1d5d801, ftLastAccessTime.dwLowDateTime=0xc0434760, ftLastAccessTime.dwHighDateTime=0x1d5cbed, ftLastWriteTime.dwLowDateTime=0xc0434760, ftLastWriteTime.dwHighDateTime=0x1d5cbed, nFileSizeHigh=0x0, nFileSizeLow=0x3477, dwReserved0=0x0, dwReserved1=0x0, cFileName="g3DIgT-M_hzBzY.csv", cAlternateFileName="G3DIGT~1.CSV")) returned 0 [0105.237] FindClose (in: hFindFile=0x6337e8 | out: hFindFile=0x6337e8) returned 1 [0105.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9f0) returned 1 [0105.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9fc) returned 1 [0105.237] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\0uvKlJ1ES8J.rtf", nBufferLength=0x105, lpBuffer=0x19e3dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\0uvKlJ1ES8J.rtf", lpFilePart=0x0) returned 0x55 [0105.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e920) returned 1 [0105.237] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\0uvKlJ1ES8J.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\npsjwid\\-3dtx57jhqbhp8_-tyzz\\0uvklj1es8j.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0105.238] GetFileType (hFile=0x430) returned 0x1 [0105.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e91c) returned 1 [0105.238] GetFileType (hFile=0x430) returned 0x1 [0105.238] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19ea1c | out: lpFileSizeHigh=0x19ea1c*=0x0) returned 0x7e0d [0105.238] ReadFile (in: hFile=0x430, lpBuffer=0x252fbac, nNumberOfBytesToRead=0x7e0d, lpNumberOfBytesRead=0x19e9c8, lpOverlapped=0x0 | out: lpBuffer=0x252fbac*, lpNumberOfBytesRead=0x19e9c8*=0x7e0d, lpOverlapped=0x0) returned 1 [0105.238] CloseHandle (hObject=0x430) returned 1 [0105.334] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\0uvKlJ1ES8J.rtf", nBufferLength=0x105, lpBuffer=0x19e3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\0uvKlJ1ES8J.rtf", lpFilePart=0x0) returned 0x55 [0105.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e908) returned 1 [0105.334] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\0uvKlJ1ES8J.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\npsjwid\\-3dtx57jhqbhp8_-tyzz\\0uvklj1es8j.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0105.335] GetFileType (hFile=0x430) returned 0x1 [0105.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e904) returned 1 [0105.336] GetFileType (hFile=0x430) returned 0x1 [0105.336] WriteFile (in: hFile=0x430, lpBuffer=0x25a3fe8*, nNumberOfBytesToWrite=0x7e10, lpNumberOfBytesWritten=0x19e9b8, lpOverlapped=0x0 | out: lpBuffer=0x25a3fe8*, lpNumberOfBytesWritten=0x19e9b8*=0x7e10, lpOverlapped=0x0) returned 1 [0105.337] CloseHandle (hObject=0x430) returned 1 [0105.338] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\0uvKlJ1ES8J.rtf", nBufferLength=0x105, lpBuffer=0x19e4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\0uvKlJ1ES8J.rtf", lpFilePart=0x0) returned 0x55 [0105.338] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\0uvKlJ1ES8J.rtf.lasan", nBufferLength=0x105, lpBuffer=0x19e4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\0uvKlJ1ES8J.rtf.lasan", lpFilePart=0x0) returned 0x5b [0105.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e99c) returned 1 [0105.338] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\0uvKlJ1ES8J.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\npsjwid\\-3dtx57jhqbhp8_-tyzz\\0uvklj1es8j.rtf"), fInfoLevelId=0x0, lpFileInformation=0x19ea18 | out: lpFileInformation=0x19ea18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48fe9770, ftCreationTime.dwHighDateTime=0x1d5cb59, ftLastAccessTime.dwLowDateTime=0x3c100920, ftLastAccessTime.dwHighDateTime=0x1d5c7f0, ftLastWriteTime.dwLowDateTime=0xc463981c, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x7e10)) returned 1 [0105.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e998) returned 1 [0105.339] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\0uvKlJ1ES8J.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\npsjwid\\-3dtx57jhqbhp8_-tyzz\\0uvklj1es8j.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\0uvKlJ1ES8J.rtf.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\npsjwid\\-3dtx57jhqbhp8_-tyzz\\0uvklj1es8j.rtf.lasan")) returned 1 [0105.339] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\1b8Yzk.pptx", nBufferLength=0x105, lpBuffer=0x19e3dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\1b8Yzk.pptx", lpFilePart=0x0) returned 0x51 [0105.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e920) returned 1 [0105.339] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\1b8Yzk.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\npsjwid\\-3dtx57jhqbhp8_-tyzz\\1b8yzk.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0105.339] GetFileType (hFile=0x430) returned 0x1 [0105.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e91c) returned 1 [0105.339] GetFileType (hFile=0x430) returned 0x1 [0105.339] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19ea1c | out: lpFileSizeHigh=0x19ea1c*=0x0) returned 0x18de3 [0105.340] ReadFile (in: hFile=0x430, lpBuffer=0x35d5788, nNumberOfBytesToRead=0x18de3, lpNumberOfBytesRead=0x19e9c8, lpOverlapped=0x0 | out: lpBuffer=0x35d5788*, lpNumberOfBytesRead=0x19e9c8*=0x18de3, lpOverlapped=0x0) returned 1 [0105.342] CloseHandle (hObject=0x430) returned 1 [0105.450] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\1b8Yzk.pptx", nBufferLength=0x105, lpBuffer=0x19e3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\1b8Yzk.pptx", lpFilePart=0x0) returned 0x51 [0105.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e908) returned 1 [0105.451] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\1b8Yzk.