# Flog Txt Version 1 # Analyzer Version: 4.1.1 # Analyzer Build Date: Feb 8 2021 16:19:57 # Log Creation Date: 23.03.2021 10:19:40.522 Process: id = "1" image_name = "covid.exe" filename = "c:\\users\\rdhj0cnfevzx\\desktop\\covid.exe" page_root = "0x3aedb000" os_pid = "0xaa4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x838" cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\covid.exe\" " cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001d5b8" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3 start_va = 0x50000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 4 start_va = 0x150000 end_va = 0x153fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 5 start_va = 0x160000 end_va = 0x160fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 6 start_va = 0x170000 end_va = 0x171fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 7 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 8 start_va = 0x400000 end_va = 0x409fff monitored = 1 entry_point = 0x4049f2 region_type = mapped_file name = "covid.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\covid.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\covid.exe") Region: id = 9 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 10 start_va = 0x7ff5fffd0000 end_va = 0x7ff5ffff2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5fffd0000" filename = "" Region: id = 11 start_va = 0x7ff846350000 end_va = 0x7ff846510fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 207 start_va = 0x590000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 208 start_va = 0x7ff828a60000 end_va = 0x7ff828ac7fff monitored = 1 entry_point = 0x7ff828a64970 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 209 start_va = 0x7ff842b80000 end_va = 0x7ff842d67fff monitored = 0 entry_point = 0x7ff842baba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 210 start_va = 0x7ff844cb0000 end_va = 0x7ff844d5cfff monitored = 0 entry_point = 0x7ff844cc81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 211 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 212 start_va = 0x7ff5ffed0000 end_va = 0x7ff5fffcffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5ffed0000" filename = "" Region: id = 213 start_va = 0x410000 end_va = 0x4cdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 214 start_va = 0x4d0000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 215 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 216 start_va = 0x7ff8410a0000 end_va = 0x7ff841118fff monitored = 0 entry_point = 0x7ff8410bfb90 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 217 start_va = 0x7ff5ffe50000 end_va = 0x7ff5ffecdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 218 start_va = 0x7ff845a70000 end_va = 0x7ff845b16fff monitored = 0 entry_point = 0x7ff845a858d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 219 start_va = 0x7ff845da0000 end_va = 0x7ff845e3cfff monitored = 0 entry_point = 0x7ff845da78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 220 start_va = 0x690000 end_va = 0x78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 221 start_va = 0x7ff845a10000 end_va = 0x7ff845a6afff monitored = 0 entry_point = 0x7ff845a238b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 222 start_va = 0x180000 end_va = 0x186fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 223 start_va = 0x7ff844d60000 end_va = 0x7ff844e7bfff monitored = 0 entry_point = 0x7ff844da02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 224 start_va = 0x790000 end_va = 0x98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 225 start_va = 0x190000 end_va = 0x196fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 226 start_va = 0x7ff8289c0000 end_va = 0x7ff828a57fff monitored = 1 entry_point = 0x7ff8289c1000 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 227 start_va = 0x7ff845950000 end_va = 0x7ff8459a1fff monitored = 0 entry_point = 0x7ff84595f530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 228 start_va = 0x7ff845f80000 end_va = 0x7ff8461fcfff monitored = 0 entry_point = 0x7ff846054970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 229 start_va = 0x7ff842a00000 end_va = 0x7ff842a69fff monitored = 0 entry_point = 0x7ff842a36d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 230 start_va = 0x7ff845260000 end_va = 0x7ff8453e5fff monitored = 0 entry_point = 0x7ff8452affc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 231 start_va = 0x7ff844f90000 end_va = 0x7ff8450e5fff monitored = 0 entry_point = 0x7ff844f9a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 232 start_va = 0x1a0000 end_va = 0x1d8fff monitored = 0 entry_point = 0x1a12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 233 start_va = 0x790000 end_va = 0x917fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000790000" filename = "" Region: id = 234 start_va = 0x980000 end_va = 0x98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 235 start_va = 0x7ff845ec0000 end_va = 0x7ff845efafff monitored = 0 entry_point = 0x7ff845ec12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 236 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 237 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 238 start_va = 0x990000 end_va = 0xb10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000990000" filename = "" Region: id = 239 start_va = 0xb20000 end_va = 0x1f1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b20000" filename = "" Region: id = 240 start_va = 0x1c0000 end_va = 0x1c3fff monitored = 1 entry_point = 0x1c49f2 region_type = mapped_file name = "covid.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\covid.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\covid.exe") Region: id = 241 start_va = 0x7ff8429e0000 end_va = 0x7ff8429eefff monitored = 0 entry_point = 0x7ff8429e3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 242 start_va = 0x7ff839250000 end_va = 0x7ff839259fff monitored = 0 entry_point = 0x7ff839251350 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 243 start_va = 0x7ff826550000 end_va = 0x7ff826eddfff monitored = 1 entry_point = 0x7ff82667d9f0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 244 start_va = 0x7ff828880000 end_va = 0x7ff828976fff monitored = 0 entry_point = 0x7ff8288a4d80 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\System32\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll") Region: id = 245 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 246 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 247 start_va = 0x1e0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 248 start_va = 0x7ff7c6dc0000 end_va = 0x7ff7c6dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff7c6dc0000" filename = "" Region: id = 249 start_va = 0x7ff7c6dd0000 end_va = 0x7ff7c6ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff7c6dd0000" filename = "" Region: id = 250 start_va = 0x7ff7c6de0000 end_va = 0x7ff7c6e6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff7c6de0000" filename = "" Region: id = 251 start_va = 0x7ff7c6e70000 end_va = 0x7ff7c6edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff7c6e70000" filename = "" Region: id = 252 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 253 start_va = 0x4d0000 end_va = 0x4d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 254 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 255 start_va = 0x1f20000 end_va = 0x210ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f20000" filename = "" Region: id = 256 start_va = 0x4e0000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 257 start_va = 0x1f20000 end_va = 0x201ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f20000" filename = "" Region: id = 258 start_va = 0x2100000 end_va = 0x210ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 259 start_va = 0x4e0000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 260 start_va = 0x510000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 261 start_va = 0x2110000 end_va = 0x1a10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002110000" filename = "" Region: id = 262 start_va = 0x1a110000 end_va = 0x1a47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a110000" filename = "" Region: id = 263 start_va = 0x1a480000 end_va = 0x1a590fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a480000" filename = "" Region: id = 264 start_va = 0x1a5a0000 end_va = 0x1a69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a5a0000" filename = "" Region: id = 265 start_va = 0x1a6a0000 end_va = 0x1a9d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 266 start_va = 0x7ff825080000 end_va = 0x7ff826545fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\e24742a3939bece9db8105d99720b0e0\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\e24742a3939bece9db8105d99720b0e0\\mscorlib.ni.dll") Region: id = 267 start_va = 0x7ff846200000 end_va = 0x7ff846342fff monitored = 0 entry_point = 0x7ff846228210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 268 start_va = 0x2020000 end_va = 0x20dffff monitored = 0 entry_point = 0x2040da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 269 start_va = 0x2020000 end_va = 0x20fcfff monitored = 0 entry_point = 0x207e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 270 start_va = 0x7ff8412f0000 end_va = 0x7ff841385fff monitored = 0 entry_point = 0x7ff841315570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 271 start_va = 0x4e0000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 272 start_va = 0x7ff5ffe30000 end_va = 0x7ff5ffecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff5ffe30000" filename = "" Region: id = 273 start_va = 0x7ff5ffe20000 end_va = 0x7ff5ffe2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff5ffe20000" filename = "" Region: id = 274 start_va = 0x7ff7c6ee0000 end_va = 0x7ff7c6f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff7c6ee0000" filename = "" Region: id = 275 start_va = 0x7ff7c6f20000 end_va = 0x7ff7c6f2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff7c6f20000" filename = "" Region: id = 276 start_va = 0x7ff82cf40000 end_va = 0x7ff82d044fff monitored = 1 entry_point = 0x7ff82cf4107c region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 277 start_va = 0x7ff845b20000 end_va = 0x7ff845be0fff monitored = 0 entry_point = 0x7ff845b40da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 278 start_va = 0x4e0000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 279 start_va = 0x500000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 280 start_va = 0x7ff824460000 end_va = 0x7ff825073fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\cb0700ff6398b8e9d0d936cfc4894ba1\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\cb0700ff6398b8e9d0d936cfc4894ba1\\system.ni.dll") Region: id = 281 start_va = 0x7ff828b80000 end_va = 0x7ff828d6afff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\07904e28a4042013cf2850aa829d512c\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\07904e28a4042013cf2850aa829d512c\\system.drawing.ni.dll") Region: id = 282 start_va = 0x7ff823570000 end_va = 0x7ff824452fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b3ed3a5b3196c07e3a9165328654c5de\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b3ed3a5b3196c07e3a9165328654c5de\\system.windows.forms.ni.dll") Region: id = 283 start_va = 0x4f0000 end_va = 0x4f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004f0000" filename = "" Region: id = 284 start_va = 0x4f0000 end_va = 0x4f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004f0000" filename = "" Region: id = 285 start_va = 0x520000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 286 start_va = 0x7ff843750000 end_va = 0x7ff844caefff monitored = 0 entry_point = 0x7ff8438b11f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 287 start_va = 0x7ff842e20000 end_va = 0x7ff842e62fff monitored = 0 entry_point = 0x7ff842e34b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 288 start_va = 0x7ff842e70000 end_va = 0x7ff8434b3fff monitored = 0 entry_point = 0x7ff8430364b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 292 start_va = 0x7ff842970000 end_va = 0x7ff8429bafff monitored = 0 entry_point = 0x7ff8429735f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 293 start_va = 0x7ff8429c0000 end_va = 0x7ff8429d3fff monitored = 0 entry_point = 0x7ff8429c52e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 294 start_va = 0x7ff843690000 end_va = 0x7ff843744fff monitored = 0 entry_point = 0x7ff8436d22e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 295 start_va = 0x520000 end_va = 0x520fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000520000" filename = "" Region: id = 296 start_va = 0x2020000 end_va = 0x20c5fff monitored = 0 entry_point = 0x20293e0 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_396e892957c7fb25\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_396e892957c7fb25\\comctl32.dll") Region: id = 297 start_va = 0x7ff83b5c0000 end_va = 0x7ff83b669fff monitored = 0 entry_point = 0x7ff83b5c93e0 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_396e892957c7fb25\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_396e892957c7fb25\\comctl32.dll") Region: id = 298 start_va = 0x2020000 end_va = 0x20fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 299 start_va = 0x530000 end_va = 0x530fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Region: id = 300 start_va = 0x2020000 end_va = 0x20dbfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002020000" filename = "" Region: id = 301 start_va = 0x20f0000 end_va = 0x20fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020f0000" filename = "" Region: id = 302 start_va = 0x530000 end_va = 0x533fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Region: id = 303 start_va = 0x540000 end_va = 0x546fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 304 start_va = 0x1a9e0000 end_va = 0x1ac4ffff monitored = 0 entry_point = 0x1aa50400 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll") Region: id = 305 start_va = 0x7ff83ef20000 end_va = 0x7ff83f193fff monitored = 0 entry_point = 0x7ff83ef90400 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll") Region: id = 306 start_va = 0x550000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 307 start_va = 0x560000 end_va = 0x561fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000560000" filename = "" Region: id = 308 start_va = 0x1a9e0000 end_va = 0x1abdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a9e0000" filename = "" Region: id = 309 start_va = 0x7ff840ba0000 end_va = 0x7ff840bc1fff monitored = 0 entry_point = 0x7ff840ba1a40 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 310 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 311 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 312 start_va = 0x920000 end_va = 0x92ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 313 start_va = 0x930000 end_va = 0x93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000930000" filename = "" Region: id = 314 start_va = 0x940000 end_va = 0x95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 315 start_va = 0x7ff8450f0000 end_va = 0x7ff845249fff monitored = 0 entry_point = 0x7ff8451338e0 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 316 start_va = 0x1a9e0000 end_va = 0x1aadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a9e0000" filename = "" Region: id = 317 start_va = 0x1abd0000 end_va = 0x1abdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001abd0000" filename = "" Region: id = 318 start_va = 0x1abe0000 end_va = 0x1acdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001abe0000" filename = "" Region: id = 319 start_va = 0x7ff839f00000 end_va = 0x7ff83a0a8fff monitored = 0 entry_point = 0x7ff839f54060 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_0bdd1d3064f6384a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_0bdd1d3064f6384a\\gdiplus.dll") Region: id = 320 start_va = 0x920000 end_va = 0x97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 321 start_va = 0x1ace0000 end_va = 0x1addffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ace0000" filename = "" Region: id = 322 start_va = 0x7ff83e180000 end_va = 0x7ff83e3dffff monitored = 0 entry_point = 0x7ff83e22b5b0 region_type = mapped_file name = "dwrite.dll" filename = "\\Windows\\System32\\DWrite.dll" (normalized: "c:\\windows\\system32\\dwrite.dll") Region: id = 323 start_va = 0x920000 end_va = 0x968fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "~fontcache-system.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-System.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-system.dat") Region: id = 324 start_va = 0x970000 end_va = 0x97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000970000" filename = "" Region: id = 325 start_va = 0x1ade0000 end_va = 0x1aedffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ade0000" filename = "" Region: id = 326 start_va = 0x1aee0000 end_va = 0x1bedffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "~fontcache-fontface.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-FontFace.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-fontface.dat") Region: id = 327 start_va = 0x550000 end_va = 0x556fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 328 start_va = 0x1bee0000 end_va = 0x1bfdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bee0000" filename = "" Region: id = 329 start_va = 0x1bfe0000 end_va = 0x1c4d1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bfe0000" filename = "" Region: id = 330 start_va = 0x1aae0000 end_va = 0x1ab9cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "micross.ttf" filename = "\\Windows\\Fonts\\micross.ttf" (normalized: "c:\\windows\\fonts\\micross.ttf") Region: id = 331 start_va = 0x1c4e0000 end_va = 0x1c8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001c4e0000" filename = "" Region: id = 332 start_va = 0x7ff7c6f30000 end_va = 0x7ff7c6f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff7c6f30000" filename = "" Region: id = 333 start_va = 0x1c8e0000 end_va = 0x1d91ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 334 start_va = 0x580000 end_va = 0x580fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 335 start_va = 0x20e0000 end_va = 0x20effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 336 start_va = 0x20e0000 end_va = 0x20effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 337 start_va = 0x1d920000 end_va = 0x1dd23fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d920000" filename = "" Region: id = 338 start_va = 0x1d920000 end_va = 0x1dd23fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d920000" filename = "" Region: id = 339 start_va = 0x20e0000 end_va = 0x20e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000020e0000" filename = "" Region: id = 340 start_va = 0x1aba0000 end_va = 0x1aba6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aba0000" filename = "" Region: id = 341 start_va = 0x1d920000 end_va = 0x1dd23fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d920000" filename = "" Region: id = 342 start_va = 0x1abb0000 end_va = 0x1abb0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001abb0000" filename = "" Region: id = 343 start_va = 0x1d920000 end_va = 0x1da1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d920000" filename = "" Region: id = 344 start_va = 0x1abb0000 end_va = 0x1abbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001abb0000" filename = "" Region: id = 345 start_va = 0x1abb0000 end_va = 0x1abbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001abb0000" filename = "" Region: id = 346 start_va = 0x1abc0000 end_va = 0x1abcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001abc0000" filename = "" Region: id = 347 start_va = 0x1da20000 end_va = 0x1da2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001da20000" filename = "" Region: id = 348 start_va = 0x1da30000 end_va = 0x1da3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001da30000" filename = "" Region: id = 349 start_va = 0x1abb0000 end_va = 0x1abbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001abb0000" filename = "" Region: id = 350 start_va = 0x7ff8422f0000 end_va = 0x7ff842306fff monitored = 0 entry_point = 0x7ff8422f79d0 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 351 start_va = 0x7ff841f80000 end_va = 0x7ff841fb3fff monitored = 0 entry_point = 0x7ff841f9ae70 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 352 start_va = 0x7ff842800000 end_va = 0x7ff842828fff monitored = 0 entry_point = 0x7ff842814530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 353 start_va = 0x7ff842410000 end_va = 0x7ff84241afff monitored = 0 entry_point = 0x7ff8424119a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 354 start_va = 0x1da20000 end_va = 0x1db1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001da20000" filename = "" Region: id = 355 start_va = 0x1db20000 end_va = 0x1dc1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db20000" filename = "" Region: id = 356 start_va = 0x1dc20000 end_va = 0x1dd1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc20000" filename = "" Region: id = 360 start_va = 0x690000 end_va = 0x691fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 361 start_va = 0x1dd20000 end_va = 0x1e123fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dd20000" filename = "" Region: id = 362 start_va = 0x690000 end_va = 0x693fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 363 start_va = 0x6a0000 end_va = 0x6a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 364 start_va = 0x6b0000 end_va = 0x6bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006b0000" filename = "" Region: id = 365 start_va = 0x1e230000 end_va = 0x1e32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e230000" filename = "" Thread: id = 1 os_tid = 0xe20 [0113.086] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0115.323] RoInitialize () returned 0x1 [0115.323] RoUninitialize () returned 0x0 [0123.149] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x14e920, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0123.169] IsAppThemed () returned 0x1 [0123.173] CoTaskMemAlloc (cb=0xf0) returned 0x61ed20 [0123.173] CreateActCtxA (pActCtx=0x14eef0) returned 0x6263a8 [0123.245] CoTaskMemFree (pv=0x61ed20) [0123.259] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc1e3 [0123.260] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc1e2 [0131.371] CoTaskMemAlloc (cb=0x20c) returned 0x628e20 [0131.371] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x628e20 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x0 [0131.381] CoTaskMemFree (pv=0x628e20) [0131.381] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x105, lpBuffer=0x14e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x0) returned 0x1d [0131.382] CoTaskMemAlloc (cb=0x20c) returned 0x627060 [0131.382] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x627060 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\Documents") returned 0x0 [0131.383] CoTaskMemFree (pv=0x627060) [0131.383] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x14e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0131.383] CoTaskMemAlloc (cb=0x20c) returned 0x627060 [0131.383] SHGetFolderPathW (in: hwnd=0x0, csidl=39, hToken=0x0, dwFlags=0x0, pszPath=0x627060 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\Pictures") returned 0x0 [0131.385] CoTaskMemFree (pv=0x627060) [0131.385] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures", nBufferLength=0x105, lpBuffer=0x14e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures", lpFilePart=0x0) returned 0x1e [0131.419] GetSystemMetrics (nIndex=75) returned 1 [0131.432] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0133.336] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x7ff83b5c0000 [0133.382] AdjustWindowRectEx (in: lpRect=0x14ef50, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x14ef50) returned 1 [0133.462] GetCurrentProcess () returned 0xffffffffffffffff [0133.462] GetCurrentThread () returned 0xfffffffffffffffe [0133.462] GetCurrentProcess () returned 0xffffffffffffffff [0133.463] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xfffffffffffffffe, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x14ed60, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x14ed60*=0x2c8) returned 1 [0133.479] GetCurrentThreadId () returned 0xe20 [0133.497] GetCurrentActCtx (in: lphActCtx=0x14ec60 | out: lphActCtx=0x14ec60*=0x0) returned 1 [0133.497] ActivateActCtx (in: hActCtx=0x6263a8, lpCookie=0x14eca0 | out: hActCtx=0x6263a8, lpCookie=0x14eca0) returned 1 [0133.497] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0136.102] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x7ff83ef20000 [0136.122] GetModuleHandleW (lpModuleName="user32.dll") returned 0x7ff844f90000 [0136.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x14e990, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcW", lpUsedDefaultChar=0x0) returned 14 [0136.123] GetProcAddress (hModule=0x7ff844f90000, lpProcName="DefWindowProcW") returned 0x7ff8463f4a40 [0136.124] GetStockObject (i=5) returned 0x1900015 [0136.131] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0136.142] CoTaskMemAlloc (cb=0x5a) returned 0x6221d0 [0136.142] RegisterClassW (lpWndClass=0x14e950) returned 0xc1de [0136.143] CoTaskMemFree (pv=0x6221d0) [0136.143] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0136.144] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r8_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffffffffffd, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x4020c [0136.160] SetWindowLongPtrW (hWnd=0x4020c, nIndex=-4, dwNewLong=0x7ff8463f4a40) returned 0x1abd085c [0136.162] GetWindowLongPtrW (hWnd=0x4020c, nIndex=-4) returned 0x7ff8463f4a40 [0136.175] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x14dd18 | out: phkResult=0x14dd18*=0x2e0) returned 0x0 [0136.177] RegQueryValueExW (in: hKey=0x2e0, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x14dd68, lpData=0x0, lpcbData=0x14dd60*=0x0 | out: lpType=0x14dd68*=0x0, lpData=0x0, lpcbData=0x14dd60*=0x0) returned 0x2 [0136.177] RegQueryValueExW (in: hKey=0x2e0, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x14dd68, lpData=0x0, lpcbData=0x14dd60*=0x0 | out: lpType=0x14dd68*=0x0, lpData=0x0, lpcbData=0x14dd60*=0x0) returned 0x2 [0136.178] RegCloseKey (hKey=0x2e0) returned 0x0 [0136.180] SetWindowLongPtrW (hWnd=0x4020c, nIndex=-4, dwNewLong=0x1abd08ac) returned 0x7ff8463f4a40 [0136.180] GetWindowLongPtrW (hWnd=0x4020c, nIndex=-4) returned 0x1abd08ac [0136.180] GetWindowLongPtrW (hWnd=0x4020c, nIndex=-16) returned 0x6c10000 [0136.183] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc14f [0136.184] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x4020c, Msg=0x24, wParam=0x0, lParam=0x14e370) returned 0x0 [0136.184] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc1dd [0136.185] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x4020c, Msg=0x81, wParam=0x0, lParam=0x14e2e0) returned 0x1 [0136.186] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x4020c, Msg=0x83, wParam=0x0, lParam=0x14e390) returned 0x0 [0136.741] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x4020c, Msg=0x1, wParam=0x0, lParam=0x14e2e0) returned 0x0 [0136.742] GetClientRect (in: hWnd=0x4020c, lpRect=0x14dd70 | out: lpRect=0x14dd70) returned 1 [0136.742] GetWindowRect (in: hWnd=0x4020c, lpRect=0x14dd70 | out: lpRect=0x14dd70) returned 1 [0136.745] GetParent (hWnd=0x4020c) returned 0x0 [0136.746] DeactivateActCtx (dwFlags=0x0, ulCookie=0x12117b3d00000001) returned 1 [0136.863] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83b5c0000 [0136.864] AdjustWindowRectEx (in: lpRect=0x14ee80, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14ee80) returned 1 [0136.864] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83b5c0000 [0136.864] AdjustWindowRectEx (in: lpRect=0x14ee80, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14ee80) returned 1 [0136.865] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83b5c0000 [0136.865] AdjustWindowRectEx (in: lpRect=0x14ee80, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14ee80) returned 1 [0136.865] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83b5c0000 [0136.865] AdjustWindowRectEx (in: lpRect=0x14ee80, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14ee80) returned 1 [0136.870] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83b5c0000 [0136.870] AdjustWindowRectEx (in: lpRect=0x14ed18, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14ed18) returned 1 [0136.894] GetProcessWindowStation () returned 0xcc [0136.900] GetUserObjectInformationA (in: hObj=0xcc, nIndex=1, pvInfo=0x211f1f8, nLength=0xc, lpnLengthNeeded=0x14e990 | out: pvInfo=0x211f1f8, lpnLengthNeeded=0x14e990) returned 1 [0136.920] SetConsoleCtrlHandler (HandlerRoutine=0x1abd08fc, Add=1) returned 1 [0136.922] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0136.923] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0136.925] GetClassInfoW (in: hInstance=0x400000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWndClass=0x211f2b8 | out: lpWndClass=0x211f2b8) returned 0 [0136.926] CoTaskMemAlloc (cb=0x58) returned 0x62bff0 [0136.926] RegisterClassW (lpWndClass=0x14e7a0) returned 0xc1dc [0136.926] CoTaskMemFree (pv=0x62bff0) [0136.927] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x50078 [0138.995] NtdllDefWindowProc_W (hWnd=0x50078, Msg=0x81, wParam=0x0, lParam=0x14e0c0) returned 0x1 [0139.003] NtdllDefWindowProc_W (hWnd=0x50078, Msg=0x83, wParam=0x0, lParam=0x14e170) returned 0x0 [0139.004] NtdllDefWindowProc_W (hWnd=0x50078, Msg=0x1, wParam=0x0, lParam=0x14e060) returned 0x0 [0139.004] NtdllDefWindowProc_W (hWnd=0x50078, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0139.004] NtdllDefWindowProc_W (hWnd=0x50078, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0139.018] GetSysColor (nIndex=10) returned 0xb4b4b4 [0139.018] GetSysColor (nIndex=2) returned 0xd1b499 [0139.018] GetSysColor (nIndex=9) returned 0x0 [0139.018] GetSysColor (nIndex=12) returned 0xababab [0139.018] GetSysColor (nIndex=15) returned 0xf0f0f0 [0139.018] GetSysColor (nIndex=20) returned 0xffffff [0139.018] GetSysColor (nIndex=16) returned 0xa0a0a0 [0139.019] GetSysColor (nIndex=15) returned 0xf0f0f0 [0139.019] GetSysColor (nIndex=16) returned 0xa0a0a0 [0139.019] GetSysColor (nIndex=21) returned 0x696969 [0139.019] GetSysColor (nIndex=22) returned 0xe3e3e3 [0139.019] GetSysColor (nIndex=20) returned 0xffffff [0139.019] GetSysColor (nIndex=18) returned 0x0 [0139.019] GetSysColor (nIndex=1) returned 0x0 [0139.019] GetSysColor (nIndex=27) returned 0xead1b9 [0139.019] GetSysColor (nIndex=28) returned 0xf2e4d7 [0139.019] GetSysColor (nIndex=17) returned 0x6d6d6d [0139.019] GetSysColor (nIndex=13) returned 0xff9933 [0139.019] GetSysColor (nIndex=14) returned 0xffffff [0139.019] GetSysColor (nIndex=26) returned 0xcc6600 [0139.019] GetSysColor (nIndex=11) returned 0xfcf7f4 [0139.019] GetSysColor (nIndex=3) returned 0xdbcdbf [0139.019] GetSysColor (nIndex=19) returned 0x0 [0139.020] GetSysColor (nIndex=24) returned 0xe1ffff [0139.020] GetSysColor (nIndex=23) returned 0x0 [0139.020] GetSysColor (nIndex=4) returned 0xf0f0f0 [0139.020] GetSysColor (nIndex=30) returned 0xf0f0f0 [0139.020] GetSysColor (nIndex=29) returned 0xff9933 [0139.020] GetSysColor (nIndex=7) returned 0x0 [0139.020] GetSysColor (nIndex=0) returned 0xc8c8c8 [0139.020] GetSysColor (nIndex=5) returned 0xffffff [0139.020] GetSysColor (nIndex=6) returned 0x646464 [0139.020] GetSysColor (nIndex=8) returned 0x0 [0139.023] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83b5c0000 [0139.023] AdjustWindowRectEx (in: lpRect=0x14ed18, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14ed18) returned 1 [0139.068] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83b5c0000 [0139.068] AdjustWindowRectEx (in: lpRect=0x14ed18, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14ed18) returned 1 [0139.068] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83b5c0000 [0139.068] AdjustWindowRectEx (in: lpRect=0x14ed18, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14ed18) returned 1 [0139.069] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83b5c0000 [0139.069] AdjustWindowRectEx (in: lpRect=0x14ed18, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14ed18) returned 1 [0139.069] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83b5c0000 [0139.069] AdjustWindowRectEx (in: lpRect=0x14ed18, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14ed18) returned 1 [0139.069] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83b5c0000 [0139.069] AdjustWindowRectEx (in: lpRect=0x14ed18, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14ed18) returned 1 [0139.070] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83b5c0000 [0139.070] AdjustWindowRectEx (in: lpRect=0x14ed18, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14ed18) returned 1 [0139.080] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83b5c0000 [0139.081] AdjustWindowRectEx (in: lpRect=0x14ede8, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x14ede8) returned 1 [0139.082] GetSystemMetrics (nIndex=59) returned 1456 [0139.082] GetSystemMetrics (nIndex=60) returned 916 [0139.082] GetSystemMetrics (nIndex=34) returned 136 [0139.082] GetSystemMetrics (nIndex=35) returned 39 [0139.082] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83b5c0000 [0139.083] AdjustWindowRectEx (in: lpRect=0x14eba8, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x14eba8) returned 1 [0139.085] GetCurrentThreadId () returned 0xe20 [0139.085] GetCurrentThreadId () returned 0xe20 [0139.089] GetSystemDefaultLCID () returned 0x409 [0139.090] GetStockObject (i=17) returned 0x10a0047 [0139.093] GetObjectW (in: h=0x10a0047, c=92, pv=0x14ead0 | out: pv=0x14ead0) returned 92 [0139.094] GetDC (hWnd=0x0) returned 0x4010184 [0140.978] GdiplusStartup (in: token=0x7ff7c6dd6d30, input=0x14d3d8, output=0x14d488 | out: token=0x7ff7c6dd6d30, output=0x14d488) returned 0x0 [0140.984] CoTaskMemAlloc (cb=0x5c) returned 0x622630 [0140.987] GdipCreateFontFromLogfontW (hdc=0x4010184, logfont=0x622630, font=0x14ec10) returned 0x0 [0143.705] CoTaskMemFree (pv=0x622630) [0143.707] CoTaskMemAlloc (cb=0x5c) returned 0x622a20 [0143.708] CoTaskMemFree (pv=0x622a20) [0143.708] CoTaskMemAlloc (cb=0x5c) returned 0x622240 [0143.708] CoTaskMemFree (pv=0x622240) [0143.712] GdipGetFontUnit (font=0x9734f0, unit=0x14eb80) returned 0x0 [0143.712] GdipGetFontSize (font=0x9734f0, size=0x14eb8c) returned 0x0 [0143.713] GdipGetFontStyle (font=0x9734f0, style=0x14eb78) returned 0x0 [0143.713] GdipGetFamily (font=0x9734f0, family=0x14eb70) returned 0x0 [0143.720] GdipGetFontSize (font=0x9734f0, size=0x21207d0) returned 0x0 [0143.721] ReleaseDC (hWnd=0x0, hDC=0x4010184) returned 1 [0143.729] GetDC (hWnd=0x0) returned 0xffffffff9801080a [0143.731] GdipCreateFromHDC (hdc=0xffffffff9801080a, graphics=0x14eb88) returned 0x0 [0143.738] GdipGetDpiY (graphics=0x1bef67f0, dpi=0x21209a8) returned 0x0 [0143.739] GdipGetFontHeight (font=0x9734f0, graphics=0x1bef67f0, height=0x14eb84) returned 0x0 [0143.741] GdipGetEmHeight (family=0x1bee9be0, style=0, EmHeight=0x14eb88) returned 0x0 [0143.742] GdipGetLineSpacing (family=0x1bee9be0, style=0, LineSpacing=0x14eb88) returned 0x0 [0143.742] GdipDeleteGraphics (graphics=0x1bef67f0) returned 0x0 [0143.746] ReleaseDC (hWnd=0x0, hDC=0xffffffff9801080a) returned 1 [0143.753] GdipCreateFont (fontFamily=0x1bee9be0, emSize=0x7ff828bedc95, style=0, unit=0x3, font=0x2120938) returned 0x0 [0143.754] GdipGetFontSize (font=0x97ed70, size=0x2120940) returned 0x0 [0143.754] GdipDeleteFont (font=0x9734f0) returned 0x0 [0143.773] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83b5c0000 [0143.776] AdjustWindowRectEx (in: lpRect=0x14eaf8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14eaf8) returned 1 [0143.792] GdipGetFamilyName (in: family=0x1bee9be0, name=0x14e840, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0143.794] CreateCompatibleDC (hdc=0x0) returned 0x1a010941 [0143.796] GetCurrentObject (hdc=0x1a010941, type=0x1) returned 0x1b00017 [0143.796] GetCurrentObject (hdc=0x1a010941, type=0x2) returned 0x1900010 [0143.796] GetCurrentObject (hdc=0x1a010941, type=0x7) returned 0x185000f [0143.796] GetCurrentObject (hdc=0x1a010941, type=0x6) returned 0x18a0048 [0143.806] SaveDC (hdc=0x1a010941) returned 1 [0143.809] GetDeviceCaps (hdc=0x1a010941, index=90) returned 96 [0143.811] CoTaskMemAlloc (cb=0x5c) returned 0x622400 [0143.811] CreateFontIndirectW (lplf=0x622400) returned 0xffffffff9b0a094a [0143.811] CoTaskMemFree (pv=0x622400) [0143.811] GetObjectW (in: h=0xffffffff9b0a094a, c=92, pv=0x14e850 | out: pv=0x14e850) returned 92 [0143.821] GetCurrentObject (hdc=0x1a010941, type=0x6) returned 0x18a0048 [0143.821] GetObjectW (in: h=0x18a0048, c=92, pv=0x14e650 | out: pv=0x14e650) returned 92 [0143.824] SelectObject (hdc=0x1a010941, h=0xffffffff9b0a094a) returned 0x18a0048 [0143.827] GetMapMode (hdc=0x1a010941) returned 1 [0143.827] GetTextMetricsW (in: hdc=0x1a010941, lptm=0x14e860 | out: lptm=0x14e860) returned 1 [0143.829] DrawTextExW (in: hdc=0x1a010941, lpchText="label1", cchText=6, lprc=0x14ea68, format=0x2400, lpdtp=0x2121378 | out: lpchText="label1", lprc=0x14ea68) returned 13 [0143.934] GetCurrentThreadId () returned 0xe20 [0143.934] GetCurrentThreadId () returned 0xe20 [0143.935] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83b5c0000 [0143.935] AdjustWindowRectEx (in: lpRect=0x14eaf8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14eaf8) returned 1 [0143.936] DrawTextExW (in: hdc=0x1a010941, lpchText="label1", cchText=6, lprc=0x14ea68, format=0x2400, lpdtp=0x21214f0 | out: lpchText="label1", lprc=0x14ea68) returned 13 [0143.936] GetCurrentThreadId () returned 0xe20 [0143.936] GetCurrentThreadId () returned 0xe20 [0143.936] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83b5c0000 [0143.937] AdjustWindowRectEx (in: lpRect=0x14eaf8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14eaf8) returned 1 [0143.937] DrawTextExW (in: hdc=0x1a010941, lpchText="label1", cchText=6, lprc=0x14ea68, format=0x2400, lpdtp=0x2121650 | out: lpchText="label1", lprc=0x14ea68) returned 13 [0143.937] GetCurrentThreadId () returned 0xe20 [0143.937] GetCurrentThreadId () returned 0xe20 [0143.937] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83b5c0000 [0143.937] AdjustWindowRectEx (in: lpRect=0x14eaf8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14eaf8) returned 1 [0143.937] DrawTextExW (in: hdc=0x1a010941, lpchText="label1", cchText=6, lprc=0x14ea68, format=0x2400, lpdtp=0x21217b0 | out: lpchText="label1", lprc=0x14ea68) returned 13 [0143.939] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83b5c0000 [0143.940] AdjustWindowRectEx (in: lpRect=0x14ebf0, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x14ebf0) returned 1 [0143.940] AdjustWindowRectEx (in: lpRect=0x14ed68, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x14ed68) returned 1 [0143.940] GetSystemMetrics (nIndex=59) returned 1456 [0143.940] GetSystemMetrics (nIndex=60) returned 916 [0143.940] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83b5c0000 [0143.940] AdjustWindowRectEx (in: lpRect=0x14e9a0, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x14e9a0) returned 1 [0143.940] AdjustWindowRectEx (in: lpRect=0x14eb28, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x14eb28) returned 1 [0143.951] CreateCompatibleDC (hdc=0x0) returned 0x230106af [0143.954] GetDC (hWnd=0x0) returned 0xffffffff9801080a [0143.954] GdipCreateFromHDC (hdc=0xffffffff9801080a, graphics=0x14ea38) returned 0x0 [0143.955] CoTaskMemAlloc (cb=0x5c) returned 0x622b00 [0143.955] GdipGetLogFontW (font=0x97ed70, graphics=0x1bef67f0, logfontW=0x622b00) returned 0x0 [0143.957] CoTaskMemFree (pv=0x622b00) [0143.957] CoTaskMemAlloc (cb=0x5c) returned 0x622400 [0143.957] CoTaskMemFree (pv=0x622400) [0143.958] CoTaskMemAlloc (cb=0x5c) returned 0x6222b0 [0143.958] CoTaskMemFree (pv=0x6222b0) [0143.958] GdipDeleteGraphics (graphics=0x1bef67f0) returned 0x0 [0143.958] ReleaseDC (hWnd=0x0, hDC=0xffffffff9801080a) returned 1 [0143.959] CoTaskMemAlloc (cb=0x5c) returned 0x6222b0 [0143.959] CreateFontIndirectW (lplf=0x6222b0) returned 0x340a0536 [0143.959] CoTaskMemFree (pv=0x6222b0) [0143.960] SelectObject (hdc=0x230106af, h=0x340a0536) returned 0x18a0048 [0143.960] GetTextMetricsW (in: hdc=0x230106af, lptm=0x14ecb8 | out: lptm=0x14ecb8) returned 1 [0143.963] GetTextExtentPoint32W (in: hdc=0x230106af, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x21222d0 | out: psizl=0x21222d0) returned 1 [0143.966] SelectObject (hdc=0x230106af, h=0x18a0048) returned 0x340a0536 [0143.967] DeleteDC (hdc=0x230106af) returned 1 [0143.968] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83b5c0000 [0143.968] AdjustWindowRectEx (in: lpRect=0x14e920, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x14e920) returned 1 [0143.969] GetCursorPos (in: lpPoint=0x2122308 | out: lpPoint=0x2122308*(x=748, y=547)) returned 1 [0143.970] GetSystemMetrics (nIndex=80) returned 1 [0143.972] MonitorFromPoint (pt=0x223000002ec, dwFlags=0x2) returned 0x10001 [0143.973] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x14e6d0 | out: lpmi=0x14e6d0) returned 1 [0143.974] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x250106af [0143.974] GetDeviceCaps (hdc=0x250106af, index=12) returned 32 [0143.974] GetDeviceCaps (hdc=0x250106af, index=14) returned 1 [0143.974] DeleteDC (hdc=0x250106af) returned 1 [0143.975] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x14e7a0 | out: lpmi=0x14e7a0) returned 1 [0143.975] AdjustWindowRectEx (in: lpRect=0x14eba0, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x14eba0) returned 1 [0143.975] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83b5c0000 [0143.975] AdjustWindowRectEx (in: lpRect=0x14e810, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x14e810) returned 1 [0143.975] GetCursorPos (in: lpPoint=0x2122770 | out: lpPoint=0x2122770*(x=748, y=547)) returned 1 [0143.975] MonitorFromPoint (pt=0x221000002e9, dwFlags=0x2) returned 0x10001 [0143.975] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x14e5c0 | out: lpmi=0x14e5c0) returned 1 [0143.975] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x260106af [0143.976] GetDeviceCaps (hdc=0x260106af, index=12) returned 32 [0143.976] GetDeviceCaps (hdc=0x260106af, index=14) returned 1 [0143.976] DeleteDC (hdc=0x260106af) returned 1 [0143.976] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x14e690 | out: lpmi=0x14e690) returned 1 [0143.976] AdjustWindowRectEx (in: lpRect=0x14e990, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x14e990) returned 1 [0143.976] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83b5c0000 [0143.977] AdjustWindowRectEx (in: lpRect=0x14ebb0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14ebb0) returned 1 [0143.977] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83b5c0000 [0143.977] AdjustWindowRectEx (in: lpRect=0x14ea00, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14ea00) returned 1 [0143.977] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83b5c0000 [0143.977] AdjustWindowRectEx (in: lpRect=0x14e7a8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14e7a8) returned 1 [0143.977] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83b5c0000 [0143.978] AdjustWindowRectEx (in: lpRect=0x14ebb0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14ebb0) returned 1 [0143.978] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83b5c0000 [0143.978] AdjustWindowRectEx (in: lpRect=0x14ea00, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14ea00) returned 1 [0143.978] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83b5c0000 [0143.978] AdjustWindowRectEx (in: lpRect=0x14e7a8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14e7a8) returned 1 [0143.979] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83b5c0000 [0143.979] AdjustWindowRectEx (in: lpRect=0x14ebb0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14ebb0) returned 1 [0143.979] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83b5c0000 [0143.979] AdjustWindowRectEx (in: lpRect=0x14ea00, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14ea00) returned 1 [0143.979] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83b5c0000 [0143.979] AdjustWindowRectEx (in: lpRect=0x14e7a8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14e7a8) returned 1 [0143.980] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83b5c0000 [0143.980] AdjustWindowRectEx (in: lpRect=0x14ebb0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14ebb0) returned 1 [0143.980] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83b5c0000 [0143.980] AdjustWindowRectEx (in: lpRect=0x14ea00, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14ea00) returned 1 [0143.980] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83b5c0000 [0143.981] AdjustWindowRectEx (in: lpRect=0x14e7a8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14e7a8) returned 1 [0143.988] GetCurrentActCtx (in: lphActCtx=0x14efe0 | out: lphActCtx=0x14efe0*=0x0) returned 1 [0143.988] ActivateActCtx (in: hActCtx=0x6263a8, lpCookie=0x14f020 | out: hActCtx=0x6263a8, lpCookie=0x14f020) returned 1 [0143.989] GetCurrentActCtx (in: lphActCtx=0x14ec70 | out: lphActCtx=0x14ec70*=0x6263a8) returned 1 [0143.990] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83ef20000 [0143.990] AdjustWindowRectEx (in: lpRect=0x14eb90, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x14eb90) returned 1 [0143.990] GetCursorPos (in: lpPoint=0x2122d90 | out: lpPoint=0x2122d90*(x=748, y=547)) returned 1 [0143.990] MonitorFromPoint (pt=0x223000002ec, dwFlags=0x2) returned 0x10001 [0143.990] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x14e940 | out: lpmi=0x14e940) returned 1 [0143.990] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x270106af [0143.991] GetDeviceCaps (hdc=0x270106af, index=12) returned 32 [0143.991] GetDeviceCaps (hdc=0x270106af, index=14) returned 1 [0143.991] DeleteDC (hdc=0x270106af) returned 1 [0143.991] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x14ea10 | out: lpmi=0x14ea10) returned 1 [0143.991] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0143.991] CreateWindowExW (dwExStyle=0x50000, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r8_ad1", lpWindowName="Form1", dwStyle=0x2010000, X=69, Y=26, nWidth=1302, nHeight=808, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x50218 [0143.993] SetWindowLongPtrW (hWnd=0x50218, nIndex=-4, dwNewLong=0x7ff8463f4a40) returned 0x1abd085c [0143.993] GetWindowLongPtrW (hWnd=0x50218, nIndex=-4) returned 0x7ff8463f4a40 [0143.994] SetWindowLongPtrW (hWnd=0x50218, nIndex=-4, dwNewLong=0x1abd099c) returned 0x7ff8463f4a40 [0143.994] GetWindowLongPtrW (hWnd=0x50218, nIndex=-4) returned 0x1abd099c [0143.994] GetWindowLongPtrW (hWnd=0x50218, nIndex=-16) returned 0x6c10000 [0143.994] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x50218, Msg=0x81, wParam=0x0, lParam=0x14e2f0) returned 0x1 [0143.995] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x50218, Msg=0x83, wParam=0x0, lParam=0x14e3a0) returned 0x0 [0143.998] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x50218, Msg=0x1, wParam=0x0, lParam=0x14e2d0) returned 0x0 [0143.998] GetClientRect (in: hWnd=0x50218, lpRect=0x14dd20 | out: lpRect=0x14dd20) returned 1 [0143.998] GetWindowRect (in: hWnd=0x50218, lpRect=0x14dd20 | out: lpRect=0x14dd20) returned 1 [0144.000] SetWindowTextW (hWnd=0x50218, lpString="Form1") returned 1 [0144.000] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x50218, Msg=0xc, wParam=0x0, lParam=0x211de9c) returned 0x1 [0144.003] GetStartupInfoW (in: lpStartupInfo=0x2123320 | out: lpStartupInfo=0x2123320*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\covid.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0144.005] GetParent (hWnd=0x50218) returned 0x0 [0144.005] SetWindowLongPtrW (hWnd=0x50218, nIndex=-8, dwNewLong=0x0) returned 0x0 [0144.014] GetSystemMetrics (nIndex=11) returned 32 [0144.014] GetSystemMetrics (nIndex=12) returned 32 [0144.014] GetDC (hWnd=0x0) returned 0x4010184 [0144.014] GetDeviceCaps (hdc=0x4010184, index=12) returned 32 [0144.014] GetDeviceCaps (hdc=0x4010184, index=14) returned 1 [0144.014] ReleaseDC (hWnd=0x0, hDC=0x4010184) returned 1 [0144.015] CreateIconFromResourceEx (presbits=0x2125f50, dwResSize=0x10a8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x600fd [0144.017] GetSystemMetrics (nIndex=49) returned 16 [0144.017] GetSystemMetrics (nIndex=50) returned 16 [0144.019] CreateIconFromResourceEx (presbits=0x2127058, dwResSize=0x468, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0xd0277 [0144.021] SendMessageW (hWnd=0x50218, Msg=0x80, wParam=0x0, lParam=0xd0277) returned 0x0 [0144.022] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x50218, Msg=0x80, wParam=0x0, lParam=0xd0277) returned 0x0 [0144.022] SendMessageW (hWnd=0x50218, Msg=0x80, wParam=0x1, lParam=0x600fd) returned 0x0 [0144.022] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x50218, Msg=0x80, wParam=0x1, lParam=0x600fd) returned 0x0 [0144.023] GetSystemMenu (hWnd=0x50218, bRevert=0) returned 0x0 [0144.023] GetWindowPlacement (in: hWnd=0x50218, lpwndpl=0x14ec78 | out: lpwndpl=0x14ec78) returned 1 [0144.023] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x0) returned 1 [0144.023] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf030, uEnable=0x0) returned 1 [0144.024] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf060, uEnable=0x0) returned 1 [0144.024] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0144.024] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf000, uEnable=0x1) returned 1 [0144.024] GetClientRect (in: hWnd=0x50218, lpRect=0x14ed40 | out: lpRect=0x14ed40) returned 1 [0144.024] GetClientRect (in: hWnd=0x50218, lpRect=0x14ec70 | out: lpRect=0x14ec70) returned 1 [0144.024] GetWindowRect (in: hWnd=0x50218, lpRect=0x14ec70 | out: lpRect=0x14ec70) returned 1 [0144.024] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83ef20000 [0144.024] GetWindowLongPtrW (hWnd=0x50218, nIndex=-16) returned 0x6c10000 [0144.024] GetCursorPos (in: lpPoint=0x2127508 | out: lpPoint=0x2127508*(x=748, y=547)) returned 1 [0144.024] MonitorFromPoint (pt=0x222000002ec, dwFlags=0x2) returned 0x10001 [0144.025] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x14e910 | out: lpmi=0x14e910) returned 1 [0144.025] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x220106e8 [0144.025] GetDeviceCaps (hdc=0x220106e8, index=12) returned 32 [0144.025] GetDeviceCaps (hdc=0x220106e8, index=14) returned 1 [0144.025] DeleteDC (hdc=0x220106e8) returned 1 [0144.025] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x14e9e0 | out: lpmi=0x14e9e0) returned 1 [0144.025] GetWindowLongPtrW (hWnd=0x50218, nIndex=-16) returned 0x6c10000 [0144.025] GetWindowLongPtrW (hWnd=0x50218, nIndex=-20) returned 0x50100 [0144.025] SetWindowLongPtrW (hWnd=0x50218, nIndex=-16, dwNewLong=0x2010000) returned 0x6c10000 [0144.025] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x50218, Msg=0x7c, wParam=0xfffffffffffffff0, lParam=0x14eb40) returned 0x0 [0144.026] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x50218, Msg=0x7d, wParam=0xfffffffffffffff0, lParam=0x14eb40) returned 0x0 [0144.027] SetWindowLongPtrW (hWnd=0x50218, nIndex=-20, dwNewLong=0x50000) returned 0x50000 [0144.027] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x50218, Msg=0x7c, wParam=0xffffffffffffffec, lParam=0x14eb40) returned 0x0 [0144.027] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x50218, Msg=0x7d, wParam=0xffffffffffffffec, lParam=0x14eb40) returned 0x0 [0144.028] SetWindowPos (hWnd=0x50218, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0144.028] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x50218, Msg=0x46, wParam=0x0, lParam=0x14eba0) returned 0x0 [0144.028] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x50218, Msg=0x83, wParam=0x1, lParam=0x14eb70) returned 0x0 [0144.032] GetWindowPlacement (in: hWnd=0x50218, lpwndpl=0x14e748 | out: lpwndpl=0x14e748) returned 1 [0144.032] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x50218, Msg=0x47, wParam=0x0, lParam=0x14eba0) returned 0x0 [0144.032] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x50218, Msg=0x3, wParam=0x0, lParam=0x1a0045) returned 0x0 [0144.032] GetClientRect (in: hWnd=0x50218, lpRect=0x14dba0 | out: lpRect=0x14dba0) returned 1 [0144.032] GetWindowRect (in: hWnd=0x50218, lpRect=0x14dba0 | out: lpRect=0x14dba0) returned 1 [0144.032] GetWindowTextLengthW (hWnd=0x50218) returned 5 [0144.032] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x50218, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0144.032] GetSystemMetrics (nIndex=42) returned 0 [0144.033] GetWindowTextW (in: hWnd=0x50218, lpString=0x14d7e0, nMaxCount=6 | out: lpString="Form1") returned 5 [0144.033] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x50218, Msg=0xd, wParam=0x6, lParam=0x14d7e0) returned 0x5 [0144.033] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x50218, Msg=0x5, wParam=0x0, lParam=0x3280516) returned 0x0 [0144.033] GetClientRect (in: hWnd=0x50218, lpRect=0x14e5e0 | out: lpRect=0x14e5e0) returned 1 [0144.033] GetWindowRect (in: hWnd=0x50218, lpRect=0x14e5e0 | out: lpRect=0x14e5e0) returned 1 [0144.034] RedrawWindow (hWnd=0x50218, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0144.035] GetSystemMenu (hWnd=0x50218, bRevert=0) returned 0x0 [0144.035] GetWindowPlacement (in: hWnd=0x50218, lpwndpl=0x14ec18 | out: lpwndpl=0x14ec18) returned 1 [0144.035] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x0) returned 1 [0144.036] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf030, uEnable=0x0) returned 1 [0144.036] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf060, uEnable=0x0) returned 1 [0144.036] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0144.036] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf000, uEnable=0x1) returned 1 [0144.036] ShowWindow (hWnd=0x50218, nCmdShow=5) returned 0 [0144.036] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x50218, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0144.037] GetCurrentActCtx (in: lphActCtx=0x14e630 | out: lphActCtx=0x14e630*=0x6263a8) returned 1 [0144.037] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83ef20000 [0144.038] GetClassInfoW (in: hInstance=0x0, lpClassName="STATIC", lpWndClass=0x2127a28 | out: lpWndClass=0x2127a28) returned 1 [0144.039] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0144.040] CoTaskMemAlloc (cb=0x56) returned 0x62bb10 [0144.040] RegisterClassW (lpWndClass=0x14e320) returned 0xc1e4 [0144.040] CoTaskMemFree (pv=0x62bb10) [0144.040] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0144.040] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r8_ad1", lpWindowName="label1", dwStyle=0x5600000d, X=342, Y=684, nWidth=35, nHeight=13, hWndParent=0x50218, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x9005a [0144.041] SetWindowLongPtrW (hWnd=0x9005a, nIndex=-4, dwNewLong=0x7ff83ef340d0) returned 0x1abd09ec [0144.041] GetWindowLongPtrW (hWnd=0x9005a, nIndex=-4) returned 0x7ff83ef340d0 [0144.041] SetWindowLongPtrW (hWnd=0x9005a, nIndex=-4, dwNewLong=0x1abd0a3c) returned 0x7ff83ef340d0 [0144.041] GetWindowLongPtrW (hWnd=0x9005a, nIndex=-4) returned 0x1abd0a3c [0144.041] GetWindowLongPtrW (hWnd=0x9005a, nIndex=-16) returned 0x4600000d [0144.041] GetWindowLongPtrW (hWnd=0x9005a, nIndex=-12) returned 0x0 [0144.041] SetWindowLongPtrW (hWnd=0x9005a, nIndex=-12, dwNewLong=0x9005a) returned 0x0 [0144.041] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9005a, Msg=0x81, wParam=0x0, lParam=0x14dcb0) returned 0x1 [0144.042] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9005a, Msg=0x83, wParam=0x0, lParam=0x14dd60) returned 0x0 [0144.042] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9005a, Msg=0x1, wParam=0x0, lParam=0x14dc90) returned 0x0 [0144.045] GetWindow (hWnd=0x9005a, uCmd=0x3) returned 0x0 [0144.045] GetClientRect (in: hWnd=0x9005a, lpRect=0x14d6a0 | out: lpRect=0x14d6a0) returned 1 [0144.045] GetWindowRect (in: hWnd=0x9005a, lpRect=0x14d6a0 | out: lpRect=0x14d6a0) returned 1 [0144.045] GetParent (hWnd=0x9005a) returned 0x50218 [0144.045] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50218, lpPoints=0x14d6a0, cPoints=0x2 | out: lpPoints=0x14d6a0) returned -1638469 [0144.046] SetWindowTextW (hWnd=0x9005a, lpString="label1") returned 1 [0144.046] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9005a, Msg=0xc, wParam=0x0, lParam=0x211ddbc) returned 0x1 [0144.046] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9005a, Msg=0x5, wParam=0x0, lParam=0xd0023) returned 0x0 [0144.047] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9005a, Msg=0x3, wParam=0x0, lParam=0x2ac0156) returned 0x0 [0144.047] GetClientRect (in: hWnd=0x9005a, lpRect=0x14d7d0 | out: lpRect=0x14d7d0) returned 1 [0144.047] GetWindowRect (in: hWnd=0x9005a, lpRect=0x14d7d0 | out: lpRect=0x14d7d0) returned 1 [0144.047] GetParent (hWnd=0x9005a) returned 0x50218 [0144.047] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50218, lpPoints=0x14d7d0, cPoints=0x2 | out: lpPoints=0x14d7d0) returned -1638469 [0144.050] SendMessageW (hWnd=0x9005a, Msg=0x2210, wParam=0x5a0001, lParam=0x9005a) returned 0x0 [0144.050] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9005a, Msg=0x2210, wParam=0x5a0001, lParam=0x9005a) returned 0x0 [0144.050] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9005a, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0144.051] GetParent (hWnd=0x9005a) returned 0x50218 [0144.051] GetCurrentActCtx (in: lphActCtx=0x14e630 | out: lphActCtx=0x14e630*=0x6263a8) returned 1 [0144.051] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83ef20000 [0144.051] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0144.051] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r8_ad1", lpWindowName="label1", dwStyle=0x5600000d, X=563, Y=413, nWidth=35, nHeight=13, hWndParent=0x50218, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x9036a [0144.052] SetWindowLongPtrW (hWnd=0x9036a, nIndex=-4, dwNewLong=0x7ff83ef340d0) returned 0x1abd09ec [0144.052] GetWindowLongPtrW (hWnd=0x9036a, nIndex=-4) returned 0x7ff83ef340d0 [0144.052] SetWindowLongPtrW (hWnd=0x9036a, nIndex=-4, dwNewLong=0x1abd0a8c) returned 0x7ff83ef340d0 [0144.052] GetWindowLongPtrW (hWnd=0x9036a, nIndex=-4) returned 0x1abd0a8c [0144.052] GetWindowLongPtrW (hWnd=0x9036a, nIndex=-16) returned 0x4600000d [0144.052] GetWindowLongPtrW (hWnd=0x9036a, nIndex=-12) returned 0x0 [0144.052] SetWindowLongPtrW (hWnd=0x9036a, nIndex=-12, dwNewLong=0x9036a) returned 0x0 [0144.052] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0x81, wParam=0x0, lParam=0x14dcb0) returned 0x1 [0144.053] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0x83, wParam=0x0, lParam=0x14dd60) returned 0x0 [0144.053] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0x1, wParam=0x0, lParam=0x14dc90) returned 0x0 [0144.053] GetWindow (hWnd=0x9036a, uCmd=0x3) returned 0x9005a [0144.053] GetClientRect (in: hWnd=0x9036a, lpRect=0x14d6a0 | out: lpRect=0x14d6a0) returned 1 [0144.053] GetWindowRect (in: hWnd=0x9036a, lpRect=0x14d6a0 | out: lpRect=0x14d6a0) returned 1 [0144.053] GetParent (hWnd=0x9036a) returned 0x50218 [0144.053] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50218, lpPoints=0x14d6a0, cPoints=0x2 | out: lpPoints=0x14d6a0) returned -1638469 [0144.054] SetWindowTextW (hWnd=0x9036a, lpString="label1") returned 1 [0144.054] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0xc, wParam=0x0, lParam=0x211ddbc) returned 0x1 [0144.054] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0x5, wParam=0x0, lParam=0xd0023) returned 0x0 [0144.054] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0x3, wParam=0x0, lParam=0x19d0233) returned 0x0 [0144.054] GetClientRect (in: hWnd=0x9036a, lpRect=0x14d7d0 | out: lpRect=0x14d7d0) returned 1 [0144.054] GetWindowRect (in: hWnd=0x9036a, lpRect=0x14d7d0 | out: lpRect=0x14d7d0) returned 1 [0144.055] GetParent (hWnd=0x9036a) returned 0x50218 [0144.055] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50218, lpPoints=0x14d7d0, cPoints=0x2 | out: lpPoints=0x14d7d0) returned -1638469 [0144.055] SendMessageW (hWnd=0x9036a, Msg=0x2210, wParam=0x36a0001, lParam=0x9036a) returned 0x0 [0144.055] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0x2210, wParam=0x36a0001, lParam=0x9036a) returned 0x0 [0144.055] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0144.055] GetParent (hWnd=0x9036a) returned 0x50218 [0144.055] GetCurrentActCtx (in: lphActCtx=0x14e630 | out: lphActCtx=0x14e630*=0x6263a8) returned 1 [0144.055] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83ef20000 [0144.056] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0144.056] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r8_ad1", lpWindowName="label1", dwStyle=0x5600000d, X=113, Y=247, nWidth=35, nHeight=13, hWndParent=0x50218, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x60298 [0144.056] SetWindowLongPtrW (hWnd=0x60298, nIndex=-4, dwNewLong=0x7ff83ef340d0) returned 0x1abd09ec [0144.056] GetWindowLongPtrW (hWnd=0x60298, nIndex=-4) returned 0x7ff83ef340d0 [0144.059] SetWindowLongPtrW (hWnd=0x60298, nIndex=-4, dwNewLong=0x1abd0adc) returned 0x7ff83ef340d0 [0144.059] GetWindowLongPtrW (hWnd=0x60298, nIndex=-4) returned 0x1abd0adc [0144.059] GetWindowLongPtrW (hWnd=0x60298, nIndex=-16) returned 0x4600000d [0144.059] GetWindowLongPtrW (hWnd=0x60298, nIndex=-12) returned 0x0 [0144.059] SetWindowLongPtrW (hWnd=0x60298, nIndex=-12, dwNewLong=0x60298) returned 0x0 [0144.061] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0x81, wParam=0x0, lParam=0x14dcb0) returned 0x1 [0144.062] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0x83, wParam=0x0, lParam=0x14dd60) returned 0x0 [0144.070] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0x1, wParam=0x0, lParam=0x14dc90) returned 0x0 [0144.071] GetWindow (hWnd=0x60298, uCmd=0x3) returned 0x9036a [0144.071] GetClientRect (in: hWnd=0x60298, lpRect=0x14d6a0 | out: lpRect=0x14d6a0) returned 1 [0144.071] GetWindowRect (in: hWnd=0x60298, lpRect=0x14d6a0 | out: lpRect=0x14d6a0) returned 1 [0144.071] GetParent (hWnd=0x60298) returned 0x50218 [0144.071] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50218, lpPoints=0x14d6a0, cPoints=0x2 | out: lpPoints=0x14d6a0) returned -1638469 [0144.072] SetWindowTextW (hWnd=0x60298, lpString="label1") returned 1 [0144.072] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0xc, wParam=0x0, lParam=0x211ddbc) returned 0x1 [0144.072] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0x5, wParam=0x0, lParam=0xd0023) returned 0x0 [0144.072] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0x3, wParam=0x0, lParam=0xf70071) returned 0x0 [0144.072] GetClientRect (in: hWnd=0x60298, lpRect=0x14d7d0 | out: lpRect=0x14d7d0) returned 1 [0144.072] GetWindowRect (in: hWnd=0x60298, lpRect=0x14d7d0 | out: lpRect=0x14d7d0) returned 1 [0144.072] GetParent (hWnd=0x60298) returned 0x50218 [0144.072] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50218, lpPoints=0x14d7d0, cPoints=0x2 | out: lpPoints=0x14d7d0) returned -1638469 [0144.073] SendMessageW (hWnd=0x60298, Msg=0x2210, wParam=0x2980001, lParam=0x60298) returned 0x0 [0144.073] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0x2210, wParam=0x2980001, lParam=0x60298) returned 0x0 [0144.073] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0144.073] GetParent (hWnd=0x60298) returned 0x50218 [0144.073] GetCurrentActCtx (in: lphActCtx=0x14e630 | out: lphActCtx=0x14e630*=0x6263a8) returned 1 [0144.073] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83ef20000 [0144.073] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0144.074] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r8_ad1", lpWindowName="label1", dwStyle=0x5600000d, X=13, Y=13, nWidth=35, nHeight=13, hWndParent=0x50218, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0xa0370 [0144.074] SetWindowLongPtrW (hWnd=0xa0370, nIndex=-4, dwNewLong=0x7ff83ef340d0) returned 0x1abd09ec [0144.074] GetWindowLongPtrW (hWnd=0xa0370, nIndex=-4) returned 0x7ff83ef340d0 [0144.074] SetWindowLongPtrW (hWnd=0xa0370, nIndex=-4, dwNewLong=0x1abd0b2c) returned 0x7ff83ef340d0 [0144.074] GetWindowLongPtrW (hWnd=0xa0370, nIndex=-4) returned 0x1abd0b2c [0144.074] GetWindowLongPtrW (hWnd=0xa0370, nIndex=-16) returned 0x4600000d [0144.074] GetWindowLongPtrW (hWnd=0xa0370, nIndex=-12) returned 0x0 [0144.074] SetWindowLongPtrW (hWnd=0xa0370, nIndex=-12, dwNewLong=0xa0370) returned 0x0 [0144.075] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0x81, wParam=0x0, lParam=0x14dcb0) returned 0x1 [0144.075] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0x83, wParam=0x0, lParam=0x14dd60) returned 0x0 [0144.075] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0x1, wParam=0x0, lParam=0x14dc90) returned 0x0 [0144.076] GetWindow (hWnd=0xa0370, uCmd=0x3) returned 0x60298 [0144.076] GetClientRect (in: hWnd=0xa0370, lpRect=0x14d6a0 | out: lpRect=0x14d6a0) returned 1 [0144.076] GetWindowRect (in: hWnd=0xa0370, lpRect=0x14d6a0 | out: lpRect=0x14d6a0) returned 1 [0144.076] GetParent (hWnd=0xa0370) returned 0x50218 [0144.076] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50218, lpPoints=0x14d6a0, cPoints=0x2 | out: lpPoints=0x14d6a0) returned -1638469 [0144.077] SetWindowTextW (hWnd=0xa0370, lpString="label1") returned 1 [0144.077] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0xc, wParam=0x0, lParam=0x211ddbc) returned 0x1 [0144.077] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0x5, wParam=0x0, lParam=0xd0023) returned 0x0 [0144.077] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0x3, wParam=0x0, lParam=0xd000d) returned 0x0 [0144.077] GetClientRect (in: hWnd=0xa0370, lpRect=0x14d7d0 | out: lpRect=0x14d7d0) returned 1 [0144.077] GetWindowRect (in: hWnd=0xa0370, lpRect=0x14d7d0 | out: lpRect=0x14d7d0) returned 1 [0144.077] GetParent (hWnd=0xa0370) returned 0x50218 [0144.077] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50218, lpPoints=0x14d7d0, cPoints=0x2 | out: lpPoints=0x14d7d0) returned -1638469 [0144.077] SendMessageW (hWnd=0xa0370, Msg=0x2210, wParam=0x3700001, lParam=0xa0370) returned 0x0 [0144.077] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0x2210, wParam=0x3700001, lParam=0xa0370) returned 0x0 [0144.078] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0144.078] GetParent (hWnd=0xa0370) returned 0x50218 [0144.082] GetWindowTextLengthW (hWnd=0x50218) returned 5 [0144.082] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x50218, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0144.082] GetSystemMetrics (nIndex=42) returned 0 [0144.082] GetWindowTextW (in: hWnd=0x50218, lpString=0x14e5b0, nMaxCount=6 | out: lpString="Form1") returned 5 [0144.082] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x50218, Msg=0xd, wParam=0x6, lParam=0x14e5b0) returned 0x5 [0144.167] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83ef20000 [0144.167] GetWindowLongPtrW (hWnd=0x50218, nIndex=-16) returned 0x6010000 [0144.168] GetCursorPos (in: lpPoint=0x2128738 | out: lpPoint=0x2128738*(x=748, y=547)) returned 1 [0144.168] MonitorFromPoint (pt=0xc4000004f1, dwFlags=0x2) returned 0x10001 [0144.168] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x14e0f0 | out: lpmi=0x14e0f0) returned 1 [0144.169] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x7b01054b [0144.169] GetDeviceCaps (hdc=0x7b01054b, index=12) returned 32 [0144.169] GetDeviceCaps (hdc=0x7b01054b, index=14) returned 1 [0144.169] DeleteDC (hdc=0x7b01054b) returned 1 [0144.169] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x14e1c0 | out: lpmi=0x14e1c0) returned 1 [0144.169] GetWindowLongPtrW (hWnd=0x50218, nIndex=-16) returned 0x6010000 [0144.169] GetWindowLongPtrW (hWnd=0x50218, nIndex=-20) returned 0x50000 [0144.169] SetWindowLongPtrW (hWnd=0x50218, nIndex=-16, dwNewLong=0x12010000) returned 0x6010000 [0144.170] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x50218, Msg=0x7c, wParam=0xfffffffffffffff0, lParam=0x14e320) returned 0x0 [0144.178] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x50218, Msg=0x7d, wParam=0xfffffffffffffff0, lParam=0x14e320) returned 0x0 [0144.178] SetWindowLongPtrW (hWnd=0x50218, nIndex=-20, dwNewLong=0xd0000) returned 0x50000 [0144.178] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x50218, Msg=0x7c, wParam=0xffffffffffffffec, lParam=0x14e320) returned 0x0 [0144.179] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x50218, Msg=0x7d, wParam=0xffffffffffffffec, lParam=0x14e320) returned 0x0 [0144.179] SetWindowPos (hWnd=0x50218, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0144.180] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x50218, Msg=0x46, wParam=0x0, lParam=0x14e380) returned 0x0 [0144.180] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x50218, Msg=0x83, wParam=0x1, lParam=0x14e350) returned 0x0 [0144.182] GetWindowPlacement (in: hWnd=0x50218, lpwndpl=0x14df28 | out: lpwndpl=0x14df28) returned 1 [0144.182] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x50218, Msg=0x47, wParam=0x0, lParam=0x14e380) returned 0x0 [0144.183] GetClientRect (in: hWnd=0x50218, lpRect=0x14ddc0 | out: lpRect=0x14ddc0) returned 1 [0144.183] GetWindowRect (in: hWnd=0x50218, lpRect=0x14ddc0 | out: lpRect=0x14ddc0) returned 1 [0144.183] RedrawWindow (hWnd=0x50218, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0144.183] GetSystemMenu (hWnd=0x50218, bRevert=0) returned 0x0 [0144.183] GetWindowPlacement (in: hWnd=0x50218, lpwndpl=0x14e3f8 | out: lpwndpl=0x14e3f8) returned 1 [0144.183] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x0) returned 1 [0144.183] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf030, uEnable=0x0) returned 1 [0144.183] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf060, uEnable=0x0) returned 1 [0144.183] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0144.183] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf000, uEnable=0x1) returned 1 [0144.188] SetLayeredWindowAttributes (hwnd=0x50218, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0144.201] GetCurrentThreadId () returned 0xe20 [0144.205] EnumThreadWindows (dwThreadId=0xe20, lpfn=0x1abd0b7c, lParam=0x50218) returned 1 [0144.260] GetWindowLongPtrW (hWnd=0x50218, nIndex=-8) returned 0x0 [0144.260] GetWindowLongPtrW (hWnd=0x50078, nIndex=-8) returned 0x0 [0144.260] GetWindowLongPtrW (hWnd=0x2020a, nIndex=-8) returned 0x50078 [0144.270] GetFocus () returned 0x0 [0144.270] GetParent (hWnd=0x50218) returned 0x0 [0144.270] GetWindowThreadProcessId (in: hWnd=0x9005a, lpdwProcessId=0x14e450 | out: lpdwProcessId=0x14e450) returned 0xe20 [0144.279] GetCurrentActCtx (in: lphActCtx=0x14e2a0 | out: lphActCtx=0x14e2a0*=0x6263a8) returned 1 [0144.279] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83ef20000 [0144.280] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0144.280] CreateWindowExW (dwExStyle=0x10000, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r8_ad1", lpWindowName="WindowsFormsParkingWindow", dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffffffffffd, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0xd0024 [0144.280] SetWindowLongPtrW (hWnd=0xd0024, nIndex=-4, dwNewLong=0x7ff8463f4a40) returned 0x1abd085c [0144.281] GetWindowLongPtrW (hWnd=0xd0024, nIndex=-4) returned 0x7ff8463f4a40 [0144.281] SetWindowLongPtrW (hWnd=0xd0024, nIndex=-4, dwNewLong=0x1abd0bcc) returned 0x7ff8463f4a40 [0144.281] GetWindowLongPtrW (hWnd=0xd0024, nIndex=-4) returned 0x1abd0bcc [0144.281] GetWindowLongPtrW (hWnd=0xd0024, nIndex=-16) returned 0x6c10000 [0144.281] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0xd0024, Msg=0x24, wParam=0x0, lParam=0x14d9b0) returned 0x0 [0144.281] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0xd0024, Msg=0x81, wParam=0x0, lParam=0x14d920) returned 0x1 [0144.282] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0xd0024, Msg=0x83, wParam=0x0, lParam=0x14d9d0) returned 0x0 [0144.282] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0xd0024, Msg=0x1, wParam=0x0, lParam=0x14d8e0) returned 0x0 [0144.282] GetClientRect (in: hWnd=0xd0024, lpRect=0x14d320 | out: lpRect=0x14d320) returned 1 [0144.282] GetWindowRect (in: hWnd=0xd0024, lpRect=0x14d320 | out: lpRect=0x14d320) returned 1 [0144.283] SetWindowTextW (hWnd=0xd0024, lpString="WindowsFormsParkingWindow") returned 1 [0144.283] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0xd0024, Msg=0xc, wParam=0x0, lParam=0x2128e4c) returned 0x1 [0144.284] GetParent (hWnd=0xd0024) returned 0x0 [0144.284] SetParent (hWndChild=0x9005a, hWndNewParent=0xd0024) returned 0x50218 [0144.284] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9005a, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0144.285] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9005a, Msg=0x46, wParam=0x0, lParam=0x14e2e0) returned 0x0 [0144.291] GetWindowPlacement (in: hWnd=0x50218, lpwndpl=0x14dea8 | out: lpwndpl=0x14dea8) returned 1 [0144.291] GetClientRect (in: hWnd=0x50218, lpRect=0x14ddc0 | out: lpRect=0x14ddc0) returned 1 [0144.291] GetWindowTextLengthW (hWnd=0x50218) returned 5 [0144.291] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x50218, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0144.291] GetSystemMetrics (nIndex=42) returned 0 [0144.291] GetWindowTextW (in: hWnd=0x50218, lpString=0x14db30, nMaxCount=6 | out: lpString="Form1") returned 5 [0144.291] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x50218, Msg=0xd, wParam=0x6, lParam=0x14db30) returned 0x5 [0144.291] GetClientRect (in: hWnd=0x50218, lpRect=0x14dba8 | out: lpRect=0x14dba8) returned 1 [0144.296] EnumDisplayMonitors (hdc=0x0, lprcClip=0x0, lpfnEnum=0x1abd0c1c, dwData=0x0) returned 1 [0144.296] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x14d3a0 | out: lpmi=0x14d3a0) returned 1 [0144.296] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0xffffffffc0010549 [0144.296] GetDeviceCaps (hdc=0xffffffffc0010549, index=12) returned 32 [0144.296] GetDeviceCaps (hdc=0xffffffffc0010549, index=14) returned 1 [0144.296] DeleteDC (hdc=0xffffffffc0010549) returned 1 [0144.297] GetCurrentObject (hdc=0x4010184, type=0x1) returned 0x1b00017 [0144.297] GetCurrentObject (hdc=0x4010184, type=0x2) returned 0x1900010 [0144.297] GetCurrentObject (hdc=0x4010184, type=0x7) returned 0x590506b6 [0144.297] GetCurrentObject (hdc=0x4010184, type=0x6) returned 0x18a0048 [0144.297] SaveDC (hdc=0x4010184) returned 1 [0144.298] GetNearestColor (hdc=0x4010184, color=0xf0f0f0) returned 0xf0f0f0 [0144.304] CreateSolidBrush (color=0xf0f0f0) returned 0x1c100999 [0144.304] FillRect (hDC=0x4010184, lprc=0x14d898, hbr=0x1c100999) returned 1 [0144.593] DeleteObject (ho=0x1c100999) returned 1 [0144.595] RestoreDC (hdc=0x4010184, nSavedDC=-1) returned 1 [0144.597] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0144.597] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0144.600] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0144.600] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9005a, Msg=0x47, wParam=0x0, lParam=0x14e2e0) returned 0x0 [0144.600] GetClientRect (in: hWnd=0x9005a, lpRect=0x14dce0 | out: lpRect=0x14dce0) returned 1 [0144.600] GetWindowRect (in: hWnd=0x9005a, lpRect=0x14dce0 | out: lpRect=0x14dce0) returned 1 [0144.600] GetParent (hWnd=0x9005a) returned 0x50218 [0144.600] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x50218, lpPoints=0x14dce0, cPoints=0x2 | out: lpPoints=0x14dce0) returned -1638469 [0144.600] GetParent (hWnd=0x9005a) returned 0x50218 [0144.601] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9005a, Msg=0x46, wParam=0x0, lParam=0x14e2e0) returned 0x0 [0144.604] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9005a, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0144.604] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9005a, Msg=0x47, wParam=0x0, lParam=0x14e2e0) returned 0x0 [0144.604] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9005a, Msg=0x3, wParam=0x0, lParam=0x2ac0156) returned 0x0 [0144.605] GetClientRect (in: hWnd=0x9005a, lpRect=0x14d1d0 | out: lpRect=0x14d1d0) returned 1 [0144.605] GetWindowRect (in: hWnd=0x9005a, lpRect=0x14d1d0 | out: lpRect=0x14d1d0) returned 1 [0144.605] GetParent (hWnd=0x9005a) returned 0xd0024 [0144.605] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0xd0024, lpPoints=0x14d1d0, cPoints=0x2 | out: lpPoints=0x14d1d0) returned -1638403 [0144.605] GetClientRect (in: hWnd=0x9005a, lpRect=0x14dce0 | out: lpRect=0x14dce0) returned 1 [0144.605] GetWindowRect (in: hWnd=0x9005a, lpRect=0x14dce0 | out: lpRect=0x14dce0) returned 1 [0144.605] GetParent (hWnd=0x9005a) returned 0xd0024 [0144.605] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0xd0024, lpPoints=0x14dce0, cPoints=0x2 | out: lpPoints=0x14dce0) returned -1638403 [0144.605] GetParent (hWnd=0x9005a) returned 0xd0024 [0144.605] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9005a, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0144.605] GetWindowThreadProcessId (in: hWnd=0x9036a, lpdwProcessId=0x14e450 | out: lpdwProcessId=0x14e450) returned 0xe20 [0144.605] SetParent (hWndChild=0x9036a, hWndNewParent=0xd0024) returned 0x50218 [0144.605] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0144.606] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0x46, wParam=0x0, lParam=0x14e2e0) returned 0x0 [0144.607] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0144.607] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0x47, wParam=0x0, lParam=0x14e2e0) returned 0x0 [0144.607] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0x3, wParam=0x0, lParam=0x19d0233) returned 0x0 [0144.607] GetClientRect (in: hWnd=0x9036a, lpRect=0x14d1d0 | out: lpRect=0x14d1d0) returned 1 [0144.607] GetWindowRect (in: hWnd=0x9036a, lpRect=0x14d1d0 | out: lpRect=0x14d1d0) returned 1 [0144.607] GetParent (hWnd=0x9036a) returned 0xd0024 [0144.607] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0xd0024, lpPoints=0x14d1d0, cPoints=0x2 | out: lpPoints=0x14d1d0) returned -1638403 [0144.607] GetClientRect (in: hWnd=0x9036a, lpRect=0x14dce0 | out: lpRect=0x14dce0) returned 1 [0144.607] GetWindowRect (in: hWnd=0x9036a, lpRect=0x14dce0 | out: lpRect=0x14dce0) returned 1 [0144.607] GetParent (hWnd=0x9036a) returned 0xd0024 [0144.607] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0xd0024, lpPoints=0x14dce0, cPoints=0x2 | out: lpPoints=0x14dce0) returned -1638403 [0144.607] GetParent (hWnd=0x9036a) returned 0xd0024 [0144.607] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0144.608] GetWindowThreadProcessId (in: hWnd=0x60298, lpdwProcessId=0x14e450 | out: lpdwProcessId=0x14e450) returned 0xe20 [0144.608] SetParent (hWndChild=0x60298, hWndNewParent=0xd0024) returned 0x50218 [0144.608] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0144.609] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0x46, wParam=0x0, lParam=0x14e2e0) returned 0x0 [0144.609] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0144.609] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0x47, wParam=0x0, lParam=0x14e2e0) returned 0x0 [0144.609] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0x3, wParam=0x0, lParam=0xf70071) returned 0x0 [0144.610] GetClientRect (in: hWnd=0x60298, lpRect=0x14d1d0 | out: lpRect=0x14d1d0) returned 1 [0144.610] GetWindowRect (in: hWnd=0x60298, lpRect=0x14d1d0 | out: lpRect=0x14d1d0) returned 1 [0144.610] GetParent (hWnd=0x60298) returned 0xd0024 [0144.610] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0xd0024, lpPoints=0x14d1d0, cPoints=0x2 | out: lpPoints=0x14d1d0) returned -1638403 [0144.610] GetClientRect (in: hWnd=0x60298, lpRect=0x14dce0 | out: lpRect=0x14dce0) returned 1 [0144.610] GetWindowRect (in: hWnd=0x60298, lpRect=0x14dce0 | out: lpRect=0x14dce0) returned 1 [0144.610] GetParent (hWnd=0x60298) returned 0xd0024 [0144.610] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0xd0024, lpPoints=0x14dce0, cPoints=0x2 | out: lpPoints=0x14dce0) returned -1638403 [0144.610] GetParent (hWnd=0x60298) returned 0xd0024 [0144.610] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0144.610] GetWindowThreadProcessId (in: hWnd=0xa0370, lpdwProcessId=0x14e450 | out: lpdwProcessId=0x14e450) returned 0xe20 [0144.610] SetParent (hWndChild=0xa0370, hWndNewParent=0xd0024) returned 0x50218 [0144.610] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0144.611] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0x46, wParam=0x0, lParam=0x14e2e0) returned 0x0 [0144.612] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0144.612] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0x47, wParam=0x0, lParam=0x14e2e0) returned 0x0 [0144.612] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0x3, wParam=0x0, lParam=0xd000d) returned 0x0 [0144.612] GetClientRect (in: hWnd=0xa0370, lpRect=0x14d1d0 | out: lpRect=0x14d1d0) returned 1 [0144.612] GetWindowRect (in: hWnd=0xa0370, lpRect=0x14d1d0 | out: lpRect=0x14d1d0) returned 1 [0144.612] GetParent (hWnd=0xa0370) returned 0xd0024 [0144.612] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0xd0024, lpPoints=0x14d1d0, cPoints=0x2 | out: lpPoints=0x14d1d0) returned -1638403 [0144.612] GetClientRect (in: hWnd=0xa0370, lpRect=0x14dce0 | out: lpRect=0x14dce0) returned 1 [0144.613] GetWindowRect (in: hWnd=0xa0370, lpRect=0x14dce0 | out: lpRect=0x14dce0) returned 1 [0144.613] GetParent (hWnd=0xa0370) returned 0xd0024 [0144.613] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0xd0024, lpPoints=0x14dce0, cPoints=0x2 | out: lpPoints=0x14dce0) returned -1638403 [0144.613] GetParent (hWnd=0xa0370) returned 0xd0024 [0144.613] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0144.613] GetWindowLongPtrW (hWnd=0x50218, nIndex=-20) returned 0xd0000 [0144.613] DestroyWindow (hWnd=0x50218) returned 1 [0144.613] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x50218, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0144.712] GetWindowTextLengthW (hWnd=0x50218) returned 5 [0144.712] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x50218, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0144.712] GetSystemMetrics (nIndex=42) returned 0 [0144.712] GetWindowTextW (in: hWnd=0x50218, lpString=0x14daa0, nMaxCount=6 | out: lpString="Form1") returned 5 [0144.712] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x50218, Msg=0xd, wParam=0x6, lParam=0x14daa0) returned 0x5 [0144.712] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x50218, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0144.713] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x50218, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0144.718] GetCurrentActCtx (in: lphActCtx=0x14e2c0 | out: lphActCtx=0x14e2c0*=0x6263a8) returned 1 [0144.719] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83ef20000 [0144.719] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0144.719] CreateWindowExW (dwExStyle=0x90000, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r8_ad1", lpWindowName="Form1", dwStyle=0x2010000, X=69, Y=26, nWidth=1302, nHeight=808, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x703a0 [0144.720] SetWindowLongPtrW (hWnd=0x703a0, nIndex=-4, dwNewLong=0x7ff8463f4a40) returned 0x1abd085c [0144.720] GetWindowLongPtrW (hWnd=0x703a0, nIndex=-4) returned 0x7ff8463f4a40 [0144.720] SetWindowLongPtrW (hWnd=0x703a0, nIndex=-4, dwNewLong=0x1abd0c6c) returned 0x7ff8463f4a40 [0144.721] GetWindowLongPtrW (hWnd=0x703a0, nIndex=-4) returned 0x1abd0c6c [0144.721] GetWindowLongPtrW (hWnd=0x703a0, nIndex=-16) returned 0x6c10000 [0144.728] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x81, wParam=0x0, lParam=0x14d940) returned 0x1 [0144.729] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x83, wParam=0x0, lParam=0x14d9f0) returned 0x0 [0144.730] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x1, wParam=0x0, lParam=0x14d920) returned 0x0 [0144.730] GetClientRect (in: hWnd=0x703a0, lpRect=0x14d370 | out: lpRect=0x14d370) returned 1 [0144.730] GetWindowRect (in: hWnd=0x703a0, lpRect=0x14d370 | out: lpRect=0x14d370) returned 1 [0144.731] SetWindowTextW (hWnd=0x703a0, lpString="Form1") returned 1 [0144.731] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xc, wParam=0x0, lParam=0x2129bf4) returned 0x1 [0144.731] SetLayeredWindowAttributes (hwnd=0x703a0, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0144.814] GetStartupInfoW (in: lpStartupInfo=0x212a100 | out: lpStartupInfo=0x212a100*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\covid.