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\npsjwid\\-3dtx57jhqbhp8_-tyzz\\1b8yzk.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0105.452] GetFileType (hFile=0x430) returned 0x1 [0105.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e904) returned 1 [0105.452] GetFileType (hFile=0x430) returned 0x1 [0105.452] WriteFile (in: hFile=0x430, lpBuffer=0x3651d68*, nNumberOfBytesToWrite=0x18df0, lpNumberOfBytesWritten=0x19e9b8, lpOverlapped=0x0 | out: lpBuffer=0x3651d68*, lpNumberOfBytesWritten=0x19e9b8*=0x18df0, lpOverlapped=0x0) returned 1 [0105.454] CloseHandle (hObject=0x430) returned 1 [0105.457] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\1b8Yzk.pptx", nBufferLength=0x105, lpBuffer=0x19e4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\1b8Yzk.pptx", lpFilePart=0x0) returned 0x51 [0105.457] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\1b8Yzk.pptx.lasan", nBufferLength=0x105, lpBuffer=0x19e4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\1b8Yzk.pptx.lasan", lpFilePart=0x0) returned 0x57 [0105.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e99c) returned 1 [0105.457] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\1b8Yzk.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\npsjwid\\-3dtx57jhqbhp8_-tyzz\\1b8yzk.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19ea18 | out: lpFileInformation=0x19ea18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77e6b340, ftCreationTime.dwHighDateTime=0x1d5c967, ftLastAccessTime.dwLowDateTime=0x78268e00, ftLastAccessTime.dwHighDateTime=0x1d5c84c, ftLastWriteTime.dwLowDateTime=0xc476aad0, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x18df0)) returned 1 [0105.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e998) returned 1 [0105.457] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\1b8Yzk.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\npsjwid\\-3dtx57jhqbhp8_-tyzz\\1b8yzk.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\1b8Yzk.pptx.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\npsjwid\\-3dtx57jhqbhp8_-tyzz\\1b8yzk.pptx.lasan")) returned 1 [0105.458] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\ct3gGzyJ jRsRQ7-K9.doc", nBufferLength=0x105, lpBuffer=0x19e3dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\ct3gGzyJ jRsRQ7-K9.doc", lpFilePart=0x0) returned 0x5c [0105.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e920) returned 1 [0105.458] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\ct3gGzyJ jRsRQ7-K9.doc" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\npsjwid\\-3dtx57jhqbhp8_-tyzz\\ct3ggzyj jrsrq7-k9.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0105.458] GetFileType (hFile=0x430) returned 0x1 [0105.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e91c) returned 1 [0105.458] GetFileType (hFile=0x430) returned 0x1 [0105.458] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19ea1c | out: lpFileSizeHigh=0x19ea1c*=0x0) returned 0x713a [0105.459] ReadFile (in: hFile=0x430, lpBuffer=0x23f26b0, nNumberOfBytesToRead=0x713a, lpNumberOfBytesRead=0x19e9c8, lpOverlapped=0x0 | out: lpBuffer=0x23f26b0*, lpNumberOfBytesRead=0x19e9c8*=0x713a, lpOverlapped=0x0) returned 1 [0105.459] CloseHandle (hObject=0x430) returned 1 [0105.523] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\ct3gGzyJ jRsRQ7-K9.doc", nBufferLength=0x105, lpBuffer=0x19e3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\ct3gGzyJ jRsRQ7-K9.doc", lpFilePart=0x0) returned 0x5c [0105.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e908) returned 1 [0105.523] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\ct3gGzyJ jRsRQ7-K9.doc" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\npsjwid\\-3dtx57jhqbhp8_-tyzz\\ct3ggzyj jrsrq7-k9.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0105.524] GetFileType (hFile=0x430) returned 0x1 [0105.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e904) returned 1 [0105.525] GetFileType (hFile=0x430) returned 0x1 [0105.525] WriteFile (in: hFile=0x430, lpBuffer=0x2462c38*, nNumberOfBytesToWrite=0x7140, lpNumberOfBytesWritten=0x19e9b8, lpOverlapped=0x0 | out: lpBuffer=0x2462c38*, lpNumberOfBytesWritten=0x19e9b8*=0x7140, lpOverlapped=0x0) returned 1 [0105.526] CloseHandle (hObject=0x430) returned 1 [0105.527] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\ct3gGzyJ jRsRQ7-K9.doc", nBufferLength=0x105, lpBuffer=0x19e4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\ct3gGzyJ jRsRQ7-K9.doc", lpFilePart=0x0) returned 0x5c [0105.527] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\ct3gGzyJ jRsRQ7-K9.doc.lasan", nBufferLength=0x105, lpBuffer=0x19e4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\ct3gGzyJ jRsRQ7-K9.doc.lasan", lpFilePart=0x0) returned 0x62 [0105.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e99c) returned 1 [0105.528] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\ct3gGzyJ jRsRQ7-K9.doc" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\npsjwid\\-3dtx57jhqbhp8_-tyzz\\ct3ggzyj jrsrq7-k9.doc"), fInfoLevelId=0x0, lpFileInformation=0x19ea18 | out: lpFileInformation=0x19ea18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a0c89a0, ftCreationTime.dwHighDateTime=0x1d5cb9b, ftLastAccessTime.dwLowDateTime=0x8187af20, ftLastAccessTime.dwHighDateTime=0x1d5d421, ftLastWriteTime.dwLowDateTime=0xc4803325, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x7140)) returned 1 [0105.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e998) returned 1 [0105.528] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\ct3gGzyJ jRsRQ7-K9.doc" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\npsjwid\\-3dtx57jhqbhp8_-tyzz\\ct3ggzyj jrsrq7-k9.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\ct3gGzyJ jRsRQ7-K9.doc.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\npsjwid\\-3dtx57jhqbhp8_-tyzz\\ct3ggzyj jrsrq7-k9.doc.lasan")) returned 1 [0105.528] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\g3DIgT-M_hzBzY.csv", nBufferLength=0x105, lpBuffer=0x19e3dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\g3DIgT-M_hzBzY.csv", lpFilePart=0x0) returned 0x58 [0105.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e920) returned 1 [0105.528] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\g3DIgT-M_hzBzY.csv" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\npsjwid\\-3dtx57jhqbhp8_-tyzz\\g3digt-m_hzbzy.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0105.529] GetFileType (hFile=0x430) returned 0x1 [0105.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e91c) returned 1 [0105.529] GetFileType (hFile=0x430) returned 0x1 [0105.529] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19ea1c | out: lpFileSizeHigh=0x19ea1c*=0x0) returned 0x3477 [0105.529] ReadFile (in: hFile=0x430, lpBuffer=0x246a2d8, nNumberOfBytesToRead=0x3477, lpNumberOfBytesRead=0x19e9c8, lpOverlapped=0x0 | out: lpBuffer=0x246a2d8*, lpNumberOfBytesRead=0x19e9c8*=0x3477, lpOverlapped=0x0) returned 1 [0105.529] CloseHandle (hObject=0x430) returned 1 [0105.544] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\g3DIgT-M_hzBzY.csv", nBufferLength=0x105, lpBuffer=0x19e3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\g3DIgT-M_hzBzY.csv", lpFilePart=0x0) returned 0x58 [0105.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e908) returned 1 [0105.544] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\g3DIgT-M_hzBzY.csv" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\npsjwid\\-3dtx57jhqbhp8_-tyzz\\g3digt-m_hzbzy.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0105.545] GetFileType (hFile=0x430) returned 0x1 [0105.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e904) returned 1 [0105.546] GetFileType (hFile=0x430) returned 0x1 [0105.546] WriteFile (in: hFile=0x430, lpBuffer=0x24c7744*, nNumberOfBytesToWrite=0x3480, lpNumberOfBytesWritten=0x19e9b8, lpOverlapped=0x0 | out: lpBuffer=0x24c7744*, lpNumberOfBytesWritten=0x19e9b8*=0x3480, lpOverlapped=0x0) returned 1 [0105.547] CloseHandle (hObject=0x430) returned 1 [0105.596] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\g3DIgT-M_hzBzY.csv", nBufferLength=0x105, lpBuffer=0x19e4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\g3DIgT-M_hzBzY.csv", lpFilePart=0x0) returned 0x58 [0105.596] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\g3DIgT-M_hzBzY.csv.lasan", nBufferLength=0x105, lpBuffer=0x19e4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\g3DIgT-M_hzBzY.csv.lasan", lpFilePart=0x0) returned 0x5e [0105.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e99c) returned 1 [0105.596] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\g3DIgT-M_hzBzY.csv" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\npsjwid\\-3dtx57jhqbhp8_-tyzz\\g3digt-m_hzbzy.csv"), fInfoLevelId=0x0, lpFileInformation=0x19ea18 | out: lpFileInformation=0x19ea18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6b8bf30, ftCreationTime.dwHighDateTime=0x1d5d801, ftLastAccessTime.dwLowDateTime=0xc0434760, ftLastAccessTime.dwHighDateTime=0x1d5cbed, ftLastWriteTime.dwLowDateTime=0xc48c1fd1, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x3480)) returned 1 [0105.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e998) returned 1 [0105.596] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\g3DIgT-M_hzBzY.csv" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\npsjwid\\-3dtx57jhqbhp8_-tyzz\\g3digt-m_hzbzy.csv"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\npsjwiD\\-3Dtx57jhQbHP8_-Tyzz\\g3DIgT-M_hzBzY.csv.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\npsjwid\\-3dtx57jhqbhp8_-tyzz\\g3digt-m_hzbzy.csv.lasan")) returned 1 [0105.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0105.597] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c", lpFilePart=0x0) returned 0x3c [0105.597] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\*", lpFindFileData=0x19e7a8 | out: lpFindFileData=0x19e7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x129e8e70, ftCreationTime.dwHighDateTime=0x1d5cb9e, ftLastAccessTime.dwLowDateTime=0x6293fd90, ftLastAccessTime.dwHighDateTime=0x1d5d137, ftLastWriteTime.dwLowDateTime=0x6293fd90, ftLastWriteTime.dwHighDateTime=0x1d5d137, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x633a68 [0105.597] FindNextFileW (in: hFindFile=0x633a68, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x129e8e70, ftCreationTime.dwHighDateTime=0x1d5cb9e, ftLastAccessTime.dwLowDateTime=0x6293fd90, ftLastAccessTime.dwHighDateTime=0x1d5d137, ftLastWriteTime.dwLowDateTime=0x6293fd90, ftLastWriteTime.dwHighDateTime=0x1d5d137, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.598] FindNextFileW (in: hFindFile=0x633a68, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x319630, ftCreationTime.dwHighDateTime=0x1d5d574, ftLastAccessTime.dwLowDateTime=0x5acb6d30, ftLastAccessTime.dwHighDateTime=0x1d5c8d8, ftLastWriteTime.dwLowDateTime=0x5acb6d30, ftLastWriteTime.dwHighDateTime=0x1d5c8d8, nFileSizeHigh=0x0, nFileSizeLow=0x31ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="8DlKDK-3_w3zasIu.doc", cAlternateFileName="8DLKDK~1.DOC")) returned 1 [0105.598] FindNextFileW (in: hFindFile=0x633a68, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee51e30, ftCreationTime.dwHighDateTime=0x1d5cf20, ftLastAccessTime.dwLowDateTime=0xed1fbb00, ftLastAccessTime.dwHighDateTime=0x1d5cfa9, ftLastWriteTime.dwLowDateTime=0xed1fbb00, ftLastWriteTime.dwHighDateTime=0x1d5cfa9, nFileSizeHigh=0x0, nFileSizeLow=0x3355, dwReserved0=0x0, dwReserved1=0x0, cFileName="i74n4v4aHki.ppt", cAlternateFileName="I74N4V~1.PPT")) returned 1 [0105.598] FindNextFileW (in: hFindFile=0x633a68, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6355ca30, ftCreationTime.dwHighDateTime=0x1d5d077, ftLastAccessTime.dwLowDateTime=0x78c00370, ftLastAccessTime.dwHighDateTime=0x1d5cbb0, ftLastWriteTime.dwLowDateTime=0x78c00370, ftLastWriteTime.dwHighDateTime=0x1d5cbb0, nFileSizeHigh=0x0, nFileSizeLow=0x1d19, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTufqNMCcUTskx.rtf", cAlternateFileName="NTUFQN~1.RTF")) returned 1 [0105.598] FindNextFileW (in: hFindFile=0x633a68, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0105.598] FindClose (in: hFindFile=0x633a68 | out: hFindFile=0x633a68) returned 1 [0105.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea3c) returned 1 [0105.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea48) returned 1 [0105.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea80) returned 1 [0105.598] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c", lpFilePart=0x0) returned 0x3c [0105.598] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\*", lpFindFileData=0x19e7a8 | out: lpFindFileData=0x19e7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x129e8e70, ftCreationTime.dwHighDateTime=0x1d5cb9e, ftLastAccessTime.dwLowDateTime=0x6293fd90, ftLastAccessTime.dwHighDateTime=0x1d5d137, ftLastWriteTime.dwLowDateTime=0x6293fd90, ftLastWriteTime.dwHighDateTime=0x1d5d137, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x633a68 [0105.599] FindNextFileW (in: hFindFile=0x633a68, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x129e8e70, ftCreationTime.dwHighDateTime=0x1d5cb9e, ftLastAccessTime.dwLowDateTime=0x6293fd90, ftLastAccessTime.dwHighDateTime=0x1d5d137, ftLastWriteTime.dwLowDateTime=0x6293fd90, ftLastWriteTime.dwHighDateTime=0x1d5d137, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.599] FindNextFileW (in: hFindFile=0x633a68, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x319630, ftCreationTime.dwHighDateTime=0x1d5d574, ftLastAccessTime.dwLowDateTime=0x5acb6d30, ftLastAccessTime.dwHighDateTime=0x1d5c8d8, ftLastWriteTime.dwLowDateTime=0x5acb6d30, ftLastWriteTime.dwHighDateTime=0x1d5c8d8, nFileSizeHigh=0x0, nFileSizeLow=0x31ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="8DlKDK-3_w3zasIu.doc", cAlternateFileName="8DLKDK~1.DOC")) returned 1 [0105.599] FindNextFileW (in: hFindFile=0x633a68, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee51e30, ftCreationTime.dwHighDateTime=0x1d5cf20, ftLastAccessTime.dwLowDateTime=0xed1fbb00, ftLastAccessTime.dwHighDateTime=0x1d5cfa9, ftLastWriteTime.dwLowDateTime=0xed1fbb00, ftLastWriteTime.dwHighDateTime=0x1d5cfa9, nFileSizeHigh=0x0, nFileSizeLow=0x3355, dwReserved0=0x0, dwReserved1=0x0, cFileName="i74n4v4aHki.ppt", cAlternateFileName="I74N4V~1.PPT")) returned 1 [0105.599] FindNextFileW (in: hFindFile=0x633a68, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6355ca30, ftCreationTime.dwHighDateTime=0x1d5d077, ftLastAccessTime.dwLowDateTime=0x78c00370, ftLastAccessTime.dwHighDateTime=0x1d5cbb0, ftLastWriteTime.dwLowDateTime=0x78c00370, ftLastWriteTime.dwHighDateTime=0x1d5cbb0, nFileSizeHigh=0x0, nFileSizeLow=0x1d19, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTufqNMCcUTskx.rtf", cAlternateFileName="NTUFQN~1.RTF")) returned 1 [0105.599] FindNextFileW (in: hFindFile=0x633a68, lpFindFileData=0x19e7b4 | out: lpFindFileData=0x19e7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6355ca30, ftCreationTime.dwHighDateTime=0x1d5d077, ftLastAccessTime.dwLowDateTime=0x78c00370, ftLastAccessTime.dwHighDateTime=0x1d5cbb0, ftLastWriteTime.dwLowDateTime=0x78c00370, ftLastWriteTime.dwHighDateTime=0x1d5cbb0, nFileSizeHigh=0x0, nFileSizeLow=0x1d19, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTufqNMCcUTskx.rtf", cAlternateFileName="NTUFQN~1.RTF")) returned 0 [0105.599] FindClose (in: hFindFile=0x633a68 | out: hFindFile=0x633a68) returned 1 [0105.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea3c) returned 1 [0105.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea48) returned 1 [0105.600] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\8DlKDK-3_w3zasIu.doc", nBufferLength=0x105, lpBuffer=0x19e428, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\8DlKDK-3_w3zasIu.doc", lpFilePart=0x0) returned 0x51 [0105.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e96c) returned 1 [0105.600] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\8DlKDK-3_w3zasIu.doc" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\qfals26m8ilmiqpho8c\\8dlkdk-3_w3zasiu.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0105.600] GetFileType (hFile=0x430) returned 0x1 [0105.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e968) returned 1 [0105.600] GetFileType (hFile=0x430) returned 0x1 [0105.600] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19ea68 | out: lpFileSizeHigh=0x19ea68*=0x0) returned 0x31ab [0105.600] ReadFile (in: hFile=0x430, lpBuffer=0x24ccfd0, nNumberOfBytesToRead=0x31ab, lpNumberOfBytesRead=0x19ea14, lpOverlapped=0x0 | out: lpBuffer=0x24ccfd0*, lpNumberOfBytesRead=0x19ea14*=0x31ab, lpOverlapped=0x0) returned 1 [0105.600] CloseHandle (hObject=0x430) returned 1 [0105.640] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\8DlKDK-3_w3zasIu.doc", nBufferLength=0x105, lpBuffer=0x19e410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\8DlKDK-3_w3zasIu.doc", lpFilePart=0x0) returned 0x51 [0105.