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0144.815] GetParent (hWnd=0x703a0) returned 0x0 [0144.816] GetStockObject (i=5) returned 0x1900015 [0144.817] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0144.817] CoTaskMemAlloc (cb=0x5a) returned 0x622b00 [0144.817] RegisterClassW (lpWndClass=0x14dfc0) returned 0xc1e5 [0144.818] CoTaskMemFree (pv=0x622b00) [0144.818] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0144.818] CreateWindowExW (dwExStyle=0x80, lpClassName="WindowsForms10.Window.0.app.0.141b42a_r8_ad1", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x30372 [0144.818] SetWindowLongPtrW (hWnd=0x30372, nIndex=-4, dwNewLong=0x7ff8463f4a40) returned 0x1abd0cbc [0144.818] GetWindowLongPtrW (hWnd=0x30372, nIndex=-4) returned 0x7ff8463f4a40 [0144.819] SetWindowLongPtrW (hWnd=0x30372, nIndex=-4, dwNewLong=0x1abd0d0c) returned 0x7ff8463f4a40 [0144.819] GetWindowLongPtrW (hWnd=0x30372, nIndex=-4) returned 0x1abd0d0c [0144.819] GetWindowLongPtrW (hWnd=0x30372, nIndex=-16) returned 0x4c00000 [0144.820] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x30372, Msg=0x24, wParam=0x0, lParam=0x14d9e0) returned 0x0 [0144.820] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x30372, Msg=0x81, wParam=0x0, lParam=0x14d950) returned 0x1 [0144.820] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x30372, Msg=0x83, wParam=0x0, lParam=0x14da00) returned 0x0 [0144.821] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x30372, Msg=0x1, wParam=0x0, lParam=0x14d950) returned 0x0 [0144.821] SetWindowLongPtrW (hWnd=0x703a0, nIndex=-8, dwNewLong=0x30372) returned 0x0 [0144.823] SendMessageW (hWnd=0x703a0, Msg=0x80, wParam=0x0, lParam=0xd0277) returned 0x0 [0144.823] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x80, wParam=0x0, lParam=0xd0277) returned 0x0 [0144.823] SendMessageW (hWnd=0x703a0, Msg=0x80, wParam=0x1, lParam=0x600fd) returned 0x0 [0144.823] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x80, wParam=0x1, lParam=0x600fd) returned 0x0 [0144.845] GetSystemMenu (hWnd=0x703a0, bRevert=0) returned 0x0 [0144.845] GetWindowPlacement (in: hWnd=0x703a0, lpwndpl=0x14e2c8 | out: lpwndpl=0x14e2c8) returned 1 [0144.845] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x0) returned 1 [0144.845] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf030, uEnable=0x0) returned 1 [0144.845] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf060, uEnable=0x0) returned 1 [0144.845] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0144.845] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf000, uEnable=0x1) returned 1 [0144.845] GetClientRect (in: hWnd=0x703a0, lpRect=0x14e390 | out: lpRect=0x14e390) returned 1 [0144.845] GetClientRect (in: hWnd=0x703a0, lpRect=0x14e2c0 | out: lpRect=0x14e2c0) returned 1 [0144.845] GetWindowRect (in: hWnd=0x703a0, lpRect=0x14e2c0 | out: lpRect=0x14e2c0) returned 1 [0144.845] SetWindowPos (hWnd=0x703a0, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1 [0144.845] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x46, wParam=0x0, lParam=0x14e220) returned 0x0 [0144.893] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0144.916] GetWindowPlacement (in: hWnd=0x703a0, lpwndpl=0x14dde8 | out: lpwndpl=0x14dde8) returned 1 [0144.917] GetClientRect (in: hWnd=0x703a0, lpRect=0x14dd00 | out: lpRect=0x14dd00) returned 1 [0144.917] GetWindowTextLengthW (hWnd=0x703a0) returned 5 [0144.917] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0144.917] GetSystemMetrics (nIndex=42) returned 0 [0144.917] GetWindowTextW (in: hWnd=0x703a0, lpString=0x14da70, nMaxCount=6 | out: lpString="Form1") returned 5 [0144.917] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xd, wParam=0x6, lParam=0x14da70) returned 0x5 [0144.917] GetClientRect (in: hWnd=0x703a0, lpRect=0x14dae8 | out: lpRect=0x14dae8) returned 1 [0144.917] GetCurrentObject (hdc=0xa0100d0, type=0x1) returned 0x1b00017 [0144.917] GetCurrentObject (hdc=0xa0100d0, type=0x2) returned 0x1900010 [0144.917] GetCurrentObject (hdc=0xa0100d0, type=0x7) returned 0x5305067a [0144.917] GetCurrentObject (hdc=0xa0100d0, type=0x6) returned 0x18a0048 [0144.917] SaveDC (hdc=0xa0100d0) returned 1 [0144.917] GetNearestColor (hdc=0xa0100d0, color=0xf0f0f0) returned 0xf0f0f0 [0144.918] CreateSolidBrush (color=0xf0f0f0) returned 0x1d100999 [0144.918] FillRect (hDC=0xa0100d0, lprc=0x14d7d8, hbr=0x1d100999) returned 1 [0144.936] DeleteObject (ho=0x1d100999) returned 1 [0144.936] RestoreDC (hdc=0xa0100d0, nSavedDC=-1) returned 1 [0144.936] GetWindowPlacement (in: hWnd=0x703a0, lpwndpl=0x14ddc8 | out: lpwndpl=0x14ddc8) returned 1 [0144.936] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x47, wParam=0x0, lParam=0x14e220) returned 0x0 [0144.936] GetClientRect (in: hWnd=0x703a0, lpRect=0x14dc60 | out: lpRect=0x14dc60) returned 1 [0144.936] GetWindowRect (in: hWnd=0x703a0, lpRect=0x14dc60 | out: lpRect=0x14dc60) returned 1 [0144.942] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x83, wParam=0x1, lParam=0x14dac0) returned 0x0 [0144.992] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0145.008] GetWindowPlacement (in: hWnd=0x703a0, lpwndpl=0x14d6b8 | out: lpwndpl=0x14d6b8) returned 1 [0145.008] GetClientRect (in: hWnd=0x703a0, lpRect=0x14d5d0 | out: lpRect=0x14d5d0) returned 1 [0145.008] GetWindowTextLengthW (hWnd=0x703a0) returned 5 [0145.008] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0145.008] GetSystemMetrics (nIndex=42) returned 0 [0145.008] GetWindowTextW (in: hWnd=0x703a0, lpString=0x14d340, nMaxCount=6 | out: lpString="Form1") returned 5 [0145.008] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xd, wParam=0x6, lParam=0x14d340) returned 0x5 [0145.008] GetClientRect (in: hWnd=0x703a0, lpRect=0x14d3b8 | out: lpRect=0x14d3b8) returned 1 [0145.008] GetCurrentObject (hdc=0x4010184, type=0x1) returned 0x1b00017 [0145.009] GetCurrentObject (hdc=0x4010184, type=0x2) returned 0x1900010 [0145.009] GetCurrentObject (hdc=0x4010184, type=0x7) returned 0x5305067a [0145.009] GetCurrentObject (hdc=0x4010184, type=0x6) returned 0x18a0048 [0145.009] SaveDC (hdc=0x4010184) returned 1 [0145.009] GetNearestColor (hdc=0x4010184, color=0xf0f0f0) returned 0xf0f0f0 [0145.009] CreateSolidBrush (color=0xf0f0f0) returned 0x1e100999 [0145.009] FillRect (hDC=0x4010184, lprc=0x14d0a8, hbr=0x1e100999) returned 1 [0145.010] DeleteObject (ho=0x1e100999) returned 1 [0145.010] RestoreDC (hdc=0x4010184, nSavedDC=-1) returned 1 [0145.011] SetWindowLongPtrW (hWnd=0x703a0, nIndex=-8, dwNewLong=0x30372) returned 0x30372 [0145.018] SendMessageW (hWnd=0x30372, Msg=0x80, wParam=0x1, lParam=0x600fd) returned 0x0 [0145.018] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x30372, Msg=0x80, wParam=0x1, lParam=0x600fd) returned 0x0 [0145.019] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83ef20000 [0145.020] GetWindowLongPtrW (hWnd=0x703a0, nIndex=-16) returned 0x16c10000 [0145.020] GetWindowLongPtrW (hWnd=0x703a0, nIndex=-16) returned 0x16c10000 [0145.020] GetWindowLongPtrW (hWnd=0x703a0, nIndex=-20) returned 0x90100 [0145.020] SetWindowLongPtrW (hWnd=0x703a0, nIndex=-16, dwNewLong=0x12010000) returned 0x16c10000 [0145.020] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x7c, wParam=0xfffffffffffffff0, lParam=0x14e190) returned 0x0 [0145.022] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x7d, wParam=0xfffffffffffffff0, lParam=0x14e190) returned 0x0 [0145.022] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x46, wParam=0x0, lParam=0x14d480) returned 0x0 [0145.022] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x83, wParam=0x1, lParam=0x14d450) returned 0x0 [0145.077] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0145.077] GetWindowPlacement (in: hWnd=0x703a0, lpwndpl=0x14d048 | out: lpwndpl=0x14d048) returned 1 [0145.077] GetClientRect (in: hWnd=0x703a0, lpRect=0x14cf60 | out: lpRect=0x14cf60) returned 1 [0145.077] GetWindowTextLengthW (hWnd=0x703a0) returned 5 [0145.077] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0145.077] GetSystemMetrics (nIndex=42) returned 0 [0145.077] GetWindowTextW (in: hWnd=0x703a0, lpString=0x14ccd0, nMaxCount=6 | out: lpString="Form1") returned 5 [0145.077] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xd, wParam=0x6, lParam=0x14ccd0) returned 0x5 [0145.077] GetClientRect (in: hWnd=0x703a0, lpRect=0x14cd48 | out: lpRect=0x14cd48) returned 1 [0145.077] GetCurrentObject (hdc=0xa0100d0, type=0x1) returned 0x1b00017 [0145.077] GetCurrentObject (hdc=0xa0100d0, type=0x2) returned 0x1900010 [0145.077] GetCurrentObject (hdc=0xa0100d0, type=0x7) returned 0x5305067a [0145.077] GetCurrentObject (hdc=0xa0100d0, type=0x6) returned 0x18a0048 [0145.077] SaveDC (hdc=0xa0100d0) returned 1 [0145.077] GetNearestColor (hdc=0xa0100d0, color=0xf0f0f0) returned 0xf0f0f0 [0145.078] CreateSolidBrush (color=0xf0f0f0) returned 0x1f100999 [0145.078] FillRect (hDC=0xa0100d0, lprc=0x14ca38, hbr=0x1f100999) returned 1 [0145.092] DeleteObject (ho=0x1f100999) returned 1 [0145.092] RestoreDC (hdc=0xa0100d0, nSavedDC=-1) returned 1 [0145.093] GetWindowPlacement (in: hWnd=0x703a0, lpwndpl=0x14d028 | out: lpwndpl=0x14d028) returned 1 [0145.093] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x47, wParam=0x0, lParam=0x14d480) returned 0x0 [0145.093] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x3, wParam=0x0, lParam=0x1a0045) returned 0x0 [0145.093] GetClientRect (in: hWnd=0x703a0, lpRect=0x14c480 | out: lpRect=0x14c480) returned 1 [0145.093] GetWindowRect (in: hWnd=0x703a0, lpRect=0x14c480 | out: lpRect=0x14c480) returned 1 [0145.093] GetWindowTextLengthW (hWnd=0x703a0) returned 5 [0145.093] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0145.093] GetSystemMetrics (nIndex=42) returned 0 [0145.093] GetWindowTextW (in: hWnd=0x703a0, lpString=0x14c0c0, nMaxCount=6 | out: lpString="Form1") returned 5 [0145.093] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xd, wParam=0x6, lParam=0x14c0c0) returned 0x5 [0145.094] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x5, wParam=0x0, lParam=0x3280516) returned 0x0 [0145.094] GetClientRect (in: hWnd=0x703a0, lpRect=0x14cec0 | out: lpRect=0x14cec0) returned 1 [0145.094] GetWindowRect (in: hWnd=0x703a0, lpRect=0x14cec0 | out: lpRect=0x14cec0) returned 1 [0145.094] SetWindowLongPtrW (hWnd=0x703a0, nIndex=-20, dwNewLong=0x90000) returned 0x90000 [0145.094] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x7c, wParam=0xffffffffffffffec, lParam=0x14e190) returned 0x0 [0145.094] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x7d, wParam=0xffffffffffffffec, lParam=0x14e190) returned 0x0 [0145.095] SetWindowPos (hWnd=0x703a0, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0145.095] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x46, wParam=0x0, lParam=0x14e1f0) returned 0x0 [0145.095] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x83, wParam=0x1, lParam=0x14e1c0) returned 0x0 [0145.159] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0145.159] GetWindowPlacement (in: hWnd=0x703a0, lpwndpl=0x14ddb8 | out: lpwndpl=0x14ddb8) returned 1 [0145.159] GetClientRect (in: hWnd=0x703a0, lpRect=0x14dcd0 | out: lpRect=0x14dcd0) returned 1 [0145.159] GetWindowTextLengthW (hWnd=0x703a0) returned 5 [0145.159] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0145.159] GetSystemMetrics (nIndex=42) returned 0 [0145.159] GetWindowTextW (in: hWnd=0x703a0, lpString=0x14da40, nMaxCount=6 | out: lpString="Form1") returned 5 [0145.159] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xd, wParam=0x6, lParam=0x14da40) returned 0x5 [0145.159] GetClientRect (in: hWnd=0x703a0, lpRect=0x14dab8 | out: lpRect=0x14dab8) returned 1 [0145.159] GetCurrentObject (hdc=0x4010184, type=0x1) returned 0x1b00017 [0145.159] GetCurrentObject (hdc=0x4010184, type=0x2) returned 0x1900010 [0145.159] GetCurrentObject (hdc=0x4010184, type=0x7) returned 0x5305067a [0145.159] GetCurrentObject (hdc=0x4010184, type=0x6) returned 0x18a0048 [0145.160] SaveDC (hdc=0x4010184) returned 1 [0145.160] GetNearestColor (hdc=0x4010184, color=0xf0f0f0) returned 0xf0f0f0 [0145.160] CreateSolidBrush (color=0xf0f0f0) returned 0x20100999 [0145.160] FillRect (hDC=0x4010184, lprc=0x14d7a8, hbr=0x20100999) returned 1 [0145.176] DeleteObject (ho=0x20100999) returned 1 [0145.176] RestoreDC (hdc=0x4010184, nSavedDC=-1) returned 1 [0145.177] GetWindowPlacement (in: hWnd=0x703a0, lpwndpl=0x14dd98 | out: lpwndpl=0x14dd98) returned 1 [0145.177] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x47, wParam=0x0, lParam=0x14e1f0) returned 0x0 [0145.177] GetClientRect (in: hWnd=0x703a0, lpRect=0x14dc30 | out: lpRect=0x14dc30) returned 1 [0145.177] GetWindowRect (in: hWnd=0x703a0, lpRect=0x14dc30 | out: lpRect=0x14dc30) returned 1 [0145.177] RedrawWindow (hWnd=0x703a0, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0145.177] GetSystemMenu (hWnd=0x703a0, bRevert=0) returned 0x0 [0145.177] GetWindowPlacement (in: hWnd=0x703a0, lpwndpl=0x14e268 | out: lpwndpl=0x14e268) returned 1 [0145.177] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x0) returned 1 [0145.177] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf030, uEnable=0x0) returned 1 [0145.177] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf060, uEnable=0x0) returned 1 [0145.177] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0145.177] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf000, uEnable=0x1) returned 1 [0145.177] SetParent (hWndChild=0x9005a, hWndNewParent=0x703a0) returned 0xd0024 [0145.177] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9005a, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0145.178] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9005a, Msg=0x46, wParam=0x0, lParam=0x14e300) returned 0x0 [0145.230] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9005a, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0145.231] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9005a, Msg=0x47, wParam=0x0, lParam=0x14e300) returned 0x0 [0145.231] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9005a, Msg=0x3, wParam=0x0, lParam=0x2ac0156) returned 0x0 [0145.231] GetClientRect (in: hWnd=0x9005a, lpRect=0x14d1f0 | out: lpRect=0x14d1f0) returned 1 [0145.231] GetWindowRect (in: hWnd=0x9005a, lpRect=0x14d1f0 | out: lpRect=0x14d1f0) returned 1 [0145.231] GetParent (hWnd=0x9005a) returned 0x703a0 [0145.231] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14d1f0, cPoints=0x2 | out: lpPoints=0x14d1f0) returned -1638469 [0145.231] GetClientRect (in: hWnd=0x9005a, lpRect=0x14dd00 | out: lpRect=0x14dd00) returned 1 [0145.231] GetWindowRect (in: hWnd=0x9005a, lpRect=0x14dd00 | out: lpRect=0x14dd00) returned 1 [0145.231] GetParent (hWnd=0x9005a) returned 0x703a0 [0145.231] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14dd00, cPoints=0x2 | out: lpPoints=0x14dd00) returned -1638469 [0145.231] GetParent (hWnd=0x9005a) returned 0x703a0 [0145.231] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9005a, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0145.231] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9005a, Msg=0x46, wParam=0x0, lParam=0x14e300) returned 0x0 [0145.234] GetWindowPlacement (in: hWnd=0x703a0, lpwndpl=0x14dec8 | out: lpwndpl=0x14dec8) returned 1 [0145.234] GetClientRect (in: hWnd=0x703a0, lpRect=0x14dde0 | out: lpRect=0x14dde0) returned 1 [0145.234] GetWindowTextLengthW (hWnd=0x703a0) returned 5 [0145.234] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0145.234] GetSystemMetrics (nIndex=42) returned 0 [0145.234] GetWindowTextW (in: hWnd=0x703a0, lpString=0x14db50, nMaxCount=6 | out: lpString="Form1") returned 5 [0145.234] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xd, wParam=0x6, lParam=0x14db50) returned 0x5 [0145.234] GetClientRect (in: hWnd=0x703a0, lpRect=0x14dbc8 | out: lpRect=0x14dbc8) returned 1 [0145.234] GetCurrentObject (hdc=0x4010184, type=0x1) returned 0x1b00017 [0145.234] GetCurrentObject (hdc=0x4010184, type=0x2) returned 0x1900010 [0145.235] GetCurrentObject (hdc=0x4010184, type=0x7) returned 0x5305067a [0145.235] GetCurrentObject (hdc=0x4010184, type=0x6) returned 0x18a0048 [0145.235] SaveDC (hdc=0x4010184) returned 1 [0145.235] GetNearestColor (hdc=0x4010184, color=0xf0f0f0) returned 0xf0f0f0 [0145.235] CreateSolidBrush (color=0xf0f0f0) returned 0x21100999 [0145.235] FillRect (hDC=0x4010184, lprc=0x14d8b8, hbr=0x21100999) returned 1 [0145.252] DeleteObject (ho=0x21100999) returned 1 [0145.252] RestoreDC (hdc=0x4010184, nSavedDC=-1) returned 1 [0145.253] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9005a, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0145.253] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9005a, Msg=0x47, wParam=0x0, lParam=0x14e300) returned 0x0 [0145.253] GetClientRect (in: hWnd=0x9005a, lpRect=0x14dd00 | out: lpRect=0x14dd00) returned 1 [0145.253] GetWindowRect (in: hWnd=0x9005a, lpRect=0x14dd00 | out: lpRect=0x14dd00) returned 1 [0145.253] GetParent (hWnd=0x9005a) returned 0x703a0 [0145.253] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14dd00, cPoints=0x2 | out: lpPoints=0x14dd00) returned -1638469 [0145.253] GetParent (hWnd=0x9005a) returned 0x703a0 [0145.253] GetWindow (hWnd=0x9005a, uCmd=0x3) returned 0x0 [0145.253] GetFocus () returned 0x0 [0145.253] GetParent (hWnd=0x9005a) returned 0x703a0 [0145.253] GetWindowLongPtrW (hWnd=0x9005a, nIndex=-20) returned 0x0 [0145.254] DestroyWindow (hWnd=0x9005a) returned 1 [0145.254] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9005a, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0145.254] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x210, wParam=0x5a0002, lParam=0x9005a) returned 0x0 [0145.254] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9005a, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0145.254] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9005a, Msg=0x46, wParam=0x0, lParam=0x14e080) returned 0x0 [0145.303] GetWindowPlacement (in: hWnd=0x703a0, lpwndpl=0x14dc48 | out: lpwndpl=0x14dc48) returned 1 [0145.303] GetClientRect (in: hWnd=0x703a0, lpRect=0x14db60 | out: lpRect=0x14db60) returned 1 [0145.303] GetWindowTextLengthW (hWnd=0x703a0) returned 5 [0145.303] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0145.303] GetSystemMetrics (nIndex=42) returned 0 [0145.303] GetWindowTextW (in: hWnd=0x703a0, lpString=0x14d8d0, nMaxCount=6 | out: lpString="Form1") returned 5 [0145.303] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xd, wParam=0x6, lParam=0x14d8d0) returned 0x5 [0145.304] GetClientRect (in: hWnd=0x703a0, lpRect=0x14d948 | out: lpRect=0x14d948) returned 1 [0145.304] GetCurrentObject (hdc=0xa0100d0, type=0x1) returned 0x1b00017 [0145.304] GetCurrentObject (hdc=0xa0100d0, type=0x2) returned 0x1900010 [0145.304] GetCurrentObject (hdc=0xa0100d0, type=0x7) returned 0x5305067a [0145.304] GetCurrentObject (hdc=0xa0100d0, type=0x6) returned 0x18a0048 [0145.304] SaveDC (hdc=0xa0100d0) returned 1 [0145.304] GetNearestColor (hdc=0xa0100d0, color=0xf0f0f0) returned 0xf0f0f0 [0145.304] CreateSolidBrush (color=0xf0f0f0) returned 0x22100999 [0145.304] FillRect (hDC=0xa0100d0, lprc=0x14d638, hbr=0x22100999) returned 1 [0145.329] DeleteObject (ho=0x22100999) returned 1 [0145.329] RestoreDC (hdc=0xa0100d0, nSavedDC=-1) returned 1 [0145.330] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9005a, Msg=0x47, wParam=0x0, lParam=0x14e080) returned 0x0 [0145.330] GetClientRect (in: hWnd=0x9005a, lpRect=0x14da80 | out: lpRect=0x14da80) returned 1 [0145.330] GetWindowRect (in: hWnd=0x9005a, lpRect=0x14da80 | out: lpRect=0x14da80) returned 1 [0145.330] GetParent (hWnd=0x9005a) returned 0x703a0 [0145.330] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14da80, cPoints=0x2 | out: lpPoints=0x14da80) returned -1638469 [0145.330] GetParent (hWnd=0x9005a) returned 0x703a0 [0145.330] GetWindowTextLengthW (hWnd=0x9005a) returned 6 [0145.330] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9005a, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x6 [0145.330] GetSystemMetrics (nIndex=42) returned 0 [0145.330] GetWindowTextW (in: hWnd=0x9005a, lpString=0x14d8f0, nMaxCount=7 | out: lpString="label1") returned 6 [0145.330] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9005a, Msg=0xd, wParam=0x7, lParam=0x14d8f0) returned 0x6 [0145.330] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9005a, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0145.331] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9005a, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0145.333] GetCurrentActCtx (in: lphActCtx=0x14e210 | out: lphActCtx=0x14e210*=0x6263a8) returned 1 [0145.334] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83ef20000 [0145.334] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0145.334] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r8_ad1", lpWindowName="label1", dwStyle=0x5600000d, X=342, Y=684, nWidth=35, nHeight=13, hWndParent=0x703a0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0xa005a [0145.335] SetWindowLongPtrW (hWnd=0xa005a, nIndex=-4, dwNewLong=0x7ff83ef340d0) returned 0x1abd09ec [0145.335] GetWindowLongPtrW (hWnd=0xa005a, nIndex=-4) returned 0x7ff83ef340d0 [0145.335] SetWindowLongPtrW (hWnd=0xa005a, nIndex=-4, dwNewLong=0x1abd0d5c) returned 0x7ff83ef340d0 [0145.335] GetWindowLongPtrW (hWnd=0xa005a, nIndex=-4) returned 0x1abd0d5c [0145.335] GetWindowLongPtrW (hWnd=0xa005a, nIndex=-16) returned 0x4600000d [0145.335] GetWindowLongPtrW (hWnd=0xa005a, nIndex=-12) returned 0x0 [0145.336] SetWindowLongPtrW (hWnd=0xa005a, nIndex=-12, dwNewLong=0xa005a) returned 0x0 [0145.336] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa005a, Msg=0x81, wParam=0x0, lParam=0x14d890) returned 0x1 [0145.337] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa005a, Msg=0x83, wParam=0x0, lParam=0x14d940) returned 0x0 [0145.337] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa005a, Msg=0x1, wParam=0x0, lParam=0x14d870) returned 0x0 [0145.338] GetWindow (hWnd=0xa005a, uCmd=0x3) returned 0x0 [0145.338] GetClientRect (in: hWnd=0xa005a, lpRect=0x14d280 | out: lpRect=0x14d280) returned 1 [0145.338] GetWindowRect (in: hWnd=0xa005a, lpRect=0x14d280 | out: lpRect=0x14d280) returned 1 [0145.338] GetParent (hWnd=0xa005a) returned 0x703a0 [0145.338] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14d280, cPoints=0x2 | out: lpPoints=0x14d280) returned -1638469 [0145.339] SetWindowTextW (hWnd=0xa005a, lpString="label1") returned 1 [0145.339] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa005a, Msg=0xc, wParam=0x0, lParam=0x212c08c) returned 0x1 [0145.399] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa005a, Msg=0x5, wParam=0x0, lParam=0xd0023) returned 0x0 [0145.400] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa005a, Msg=0x3, wParam=0x0, lParam=0x2ac0156) returned 0x0 [0145.400] GetClientRect (in: hWnd=0xa005a, lpRect=0x14d3b0 | out: lpRect=0x14d3b0) returned 1 [0145.400] GetWindowRect (in: hWnd=0xa005a, lpRect=0x14d3b0 | out: lpRect=0x14d3b0) returned 1 [0145.400] GetParent (hWnd=0xa005a) returned 0x703a0 [0145.400] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14d3b0, cPoints=0x2 | out: lpPoints=0x14d3b0) returned -1638469 [0145.400] SendMessageW (hWnd=0xa005a, Msg=0x2210, wParam=0x5a0001, lParam=0xa005a) returned 0x0 [0145.400] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa005a, Msg=0x2210, wParam=0x5a0001, lParam=0xa005a) returned 0x0 [0145.400] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa005a, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0145.400] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa005a, Msg=0x46, wParam=0x0, lParam=0x14d920) returned 0x0 [0145.438] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa005a, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0145.439] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa005a, Msg=0x47, wParam=0x0, lParam=0x14d920) returned 0x0 [0145.439] GetClientRect (in: hWnd=0xa005a, lpRect=0x14d320 | out: lpRect=0x14d320) returned 1 [0145.439] GetWindowRect (in: hWnd=0xa005a, lpRect=0x14d320 | out: lpRect=0x14d320) returned 1 [0145.439] GetParent (hWnd=0xa005a) returned 0x703a0 [0145.439] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14d320, cPoints=0x2 | out: lpPoints=0x14d320) returned -1638469 [0145.439] GetParent (hWnd=0xa005a) returned 0x703a0 [0145.439] GetParent (hWnd=0xa005a) returned 0x703a0 [0145.439] SetParent (hWndChild=0x9036a, hWndNewParent=0x703a0) returned 0xd0024 [0145.439] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0145.440] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0x46, wParam=0x0, lParam=0x14e300) returned 0x0 [0145.442] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0145.442] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0x47, wParam=0x0, lParam=0x14e300) returned 0x0 [0145.442] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0x3, wParam=0x0, lParam=0x19d0233) returned 0x0 [0145.442] GetClientRect (in: hWnd=0x9036a, lpRect=0x14d1f0 | out: lpRect=0x14d1f0) returned 1 [0145.442] GetWindowRect (in: hWnd=0x9036a, lpRect=0x14d1f0 | out: lpRect=0x14d1f0) returned 1 [0145.442] GetParent (hWnd=0x9036a) returned 0x703a0 [0145.442] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14d1f0, cPoints=0x2 | out: lpPoints=0x14d1f0) returned -1638469 [0145.442] GetClientRect (in: hWnd=0x9036a, lpRect=0x14dd00 | out: lpRect=0x14dd00) returned 1 [0145.442] GetWindowRect (in: hWnd=0x9036a, lpRect=0x14dd00 | out: lpRect=0x14dd00) returned 1 [0145.442] GetParent (hWnd=0x9036a) returned 0x703a0 [0145.442] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14dd00, cPoints=0x2 | out: lpPoints=0x14dd00) returned -1638469 [0145.442] GetParent (hWnd=0x9036a) returned 0x703a0 [0145.442] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0145.443] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0x46, wParam=0x0, lParam=0x14e300) returned 0x0 [0145.445] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0145.445] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0x47, wParam=0x0, lParam=0x14e300) returned 0x0 [0145.445] GetClientRect (in: hWnd=0x9036a, lpRect=0x14dd00 | out: lpRect=0x14dd00) returned 1 [0145.445] GetWindowRect (in: hWnd=0x9036a, lpRect=0x14dd00 | out: lpRect=0x14dd00) returned 1 [0145.445] GetParent (hWnd=0x9036a) returned 0x703a0 [0145.445] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14dd00, cPoints=0x2 | out: lpPoints=0x14dd00) returned -1638469 [0145.445] GetParent (hWnd=0x9036a) returned 0x703a0 [0145.446] GetWindow (hWnd=0x9036a, uCmd=0x3) returned 0x0 [0145.446] SetWindowPos (hWnd=0x9036a, hWndInsertAfter=0xa005a, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0145.446] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0x46, wParam=0x0, lParam=0x14e250) returned 0x0 [0145.448] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0145.448] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0145.448] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0x47, wParam=0x0, lParam=0x14e250) returned 0x0 [0145.449] GetClientRect (in: hWnd=0x9036a, lpRect=0x14dc50 | out: lpRect=0x14dc50) returned 1 [0145.449] GetWindowRect (in: hWnd=0x9036a, lpRect=0x14dc50 | out: lpRect=0x14dc50) returned 1 [0145.449] GetParent (hWnd=0x9036a) returned 0x703a0 [0145.449] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14dc50, cPoints=0x2 | out: lpPoints=0x14dc50) returned -1638469 [0145.449] GetParent (hWnd=0x9036a) returned 0x703a0 [0145.450] GetWindow (hWnd=0x9036a, uCmd=0x3) returned 0xa005a [0145.450] GetFocus () returned 0x0 [0145.450] GetParent (hWnd=0x9036a) returned 0x703a0 [0145.450] GetWindowLongPtrW (hWnd=0x9036a, nIndex=-20) returned 0x0 [0145.450] DestroyWindow (hWnd=0x9036a) returned 1 [0145.450] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0145.450] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x210, wParam=0x36a0002, lParam=0x9036a) returned 0x0 [0145.451] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0145.451] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0x46, wParam=0x0, lParam=0x14e080) returned 0x0 [0145.453] GetWindowPlacement (in: hWnd=0x703a0, lpwndpl=0x14dc48 | out: lpwndpl=0x14dc48) returned 1 [0145.453] GetClientRect (in: hWnd=0x703a0, lpRect=0x14db60 | out: lpRect=0x14db60) returned 1 [0145.453] GetWindowTextLengthW (hWnd=0x703a0) returned 5 [0145.454] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0145.454] GetSystemMetrics (nIndex=42) returned 0 [0145.454] GetWindowTextW (in: hWnd=0x703a0, lpString=0x14d8d0, nMaxCount=6 | out: lpString="Form1") returned 5 [0145.454] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xd, wParam=0x6, lParam=0x14d8d0) returned 0x5 [0145.454] GetClientRect (in: hWnd=0x703a0, lpRect=0x14d948 | out: lpRect=0x14d948) returned 1 [0145.454] GetCurrentObject (hdc=0xffffffff9801080a, type=0x1) returned 0x1b00017 [0145.454] GetCurrentObject (hdc=0xffffffff9801080a, type=0x2) returned 0x1900010 [0145.454] GetCurrentObject (hdc=0xffffffff9801080a, type=0x7) returned 0x5305067a [0145.454] GetCurrentObject (hdc=0xffffffff9801080a, type=0x6) returned 0x18a0048 [0145.454] SaveDC (hdc=0xffffffff9801080a) returned 1 [0145.455] GetNearestColor (hdc=0xffffffff9801080a, color=0xf0f0f0) returned 0xf0f0f0 [0145.455] CreateSolidBrush (color=0xf0f0f0) returned 0x23100999 [0145.455] FillRect (hDC=0xffffffff9801080a, lprc=0x14d638, hbr=0x23100999) returned 1 [0145.471] DeleteObject (ho=0x23100999) returned 1 [0145.471] RestoreDC (hdc=0xffffffff9801080a, nSavedDC=-1) returned 1 [0145.471] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0x47, wParam=0x0, lParam=0x14e080) returned 0x0 [0145.471] GetClientRect (in: hWnd=0x9036a, lpRect=0x14da80 | out: lpRect=0x14da80) returned 1 [0145.471] GetWindowRect (in: hWnd=0x9036a, lpRect=0x14da80 | out: lpRect=0x14da80) returned 1 [0145.472] GetParent (hWnd=0x9036a) returned 0x703a0 [0145.472] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14da80, cPoints=0x2 | out: lpPoints=0x14da80) returned -1638469 [0145.472] GetParent (hWnd=0x9036a) returned 0x703a0 [0145.472] GetWindowTextLengthW (hWnd=0x9036a) returned 6 [0145.472] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x6 [0145.472] GetSystemMetrics (nIndex=42) returned 0 [0145.472] GetWindowTextW (in: hWnd=0x9036a, lpString=0x14d8f0, nMaxCount=7 | out: lpString="label1") returned 6 [0145.472] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0xd, wParam=0x7, lParam=0x14d8f0) returned 0x6 [0145.474] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0145.474] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x9036a, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0145.477] GetCurrentActCtx (in: lphActCtx=0x14e210 | out: lphActCtx=0x14e210*=0x6263a8) returned 1 [0145.477] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83ef20000 [0145.477] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0145.477] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r8_ad1", lpWindowName="label1", dwStyle=0x5600000d, X=563, Y=413, nWidth=35, nHeight=13, hWndParent=0x703a0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0xa036a [0145.478] SetWindowLongPtrW (hWnd=0xa036a, nIndex=-4, dwNewLong=0x7ff83ef340d0) returned 0x1abd09ec [0145.478] GetWindowLongPtrW (hWnd=0xa036a, nIndex=-4) returned 0x7ff83ef340d0 [0145.479] SetWindowLongPtrW (hWnd=0xa036a, nIndex=-4, dwNewLong=0x1abd074c) returned 0x7ff83ef340d0 [0145.479] GetWindowLongPtrW (hWnd=0xa036a, nIndex=-4) returned 0x1abd074c [0145.479] GetWindowLongPtrW (hWnd=0xa036a, nIndex=-16) returned 0x4600000d [0145.479] GetWindowLongPtrW (hWnd=0xa036a, nIndex=-12) returned 0x0 [0145.479] SetWindowLongPtrW (hWnd=0xa036a, nIndex=-12, dwNewLong=0xa036a) returned 0x0 [0145.479] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa036a, Msg=0x81, wParam=0x0, lParam=0x14d890) returned 0x1 [0145.480] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa036a, Msg=0x83, wParam=0x0, lParam=0x14d940) returned 0x0 [0145.480] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa036a, Msg=0x1, wParam=0x0, lParam=0x14d870) returned 0x0 [0145.481] GetWindow (hWnd=0xa036a, uCmd=0x3) returned 0xa005a [0145.481] GetClientRect (in: hWnd=0xa036a, lpRect=0x14d280 | out: lpRect=0x14d280) returned 1 [0145.481] GetWindowRect (in: hWnd=0xa036a, lpRect=0x14d280 | out: lpRect=0x14d280) returned 1 [0145.481] GetParent (hWnd=0xa036a) returned 0x703a0 [0145.481] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14d280, cPoints=0x2 | out: lpPoints=0x14d280) returned -1638469 [0145.482] SetWindowTextW (hWnd=0xa036a, lpString="label1") returned 1 [0145.482] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa036a, Msg=0xc, wParam=0x0, lParam=0x212c9f4) returned 0x1 [0145.482] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa036a, Msg=0x5, wParam=0x0, lParam=0xd0023) returned 0x0 [0145.482] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa036a, Msg=0x3, wParam=0x0, lParam=0x19d0233) returned 0x0 [0145.482] GetClientRect (in: hWnd=0xa036a, lpRect=0x14d3b0 | out: lpRect=0x14d3b0) returned 1 [0145.482] GetWindowRect (in: hWnd=0xa036a, lpRect=0x14d3b0 | out: lpRect=0x14d3b0) returned 1 [0145.482] GetParent (hWnd=0xa036a) returned 0x703a0 [0145.482] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14d3b0, cPoints=0x2 | out: lpPoints=0x14d3b0) returned -1638469 [0145.483] SendMessageW (hWnd=0xa036a, Msg=0x2210, wParam=0x36a0001, lParam=0xa036a) returned 0x0 [0145.483] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa036a, Msg=0x2210, wParam=0x36a0001, lParam=0xa036a) returned 0x0 [0145.483] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa036a, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0145.483] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa036a, Msg=0x46, wParam=0x0, lParam=0x14d920) returned 0x0 [0145.525] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa036a, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0145.526] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa036a, Msg=0x47, wParam=0x0, lParam=0x14d920) returned 0x0 [0145.526] GetClientRect (in: hWnd=0xa036a, lpRect=0x14d320 | out: lpRect=0x14d320) returned 1 [0145.526] GetWindowRect (in: hWnd=0xa036a, lpRect=0x14d320 | out: lpRect=0x14d320) returned 1 [0145.526] GetParent (hWnd=0xa036a) returned 0x703a0 [0145.526] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14d320, cPoints=0x2 | out: lpPoints=0x14d320) returned -1638469 [0145.526] GetParent (hWnd=0xa036a) returned 0x703a0 [0145.526] GetParent (hWnd=0xa036a) returned 0x703a0 [0145.526] SetParent (hWndChild=0x60298, hWndNewParent=0x703a0) returned 0xd0024 [0145.526] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0145.527] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0x46, wParam=0x0, lParam=0x14e300) returned 0x0 [0145.530] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0145.531] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0x47, wParam=0x0, lParam=0x14e300) returned 0x0 [0145.531] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0x3, wParam=0x0, lParam=0xf70071) returned 0x0 [0145.531] GetClientRect (in: hWnd=0x60298, lpRect=0x14d1f0 | out: lpRect=0x14d1f0) returned 1 [0145.531] GetWindowRect (in: hWnd=0x60298, lpRect=0x14d1f0 | out: lpRect=0x14d1f0) returned 1 [0145.531] GetParent (hWnd=0x60298) returned 0x703a0 [0145.531] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14d1f0, cPoints=0x2 | out: lpPoints=0x14d1f0) returned -1638469 [0145.531] GetClientRect (in: hWnd=0x60298, lpRect=0x14dd00 | out: lpRect=0x14dd00) returned 1 [0145.531] GetWindowRect (in: hWnd=0x60298, lpRect=0x14dd00 | out: lpRect=0x14dd00) returned 1 [0145.531] GetParent (hWnd=0x60298) returned 0x703a0 [0145.531] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14dd00, cPoints=0x2 | out: lpPoints=0x14dd00) returned -1638469 [0145.531] GetParent (hWnd=0x60298) returned 0x703a0 [0145.531] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0145.531] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0x46, wParam=0x0, lParam=0x14e300) returned 0x0 [0145.533] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0145.533] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0x47, wParam=0x0, lParam=0x14e300) returned 0x0 [0145.533] GetClientRect (in: hWnd=0x60298, lpRect=0x14dd00 | out: lpRect=0x14dd00) returned 1 [0145.534] GetWindowRect (in: hWnd=0x60298, lpRect=0x14dd00 | out: lpRect=0x14dd00) returned 1 [0145.534] GetParent (hWnd=0x60298) returned 0x703a0 [0145.534] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14dd00, cPoints=0x2 | out: lpPoints=0x14dd00) returned -1638469 [0145.534] GetParent (hWnd=0x60298) returned 0x703a0 [0145.534] GetWindow (hWnd=0x60298, uCmd=0x3) returned 0x0 [0145.534] SetWindowPos (hWnd=0x60298, hWndInsertAfter=0xa036a, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0145.534] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0x46, wParam=0x0, lParam=0x14e250) returned 0x0 [0145.544] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0145.544] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0145.545] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0x47, wParam=0x0, lParam=0x14e250) returned 0x0 [0145.545] GetClientRect (in: hWnd=0x60298, lpRect=0x14dc50 | out: lpRect=0x14dc50) returned 1 [0145.545] GetWindowRect (in: hWnd=0x60298, lpRect=0x14dc50 | out: lpRect=0x14dc50) returned 1 [0145.545] GetParent (hWnd=0x60298) returned 0x703a0 [0145.545] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14dc50, cPoints=0x2 | out: lpPoints=0x14dc50) returned -1638469 [0145.545] GetParent (hWnd=0x60298) returned 0x703a0 [0145.545] GetWindow (hWnd=0x60298, uCmd=0x3) returned 0xa036a [0145.545] GetFocus () returned 0x0 [0145.545] GetParent (hWnd=0x60298) returned 0x703a0 [0145.545] GetWindowLongPtrW (hWnd=0x60298, nIndex=-20) returned 0x0 [0145.545] DestroyWindow (hWnd=0x60298) returned 1 [0145.545] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0145.545] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x210, wParam=0x2980002, lParam=0x60298) returned 0x0 [0145.546] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0145.546] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0x46, wParam=0x0, lParam=0x14e080) returned 0x0 [0145.548] GetWindowPlacement (in: hWnd=0x703a0, lpwndpl=0x14dc48 | out: lpwndpl=0x14dc48) returned 1 [0145.548] GetClientRect (in: hWnd=0x703a0, lpRect=0x14db60 | out: lpRect=0x14db60) returned 1 [0145.548] GetWindowTextLengthW (hWnd=0x703a0) returned 5 [0145.548] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0145.548] GetSystemMetrics (nIndex=42) returned 0 [0145.548] GetWindowTextW (in: hWnd=0x703a0, lpString=0x14d8d0, nMaxCount=6 | out: lpString="Form1") returned 5 [0145.548] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xd, wParam=0x6, lParam=0x14d8d0) returned 0x5 [0145.548] GetClientRect (in: hWnd=0x703a0, lpRect=0x14d948 | out: lpRect=0x14d948) returned 1 [0145.548] GetCurrentObject (hdc=0xa0100d0, type=0x1) returned 0x1b00017 [0145.548] GetCurrentObject (hdc=0xa0100d0, type=0x2) returned 0x1900010 [0145.548] GetCurrentObject (hdc=0xa0100d0, type=0x7) returned 0x5305067a [0145.548] GetCurrentObject (hdc=0xa0100d0, type=0x6) returned 0x18a0048 [0145.548] SaveDC (hdc=0xa0100d0) returned 1 [0145.549] GetNearestColor (hdc=0xa0100d0, color=0xf0f0f0) returned 0xf0f0f0 [0145.549] CreateSolidBrush (color=0xf0f0f0) returned 0x24100999 [0145.549] FillRect (hDC=0xa0100d0, lprc=0x14d638, hbr=0x24100999) returned 1 [0145.571] DeleteObject (ho=0x24100999) returned 1 [0145.571] RestoreDC (hdc=0xa0100d0, nSavedDC=-1) returned 1 [0145.572] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0x47, wParam=0x0, lParam=0x14e080) returned 0x0 [0145.572] GetClientRect (in: hWnd=0x60298, lpRect=0x14da80 | out: lpRect=0x14da80) returned 1 [0145.572] GetWindowRect (in: hWnd=0x60298, lpRect=0x14da80 | out: lpRect=0x14da80) returned 1 [0145.572] GetParent (hWnd=0x60298) returned 0x703a0 [0145.572] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14da80, cPoints=0x2 | out: lpPoints=0x14da80) returned -1638469 [0145.572] GetParent (hWnd=0x60298) returned 0x703a0 [0145.572] GetWindowTextLengthW (hWnd=0x60298) returned 6 [0145.572] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x6 [0145.572] GetSystemMetrics (nIndex=42) returned 0 [0145.572] GetWindowTextW (in: hWnd=0x60298, lpString=0x14d8f0, nMaxCount=7 | out: lpString="label1") returned 6 [0145.572] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0xd, wParam=0x7, lParam=0x14d8f0) returned 0x6 [0145.572] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0145.572] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x60298, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0145.575] GetCurrentActCtx (in: lphActCtx=0x14e210 | out: lphActCtx=0x14e210*=0x6263a8) returned 1 [0145.575] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83ef20000 [0145.580] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0145.580] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r8_ad1", lpWindowName="label1", dwStyle=0x5600000d, X=113, Y=247, nWidth=35, nHeight=13, hWndParent=0x703a0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x70298 [0145.580] SetWindowLongPtrW (hWnd=0x70298, nIndex=-4, dwNewLong=0x7ff83ef340d0) returned 0x1abd09ec [0145.580] GetWindowLongPtrW (hWnd=0x70298, nIndex=-4) returned 0x7ff83ef340d0 [0145.581] SetWindowLongPtrW (hWnd=0x70298, nIndex=-4, dwNewLong=0x1abd380c) returned 0x7ff83ef340d0 [0145.581] GetWindowLongPtrW (hWnd=0x70298, nIndex=-4) returned 0x1abd380c [0145.581] GetWindowLongPtrW (hWnd=0x70298, nIndex=-16) returned 0x4600000d [0145.581] GetWindowLongPtrW (hWnd=0x70298, nIndex=-12) returned 0x0 [0145.581] SetWindowLongPtrW (hWnd=0x70298, nIndex=-12, dwNewLong=0x70298) returned 0x0 [0145.582] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0x81, wParam=0x0, lParam=0x14d890) returned 0x1 [0145.583] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0x83, wParam=0x0, lParam=0x14d940) returned 0x0 [0145.583] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0x1, wParam=0x0, lParam=0x14d870) returned 0x0 [0145.583] GetWindow (hWnd=0x70298, uCmd=0x3) returned 0xa036a [0145.584] GetClientRect (in: hWnd=0x70298, lpRect=0x14d280 | out: lpRect=0x14d280) returned 1 [0145.584] GetWindowRect (in: hWnd=0x70298, lpRect=0x14d280 | out: lpRect=0x14d280) returned 1 [0145.584] GetParent (hWnd=0x70298) returned 0x703a0 [0145.584] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14d280, cPoints=0x2 | out: lpPoints=0x14d280) returned -1638469 [0145.584] SetWindowTextW (hWnd=0x70298, lpString="label1") returned 1 [0145.584] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0xc, wParam=0x0, lParam=0x212d35c) returned 0x1 [0145.585] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0x5, wParam=0x0, lParam=0xd0023) returned 0x0 [0145.585] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0x3, wParam=0x0, lParam=0xf70071) returned 0x0 [0145.585] GetClientRect (in: hWnd=0x70298, lpRect=0x14d3b0 | out: lpRect=0x14d3b0) returned 1 [0145.585] GetWindowRect (in: hWnd=0x70298, lpRect=0x14d3b0 | out: lpRect=0x14d3b0) returned 1 [0145.585] GetParent (hWnd=0x70298) returned 0x703a0 [0145.585] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14d3b0, cPoints=0x2 | out: lpPoints=0x14d3b0) returned -1638469 [0145.585] SendMessageW (hWnd=0x70298, Msg=0x2210, wParam=0x2980001, lParam=0x70298) returned 0x0 [0145.585] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0x2210, wParam=0x2980001, lParam=0x70298) returned 0x0 [0145.585] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0145.585] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0x46, wParam=0x0, lParam=0x14d920) returned 0x0 [0145.627] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0145.627] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0x47, wParam=0x0, lParam=0x14d920) returned 0x0 [0145.627] GetClientRect (in: hWnd=0x70298, lpRect=0x14d320 | out: lpRect=0x14d320) returned 1 [0145.627] GetWindowRect (in: hWnd=0x70298, lpRect=0x14d320 | out: lpRect=0x14d320) returned 1 [0145.628] GetParent (hWnd=0x70298) returned 0x703a0 [0145.628] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14d320, cPoints=0x2 | out: lpPoints=0x14d320) returned -1638469 [0145.628] GetParent (hWnd=0x70298) returned 0x703a0 [0145.628] GetParent (hWnd=0x70298) returned 0x703a0 [0145.628] SetParent (hWndChild=0xa0370, hWndNewParent=0x703a0) returned 0xd0024 [0145.628] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0145.632] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0x46, wParam=0x0, lParam=0x14e300) returned 0x0 [0145.635] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0145.635] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0x47, wParam=0x0, lParam=0x14e300) returned 0x0 [0145.635] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0x3, wParam=0x0, lParam=0xd000d) returned 0x0 [0145.635] GetClientRect (in: hWnd=0xa0370, lpRect=0x14d1f0 | out: lpRect=0x14d1f0) returned 1 [0145.635] GetWindowRect (in: hWnd=0xa0370, lpRect=0x14d1f0 | out: lpRect=0x14d1f0) returned 1 [0145.635] GetParent (hWnd=0xa0370) returned 0x703a0 [0145.635] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14d1f0, cPoints=0x2 | out: lpPoints=0x14d1f0) returned -1638469 [0145.635] GetClientRect (in: hWnd=0xa0370, lpRect=0x14dd00 | out: lpRect=0x14dd00) returned 1 [0145.635] GetWindowRect (in: hWnd=0xa0370, lpRect=0x14dd00 | out: lpRect=0x14dd00) returned 1 [0145.635] GetParent (hWnd=0xa0370) returned 0x703a0 [0145.635] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14dd00, cPoints=0x2 | out: lpPoints=0x14dd00) returned -1638469 [0145.635] GetParent (hWnd=0xa0370) returned 0x703a0 [0145.635] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0145.636] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0x46, wParam=0x0, lParam=0x14e300) returned 0x0 [0145.638] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0145.638] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0x47, wParam=0x0, lParam=0x14e300) returned 0x0 [0145.638] GetClientRect (in: hWnd=0xa0370, lpRect=0x14dd00 | out: lpRect=0x14dd00) returned 1 [0145.638] GetWindowRect (in: hWnd=0xa0370, lpRect=0x14dd00 | out: lpRect=0x14dd00) returned 1 [0145.638] GetParent (hWnd=0xa0370) returned 0x703a0 [0145.638] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14dd00, cPoints=0x2 | out: lpPoints=0x14dd00) returned -1638469 [0145.638] GetParent (hWnd=0xa0370) returned 0x703a0 [0145.639] GetWindow (hWnd=0xa0370, uCmd=0x3) returned 0x0 [0145.639] SetWindowPos (hWnd=0xa0370, hWndInsertAfter=0x70298, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0145.639] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0x46, wParam=0x0, lParam=0x14e250) returned 0x0 [0145.641] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0145.641] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0145.642] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0x47, wParam=0x0, lParam=0x14e250) returned 0x0 [0145.642] GetClientRect (in: hWnd=0xa0370, lpRect=0x14dc50 | out: lpRect=0x14dc50) returned 1 [0145.642] GetWindowRect (in: hWnd=0xa0370, lpRect=0x14dc50 | out: lpRect=0x14dc50) returned 1 [0145.642] GetParent (hWnd=0xa0370) returned 0x703a0 [0145.642] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14dc50, cPoints=0x2 | out: lpPoints=0x14dc50) returned -1638469 [0145.642] GetParent (hWnd=0xa0370) returned 0x703a0 [0145.642] GetWindow (hWnd=0xa0370, uCmd=0x3) returned 0x70298 [0145.642] GetFocus () returned 0x0 [0145.642] GetParent (hWnd=0xa0370) returned 0x703a0 [0145.642] GetWindowLongPtrW (hWnd=0xa0370, nIndex=-20) returned 0x0 [0145.642] DestroyWindow (hWnd=0xa0370) returned 1 [0145.642] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0145.642] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x210, wParam=0x3700002, lParam=0xa0370) returned 0x0 [0145.642] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0145.643] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0x46, wParam=0x0, lParam=0x14e080) returned 0x0 [0145.645] GetWindowPlacement (in: hWnd=0x703a0, lpwndpl=0x14dc48 | out: lpwndpl=0x14dc48) returned 1 [0145.645] GetClientRect (in: hWnd=0x703a0, lpRect=0x14db60 | out: lpRect=0x14db60) returned 1 [0145.645] GetWindowTextLengthW (hWnd=0x703a0) returned 5 [0145.645] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0145.645] GetSystemMetrics (nIndex=42) returned 0 [0145.645] GetWindowTextW (in: hWnd=0x703a0, lpString=0x14d8d0, nMaxCount=6 | out: lpString="Form1") returned 5 [0145.645] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xd, wParam=0x6, lParam=0x14d8d0) returned 0x5 [0145.646] GetClientRect (in: hWnd=0x703a0, lpRect=0x14d948 | out: lpRect=0x14d948) returned 1 [0145.646] GetCurrentObject (hdc=0xffffffff9801080a, type=0x1) returned 0x1b00017 [0145.646] GetCurrentObject (hdc=0xffffffff9801080a, type=0x2) returned 0x1900010 [0145.646] GetCurrentObject (hdc=0xffffffff9801080a, type=0x7) returned 0x5305067a [0145.646] GetCurrentObject (hdc=0xffffffff9801080a, type=0x6) returned 0x18a0048 [0145.646] SaveDC (hdc=0xffffffff9801080a) returned 1 [0145.646] GetNearestColor (hdc=0xffffffff9801080a, color=0xf0f0f0) returned 0xf0f0f0 [0145.646] CreateSolidBrush (color=0xf0f0f0) returned 0x25100999 [0145.646] FillRect (hDC=0xffffffff9801080a, lprc=0x14d638, hbr=0x25100999) returned 1 [0145.663] DeleteObject (ho=0x25100999) returned 1 [0145.663] RestoreDC (hdc=0xffffffff9801080a, nSavedDC=-1) returned 1 [0145.664] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0x47, wParam=0x0, lParam=0x14e080) returned 0x0 [0145.664] GetClientRect (in: hWnd=0xa0370, lpRect=0x14da80 | out: lpRect=0x14da80) returned 1 [0145.664] GetWindowRect (in: hWnd=0xa0370, lpRect=0x14da80 | out: lpRect=0x14da80) returned 1 [0145.664] GetParent (hWnd=0xa0370) returned 0x703a0 [0145.664] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14da80, cPoints=0x2 | out: lpPoints=0x14da80) returned -1638469 [0145.664] GetParent (hWnd=0xa0370) returned 0x703a0 [0145.665] GetWindowTextLengthW (hWnd=0xa0370) returned 6 [0145.665] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x6 [0145.665] GetSystemMetrics (nIndex=42) returned 0 [0145.665] GetWindowTextW (in: hWnd=0xa0370, lpString=0x14d8f0, nMaxCount=7 | out: lpString="label1") returned 6 [0145.665] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0xd, wParam=0x7, lParam=0x14d8f0) returned 0x6 [0145.665] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0145.665] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa0370, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0145.668] GetCurrentActCtx (in: lphActCtx=0x14e210 | out: lphActCtx=0x14e210*=0x6263a8) returned 1 [0145.668] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83ef20000 [0145.668] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0145.668] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r8_ad1", lpWindowName="label1", dwStyle=0x5600000d, X=13, Y=13, nWidth=35, nHeight=13, hWndParent=0x703a0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0xb0370 [0145.669] SetWindowLongPtrW (hWnd=0xb0370, nIndex=-4, dwNewLong=0x7ff83ef340d0) returned 0x1abd09ec [0145.669] GetWindowLongPtrW (hWnd=0xb0370, nIndex=-4) returned 0x7ff83ef340d0 [0145.669] SetWindowLongPtrW (hWnd=0xb0370, nIndex=-4, dwNewLong=0x1abd353c) returned 0x7ff83ef340d0 [0145.669] GetWindowLongPtrW (hWnd=0xb0370, nIndex=-4) returned 0x1abd353c [0145.669] GetWindowLongPtrW (hWnd=0xb0370, nIndex=-16) returned 0x4600000d [0145.669] GetWindowLongPtrW (hWnd=0xb0370, nIndex=-12) returned 0x0 [0145.669] SetWindowLongPtrW (hWnd=0xb0370, nIndex=-12, dwNewLong=0xb0370) returned 0x0 [0145.670] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xb0370, Msg=0x81, wParam=0x0, lParam=0x14d890) returned 0x1 [0145.671] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xb0370, Msg=0x83, wParam=0x0, lParam=0x14d940) returned 0x0 [0145.671] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xb0370, Msg=0x1, wParam=0x0, lParam=0x14d870) returned 0x0 [0145.671] GetWindow (hWnd=0xb0370, uCmd=0x3) returned 0x70298 [0145.671] GetClientRect (in: hWnd=0xb0370, lpRect=0x14d280 | out: lpRect=0x14d280) returned 1 [0145.672] GetWindowRect (in: hWnd=0xb0370, lpRect=0x14d280 | out: lpRect=0x14d280) returned 1 [0145.672] GetParent (hWnd=0xb0370) returned 0x703a0 [0145.672] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14d280, cPoints=0x2 | out: lpPoints=0x14d280) returned -1638469 [0145.672] SetWindowTextW (hWnd=0xb0370, lpString="label1") returned 1 [0145.672] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xb0370, Msg=0xc, wParam=0x0, lParam=0x212dcc4) returned 0x1 [0145.673] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xb0370, Msg=0x5, wParam=0x0, lParam=0xd0023) returned 0x0 [0145.673] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xb0370, Msg=0x3, wParam=0x0, lParam=0xd000d) returned 0x0 [0145.673] GetClientRect (in: hWnd=0xb0370, lpRect=0x14d3b0 | out: lpRect=0x14d3b0) returned 1 [0145.673] GetWindowRect (in: hWnd=0xb0370, lpRect=0x14d3b0 | out: lpRect=0x14d3b0) returned 1 [0145.673] GetParent (hWnd=0xb0370) returned 0x703a0 [0145.673] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14d3b0, cPoints=0x2 | out: lpPoints=0x14d3b0) returned -1638469 [0145.673] SendMessageW (hWnd=0xb0370, Msg=0x2210, wParam=0x3700001, lParam=0xb0370) returned 0x0 [0145.673] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xb0370, Msg=0x2210, wParam=0x3700001, lParam=0xb0370) returned 0x0 [0145.673] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xb0370, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0145.674] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xb0370, Msg=0x46, wParam=0x0, lParam=0x14d920) returned 0x0 [0145.729] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xb0370, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0145.729] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xb0370, Msg=0x47, wParam=0x0, lParam=0x14d920) returned 0x0 [0145.729] GetClientRect (in: hWnd=0xb0370, lpRect=0x14d320 | out: lpRect=0x14d320) returned 1 [0145.729] GetWindowRect (in: hWnd=0xb0370, lpRect=0x14d320 | out: lpRect=0x14d320) returned 1 [0145.729] GetParent (hWnd=0xb0370) returned 0x703a0 [0145.729] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14d320, cPoints=0x2 | out: lpPoints=0x14d320) returned -1638469 [0145.729] GetParent (hWnd=0xb0370) returned 0x703a0 [0145.730] GetParent (hWnd=0xb0370) returned 0x703a0 [0145.731] GetParent (hWnd=0xa005a) returned 0x703a0 [0145.731] GetParent (hWnd=0xa036a) returned 0x703a0 [0145.731] GetParent (hWnd=0x70298) returned 0x703a0 [0145.731] GetParent (hWnd=0xb0370) returned 0x703a0 [0145.731] GetWindowTextLengthW (hWnd=0x70298) returned 6 [0145.731] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x6 [0145.731] GetSystemMetrics (nIndex=42) returned 0 [0145.731] GetWindowTextW (in: hWnd=0x70298, lpString=0x14e4b0, nMaxCount=7 | out: lpString="label1") returned 6 [0145.731] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0xd, wParam=0x7, lParam=0x14e4b0) returned 0x6 [0145.731] GetWindowTextLengthW (hWnd=0x70298) returned 6 [0145.731] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x6 [0145.731] GetSystemMetrics (nIndex=42) returned 0 [0145.731] GetWindowTextW (in: hWnd=0x70298, lpString=0x14e450, nMaxCount=7 | out: lpString="label1") returned 6 [0145.731] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0xd, wParam=0x7, lParam=0x14e450) returned 0x6 [0145.732] SetWindowTextW (hWnd=0x70298, lpString="Please send 1 Bitcoin(s) to the following BTC address:") returned 1 [0145.732] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0xc, wParam=0x0, lParam=0x2128464) returned 0x1 [0145.732] GetStockObject (i=5) returned 0x1900015 [0145.733] GetDlgItem (hDlg=0x703a0, nIDDlgItem=459416) returned 0x70298 [0145.733] SendMessageW (hWnd=0x70298, Msg=0x202b, wParam=0x70298, lParam=0x14dc90) returned 0x0 [0145.733] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0x202b, wParam=0x70298, lParam=0x14dc90) returned 0x0 [0145.734] GetWindowTextLengthW (hWnd=0x70298) returned 54 [0145.734] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x36 [0145.734] GetSystemMetrics (nIndex=42) returned 0 [0145.734] GetWindowTextW (in: hWnd=0x70298, lpString=0x14e2b0, nMaxCount=55 | out: lpString="Please send 1 Bitcoin(s) to the following BTC address:") returned 54 [0145.734] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0xd, wParam=0x37, lParam=0x14e2b0) returned 0x36 [0145.735] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83ef20000 [0145.735] AdjustWindowRectEx (in: lpRect=0x14e338, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14e338) returned 1 [0145.735] SystemParametersInfoW (in: uiAction=0x100a, uiParam=0x0, pvParam=0x14e388, fWinIni=0x0 | out: pvParam=0x14e388) returned 1 [0145.736] SendMessageW (hWnd=0x703a0, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0145.736] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0145.736] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0145.736] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa005a, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0145.736] RedrawWindow (hWnd=0xa005a, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0145.736] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa036a, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0145.736] RedrawWindow (hWnd=0xa036a, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0145.736] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0145.736] RedrawWindow (hWnd=0x70298, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0145.737] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xb0370, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0145.737] RedrawWindow (hWnd=0xb0370, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0145.737] RedrawWindow (hWnd=0x703a0, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0145.737] DrawTextExW (in: hdc=0x1a010941, lpchText="Please send 1 Bitcoin(s) to the following BTC address:", cchText=54, lprc=0x14e2a8, format=0x102400, lpdtp=0x212e790 | out: lpchText="Please send 1 Bitcoin(s) to the following BTC address:", lprc=0x14e2a8) returned 13 [0145.738] SetWindowPos (hWnd=0x70298, hWndInsertAfter=0x0, X=113, Y=247, cx=261, cy=13, uFlags=0x16) returned 1 [0145.738] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0x46, wParam=0x0, lParam=0x14e2e0) returned 0x0 [0145.738] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0x83, wParam=0x1, lParam=0x14e2b0) returned 0x0 [0145.742] GetWindowPlacement (in: hWnd=0x703a0, lpwndpl=0x14dea8 | out: lpwndpl=0x14dea8) returned 1 [0145.742] GetClientRect (in: hWnd=0x703a0, lpRect=0x14ddc0 | out: lpRect=0x14ddc0) returned 1 [0145.742] GetWindowTextLengthW (hWnd=0x703a0) returned 5 [0145.743] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0145.743] GetSystemMetrics (nIndex=42) returned 0 [0145.743] GetWindowTextW (in: hWnd=0x703a0, lpString=0x14db30, nMaxCount=6 | out: lpString="Form1") returned 5 [0145.743] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xd, wParam=0x6, lParam=0x14db30) returned 0x5 [0145.743] GetClientRect (in: hWnd=0x703a0, lpRect=0x14dba8 | out: lpRect=0x14dba8) returned 1 [0145.743] GetCurrentObject (hdc=0x4010184, type=0x1) returned 0x1b00017 [0145.743] GetCurrentObject (hdc=0x4010184, type=0x2) returned 0x1900010 [0145.743] GetCurrentObject (hdc=0x4010184, type=0x7) returned 0x5305067a [0145.743] GetCurrentObject (hdc=0x4010184, type=0x6) returned 0x18a0048 [0145.743] SaveDC (hdc=0x4010184) returned 1 [0145.743] GetNearestColor (hdc=0x4010184, color=0xf0f0f0) returned 0xf0f0f0 [0145.743] CreateSolidBrush (color=0xf0f0f0) returned 0x26100999 [0145.744] FillRect (hDC=0x4010184, lprc=0x14d898, hbr=0x26100999) returned 1 [0145.762] DeleteObject (ho=0x26100999) returned 1 [0145.762] RestoreDC (hdc=0x4010184, nSavedDC=-1) returned 1 [0145.763] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa005a, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0145.763] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa036a, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0145.763] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0145.763] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xb0370, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0145.764] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0x47, wParam=0x0, lParam=0x14e2e0) returned 0x0 [0145.764] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0x5, wParam=0x0, lParam=0xd0105) returned 0x0 [0145.764] GetClientRect (in: hWnd=0x70298, lpRect=0x14dce0 | out: lpRect=0x14dce0) returned 1 [0145.764] GetWindowRect (in: hWnd=0x70298, lpRect=0x14dce0 | out: lpRect=0x14dce0) returned 1 [0145.764] GetParent (hWnd=0x70298) returned 0x703a0 [0145.764] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14dce0, cPoints=0x2 | out: lpPoints=0x14dce0) returned -1638469 [0145.764] InvalidateRect (hWnd=0x70298, lpRect=0x0, bErase=1) returned 1 [0145.764] GetWindowTextLengthW (hWnd=0x70298) returned 54 [0145.764] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x36 [0145.764] GetSystemMetrics (nIndex=42) returned 0 [0145.764] GetWindowTextW (in: hWnd=0x70298, lpString=0x14d8f0, nMaxCount=55 | out: lpString="Please send 1 Bitcoin(s) to the following BTC address:") returned 54 [0145.764] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0xd, wParam=0x37, lParam=0x14d8f0) returned 0x36 [0145.767] GetParent (hWnd=0x70298) returned 0x703a0 [0145.767] InvalidateRect (hWnd=0x70298, lpRect=0x0, bErase=1) returned 1 [0145.767] GetWindowTextLengthW (hWnd=0x703a0) returned 5 [0145.767] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0145.767] GetSystemMetrics (nIndex=42) returned 0 [0145.767] GetWindowTextW (in: hWnd=0x703a0, lpString=0x14e2a0, nMaxCount=6 | out: lpString="Form1") returned 5 [0145.767] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xd, wParam=0x6, lParam=0x14e2a0) returned 