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e954) returned 1 [0105.640] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\8DlKDK-3_w3zasIu.doc" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\qfals26m8ilmiqpho8c\\8dlkdk-3_w3zasiu.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0105.641] GetFileType (hFile=0x430) returned 0x1 [0105.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e950) returned 1 [0105.641] GetFileType (hFile=0x430) returned 0x1 [0105.641] WriteFile (in: hFile=0x430, lpBuffer=0x252962c*, nNumberOfBytesToWrite=0x31b0, lpNumberOfBytesWritten=0x19ea04, lpOverlapped=0x0 | out: lpBuffer=0x252962c*, lpNumberOfBytesWritten=0x19ea04*=0x31b0, lpOverlapped=0x0) returned 1 [0105.695] CloseHandle (hObject=0x430) returned 1 [0105.696] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\8DlKDK-3_w3zasIu.doc", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\8DlKDK-3_w3zasIu.doc", lpFilePart=0x0) returned 0x51 [0105.696] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\8DlKDK-3_w3zasIu.doc.lasan", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\8DlKDK-3_w3zasIu.doc.lasan", lpFilePart=0x0) returned 0x57 [0105.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9e8) returned 1 [0105.696] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\8DlKDK-3_w3zasIu.doc" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\qfals26m8ilmiqpho8c\\8dlkdk-3_w3zasiu.doc"), fInfoLevelId=0x0, lpFileInformation=0x19ea64 | out: lpFileInformation=0x19ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x319630, ftCreationTime.dwHighDateTime=0x1d5d574, ftLastAccessTime.dwLowDateTime=0x5acb6d30, ftLastAccessTime.dwHighDateTime=0x1d5c8d8, ftLastWriteTime.dwLowDateTime=0xc49a6e1f, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x31b0)) returned 1 [0105.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e4) returned 1 [0105.696] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\8DlKDK-3_w3zasIu.doc" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\qfals26m8ilmiqpho8c\\8dlkdk-3_w3zasiu.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\8DlKDK-3_w3zasIu.doc.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\qfals26m8ilmiqpho8c\\8dlkdk-3_w3zasiu.doc.lasan")) returned 1 [0105.697] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\i74n4v4aHki.ppt", nBufferLength=0x105, lpBuffer=0x19e428, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\i74n4v4aHki.ppt", lpFilePart=0x0) returned 0x4c [0105.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e96c) returned 1 [0105.697] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\i74n4v4aHki.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\qfals26m8ilmiqpho8c\\i74n4v4ahki.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0105.697] GetFileType (hFile=0x430) returned 0x1 [0105.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e968) returned 1 [0105.697] GetFileType (hFile=0x430) returned 0x1 [0105.697] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19ea68 | out: lpFileSizeHigh=0x19ea68*=0x0) returned 0x3355 [0105.697] ReadFile (in: hFile=0x430, lpBuffer=0x252ccb8, nNumberOfBytesToRead=0x3355, lpNumberOfBytesRead=0x19ea14, lpOverlapped=0x0 | out: lpBuffer=0x252ccb8*, lpNumberOfBytesRead=0x19ea14*=0x3355, lpOverlapped=0x0) returned 1 [0105.698] CloseHandle (hObject=0x430) returned 1 [0105.713] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\i74n4v4aHki.ppt", nBufferLength=0x105, lpBuffer=0x19e410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\i74n4v4aHki.ppt", lpFilePart=0x0) returned 0x4c [0105.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e954) returned 1 [0105.713] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\i74n4v4aHki.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\qfals26m8ilmiqpho8c\\i74n4v4ahki.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0105.714] GetFileType (hFile=0x430) returned 0x1 [0105.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e950) returned 1 [0105.714] GetFileType (hFile=0x430) returned 0x1 [0105.714] WriteFile (in: hFile=0x430, lpBuffer=0x2589b84*, nNumberOfBytesToWrite=0x3360, lpNumberOfBytesWritten=0x19ea04, lpOverlapped=0x0 | out: lpBuffer=0x2589b84*, lpNumberOfBytesWritten=0x19ea04*=0x3360, lpOverlapped=0x0) returned 1 [0105.715] CloseHandle (hObject=0x430) returned 1 [0105.717] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\i74n4v4aHki.ppt", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\i74n4v4aHki.ppt", lpFilePart=0x0) returned 0x4c [0105.717] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\i74n4v4aHki.ppt.lasan", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\i74n4v4aHki.ppt.lasan", lpFilePart=0x0) returned 0x52 [0105.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9e8) returned 1 [0105.717] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\i74n4v4aHki.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\qfals26m8ilmiqpho8c\\i74n4v4ahki.ppt"), fInfoLevelId=0x0, lpFileInformation=0x19ea64 | out: lpFileInformation=0x19ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee51e30, ftCreationTime.dwHighDateTime=0x1d5cf20, ftLastAccessTime.dwLowDateTime=0xed1fbb00, ftLastAccessTime.dwHighDateTime=0x1d5cfa9, ftLastWriteTime.dwLowDateTime=0xc49cd019, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x3360)) returned 1 [0105.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e4) returned 1 [0105.717] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\i74n4v4aHki.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\qfals26m8ilmiqpho8c\\i74n4v4ahki.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\i74n4v4aHki.ppt.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\qfals26m8ilmiqpho8c\\i74n4v4ahki.ppt.lasan")) returned 1 [0105.718] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\NTufqNMCcUTskx.rtf", nBufferLength=0x105, lpBuffer=0x19e428, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\NTufqNMCcUTskx.rtf", lpFilePart=0x0) returned 0x4f [0105.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e96c) returned 1 [0105.718] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\NTufqNMCcUTskx.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\qfals26m8ilmiqpho8c\\ntufqnmccutskx.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0105.718] GetFileType (hFile=0x430) returned 0x1 [0105.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e968) returned 1 [0105.718] GetFileType (hFile=0x430) returned 0x1 [0105.718] GetFileSize (in: hFile=0x430, lpFileSizeHigh=0x19ea68 | out: lpFileSizeHigh=0x19ea68*=0x0) returned 0x1d19 [0105.718] ReadFile (in: hFile=0x430, lpBuffer=0x258d3a0, nNumberOfBytesToRead=0x1d19, lpNumberOfBytesRead=0x19ea14, lpOverlapped=0x0 | out: lpBuffer=0x258d3a0*, lpNumberOfBytesRead=0x19ea14*=0x1d19, lpOverlapped=0x0) returned 1 [0105.718] CloseHandle (hObject=0x430) returned 1 [0105.733] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\NTufqNMCcUTskx.rtf", nBufferLength=0x105, lpBuffer=0x19e410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\NTufqNMCcUTskx.rtf", lpFilePart=0x0) returned 0x4f [0105.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e954) returned 1 [0105.733] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\NTufqNMCcUTskx.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\qfals26m8ilmiqpho8c\\ntufqnmccutskx.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x430 [0105.786] GetFileType (hFile=0x430) returned 0x1 [0105.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e950) returned 1 [0105.786] GetFileType (hFile=0x430) returned 0x1 [0105.786] WriteFile (in: hFile=0x430, lpBuffer=0x25e332c*, nNumberOfBytesToWrite=0x1d20, lpNumberOfBytesWritten=0x19ea04, lpOverlapped=0x0 | out: lpBuffer=0x25e332c*, lpNumberOfBytesWritten=0x19ea04*=0x1d20, lpOverlapped=0x0) returned 1 [0105.787] CloseHandle (hObject=0x430) returned 1 [0105.788] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\NTufqNMCcUTskx.rtf", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\NTufqNMCcUTskx.rtf", lpFilePart=0x0) returned 0x4f [0105.788] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\NTufqNMCcUTskx.rtf.lasan", nBufferLength=0x105, lpBuffer=0x19e534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\NTufqNMCcUTskx.rtf.lasan", lpFilePart=0x0) returned 0x55 [0105.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e9e8) returned 1 [0105.788] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\NTufqNMCcUTskx.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\qfals26m8ilmiqpho8c\\ntufqnmccutskx.rtf"), fInfoLevelId=0x0, lpFileInformation=0x19ea64 | out: lpFileInformation=0x19ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6355ca30, ftCreationTime.dwHighDateTime=0x1d5d077, ftLastAccessTime.dwLowDateTime=0x78c00370, ftLastAccessTime.dwHighDateTime=0x1d5cbb0, ftLastWriteTime.dwLowDateTime=0xc4a8bbfc, ftLastWriteTime.dwHighDateTime=0x1d5dffe, nFileSizeHigh=0x0, nFileSizeLow=0x1d20)) returned 1 [0105.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e9e4) returned 1 [0105.789] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\NTufqNMCcUTskx.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\qfals26m8ilmiqpho8c\\ntufqnmccutskx.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\_D0TfTj_TXFm1W\\qFAlS26m8ilmiqpho8c\\NTufqNMCcUTskx.rtf.lasan" (normalized: "c:\\users\\fd1hvy\\documents\\_d0tftj_txfm1w\\qfals26m8ilmiqpho8c\\ntufqnmccutskx.rtf.lasan")) returned 1 [0105.789] GetFullPathNameW (in: lpFileName="A:\\", nBufferLength=0x105, lpBuffer=0x19e630, lpFilePart=0x0 | out: lpBuffer="A:\\", lpFilePart=0x0) returned 0x3 [0105.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eae0) returned 1 [0105.794] GetFileAttributesExW (in: lpFileName="A:\\" (normalized: "a:"), fInfoLevelId=0x0, lpFileInformation=0x19eb5c | out: lpFileInformation=0x19eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0105.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eadc) returned 1 [0105.795] GetFullPathNameW (in: lpFileName="B:\\", nBufferLength=0x105, lpBuffer=0x19e630, lpFilePart=0x0 | out: lpBuffer="B:\\", lpFilePart=0x0) returned 0x3 [0105.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eae0) returned 1 [0105.799] GetFileAttributesExW (in: lpFileName="B:\\" (normalized: "b:"), fInfoLevelId=0x0, lpFileInformation=0x19eb5c | out: lpFileInformation=0x19eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0105.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eadc) returned 1 [0105.799] GetFullPathNameW (in: lpFileName="D:\\", nBufferLength=0x105, lpBuffer=0x19e630, lpFilePart=0x0 | out: lpBuffer="D:\\", lpFilePart=0x0) returned 0x3 [0105.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eae0) returned 1 [0105.803] GetFileAttributesExW (in: lpFileName="D:\\" (normalized: "d:"), fInfoLevelId=0x0, lpFileInformation=0x19eb5c | out: lpFileInformation=0x19eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0105.