0x5 [0145.767] GetWindowTextLengthW (hWnd=0xa036a) returned 6 [0145.767] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa036a, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x6 [0145.767] GetSystemMetrics (nIndex=42) returned 0 [0145.767] GetWindowTextW (in: hWnd=0xa036a, lpString=0x14e4b0, nMaxCount=7 | out: lpString="label1") returned 6 [0145.767] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa036a, Msg=0xd, wParam=0x7, lParam=0x14e4b0) returned 0x6 [0145.768] GetWindowTextLengthW (hWnd=0xa036a) returned 6 [0145.768] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa036a, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x6 [0145.768] GetSystemMetrics (nIndex=42) returned 0 [0145.768] GetWindowTextW (in: hWnd=0xa036a, lpString=0x14e450, nMaxCount=7 | out: lpString="label1") returned 6 [0145.768] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa036a, Msg=0xd, wParam=0x7, lParam=0x14e450) returned 0x6 [0145.768] SetWindowTextW (hWnd=0xa036a, lpString="4HD74J5gd6G6f6jj49786") returned 1 [0145.768] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa036a, Msg=0xc, wParam=0x0, lParam=0x21284ec) returned 0x1 [0145.768] GetStockObject (i=5) returned 0x1900015 [0145.768] GetDlgItem (hDlg=0x703a0, nIDDlgItem=656234) returned 0xa036a [0145.768] SendMessageW (hWnd=0xa036a, Msg=0x202b, wParam=0xa036a, lParam=0x14dc90) returned 0x0 [0145.768] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa036a, Msg=0x202b, wParam=0xa036a, lParam=0x14dc90) returned 0x0 [0145.768] GetWindowTextLengthW (hWnd=0xa036a) returned 21 [0145.768] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa036a, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x15 [0145.768] GetSystemMetrics (nIndex=42) returned 0 [0145.768] GetWindowTextW (in: hWnd=0xa036a, lpString=0x14e300, nMaxCount=22 | out: lpString="4HD74J5gd6G6f6jj49786") returned 21 [0145.768] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa036a, Msg=0xd, wParam=0x16, lParam=0x14e300) returned 0x15 [0145.769] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83ef20000 [0145.769] AdjustWindowRectEx (in: lpRect=0x14e338, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14e338) returned 1 [0145.769] DrawTextExW (in: hdc=0x1a010941, lpchText="4HD74J5gd6G6f6jj49786", cchText=21, lprc=0x14e2a8, format=0x102400, lpdtp=0x212f370 | out: lpchText="4HD74J5gd6G6f6jj49786", lprc=0x14e2a8) returned 13 [0145.769] SetWindowPos (hWnd=0xa036a, hWndInsertAfter=0x0, X=563, Y=413, cx=127, cy=13, uFlags=0x16) [0145.769] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa036a, Msg=0x46, wParam=0x0, lParam=0x14e2e0) returned 0x0 [0145.770] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa036a, Msg=0x83, wParam=0x1, lParam=0x14e2b0) returned 0x0 [0145.816] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa036a, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0145.816] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa036a, Msg=0x47, wParam=0x0, lParam=0x14e2e0) returned 0x0 [0145.817] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa036a, Msg=0x5, wParam=0x0, lParam=0xd007f) returned 0x0 [0145.817] GetClientRect (in: hWnd=0xa036a, lpRect=0x14dce0 | out: lpRect=0x14dce0) returned 1 [0145.817] GetWindowRect (in: hWnd=0xa036a, lpRect=0x14dce0 | out: lpRect=0x14dce0) returned 1 [0145.817] GetParent (hWnd=0xa036a) returned 0x703a0 [0145.817] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14dce0, cPoints=0x2 | out: lpPoints=0x14dce0) returned -1638469 [0145.817] InvalidateRect (hWnd=0xa036a, lpRect=0x0, bErase=1) returned 1 [0145.817] GetWindowTextLengthW (hWnd=0xa036a) [0145.817] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa036a, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x15 [0145.817] GetSystemMetrics (nIndex=42) returned 0 [0145.817] GetWindowTextW (hWnd=0xa036a, lpString=0x14d940, nMaxCount=22) [0145.817] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa036a, Msg=0xd, wParam=0x16, lParam=0x14d940) returned 0x15 [0145.817] GetParent (hWnd=0xa036a) returned 0x703a0 [0145.818] InvalidateRect (hWnd=0xa036a, lpRect=0x0, bErase=1) returned 1 [0145.818] GetWindowTextLengthW (hWnd=0x703a0) [0145.818] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0145.818] GetSystemMetrics (nIndex=42) returned 0 [0145.818] GetWindowTextW (hWnd=0x703a0, lpString=0x14e2a0, nMaxCount=6) [0145.818] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xd, wParam=0x6, lParam=0x14e2a0) returned 0x5 [0145.818] GetWindowTextLengthW (hWnd=0xa005a) [0145.818] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa005a, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x6 [0145.818] GetSystemMetrics (nIndex=42) returned 0 [0145.818] GetWindowTextW (hWnd=0xa005a, lpString=0x14e4b0, nMaxCount=7) [0145.818] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa005a, Msg=0xd, wParam=0x7, lParam=0x14e4b0) returned 0x6 [0145.818] GetWindowTextLengthW (hWnd=0xa005a) [0145.819] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa005a, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x6 [0145.819] GetSystemMetrics (nIndex=42) returned 0 [0145.819] GetWindowTextW (hWnd=0xa005a, lpString=0x14e450, nMaxCount=7) [0145.819] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa005a, Msg=0xd, wParam=0x7, lParam=0x14e450) returned 0x6 [0145.819] SetWindowTextW (hWnd=0xa005a, lpString="Ciastko.zlukrem@gmail.com") [0145.819] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa005a, Msg=0xc, wParam=0x0, lParam=0x2128534) [0145.819] GetStockObject (i=5) returned 0x1900015 [0145.819] GetSystemMetrics (nIndex=42) returned 0 [0145.819] GetWindowTextW (hWnd=0xa005a, lpString=0x14e2f0, nMaxCount=26) [0145.820] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa005a, Msg=0xd, wParam=0x1a, lParam=0x14e2f0) returned 0x19 [0145.820] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83ef20000 [0145.820] AdjustWindowRectEx (in: lpRect=0x14e338, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14e338) returned 1 [0145.820] DrawTextExW (in: hdc=0x1a010941, lpchText="Ciastko.zlukrem@gmail.com", cchText=25, lprc=0x14e2a8, format=0x102400, lpdtp=0x212fa80 | out: lpchText="Ciastko.zlukrem@gmail.com", lprc=0x14e2a8) returned 13 [0145.820] SetWindowPos (hWnd=0xa005a, hWndInsertAfter=0x0, X=342, Y=684, cx=139, cy=13, uFlags=0x16) [0145.820] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa005a, Msg=0x46, wParam=0x0, lParam=0x14e2e0) returned 0x0 [0145.821] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa005a, Msg=0x83, wParam=0x1, lParam=0x14e2b0) returned 0x0 [0145.827] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa005a, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0145.829] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa005a, Msg=0x47, wParam=0x0, lParam=0x14e2e0) [0145.830] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa005a, Msg=0x5, wParam=0x0, lParam=0xd008b) returned 0x0 [0145.830] GetClientRect (in: hWnd=0xa005a, lpRect=0x14dce0 | out: lpRect=0x14dce0) returned 1 [0145.830] GetWindowRect (in: hWnd=0xa005a, lpRect=0x14dce0 | out: lpRect=0x14dce0) returned 1 [0145.830] GetParent (hWnd=0xa005a) returned 0x703a0 [0145.830] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14dce0, cPoints=0x2 | out: lpPoints=0x14dce0) returned -1638469 [0145.830] InvalidateRect (hWnd=0xa005a, lpRect=0x0, bErase=1) returned 1 [0145.830] GetWindowTextLengthW (hWnd=0xa005a) [0145.830] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa005a, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x19 [0145.830] GetSystemMetrics (nIndex=42) returned 0 [0145.830] GetWindowTextW (hWnd=0xa005a, lpString=0x14d930, nMaxCount=26) [0145.830] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa005a, Msg=0xd, wParam=0x1a, lParam=0x14d930) returned 0x19 [0145.830] GetParent (hWnd=0xa005a) returned 0x703a0 [0145.830] InvalidateRect (hWnd=0xa005a, lpRect=0x0, bErase=1) returned 1 [0145.830] GetWindowTextLengthW (hWnd=0x703a0) [0145.830] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0145.830] GetSystemMetrics (nIndex=42) returned 0 [0145.831] GetWindowTextW (hWnd=0x703a0, lpString=0x14e2a0, nMaxCount=6) [0145.831] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xd, wParam=0x6, lParam=0x14e2a0) returned 0x5 [0145.832] IsWindowVisible (hWnd=0x70298) returned 1 [0145.832] IsWindowEnabled (hWnd=0x70298) returned 1 [0145.832] SetFocus (hWnd=0x70298) returned 0x703a0 [0145.832] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x46, wParam=0x0, lParam=0x14e510) returned 0x0 [0145.832] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x30372, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0145.833] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0145.833] NtdllDefWindowProc_W (hWnd=0x50078, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0145.833] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0145.837] OleInitialize (pvReserved=0x0) returned 0x0 [0145.838] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x14e0c8 | out: lplpMessageFilter=0x14e0c8*=0x0) returned 0x0 [0145.840] SetFocus (hWnd=0x703a0) returned 0x0 [0145.849] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0145.852] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0145.853] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0145.854] GetParent (hWnd=0x703a0) returned 0x0 [0145.854] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0145.857] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0145.859] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x8, wParam=0x70298, lParam=0x0) returned 0x0 [0145.859] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0145.860] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0145.861] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0145.865] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0x7, wParam=0x703a0, lParam=0x0) returned 0x0 [0145.867] GetFocus () returned 0x70298 [0145.869] GetFocus () returned 0x70298 [0145.869] GetFocus () returned 0x70298 [0145.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e4f0) returned 1 [0145.913] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x105, lpBuffer=0x14dfe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x0) returned 0x1d [0145.916] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", nBufferLength=0x105, lpBuffer=0x14df80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpFilePart=0x0) returned 0x1e [0145.919] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\*", lpFindFileData=0x14e190 | out: lpFindFileData=0x14e190*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x34e8e765, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x34e8e765, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x62bc30 [0145.922] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x34e8e765, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x34e8e765, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.922] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x606cdf10, ftCreationTime.dwHighDateTime=0x1d6ff07, ftLastAccessTime.dwLowDateTime=0x80148b50, ftLastAccessTime.dwHighDateTime=0x1d70386, ftLastWriteTime.dwLowDateTime=0x80148b50, ftLastWriteTime.dwHighDateTime=0x1d70386, nFileSizeHigh=0x0, nFileSizeLow=0x1091b, dwReserved0=0x0, dwReserved1=0x0, cFileName="0jVFU_fwepsE1hnB.pptx", cAlternateFileName="0JVFU_~1.PPT")) returned 1 [0145.923] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d004a20, ftCreationTime.dwHighDateTime=0x1d70448, ftLastAccessTime.dwLowDateTime=0x55e00850, ftLastAccessTime.dwHighDateTime=0x1d70a61, ftLastWriteTime.dwLowDateTime=0x55e00850, ftLastWriteTime.dwHighDateTime=0x1d70a61, nFileSizeHigh=0x0, nFileSizeLow=0xb6e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="6an92ONxDM17h_.flv", cAlternateFileName="6AN92O~1.FLV")) returned 1 [0145.923] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x834f7290, ftCreationTime.dwHighDateTime=0x1d6fec6, ftLastAccessTime.dwLowDateTime=0x64968530, ftLastAccessTime.dwHighDateTime=0x1d703e1, ftLastWriteTime.dwLowDateTime=0x64968530, ftLastWriteTime.dwHighDateTime=0x1d703e1, nFileSizeHigh=0x0, nFileSizeLow=0xf146, dwReserved0=0x0, dwReserved1=0x0, cFileName="88GtSFKzH73_vJ.avi", cAlternateFileName="88GTSF~1.AVI")) returned 1 [0145.923] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2563b0, ftCreationTime.dwHighDateTime=0x1d6fa1d, ftLastAccessTime.dwLowDateTime=0x5eec7620, ftLastAccessTime.dwHighDateTime=0x1d70324, ftLastWriteTime.dwLowDateTime=0x5eec7620, ftLastWriteTime.dwHighDateTime=0x1d70324, nFileSizeHigh=0x0, nFileSizeLow=0x7e92, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADwpnfaKGM4F2saUkB.jpg", cAlternateFileName="ADWPNF~1.JPG")) returned 1 [0145.923] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c4379a0, ftCreationTime.dwHighDateTime=0x1d706f6, ftLastAccessTime.dwLowDateTime=0xc7bdb000, ftLastAccessTime.dwHighDateTime=0x1d707a3, ftLastWriteTime.dwLowDateTime=0xc7bdb000, ftLastWriteTime.dwHighDateTime=0x1d707a3, nFileSizeHigh=0x0, nFileSizeLow=0x1683c, dwReserved0=0x0, dwReserved1=0x0, cFileName="aL5rm1Z_3UQgZuI.wav", cAlternateFileName="AL5RM1~1.WAV")) returned 1 [0145.924] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80936540, ftCreationTime.dwHighDateTime=0x1d70a4a, ftLastAccessTime.dwLowDateTime=0x377620c0, ftLastAccessTime.dwHighDateTime=0x1d70a57, ftLastWriteTime.dwLowDateTime=0x377620c0, ftLastWriteTime.dwHighDateTime=0x1d70a57, nFileSizeHigh=0x0, nFileSizeLow=0x9ed3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AOrbZA5hkn0z42FZmF.jpg", cAlternateFileName="AORBZA~1.JPG")) returned 1 [0145.924] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf075a790, ftCreationTime.dwHighDateTime=0x1d7078b, ftLastAccessTime.dwLowDateTime=0x5e40f7b0, ftLastAccessTime.dwHighDateTime=0x1d70a26, ftLastWriteTime.dwLowDateTime=0x5e40f7b0, ftLastWriteTime.dwHighDateTime=0x1d70a26, nFileSizeHigh=0x0, nFileSizeLow=0xe141, dwReserved0=0x0, dwReserved1=0x0, cFileName="bicJkMmQ4B.ppt", cAlternateFileName="BICJKM~1.PPT")) returned 1 [0145.924] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e34280, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x6e34280, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x959c00, ftLastWriteTime.dwHighDateTime=0x1d71fb7, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="covid.exe", cAlternateFileName="")) returned 1 [0145.924] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c44cd40, ftCreationTime.dwHighDateTime=0x1d6fd67, ftLastAccessTime.dwLowDateTime=0x41d27ae0, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x41d27ae0, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cUoV", cAlternateFileName="")) returned 1 [0145.924] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9530570, ftCreationTime.dwHighDateTime=0x1d6ffce, ftLastAccessTime.dwLowDateTime=0xe0dcca80, ftLastAccessTime.dwHighDateTime=0x1d708e8, ftLastWriteTime.dwLowDateTime=0xe0dcca80, ftLastWriteTime.dwHighDateTime=0x1d708e8, nFileSizeHigh=0x0, nFileSizeLow=0xd15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cz-8WwaOpdRrYUo_v.mp3", cAlternateFileName="CZ-8WW~1.MP3")) returned 1 [0145.925] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0145.925] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb297f2c0, ftCreationTime.dwHighDateTime=0x1d70146, ftLastAccessTime.dwLowDateTime=0x1e5ecbe0, ftLastAccessTime.dwHighDateTime=0x1d703d7, ftLastWriteTime.dwLowDateTime=0x1e5ecbe0, ftLastWriteTime.dwHighDateTime=0x1d703d7, nFileSizeHigh=0x0, nFileSizeLow=0x31ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eOhqKAPph_Vg2t3.m4a", cAlternateFileName="EOHQKA~1.M4A")) returned 1 [0145.925] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45261a30, ftCreationTime.dwHighDateTime=0x1d70634, ftLastAccessTime.dwLowDateTime=0x25033190, ftLastAccessTime.dwHighDateTime=0x1d706e6, ftLastWriteTime.dwLowDateTime=0x25033190, ftLastWriteTime.dwHighDateTime=0x1d706e6, nFileSizeHigh=0x0, nFileSizeLow=0x18589, dwReserved0=0x0, dwReserved1=0x0, cFileName="EWfgql1U1.wav", cAlternateFileName="EWFGQL~1.WAV")) returned 1 [0145.926] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa9d8e50, ftCreationTime.dwHighDateTime=0x1d6fd58, ftLastAccessTime.dwLowDateTime=0x8e515340, ftLastAccessTime.dwHighDateTime=0x1d70478, ftLastWriteTime.dwLowDateTime=0x8e515340, ftLastWriteTime.dwHighDateTime=0x1d70478, nFileSizeHigh=0x0, nFileSizeLow=0x167c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FexzKGT7DShGWPVcB3On.rtf", cAlternateFileName="FEXZKG~1.RTF")) returned 1 [0145.926] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe921f150, ftCreationTime.dwHighDateTime=0x1d70638, ftLastAccessTime.dwLowDateTime=0xe075fcf0, ftLastAccessTime.dwHighDateTime=0x1d708e9, ftLastWriteTime.dwLowDateTime=0xe075fcf0, ftLastWriteTime.dwHighDateTime=0x1d708e9, nFileSizeHigh=0x0, nFileSizeLow=0x14d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="gdRiew0VB6Z.png", cAlternateFileName="GDRIEW~1.PNG")) returned 1 [0145.926] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x766612c0, ftCreationTime.dwHighDateTime=0x1d70a63, ftLastAccessTime.dwLowDateTime=0xa26785a0, ftLastAccessTime.dwHighDateTime=0x1d70a6f, ftLastWriteTime.dwLowDateTime=0xa26785a0, ftLastWriteTime.dwHighDateTime=0x1d70a6f, nFileSizeHigh=0x0, nFileSizeLow=0x12b86, dwReserved0=0x0, dwReserved1=0x0, cFileName="GVXgDptCH7a.gif", cAlternateFileName="GVXGDP~1.GIF")) returned 1 [0145.926] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9c537b0, ftCreationTime.dwHighDateTime=0x1d706c4, ftLastAccessTime.dwLowDateTime=0x9a9b9a30, ftLastAccessTime.dwHighDateTime=0x1d70800, ftLastWriteTime.dwLowDateTime=0x9a9b9a30, ftLastWriteTime.dwHighDateTime=0x1d70800, nFileSizeHigh=0x0, nFileSizeLow=0x13365, dwReserved0=0x0, dwReserved1=0x0, cFileName="I4jeg.flv", cAlternateFileName="")) returned 1 [0145.926] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99327510, ftCreationTime.dwHighDateTime=0x1d70783, ftLastAccessTime.dwLowDateTime=0xb3d1a7a0, ftLastAccessTime.dwHighDateTime=0x1d7090f, ftLastWriteTime.dwLowDateTime=0xb3d1a7a0, ftLastWriteTime.dwHighDateTime=0x1d7090f, nFileSizeHigh=0x0, nFileSizeLow=0xf3b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="kO1Kn-T4EbLeCb.flv", cAlternateFileName="KO1KN-~1.FLV")) returned 1 [0145.926] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8219e620, ftCreationTime.dwHighDateTime=0x1d70845, ftLastAccessTime.dwLowDateTime=0xd02e6960, ftLastAccessTime.dwHighDateTime=0x1d70982, ftLastWriteTime.dwLowDateTime=0xd02e6960, ftLastWriteTime.dwHighDateTime=0x1d70982, nFileSizeHigh=0x0, nFileSizeLow=0x1037f, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpy9OLMAv.wav", cAlternateFileName="MPY9OL~1.WAV")) returned 1 [0145.926] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e284ba0, ftCreationTime.dwHighDateTime=0x1d6fca9, ftLastAccessTime.dwLowDateTime=0x337adb80, ftLastAccessTime.dwHighDateTime=0x1d7098c, ftLastWriteTime.dwLowDateTime=0x337adb80, ftLastWriteTime.dwHighDateTime=0x1d7098c, nFileSizeHigh=0x0, nFileSizeLow=0x1539f, dwReserved0=0x0, dwReserved1=0x0, cFileName="NC4KxrSTM8Mm.wav", cAlternateFileName="NC4KXR~1.WAV")) returned 1 [0145.927] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb73264d0, ftCreationTime.dwHighDateTime=0x1d703eb, ftLastAccessTime.dwLowDateTime=0x67a31ef0, ftLastAccessTime.dwHighDateTime=0x1d70931, ftLastWriteTime.dwLowDateTime=0x67a31ef0, ftLastWriteTime.dwHighDateTime=0x1d70931, nFileSizeHigh=0x0, nFileSizeLow=0x9856, dwReserved0=0x0, dwReserved1=0x0, cFileName="nCcP3l.gif", cAlternateFileName="")) returned 1 [0145.927] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b15ad80, ftCreationTime.dwHighDateTime=0x1d708b5, ftLastAccessTime.dwLowDateTime=0xdbb9f540, ftLastAccessTime.dwHighDateTime=0x1d709ca, ftLastWriteTime.dwLowDateTime=0xdbb9f540, ftLastWriteTime.dwHighDateTime=0x1d709ca, nFileSizeHigh=0x0, nFileSizeLow=0x8d17, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwVw5EA2Do.pdf", cAlternateFileName="NWVW5E~1.PDF")) returned 1 [0145.927] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd131240, ftCreationTime.dwHighDateTime=0x1d707f3, ftLastAccessTime.dwLowDateTime=0x43718ff0, ftLastAccessTime.dwHighDateTime=0x1d708f3, ftLastWriteTime.dwLowDateTime=0x43718ff0, ftLastWriteTime.dwHighDateTime=0x1d708f3, nFileSizeHigh=0x0, nFileSizeLow=0x14dc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NZEDN6c.mp3", cAlternateFileName="")) returned 1 [0145.927] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93197010, ftCreationTime.dwHighDateTime=0x1d7036f, ftLastAccessTime.dwLowDateTime=0x27d84760, ftLastAccessTime.dwHighDateTime=0x1d70953, ftLastWriteTime.dwLowDateTime=0x27d84760, ftLastWriteTime.dwHighDateTime=0x1d70953, nFileSizeHigh=0x0, nFileSizeLow=0x1879a, dwReserved0=0x0, dwReserved1=0x0, cFileName="oxFbvPDwHM2.mkv", cAlternateFileName="OXFBVP~1.MKV")) returned 1 [0145.927] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaef6ff0, ftCreationTime.dwHighDateTime=0x1d6fd60, ftLastAccessTime.dwLowDateTime=0xde92dc10, ftLastAccessTime.dwHighDateTime=0x1d7046a, ftLastWriteTime.dwLowDateTime=0xde92dc10, ftLastWriteTime.dwHighDateTime=0x1d7046a, nFileSizeHigh=0x0, nFileSizeLow=0x12f94, dwReserved0=0x0, dwReserved1=0x0, cFileName="ptlD8WKzT.pdf", cAlternateFileName="PTLD8W~1.PDF")) returned 1 [0145.927] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a316d20, ftCreationTime.dwHighDateTime=0x1d70967, ftLastAccessTime.dwLowDateTime=0x61a12f50, ftLastAccessTime.dwHighDateTime=0x1d70a4a, ftLastWriteTime.dwLowDateTime=0x61a12f50, ftLastWriteTime.dwHighDateTime=0x1d70a4a, nFileSizeHigh=0x0, nFileSizeLow=0xa6b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PTT8P7VT.wav", cAlternateFileName="")) returned 1 [0145.927] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfd49fe0, ftCreationTime.dwHighDateTime=0x1d6fd69, ftLastAccessTime.dwLowDateTime=0x134e8130, ftLastAccessTime.dwHighDateTime=0x1d70073, ftLastWriteTime.dwLowDateTime=0x134e8130, ftLastWriteTime.dwHighDateTime=0x1d70073, nFileSizeHigh=0x0, nFileSizeLow=0x11aab, dwReserved0=0x0, dwReserved1=0x0, cFileName="rBVIdcd7CvMtkWGIj.png", cAlternateFileName="RBVIDC~1.PNG")) returned 1 [0145.928] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf863a60, ftCreationTime.dwHighDateTime=0x1d6ff06, ftLastAccessTime.dwLowDateTime=0xfc94a490, ftLastAccessTime.dwHighDateTime=0x1d70588, ftLastWriteTime.dwLowDateTime=0xfc94a490, ftLastWriteTime.dwHighDateTime=0x1d70588, nFileSizeHigh=0x0, nFileSizeLow=0x39a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="vXqP b4gDt9htj18.bmp", cAlternateFileName="VXQPB4~1.BMP")) returned 1 [0145.928] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd4cadae0, ftCreationTime.dwHighDateTime=0x1d6fa9a, ftLastAccessTime.dwLowDateTime=0x5b3b9e70, ftLastAccessTime.dwHighDateTime=0x1d706da, ftLastWriteTime.dwLowDateTime=0x5b3b9e70, ftLastWriteTime.dwHighDateTime=0x1d706da, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wI0eObXLkk", cAlternateFileName="WI0EOB~1")) returned 1 [0145.928] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c528e60, ftCreationTime.dwHighDateTime=0x1d6fdc7, ftLastAccessTime.dwLowDateTime=0xfe493740, ftLastAccessTime.dwHighDateTime=0x1d70468, ftLastWriteTime.dwLowDateTime=0xfe493740, ftLastWriteTime.dwHighDateTime=0x1d70468, nFileSizeHigh=0x0, nFileSizeLow=0x6f18, dwReserved0=0x0, dwReserved1=0x0, cFileName="XS9ia 5hwSitvQyX.flv", cAlternateFileName="XS9IA5~1.FLV")) returned 1 [0145.928] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b78ee30, ftCreationTime.dwHighDateTime=0x1d70508, ftLastAccessTime.dwLowDateTime=0x8e9ee1f0, ftLastAccessTime.dwHighDateTime=0x1d70734, ftLastWriteTime.dwLowDateTime=0x8e9ee1f0, ftLastWriteTime.dwHighDateTime=0x1d70734, nFileSizeHigh=0x0, nFileSizeLow=0x141bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y1aB TLD5.m4a", cAlternateFileName="Y1ABTL~1.M4A")) returned 1 [0145.929] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc655940, ftCreationTime.dwHighDateTime=0x1d6fb12, ftLastAccessTime.dwLowDateTime=0x76f995f0, ftLastAccessTime.dwHighDateTime=0x1d6fcca, ftLastWriteTime.dwLowDateTime=0x76f995f0, ftLastWriteTime.dwHighDateTime=0x1d6fcca, nFileSizeHigh=0x0, nFileSizeLow=0xbb1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YF1Jkrjbn9E36sUuv_i.jpg", cAlternateFileName="YF1JKR~1.JPG")) returned 1 [0145.929] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf43fc00, ftCreationTime.dwHighDateTime=0x1d6ffb5, ftLastAccessTime.dwLowDateTime=0xd5344be0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xd5344be0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x8455, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZQy22H7Qj_M45G9C-cy.avi", cAlternateFileName="ZQY22H~1.AVI")) returned 1 [0145.929] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb2c8b20, ftCreationTime.dwHighDateTime=0x1d706f8, ftLastAccessTime.dwLowDateTime=0x3c45bb60, ftLastAccessTime.dwHighDateTime=0x1d709c1, ftLastWriteTime.dwLowDateTime=0x3c45bb60, ftLastWriteTime.dwHighDateTime=0x1d709c1, nFileSizeHigh=0x0, nFileSizeLow=0x13f9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zzxar26EVMrPGZrHi.bmp", cAlternateFileName="ZZXAR2~1.BMP")) returned 1 [0145.929] FindNextFileW (in: hFindFile=0x62bc30, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0145.929] FindClose (in: hFindFile=0x62bc30 | out: hFindFile=0x62bc30) returned 1 [0145.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e440) returned 1 [0145.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e400) returned 1 [0145.932] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.525] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\0jVFU_fwepsE1hnB.pptx.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\0jVFU_fwepsE1hnB.pptx.ncovid", lpFilePart=0x0) returned 0x3a [0147.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0147.526] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\0jVFU_fwepsE1hnB.pptx.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\0jvfu_fwepse1hnb.pptx.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0147.529] GetFileType (hFile=0x328) returned 0x1 [0147.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0147.529] GetFileType (hFile=0x328) returned 0x1 [0147.575] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x14e400 | out: pfEnabled=0x14e400) returned 0x0 [0149.867] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\0jVFU_fwepsE1hnB.pptx", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\0jVFU_fwepsE1hnB.pptx", lpFilePart=0x0) returned 0x33 [0149.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0149.867] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\0jVFU_fwepsE1hnB.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\0jvfu_fwepse1hnb.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0149.868] GetFileType (hFile=0x354) returned 0x1 [0149.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0149.868] GetFileType (hFile=0x354) returned 0x1 [0149.872] ReadFile (in: hFile=0x354, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x1091b, lpOverlapped=0x0) returned 1 [0149.893] WriteFile (in: hFile=0x328, lpBuffer=0x222c7d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x222c7d8*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0149.895] WriteFile (in: hFile=0x328, lpBuffer=0x2233090*, nNumberOfBytesToWrite=0xf930, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x2233090*, lpNumberOfBytesWritten=0x14e3c8*=0xf930, lpOverlapped=0x0) returned 1 [0149.897] ReadFile (in: hFile=0x354, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0149.897] CloseHandle (hObject=0x354) returned 1 [0149.897] WriteFile (in: hFile=0x328, lpBuffer=0x222c7d8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x222c7d8*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0149.897] CloseHandle (hObject=0x328) returned 1 [0149.904] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\0jVFU_fwepsE1hnB.pptx", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\0jVFU_fwepsE1hnB.pptx", lpFilePart=0x0) returned 0x33 [0149.905] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\0jVFU_fwepsE1hnB.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\0jvfu_fwepse1hnb.pptx")) returned 1 [0149.912] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\6an92ONxDM17h_.flv.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\6an92ONxDM17h_.flv.ncovid", lpFilePart=0x0) returned 0x37 [0149.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0149.912] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\6an92ONxDM17h_.flv.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\6an92onxdm17h_.flv.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0149.914] GetFileType (hFile=0x328) returned 0x1 [0149.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0149.914] GetFileType (hFile=0x328) returned 0x1 [0152.047] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\6an92ONxDM17h_.flv", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\6an92ONxDM17h_.flv", lpFilePart=0x0) returned 0x30 [0152.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0152.047] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\6an92ONxDM17h_.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\6an92onxdm17h_.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0152.048] GetFileType (hFile=0x354) returned 0x1 [0152.