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eadc) returned 1 [0105.803] GetFullPathNameW (in: lpFileName="E:\\", nBufferLength=0x105, lpBuffer=0x19e630, lpFilePart=0x0 | out: lpBuffer="E:\\", lpFilePart=0x0) returned 0x3 [0105.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eae0) returned 1 [0105.807] GetFileAttributesExW (in: lpFileName="E:\\" (normalized: "e:"), fInfoLevelId=0x0, lpFileInformation=0x19eb5c | out: lpFileInformation=0x19eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0105.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eadc) returned 1 [0105.807] GetFullPathNameW (in: lpFileName="F:\\", nBufferLength=0x105, lpBuffer=0x19e630, lpFilePart=0x0 | out: lpBuffer="F:\\", lpFilePart=0x0) returned 0x3 [0105.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eae0) returned 1 [0105.811] GetFileAttributesExW (in: lpFileName="F:\\" (normalized: "f:"), fInfoLevelId=0x0, lpFileInformation=0x19eb5c | out: lpFileInformation=0x19eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0105.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eadc) returned 1 [0105.811] GetFullPathNameW (in: lpFileName="G:\\", nBufferLength=0x105, lpBuffer=0x19e630, lpFilePart=0x0 | out: lpBuffer="G:\\", lpFilePart=0x0) returned 0x3 [0105.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eae0) returned 1 [0105.815] GetFileAttributesExW (in: lpFileName="G:\\" (normalized: "g:"), fInfoLevelId=0x0, lpFileInformation=0x19eb5c | out: lpFileInformation=0x19eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0105.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eadc) returned 1 [0105.817] GetFullPathNameW (in: lpFileName="H:\\", nBufferLength=0x105, lpBuffer=0x19e630, lpFilePart=0x0 | out: lpBuffer="H:\\", lpFilePart=0x0) returned 0x3 [0105.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eae0) returned 1 [0105.821] GetFileAttributesExW (in: lpFileName="H:\\" (normalized: "h:"), fInfoLevelId=0x0, lpFileInformation=0x19eb5c | out: lpFileInformation=0x19eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0105.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eadc) returned 1 [0105.821] GetFullPathNameW (in: lpFileName="I:\\", nBufferLength=0x105, lpBuffer=0x19e630, lpFilePart=0x0 | out: lpBuffer="I:\\", lpFilePart=0x0) returned 0x3 [0105.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eae0) returned 1 [0105.825] GetFileAttributesExW (in: lpFileName="I:\\" (normalized: "i:"), fInfoLevelId=0x0, lpFileInformation=0x19eb5c | out: lpFileInformation=0x19eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0105.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eadc) returned 1 [0105.825] GetFullPathNameW (in: lpFileName="J:\\", nBufferLength=0x105, lpBuffer=0x19e630, lpFilePart=0x0 | out: lpBuffer="J:\\", lpFilePart=0x0) returned 0x3 [0105.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eae0) returned 1 [0105.829] GetFileAttributesExW (in: lpFileName="J:\\" (normalized: "j:"), fInfoLevelId=0x0, lpFileInformation=0x19eb5c | out: lpFileInformation=0x19eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0105.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eadc) returned 1 [0105.887] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x19e61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0105.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ead0) returned 1 [0105.887] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x19eb4c | out: lpFileInformation=0x19eb4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0105.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eacc) returned 1 [0106.008] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x19e4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0106.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea2c) returned 1 [0106.008] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x430 [0106.009] GetFileType (hFile=0x430) returned 0x1 [0106.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea28) returned 1 [0106.009] GetFileType (hFile=0x430) returned 0x1 [0106.010] WriteFile (in: hFile=0x430, lpBuffer=0x25e7560*, nNumberOfBytesToWrite=0x88, lpNumberOfBytesWritten=0x19ea8c, lpOverlapped=0x0 | out: lpBuffer=0x25e7560*, lpNumberOfBytesWritten=0x19ea8c*=0x88, lpOverlapped=0x0) returned 1 [0106.011] CloseHandle (hObject=0x430) returned 1 [0106.015] PeekMessageW (in: lpMsg=0x19ee98, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee98) returned 1 [0106.015] GetMessageA (in: lpMsg=0x19ee98, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19ee98) returned 0 [0106.020] GetWindowThreadProcessId (in: hWnd=0x502b8, lpdwProcessId=0x19ed38 | out: lpdwProcessId=0x19ed38) returned 0xfb0 [0106.020] GetCurrentThreadId () returned 0xfb0 [0106.020] IsWindow (hWnd=0x502b8) returned 1 [0106.020] KillTimer (hWnd=0x502b8, uIDEvent=0x1) returned 1 [0106.020] DestroyWindow (hWnd=0x502b8) returned 1 [0106.021] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x502b8, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0106.021] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x502b8, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0106.021] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x502b8, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0106.025] DestroyCursor (hCursor=0x160231) returned 1 [0106.026] GetWindowLongW (hWnd=0x8006c, nIndex=-20) returned 590080 [0106.026] DestroyWindow (hWnd=0x8006c) returned 1 [0106.026] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0106.026] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0x46, wParam=0x0, lParam=0x19ec3c) returned 