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0152.048] GetFileType (hFile=0x354) returned 0x1 [0152.051] ReadFile (in: hFile=0x354, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0xb6e9, lpOverlapped=0x0) returned 1 [0152.070] WriteFile (in: hFile=0x328, lpBuffer=0x212cb10*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x212cb10*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0152.072] WriteFile (in: hFile=0x328, lpBuffer=0x212f1b8*, nNumberOfBytesToWrite=0xa700, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x212f1b8*, lpNumberOfBytesWritten=0x14e3c8*=0xa700, lpOverlapped=0x0) returned 1 [0152.073] ReadFile (in: hFile=0x354, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0152.074] CloseHandle (hObject=0x354) returned 1 [0152.074] WriteFile (in: hFile=0x328, lpBuffer=0x212cb10*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x212cb10*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0152.074] CloseHandle (hObject=0x328) returned 1 [0152.079] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\6an92ONxDM17h_.flv", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\6an92ONxDM17h_.flv", lpFilePart=0x0) returned 0x30 [0152.079] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\6an92ONxDM17h_.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\6an92onxdm17h_.flv")) returned 1 [0152.085] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\88GtSFKzH73_vJ.avi.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\88GtSFKzH73_vJ.avi.ncovid", lpFilePart=0x0) returned 0x37 [0152.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0152.086] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\88GtSFKzH73_vJ.avi.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\88gtsfkzh73_vj.avi.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0152.087] GetFileType (hFile=0x328) returned 0x1 [0152.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0152.087] GetFileType (hFile=0x328) returned 0x1 [0153.732] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\88GtSFKzH73_vJ.avi", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\88GtSFKzH73_vJ.avi", lpFilePart=0x0) returned 0x30 [0153.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0153.732] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\88GtSFKzH73_vJ.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\88gtsfkzh73_vj.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0153.732] GetFileType (hFile=0x354) returned 0x1 [0153.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0153.732] GetFileType (hFile=0x354) returned 0x1 [0153.735] ReadFile (in: hFile=0x354, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e3d8*=0xf146, lpOverlapped=0x0) returned 1 [0153.747] WriteFile (in: hFile=0x328, lpBuffer=0x221f800*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x221f800*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0153.748] WriteFile (in: hFile=0x328, lpBuffer=0x2221ea8*, nNumberOfBytesToWrite=0xe160, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x2221ea8*, lpNumberOfBytesWritten=0x14e3c8*=0xe160, lpOverlapped=0x0) returned 1 [0153.750] ReadFile (in: hFile=0x354, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0153.750] CloseHandle (hObject=0x354) returned 1 [0153.750] WriteFile (in: hFile=0x328, lpBuffer=0x221f800*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x221f800*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0153.750] CloseHandle (hObject=0x328) returned 1 [0153.753] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\88GtSFKzH73_vJ.avi", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\88GtSFKzH73_vJ.avi", lpFilePart=0x0) returned 0x30 [0153.754] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\88GtSFKzH73_vJ.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\88gtsfkzh73_vj.avi")) returned 1 [0153.756] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\ADwpnfaKGM4F2saUkB.jpg.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\ADwpnfaKGM4F2saUkB.jpg.ncovid", lpFilePart=0x0) returned 0x3b [0153.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0153.757] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\ADwpnfaKGM4F2saUkB.jpg.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\adwpnfakgm4f2saukb.jpg.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0153.757] GetFileType (hFile=0x328) returned 0x1 [0153.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0153.758] GetFileType (hFile=0x328) returned 0x1 [0155.118] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\ADwpnfaKGM4F2saUkB.jpg", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\ADwpnfaKGM4F2saUkB.jpg", lpFilePart=0x0) returned 0x34 [0155.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0155.118] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\ADwpnfaKGM4F2saUkB.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\adwpnfakgm4f2saukb.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0155.123] GetFileType (hFile=0x354) returned 0x1 [0155.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0155.123] GetFileType (hFile=0x354) returned 0x1 [0155.126] ReadFile (in: hFile=0x354, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x7e92, lpOverlapped=0x0) returned 1 [0155.167] WriteFile (in: hFile=0x328, lpBuffer=0x2310338*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x2310338*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0155.168] WriteFile (in: hFile=0x328, lpBuffer=0x23129f0*, nNumberOfBytesToWrite=0x6eb0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x23129f0*, lpNumberOfBytesWritten=0x14e3c8*=0x6eb0, lpOverlapped=0x0) returned 1 [0155.171] ReadFile (in: hFile=0x354, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0155.171] CloseHandle (hObject=0x354) returned 1 [0155.171] WriteFile (in: hFile=0x328, lpBuffer=0x2310338*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x2310338*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0155.172] CloseHandle (hObject=0x328) returned 1 [0155.180] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\ADwpnfaKGM4F2saUkB.jpg", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\ADwpnfaKGM4F2saUkB.jpg", lpFilePart=0x0) returned 0x34 [0155.180] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\ADwpnfaKGM4F2saUkB.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\adwpnfakgm4f2saukb.jpg")) returned 1 [0155.236] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aL5rm1Z_3UQgZuI.wav.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aL5rm1Z_3UQgZuI.wav.ncovid", lpFilePart=0x0) returned 0x38 [0155.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0155.236] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aL5rm1Z_3UQgZuI.wav.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\al5rm1z_3uqgzui.wav.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0155.240] GetFileType (hFile=0x328) returned 0x1 [0155.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0155.240] GetFileType (hFile=0x328) returned 0x1 [0156.912] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aL5rm1Z_3UQgZuI.wav", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aL5rm1Z_3UQgZuI.wav", lpFilePart=0x0) returned 0x31 [0156.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0156.912] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aL5rm1Z_3UQgZuI.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\al5rm1z_3uqgzui.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0156.913] GetFileType (hFile=0x354) returned 0x1 [0156.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0156.913] GetFileType (hFile=0x354) returned 0x1 [0156.916] ReadFile (in: hFile=0x354, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x1683c, lpOverlapped=0x0) returned 1 [0156.944] WriteFile (in: hFile=0x328, lpBuffer=0x21ffa30*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x21ffa30*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0156.945] WriteFile (in: hFile=0x328, lpBuffer=0x12322980*, nNumberOfBytesToWrite=0x15850, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x12322980*, lpNumberOfBytesWritten=0x14e3c8*=0x15850, lpOverlapped=0x0) returned 1 [0156.948] ReadFile (in: hFile=0x354, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0156.948] CloseHandle (hObject=0x354) returned 1 [0156.948] WriteFile (in: hFile=0x328, lpBuffer=0x21ffa30*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x21ffa30*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0156.948] CloseHandle (hObject=0x328) returned 1 [0156.953] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aL5rm1Z_3UQgZuI.wav", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aL5rm1Z_3UQgZuI.wav", lpFilePart=0x0) returned 0x31 [0156.953] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aL5rm1Z_3UQgZuI.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\al5rm1z_3uqgzui.wav")) returned 1 [0156.957] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\AOrbZA5hkn0z42FZmF.jpg.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\AOrbZA5hkn0z42FZmF.jpg.ncovid", lpFilePart=0x0) returned 0x3b [0156.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0156.958] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\AOrbZA5hkn0z42FZmF.jpg.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\aorbza5hkn0z42fzmf.jpg.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0156.959] GetFileType (hFile=0x328) returned 0x1 [0156.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0156.959] GetFileType (hFile=0x328) returned 0x1 [0158.407] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\AOrbZA5hkn0z42FZmF.jpg", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\AOrbZA5hkn0z42FZmF.jpg", lpFilePart=0x0) returned 0x34 [0158.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0158.407] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\AOrbZA5hkn0z42FZmF.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\aorbza5hkn0z42fzmf.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0158.408] GetFileType (hFile=0x354) returned 0x1 [0158.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0158.408] GetFileType (hFile=0x354) returned 0x1 [0158.413] ReadFile (in: hFile=0x354, lpBuffer=0x12338208, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12338208*, lpNumberOfBytesRead=0x14e3d8*=0x9ed3, lpOverlapped=0x0) returned 1 [0158.426] WriteFile (in: hFile=0x328, lpBuffer=0x22e72e0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x22e72e0*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0158.427] WriteFile (in: hFile=0x328, lpBuffer=0x22e9998*, nNumberOfBytesToWrite=0x8ef0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x22e9998*, lpNumberOfBytesWritten=0x14e3c8*=0x8ef0, lpOverlapped=0x0) returned 1 [0158.427] ReadFile (in: hFile=0x354, lpBuffer=0x12338208, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12338208*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0158.428] CloseHandle (hObject=0x354) returned 1 [0158.428] WriteFile (in: hFile=0x328, lpBuffer=0x22e72e0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x22e72e0*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0158.428] CloseHandle (hObject=0x328) returned 1 [0158.463] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\AOrbZA5hkn0z42FZmF.jpg", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\AOrbZA5hkn0z42FZmF.jpg", lpFilePart=0x0) returned 0x34 [0158.463] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\AOrbZA5hkn0z42FZmF.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\aorbza5hkn0z42fzmf.jpg")) returned 1 [0158.601] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\bicJkMmQ4B.ppt.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\bicJkMmQ4B.ppt.ncovid", lpFilePart=0x0) returned 0x33 [0158.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0158.601] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\bicJkMmQ4B.ppt.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\bicjkmmq4b.ppt.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0158.607] GetFileType (hFile=0x328) returned 0x1 [0158.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0158.607] GetFileType (hFile=0x328) returned 0x1 [0159.957] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\bicJkMmQ4B.ppt", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\bicJkMmQ4B.ppt", lpFilePart=0x0) returned 0x2c [0159.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0159.958] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\bicJkMmQ4B.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\bicjkmmq4b.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0159.958] GetFileType (hFile=0x354) returned 0x1 [0159.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0159.958] GetFileType (hFile=0x354) returned 0x1 [0159.961] ReadFile (in: hFile=0x354, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0xe141, lpOverlapped=0x0) returned 1 [0159.977] WriteFile (in: hFile=0x328, lpBuffer=0x21d2878*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x21d2878*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0159.978] WriteFile (in: hFile=0x328, lpBuffer=0x21d4f10*, nNumberOfBytesToWrite=0xd160, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x21d4f10*, lpNumberOfBytesWritten=0x14e3c8*=0xd160, lpOverlapped=0x0) returned 1 [0159.980] ReadFile (in: hFile=0x354, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0159.980] CloseHandle (hObject=0x354) returned 1 [0159.980] WriteFile (in: hFile=0x328, lpBuffer=0x21d2878*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x21d2878*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0159.981] CloseHandle (hObject=0x328) returned 1 [0159.990] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\bicJkMmQ4B.ppt", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\bicJkMmQ4B.ppt", lpFilePart=0x0) returned 0x2c [0159.990] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\bicJkMmQ4B.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\bicjkmmq4b.ppt")) returned 1 [0159.993] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\covid.exe.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\covid.exe.ncovid", lpFilePart=0x0) returned 0x2e [0159.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0159.994] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\covid.exe.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\covid.exe.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0159.995] GetFileType (hFile=0x328) returned 0x1 [0159.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0159.995] GetFileType (hFile=0x328) returned 0x1 [0161.431] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\covid.exe", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\covid.exe", lpFilePart=0x0) returned 0x27 [0161.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0161.431] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\covid.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\covid.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0161.524] EtwEventRegister (in: ProviderId=0x22cc5b8, EnableCallback=0x1abd32bc, CallbackContext=0x0, RegHandle=0x22cc598 | out: RegHandle=0x22cc598) returned 0x0 [0161.526] EtwEventSetInformation (RegHandle=0x480000006377b0, InformationClass=0x2, EventInformation=0x22cc540, InformationLength=0x33) returned 0x0 [0161.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14a5f0) returned 1 [0161.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e4f0) returned 1 [0161.634] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures", nBufferLength=0x105, lpBuffer=0x14dfe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures", lpFilePart=0x0) returned 0x1e [0161.634] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\", nBufferLength=0x105, lpBuffer=0x14df80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\", lpFilePart=0x0) returned 0x1f [0161.634] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\*", lpFindFileData=0x14e190 | out: lpFindFileData=0x14e190*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5528aa70, ftLastAccessTime.dwHighDateTime=0x1d70a81, ftLastWriteTime.dwLowDateTime=0x5528aa70, ftLastWriteTime.dwHighDateTime=0x1d70a81, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x62bbd0 [0161.685] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5528aa70, ftLastAccessTime.dwHighDateTime=0x1d70a81, ftLastWriteTime.dwLowDateTime=0x5528aa70, ftLastWriteTime.dwHighDateTime=0x1d70a81, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0161.685] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d9d260, ftCreationTime.dwHighDateTime=0x1d70356, ftLastAccessTime.dwLowDateTime=0xf1bbdce0, ftLastAccessTime.dwHighDateTime=0x1d70930, ftLastWriteTime.dwLowDateTime=0xf1bbdce0, ftLastWriteTime.dwHighDateTime=0x1d70930, nFileSizeHigh=0x0, nFileSizeLow=0x4789, dwReserved0=0x0, dwReserved1=0x0, cFileName="-TZ5rzCIOrbdbR.png", cAlternateFileName="-TZ5RZ~1.PNG")) returned 1 [0161.685] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfc5bcd0, ftCreationTime.dwHighDateTime=0x1d70364, ftLastAccessTime.dwLowDateTime=0x3f401f10, ftLastAccessTime.dwHighDateTime=0x1d703c0, ftLastWriteTime.dwLowDateTime=0x3f401f10, ftLastWriteTime.dwHighDateTime=0x1d703c0, nFileSizeHigh=0x0, nFileSizeLow=0x2dad, dwReserved0=0x0, dwReserved1=0x0, cFileName="35-jfpA-mtUPvs5gV4mr.jpg", cAlternateFileName="35-JFP~1.JPG")) returned 1 [0161.685] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f4a1410, ftCreationTime.dwHighDateTime=0x1d709e2, ftLastAccessTime.dwLowDateTime=0x6140d290, ftLastAccessTime.dwHighDateTime=0x1d70a18, ftLastWriteTime.dwLowDateTime=0x6140d290, ftLastWriteTime.dwHighDateTime=0x1d70a18, nFileSizeHigh=0x0, nFileSizeLow=0x82e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="4qcvOht-riX9J3ZGd2AN.jpg", cAlternateFileName="4QCVOH~1.JPG")) returned 1 [0161.686] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f9ab130, ftCreationTime.dwHighDateTime=0x1d7020a, ftLastAccessTime.dwLowDateTime=0xf0da7590, ftLastAccessTime.dwHighDateTime=0x1d70717, ftLastWriteTime.dwLowDateTime=0xf0da7590, ftLastWriteTime.dwHighDateTime=0x1d70717, nFileSizeHigh=0x0, nFileSizeLow=0x167a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="5eGY_O6oAQYCeYF.bmp", cAlternateFileName="5EGY_O~1.BMP")) returned 1 [0161.686] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf0ac80, ftCreationTime.dwHighDateTime=0x1d6fc25, ftLastAccessTime.dwLowDateTime=0x5587a890, ftLastAccessTime.dwHighDateTime=0x1d707c3, ftLastWriteTime.dwLowDateTime=0x5587a890, ftLastWriteTime.dwHighDateTime=0x1d707c3, nFileSizeHigh=0x0, nFileSizeLow=0x381d, dwReserved0=0x0, dwReserved1=0x0, cFileName="7IGp2H4UWA.png", cAlternateFileName="7IGP2H~1.PNG")) returned 1 [0161.686] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x889b3620, ftCreationTime.dwHighDateTime=0x1d70543, ftLastAccessTime.dwLowDateTime=0x3aef3560, ftLastAccessTime.dwHighDateTime=0x1d7058a, ftLastWriteTime.dwLowDateTime=0x3aef3560, ftLastWriteTime.dwHighDateTime=0x1d7058a, nFileSizeHigh=0x0, nFileSizeLow=0x61c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="8_L0.jpg", cAlternateFileName="")) returned 1 [0161.686] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48462510, ftCreationTime.dwHighDateTime=0x1d6fc53, ftLastAccessTime.dwLowDateTime=0x2af0e3e0, ftLastAccessTime.dwHighDateTime=0x1d70533, ftLastWriteTime.dwLowDateTime=0x2af0e3e0, ftLastWriteTime.dwHighDateTime=0x1d70533, nFileSizeHigh=0x0, nFileSizeLow=0xd447, dwReserved0=0x0, dwReserved1=0x0, cFileName="aEzzAV.png", cAlternateFileName="")) returned 1 [0161.686] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b0e752d, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0161.686] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee5fd790, ftCreationTime.dwHighDateTime=0x1d70304, ftLastAccessTime.dwLowDateTime=0x9a9be3f0, ftLastAccessTime.dwHighDateTime=0x1d70a53, ftLastWriteTime.dwLowDateTime=0x9a9be3f0, ftLastWriteTime.dwHighDateTime=0x1d70a53, nFileSizeHigh=0x0, nFileSizeLow=0x1261f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CfMroH.bmp", cAlternateFileName="")) returned 1 [0161.687] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0161.687] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86645610, ftCreationTime.dwHighDateTime=0x1d7064d, ftLastAccessTime.dwLowDateTime=0x6a1d0a50, ftLastAccessTime.dwHighDateTime=0x1d7090a, ftLastWriteTime.dwLowDateTime=0x6a1d0a50, ftLastWriteTime.dwHighDateTime=0x1d7090a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gQVD1CNgqQdWgWk", cAlternateFileName="GQVD1C~1")) returned 1 [0161.687] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1102bc0, ftCreationTime.dwHighDateTime=0x1d6fb2f, ftLastAccessTime.dwLowDateTime=0xd76ad1e0, ftLastAccessTime.dwHighDateTime=0x1d702e4, ftLastWriteTime.dwLowDateTime=0xd76ad1e0, ftLastWriteTime.dwHighDateTime=0x1d702e4, nFileSizeHigh=0x0, nFileSizeLow=0xc649, dwReserved0=0x0, dwReserved1=0x0, cFileName="I7J71mzGsYDYCBoUz.gif", cAlternateFileName="I7J71M~1.GIF")) returned 1 [0161.687] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3aed990, ftCreationTime.dwHighDateTime=0x1d704cc, ftLastAccessTime.dwLowDateTime=0x1fe9d3c0, ftLastAccessTime.dwHighDateTime=0x1d7082c, ftLastWriteTime.dwLowDateTime=0x1fe9d3c0, ftLastWriteTime.dwHighDateTime=0x1d7082c, nFileSizeHigh=0x0, nFileSizeLow=0xbc49, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ieiqp5qQg.gif", cAlternateFileName="IEIQP5~1.GIF")) returned 1 [0161.687] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd12860, ftCreationTime.dwHighDateTime=0x1d70a5a, ftLastAccessTime.dwLowDateTime=0x70205650, ftLastAccessTime.dwHighDateTime=0x1d70a5e, ftLastWriteTime.dwLowDateTime=0x70205650, ftLastWriteTime.dwHighDateTime=0x1d70a5e, nFileSizeHigh=0x0, nFileSizeLow=0xf775, dwReserved0=0x0, dwReserved1=0x0, cFileName="iotg5jb-wcu3hO-.gif", cAlternateFileName="IOTG5J~1.GIF")) returned 1 [0161.688] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87ebd2d0, ftCreationTime.dwHighDateTime=0x1d709a2, ftLastAccessTime.dwLowDateTime=0x4644c160, ftLastAccessTime.dwHighDateTime=0x1d709e9, ftLastWriteTime.dwLowDateTime=0x4644c160, ftLastWriteTime.dwHighDateTime=0x1d709e9, nFileSizeHigh=0x0, nFileSizeLow=0x5611, dwReserved0=0x0, dwReserved1=0x0, cFileName="iTLuTdWLR4vAu.png", cAlternateFileName="ITLUTD~1.PNG")) returned 1 [0161.688] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x787fbd50, ftCreationTime.dwHighDateTime=0x1d704b8, ftLastAccessTime.dwLowDateTime=0x74ea2130, ftLastAccessTime.dwHighDateTime=0x1d7099f, ftLastWriteTime.dwLowDateTime=0x74ea2130, ftLastWriteTime.dwHighDateTime=0x1d7099f, nFileSizeHigh=0x0, nFileSizeLow=0x4a70, dwReserved0=0x0, dwReserved1=0x0, cFileName="Izk7bTMXw-1.png", cAlternateFileName="IZK7BT~1.PNG")) returned 1 [0161.688] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3f2a1c0, ftCreationTime.dwHighDateTime=0x1d7013b, ftLastAccessTime.dwLowDateTime=0xcda24310, ftLastAccessTime.dwHighDateTime=0x1d7045a, ftLastWriteTime.dwLowDateTime=0xcda24310, ftLastWriteTime.dwHighDateTime=0x1d7045a, nFileSizeHigh=0x0, nFileSizeLow=0x60a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ljeI.gif", cAlternateFileName="")) returned 1 [0161.688] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36096550, ftCreationTime.dwHighDateTime=0x1d6fa88, ftLastAccessTime.dwLowDateTime=0x5c3841c0, ftLastAccessTime.dwHighDateTime=0x1d709aa, ftLastWriteTime.dwLowDateTime=0x5c3841c0, ftLastWriteTime.dwHighDateTime=0x1d709aa, nFileSizeHigh=0x0, nFileSizeLow=0xe382, dwReserved0=0x0, dwReserved1=0x0, cFileName="ljhkhNwA93064H5W.gif", cAlternateFileName="LJHKHN~1.GIF")) returned 1 [0161.688] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8641f10, ftCreationTime.dwHighDateTime=0x1d6fdd9, ftLastAccessTime.dwLowDateTime=0xddc5bfc0, ftLastAccessTime.dwHighDateTime=0x1d70896, ftLastWriteTime.dwLowDateTime=0xddc5bfc0, ftLastWriteTime.dwHighDateTime=0x1d70896, nFileSizeHigh=0x0, nFileSizeLow=0xf496, dwReserved0=0x0, dwReserved1=0x0, cFileName="N0pnuWNn.jpg", cAlternateFileName="")) returned 1 [0161.688] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6190080, ftCreationTime.dwHighDateTime=0x1d705aa, ftLastAccessTime.dwLowDateTime=0xa91c25f0, ftLastAccessTime.dwHighDateTime=0x1d70802, ftLastWriteTime.dwLowDateTime=0xa91c25f0, ftLastWriteTime.dwHighDateTime=0x1d70802, nFileSizeHigh=0x0, nFileSizeLow=0x3ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rne6z7RphV.jpg", cAlternateFileName="RNE6Z7~1.JPG")) returned 1 [0161.689] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0161.689] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7bb9de0, ftCreationTime.dwHighDateTime=0x1d709aa, ftLastAccessTime.dwLowDateTime=0x9fc70610, ftLastAccessTime.dwHighDateTime=0x1d709ff, ftLastWriteTime.dwLowDateTime=0x9fc70610, ftLastWriteTime.dwHighDateTime=0x1d709ff, nFileSizeHigh=0x0, nFileSizeLow=0x1612f, dwReserved0=0x0, dwReserved1=0x0, cFileName="soB3UY84J.bmp", cAlternateFileName="SOB3UY~1.BMP")) returned 1 [0161.689] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aac7560, ftCreationTime.dwHighDateTime=0x1d700f5, ftLastAccessTime.dwLowDateTime=0xe1aefcb0, ftLastAccessTime.dwHighDateTime=0x1d708ea, ftLastWriteTime.dwLowDateTime=0xe1aefcb0, ftLastWriteTime.dwHighDateTime=0x1d708ea, nFileSizeHigh=0x0, nFileSizeLow=0x126cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="V1CR3ZY6XRVc7QPNQ2G3.jpg", cAlternateFileName="V1CR3Z~1.JPG")) returned 1 [0161.689] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85589c0, ftCreationTime.dwHighDateTime=0x1d6fdbe, ftLastAccessTime.dwLowDateTime=0x2f3b8ac0, ftLastAccessTime.dwHighDateTime=0x1d70684, ftLastWriteTime.dwLowDateTime=0x2f3b8ac0, ftLastWriteTime.dwHighDateTime=0x1d70684, nFileSizeHigh=0x0, nFileSizeLow=0x6c99, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTv_2d9vuAAmrz9WS353.gif", cAlternateFileName="WTV_2D~1.GIF")) returned 1 [0161.689] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8c0b020, ftCreationTime.dwHighDateTime=0x1d703f0, ftLastAccessTime.dwLowDateTime=0x70b1f550, ftLastAccessTime.dwHighDateTime=0x1d707a8, ftLastWriteTime.dwLowDateTime=0x70b1f550, ftLastWriteTime.dwHighDateTime=0x1d707a8, nFileSizeHigh=0x0, nFileSizeLow=0x1823a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y412g.jpg", cAlternateFileName="")) returned 1 [0161.689] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc910800, ftCreationTime.dwHighDateTime=0x1d6fdf5, ftLastAccessTime.dwLowDateTime=0x995f8fb0, ftLastAccessTime.dwHighDateTime=0x1d701c9, ftLastWriteTime.dwLowDateTime=0x995f8fb0, ftLastWriteTime.dwHighDateTime=0x1d701c9, nFileSizeHigh=0x0, nFileSizeLow=0xdec1, dwReserved0=0x0, dwReserved1=0x0, cFileName="yQmXMOnbtf7h7HFf_BA.bmp", cAlternateFileName="YQMXMO~1.BMP")) returned 1 [0161.690] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0161.690] FindClose (in: hFindFile=0x62bbd0 | out: hFindFile=0x62bbd0) returned 1 [0161.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e440) returned 1 [0161.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e400) returned 1 [0161.692] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\-TZ5rzCIOrbdbR.png.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\-TZ5rzCIOrbdbR.png.ncovid", lpFilePart=0x0) returned 0x38 [0161.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0161.692] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\-TZ5rzCIOrbdbR.png.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\-tz5rzciorbdbr.png.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0161.693] GetFileType (hFile=0x350) returned 0x1 [0161.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0161.694] GetFileType (hFile=0x350) returned 0x1 [0163.007] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\-TZ5rzCIOrbdbR.png", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\-TZ5rzCIOrbdbR.png", lpFilePart=0x0) returned 0x31 [0163.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0163.007] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\-TZ5rzCIOrbdbR.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\-tz5rzciorbdbr.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x358 [0163.008] GetFileType (hFile=0x358) returned 0x1 [0163.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0163.008] GetFileType (hFile=0x358) returned 0x1 [0163.011] ReadFile (in: hFile=0x358, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x4789, lpOverlapped=0x0) returned 1 [0163.027] WriteFile (in: hFile=0x350, lpBuffer=0x21bc110*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x21bc110*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0163.028] WriteFile (in: hFile=0x350, lpBuffer=0x21be7b8*, nNumberOfBytesToWrite=0x37a0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x21be7b8*, lpNumberOfBytesWritten=0x14e3c8*=0x37a0, lpOverlapped=0x0) returned 1 [0163.029] ReadFile (in: hFile=0x358, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0163.029] CloseHandle (hObject=0x358) returned 1 [0163.029] WriteFile (in: hFile=0x350, lpBuffer=0x21bc110*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x21bc110*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0163.029] CloseHandle (hObject=0x350) returned 1 [0163.036] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\-TZ5rzCIOrbdbR.png", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\-TZ5rzCIOrbdbR.png", lpFilePart=0x0) returned 0x31 [0163.036] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\-TZ5rzCIOrbdbR.