0x0 [0106.029] GetWindowPlacement (in: hWnd=0x8006c, lpwndpl=0x19e968 | out: lpwndpl=0x19e968) returned 1 [0106.029] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0x47, wParam=0x0, lParam=0x19ec3c) returned 0x0 [0106.029] GetClientRect (in: hWnd=0x8006c, lpRect=0x19e918 | out: lpRect=0x19e918) returned 1 [0106.029] GetWindowRect (in: hWnd=0x8006c, lpRect=0x19e918 | out: lpRect=0x19e918) returned 1 [0106.030] PostThreadMessageW (idThread=0xfb0, Msg=0x12, wParam=0x0, lParam=0x0) returned 1 [0106.032] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0106.033] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x8006c, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0106.033] DestroyWindow (hWnd=0x90036) returned 1 [0106.033] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x90036, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0106.033] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x90036, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0106.033] CallWindowProcW (lpPrevWndFunc=0x742a0140, hWnd=0x90036, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0106.041] GetCurrentThreadId () returned 0xfb0 [0106.041] EnumThreadWindows (dwThreadId=0xfb0, lpfn=0x1f97de6, lParam=0x0) returned 1 [0106.042] IsWindowVisible (hWnd=0x7006e) returned 0 [0106.042] IsWindowVisible (hWnd=0x302ca) returned 0 [0106.042] GetCurrentThreadId () returned 0xfb0 [0106.042] GetCurrentThreadId () returned 0xfb0 [0106.042] EnumThreadWindows (dwThreadId=0xfb0, lpfn=0x1f97f26, lParam=0x0) returned 1 [0106.042] IsWindowVisible (hWnd=0x7006e) returned 0 [0106.043] IsWindowVisible (hWnd=0x302ca) returned 0 [0106.043] OleUninitialize () [0106.043] CloseHandle (hObject=0x370) returned 1 [0106.043] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1e880005) returned 1 [0106.045] HeapFree (in: hHeap=0x1fd0000, dwFlags=0x0, lpMem=0x1fd0fe8 | out: hHeap=0x1fd0000) returned 1 [0106.045] HeapFree (in: hHeap=0x1fd0000, dwFlags=0x0, lpMem=0x1fd0fd0 | out: hHeap=0x1fd0000) returned 1 [0106.047] HeapFree (in: hHeap=0x1fd0000, dwFlags=0x0, lpMem=0x1fd1fc0 | out: hHeap=0x1fd0000) returned 1 [0106.047] GetModuleHandleW (lpModuleName="mscoree.dll") returned 0x74160000 [0106.047] GetProcAddress (hModule=0x74160000, lpProcName="CorExitProcess") returned 0x741721f0 [0106.052] CoGetContextToken (in: pToken=0x19fb08 | out: pToken=0x19fb08) returned 0x0 [0106.052] CObjectContext::QueryInterface () returned 0x0 [0106.052] CObjectContext::GetCurrentThreadType () returned 0x0 [0106.052] Release () returned 0x0 [0106.053] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x13880, cHandles=0x1, pHandles=0x5c0d80*=0x1b4, lpdwindex=0x19f9ac | out: lpdwindex=0x19f9ac) returned 0x0 [0106.226] HeapFree (in: hHeap=0x1fd0000, dwFlags=0x0, lpMem=0x1fd05a8 | out: hHeap=0x1fd0000) returned 1 Thread: id = 27 os_tid = 0xfac Thread: id = 29 os_tid = 0xf9c Thread: id = 30 os_tid = 0xf90 [0080.244] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0080.244] RoInitialize () returned 0x1 [0080.244] RoUninitialize () returned 0x0 [0099.160] CloseHandle (hObject=0x424) returned 1 [0099.160] CloseHandle (hObject=0x40c) returned 1 [0099.160] CloseHandle (hObject=0x420) returned 1 [0099.161] CloseHandle (hObject=0x41c) returned 1 [0099.161] CloseHandle (hObject=0x434) returned 1 [0099.161] CloseHandle (hObject=0x42c) returned 1 [0099.161] CloseHandle (hObject=0x428) returned 1 [0099.161] CloseHandle (hObject=0x430) returned 1 [0106.114] SetWindowLongW (hWnd=0x80126, nIndex=-4, dwNewLong=1948909888) returned 33114838 [0106.115] SetClassLongW (hWnd=0x80126, nIndex=-24, dwNewLong=1948909888) returned 0x1f94aae [0106.115] PostMessageW (hWnd=0x80126, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0106.116] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0106.116] UnregisterClassW (lpClassName="WindowsForms10.Window.0.app.0.141b42a_r10_ad1", hInstance=0x400000) returned 1 [0106.116] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0106.117] UnregisterClassW (lpClassName="WindowsForms10.Window.8.app.0.141b42a_r10_ad1", hInstance=0x400000) returned 0 [0106.117] EtwEventUnregister (RegHandle=0x5ff3b0) returned 0x0 [0106.119] IsWindow (hWnd=0x7006e) returned 1 [0106.120] GetModuleHandleW (lpModuleName="user32.dll") returned 0x76240000 [0106.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x451fa14, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcWÊqÝá\x07Bðù\x9fs\x98üQ\x04\x01", lpUsedDefaultChar=0x0) returned 14 [0106.120] GetProcAddress (hModule=0x76240000, lpProcName="DefWindowProcW") returned 0x742a0140 [0106.121] SetWindowLongW (hWnd=0x7006e, nIndex=-4, dwNewLong=1948909888) returned 33114998 [0106.121] SetClassLongW (hWnd=0x7006e, nIndex=-24, dwNewLong=1948909888) returned 0x1f94b76 [0106.121] IsWindow (hWnd=0x7006e) returned 1 [0106.121] DestroyWindow (hWnd=0x7006e) returned 0 [0106.121] PostMessageW (hWnd=0x7006e, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0106.121] SetConsoleCtrlHandler (HandlerRoutine=0x1f94b4e, Add=0) returned 1 [0106.122] DeleteObject (ho=0x87080521) returned 1 [0106.128] DestroyCursor (hCursor=0xf0113) returned 1 [0106.129] DeleteObject (ho=0x810a0543) returned 1 [0106.129] GdipDeleteFont (font=0x6a7ef48) returned 0x0 [0106.162] RegCloseKey (hKey=0x80000004) returned 0x0 [0106.163] SleepEx (dwMilliseconds=0xffffffff, bAlertable=0) Thread: id = 31 os_tid = 0x1320 Thread: id = 32 os_tid = 0x13ac [0106.165] SleepEx (dwMilliseconds=0x14, bAlertable=0) Thread: id = 33 os_tid = 0x1328 Thread: id = 34 os_tid = 0x12f0 Thread: id = 35 os_tid = 0x12e4