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\-tz5rzciorbdbr.png")) returned 1 [0163.041] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\35-jfpA-mtUPvs5gV4mr.jpg.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\35-jfpA-mtUPvs5gV4mr.jpg.ncovid", lpFilePart=0x0) returned 0x3e [0163.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0163.041] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\35-jfpA-mtUPvs5gV4mr.jpg.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\35-jfpa-mtupvs5gv4mr.jpg.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0163.041] GetFileType (hFile=0x350) returned 0x1 [0163.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0163.042] GetFileType (hFile=0x350) returned 0x1 [0164.398] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\35-jfpA-mtUPvs5gV4mr.jpg", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\35-jfpA-mtUPvs5gV4mr.jpg", lpFilePart=0x0) returned 0x37 [0164.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0164.398] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\35-jfpA-mtUPvs5gV4mr.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\35-jfpa-mtupvs5gv4mr.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x358 [0164.400] GetFileType (hFile=0x358) returned 0x1 [0164.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0164.400] GetFileType (hFile=0x358) returned 0x1 [0164.404] ReadFile (in: hFile=0x358, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e3d8*=0x2dad, lpOverlapped=0x0) returned 1 [0164.421] WriteFile (in: hFile=0x350, lpBuffer=0x22a83a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x22a83a8*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0164.424] WriteFile (in: hFile=0x350, lpBuffer=0x22aaa68*, nNumberOfBytesToWrite=0x1dc0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x22aaa68*, lpNumberOfBytesWritten=0x14e3c8*=0x1dc0, lpOverlapped=0x0) returned 1 [0164.425] ReadFile (in: hFile=0x358, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0164.425] CloseHandle (hObject=0x358) returned 1 [0164.426] WriteFile (in: hFile=0x350, lpBuffer=0x22a83a8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x22a83a8*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0164.426] CloseHandle (hObject=0x350) returned 1 [0164.448] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\35-jfpA-mtUPvs5gV4mr.jpg", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\35-jfpA-mtUPvs5gV4mr.jpg", lpFilePart=0x0) returned 0x37 [0164.449] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\35-jfpA-mtUPvs5gV4mr.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\35-jfpa-mtupvs5gv4mr.jpg")) returned 1 [0164.453] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\4qcvOht-riX9J3ZGd2AN.jpg.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\4qcvOht-riX9J3ZGd2AN.jpg.ncovid", lpFilePart=0x0) returned 0x3e [0164.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0164.453] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\4qcvOht-riX9J3ZGd2AN.jpg.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\4qcvoht-rix9j3zgd2an.jpg.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0164.454] GetFileType (hFile=0x350) returned 0x1 [0164.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0164.454] GetFileType (hFile=0x350) returned 0x1 [0166.202] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\4qcvOht-riX9J3ZGd2AN.jpg", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\4qcvOht-riX9J3ZGd2AN.jpg", lpFilePart=0x0) returned 0x37 [0166.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0166.202] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\4qcvOht-riX9J3ZGd2AN.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\4qcvoht-rix9j3zgd2an.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0166.203] GetFileType (hFile=0x328) returned 0x1 [0166.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0166.203] GetFileType (hFile=0x328) returned 0x1 [0166.206] ReadFile (in: hFile=0x328, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x82e2, lpOverlapped=0x0) returned 1 [0166.221] WriteFile (in: hFile=0x350, lpBuffer=0x218a650*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x218a650*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0166.223] WriteFile (in: hFile=0x350, lpBuffer=0x218cd10*, nNumberOfBytesToWrite=0x7300, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x218cd10*, lpNumberOfBytesWritten=0x14e3c8*=0x7300, lpOverlapped=0x0) returned 1 [0166.224] ReadFile (in: hFile=0x328, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0166.224] CloseHandle (hObject=0x328) returned 1 [0166.224] WriteFile (in: hFile=0x350, lpBuffer=0x218a650*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x218a650*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0166.225] CloseHandle (hObject=0x350) returned 1 [0166.227] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\4qcvOht-riX9J3ZGd2AN.jpg", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\4qcvOht-riX9J3ZGd2AN.jpg", lpFilePart=0x0) returned 0x37 [0166.227] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\4qcvOht-riX9J3ZGd2AN.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\4qcvoht-rix9j3zgd2an.jpg")) returned 1 [0166.232] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\5eGY_O6oAQYCeYF.bmp.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\5eGY_O6oAQYCeYF.bmp.ncovid", lpFilePart=0x0) returned 0x39 [0166.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0166.232] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\5eGY_O6oAQYCeYF.bmp.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\5egy_o6oaqyceyf.bmp.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0166.233] GetFileType (hFile=0x350) returned 0x1 [0166.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0166.233] GetFileType (hFile=0x350) returned 0x1 [0167.329] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\5eGY_O6oAQYCeYF.bmp", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\5eGY_O6oAQYCeYF.bmp", lpFilePart=0x0) returned 0x32 [0167.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0167.329] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\5eGY_O6oAQYCeYF.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\5egy_o6oaqyceyf.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0167.330] GetFileType (hFile=0x328) returned 0x1 [0167.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0167.330] GetFileType (hFile=0x328) returned 0x1 [0167.333] ReadFile (in: hFile=0x328, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x167a4, lpOverlapped=0x0) returned 1 [0167.355] WriteFile (in: hFile=0x350, lpBuffer=0x227a608*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x227a608*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0167.358] WriteFile (in: hFile=0x350, lpBuffer=0x12322980*, nNumberOfBytesToWrite=0x157c0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x12322980*, lpNumberOfBytesWritten=0x14e3c8*=0x157c0, lpOverlapped=0x0) returned 1 [0167.360] ReadFile (in: hFile=0x328, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0167.360] CloseHandle (hObject=0x328) returned 1 [0167.360] WriteFile (in: hFile=0x350, lpBuffer=0x227a608*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x227a608*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0167.361] CloseHandle (hObject=0x350) returned 1 [0167.365] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\5eGY_O6oAQYCeYF.bmp", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\5eGY_O6oAQYCeYF.bmp", lpFilePart=0x0) returned 0x32 [0167.366] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\5eGY_O6oAQYCeYF.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\5egy_o6oaqyceyf.bmp")) returned 1 [0167.368] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\7IGp2H4UWA.png.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\7IGp2H4UWA.png.ncovid", lpFilePart=0x0) returned 0x34 [0167.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0167.369] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\7IGp2H4UWA.png.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\7igp2h4uwa.png.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0167.370] GetFileType (hFile=0x350) returned 0x1 [0167.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0167.370] GetFileType (hFile=0x350) returned 0x1 [0168.415] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\7IGp2H4UWA.png", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\7IGp2H4UWA.png", lpFilePart=0x0) returned 0x2d [0168.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0168.415] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\7IGp2H4UWA.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\7igp2h4uwa.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0168.417] GetFileType (hFile=0x328) returned 0x1 [0168.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0168.417] GetFileType (hFile=0x328) returned 0x1 [0168.420] ReadFile (in: hFile=0x328, lpBuffer=0x12338178, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12338178*, lpNumberOfBytesRead=0x14e3d8*=0x381d, lpOverlapped=0x0) returned 1 [0168.437] WriteFile (in: hFile=0x350, lpBuffer=0x2162420*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x2162420*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0168.440] WriteFile (in: hFile=0x350, lpBuffer=0x2164ab8*, nNumberOfBytesToWrite=0x2830, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x2164ab8*, lpNumberOfBytesWritten=0x14e3c8*=0x2830, lpOverlapped=0x0) returned 1 [0168.440] ReadFile (in: hFile=0x328, lpBuffer=0x12338178, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12338178*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0168.440] CloseHandle (hObject=0x328) returned 1 [0168.440] WriteFile (in: hFile=0x350, lpBuffer=0x2162420*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x2162420*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0168.440] CloseHandle (hObject=0x350) returned 1 [0168.444] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\7IGp2H4UWA.png", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\7IGp2H4UWA.png", lpFilePart=0x0) returned 0x2d [0168.444] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\7IGp2H4UWA.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\7igp2h4uwa.png")) returned 1 [0168.449] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8_L0.jpg.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8_L0.jpg.ncovid", lpFilePart=0x0) returned 0x2e [0168.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0168.449] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8_L0.jpg.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\8_l0.jpg.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0168.450] GetFileType (hFile=0x350) returned 0x1 [0168.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0168.450] GetFileType (hFile=0x350) returned 0x1 [0169.802] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8_L0.jpg", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8_L0.jpg", lpFilePart=0x0) returned 0x27 [0169.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0169.802] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8_L0.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\8_l0.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0169.804] GetFileType (hFile=0x328) returned 0x1 [0169.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0169.805] GetFileType (hFile=0x328) returned 0x1 [0169.808] ReadFile (in: hFile=0x328, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x61c3, lpOverlapped=0x0) returned 1 [0169.823] WriteFile (in: hFile=0x350, lpBuffer=0x2245cb8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x2245cb8*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0169.825] WriteFile (in: hFile=0x350, lpBuffer=0x2248338*, nNumberOfBytesToWrite=0x51e0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x2248338*, lpNumberOfBytesWritten=0x14e3c8*=0x51e0, lpOverlapped=0x0) returned 1 [0169.826] ReadFile (in: hFile=0x328, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0169.826] CloseHandle (hObject=0x328) returned 1 [0169.826] WriteFile (in: hFile=0x350, lpBuffer=0x2245cb8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x2245cb8*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0169.827] CloseHandle (hObject=0x350) returned 1 [0169.829] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8_L0.jpg", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8_L0.jpg", lpFilePart=0x0) returned 0x27 [0169.829] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8_L0.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\8_l0.jpg")) returned 1 [0169.834] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\aEzzAV.png.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\aEzzAV.png.ncovid", lpFilePart=0x0) returned 0x30 [0169.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0169.834] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\aEzzAV.png.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\aezzav.png.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0169.836] GetFileType (hFile=0x350) returned 0x1 [0169.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0169.836] GetFileType (hFile=0x350) returned 0x1 [0171.053] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\aEzzAV.png", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\aEzzAV.png", lpFilePart=0x0) returned 0x29 [0171.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0171.053] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\aEzzAV.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\aezzav.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0171.055] GetFileType (hFile=0x328) returned 0x1 [0171.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0171.055] GetFileType (hFile=0x328) returned 0x1 [0171.058] ReadFile (in: hFile=0x328, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0xd447, lpOverlapped=0x0) returned 1 [0171.075] WriteFile (in: hFile=0x350, lpBuffer=0x2133d88*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x2133d88*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0171.079] WriteFile (in: hFile=0x350, lpBuffer=0x2136410*, nNumberOfBytesToWrite=0xc460, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x2136410*, lpNumberOfBytesWritten=0x14e3c8*=0xc460, lpOverlapped=0x0) returned 1 [0171.081] ReadFile (in: hFile=0x328, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0171.081] CloseHandle (hObject=0x328) returned 1 [0171.081] WriteFile (in: hFile=0x350, lpBuffer=0x2133d88*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x2133d88*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0171.082] CloseHandle (hObject=0x350) returned 1 [0171.086] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\aEzzAV.png", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\aEzzAV.png", lpFilePart=0x0) returned 0x29 [0171.086] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\aEzzAV.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\aezzav.png")) returned 1 [0171.098] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CfMroH.bmp.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CfMroH.bmp.ncovid", lpFilePart=0x0) returned 0x30 [0171.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0171.098] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CfMroH.bmp.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cfmroh.bmp.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0171.099] GetFileType (hFile=0x350) returned 0x1 [0171.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0171.099] GetFileType (hFile=0x350) returned 0x1 [0172.186] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CfMroH.bmp", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CfMroH.bmp", lpFilePart=0x0) returned 0x29 [0172.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0172.187] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CfMroH.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cfmroh.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0172.188] GetFileType (hFile=0x328) returned 0x1 [0172.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0172.188] GetFileType (hFile=0x328) returned 0x1 [0172.191] ReadFile (in: hFile=0x328, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e3d8*=0x1261f, lpOverlapped=0x0) returned 1 [0172.207] WriteFile (in: hFile=0x350, lpBuffer=0x2229098*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x2229098*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0172.209] WriteFile (in: hFile=0x350, lpBuffer=0x222b720*, nNumberOfBytesToWrite=0x11630, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x222b720*, lpNumberOfBytesWritten=0x14e3c8*=0x11630, lpOverlapped=0x0) returned 1 [0172.210] ReadFile (in: hFile=0x328, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0172.210] CloseHandle (hObject=0x328) returned 1 [0172.210] WriteFile (in: hFile=0x350, lpBuffer=0x2229098*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x2229098*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0172.211] CloseHandle (hObject=0x350) returned 1 [0172.216] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CfMroH.bmp", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CfMroH.bmp", lpFilePart=0x0) returned 0x29 [0172.216] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CfMroH.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cfmroh.bmp")) returned 1 [0172.221] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\desktop.ini.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\desktop.ini.ncovid", lpFilePart=0x0) returned 0x31 [0172.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0172.221] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\desktop.ini.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\desktop.ini.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0172.225] GetFileType (hFile=0x350) returned 0x1 [0172.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0172.225] GetFileType (hFile=0x350) returned 0x1 [0173.293] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\desktop.ini", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\desktop.ini", lpFilePart=0x0) returned 0x2a [0173.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0173.293] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\desktop.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0173.294] GetFileType (hFile=0x328) returned 0x1 [0173.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0173.294] GetFileType (hFile=0x328) returned 0x1 [0173.297] ReadFile (in: hFile=0x328, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x1f8, lpOverlapped=0x0) returned 1 [0173.310] ReadFile (in: hFile=0x328, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0173.310] CloseHandle (hObject=0x328) returned 1 [0173.310] WriteFile (in: hFile=0x350, lpBuffer=0x231c8c0*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x231c8c0*, lpNumberOfBytesWritten=0x14e2b8*=0x220, lpOverlapped=0x0) returned 1 [0173.312] CloseHandle (hObject=0x350) returned 1 [0173.313] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\desktop.ini", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\desktop.ini", lpFilePart=0x0) returned 0x2a [0173.313] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\desktop.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\desktop.ini")) returned 1 [0173.316] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I7J71mzGsYDYCBoUz.gif.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I7J71mzGsYDYCBoUz.gif.ncovid", lpFilePart=0x0) returned 0x3b [0173.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0173.316] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I7J71mzGsYDYCBoUz.gif.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\i7j71mzgsydycbouz.gif.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0173.317] GetFileType (hFile=0x350) returned 0x1 [0173.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0173.317] GetFileType (hFile=0x350) returned 0x1 [0174.467] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I7J71mzGsYDYCBoUz.gif", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I7J71mzGsYDYCBoUz.gif", lpFilePart=0x0) returned 0x34 [0174.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0174.467] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I7J71mzGsYDYCBoUz.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\i7j71mzgsydycbouz.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0174.468] GetFileType (hFile=0x328) returned 0x1 [0174.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0174.468] GetFileType (hFile=0x328) returned 0x1 [0174.471] ReadFile (in: hFile=0x328, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0xc649, lpOverlapped=0x0) returned 1 [0174.486] WriteFile (in: hFile=0x350, lpBuffer=0x2204c58*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x2204c58*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0174.488] WriteFile (in: hFile=0x350, lpBuffer=0x2207310*, nNumberOfBytesToWrite=0xb660, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x2207310*, lpNumberOfBytesWritten=0x14e3c8*=0xb660, lpOverlapped=0x0) returned 1 [0174.489] ReadFile (in: hFile=0x328, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0174.489] CloseHandle (hObject=0x328) returned 1 [0174.490] WriteFile (in: hFile=0x350, lpBuffer=0x2204c58*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x2204c58*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0174.490] CloseHandle (hObject=0x350) returned 1 [0174.499] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I7J71mzGsYDYCBoUz.gif", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I7J71mzGsYDYCBoUz.gif", lpFilePart=0x0) returned 0x34 [0174.499] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I7J71mzGsYDYCBoUz.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\i7j71mzgsydycbouz.gif")) returned 1 [0174.503] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Ieiqp5qQg.gif.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Ieiqp5qQg.gif.ncovid", lpFilePart=0x0) returned 0x33 [0174.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0174.503] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Ieiqp5qQg.gif.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ieiqp5qqg.gif.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0174.504] GetFileType (hFile=0x350) returned 0x1 [0174.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0174.504] GetFileType (hFile=0x350) returned 0x1 [0176.025] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Ieiqp5qQg.gif", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Ieiqp5qQg.gif", lpFilePart=0x0) returned 0x2c [0176.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0176.025] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Ieiqp5qQg.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ieiqp5qqg.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0176.028] GetFileType (hFile=0x328) returned 0x1 [0176.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0176.028] GetFileType (hFile=0x328) returned 0x1 [0176.031] ReadFile (in: hFile=0x328, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e3d8*=0xbc49, lpOverlapped=0x0) returned 1 [0176.045] WriteFile (in: hFile=0x350, lpBuffer=0x22f9400*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x22f9400*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0176.046] WriteFile (in: hFile=0x350, lpBuffer=0x22fba98*, nNumberOfBytesToWrite=0xac60, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x22fba98*, lpNumberOfBytesWritten=0x14e3c8*=0xac60, lpOverlapped=0x0) returned 1 [0176.047] ReadFile (in: hFile=0x328, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0176.047] CloseHandle (hObject=0x328) returned 1 [0176.047] WriteFile (in: hFile=0x350, lpBuffer=0x22f9400*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x22f9400*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0176.047] CloseHandle (hObject=0x350) returned 1 [0176.060] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Ieiqp5qQg.gif", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Ieiqp5qQg.gif", lpFilePart=0x0) returned 0x2c [0176.060] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Ieiqp5qQg.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ieiqp5qqg.gif")) returned 1 [0176.064] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\iotg5jb-wcu3hO-.gif.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\iotg5jb-wcu3hO-.gif.ncovid", lpFilePart=0x0) returned 0x39 [0176.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0176.065] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\iotg5jb-wcu3hO-.gif.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\iotg5jb-wcu3ho-.gif.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0176.065] GetFileType (hFile=0x350) returned 0x1 [0176.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0176.065] GetFileType (hFile=0x350) returned 0x1 [0177.008] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\iotg5jb-wcu3hO-.gif", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\iotg5jb-wcu3hO-.gif", lpFilePart=0x0) returned 0x32 [0177.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0177.009] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\iotg5jb-wcu3hO-.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\iotg5jb-wcu3ho-.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0177.010] GetFileType (hFile=0x328) returned 0x1 [0177.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0177.010] GetFileType (hFile=0x328) returned 0x1 [0177.012] ReadFile (in: hFile=0x328, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0xf775, lpOverlapped=0x0) returned 1 [0177.028] WriteFile (in: hFile=0x350, lpBuffer=0x21e6260*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x21e6260*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0177.030] WriteFile (in: hFile=0x350, lpBuffer=0x21e8908*, nNumberOfBytesToWrite=0xe790, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x21e8908*, lpNumberOfBytesWritten=0x14e3c8*=0xe790, lpOverlapped=0x0) returned 1 [0177.031] ReadFile (in: hFile=0x328, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0177.031] CloseHandle (hObject=0x328) returned 1 [0177.031] WriteFile (in: hFile=0x350, lpBuffer=0x21e6260*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x21e6260*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0177.032] CloseHandle (hObject=0x350) returned 1 [0177.050] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\iotg5jb-wcu3hO-.gif", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\iotg5jb-wcu3hO-.gif", lpFilePart=0x0) returned 0x32 [0177.050] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\iotg5jb-wcu3hO-.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\iotg5jb-wcu3ho-.gif")) returned 1 [0177.054] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\iTLuTdWLR4vAu.png.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\iTLuTdWLR4vAu.png.ncovid", lpFilePart=0x0) returned 0x37 [0177.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0177.054] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\iTLuTdWLR4vAu.png.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\itlutdwlr4vau.png.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0177.055] GetFileType (hFile=0x350) returned 0x1 [0177.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0177.055] GetFileType (hFile=0x350) returned 0x1 [0178.123] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\iTLuTdWLR4vAu.png", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\iTLuTdWLR4vAu.png", lpFilePart=0x0) returned 0x30 [0178.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0178.123] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\iTLuTdWLR4vAu.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\itlutdwlr4vau.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0178.124] GetFileType (hFile=0x328) returned 0x1 [0178.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0178.124] GetFileType (hFile=0x328) returned 0x1 [0178.127] ReadFile (in: hFile=0x328, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x5611, lpOverlapped=0x0) returned 1 [0178.143] WriteFile (in: hFile=0x350, lpBuffer=0x22ddcd8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x22ddcd8*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0178.145] WriteFile (in: hFile=0x350, lpBuffer=0x22e0380*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x22e0380*, lpNumberOfBytesWritten=0x14e3c8*=0x4630, lpOverlapped=0x0) returned 1 [0178.145] ReadFile (in: hFile=0x328, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0178.146] CloseHandle (hObject=0x328) returned 1 [0178.146] WriteFile (in: hFile=0x350, lpBuffer=0x22ddcd8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x22ddcd8*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0178.146] CloseHandle (hObject=0x350) returned 1 [0178.148] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\iTLuTdWLR4vAu.png", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\iTLuTdWLR4vAu.png", lpFilePart=0x0) returned 0x30 [0178.148] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\iTLuTdWLR4vAu.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\itlutdwlr4vau.png")) returned 1 [0178.152] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Izk7bTMXw-1.png.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Izk7bTMXw-1.png.ncovid", lpFilePart=0x0) returned 0x35 [0178.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0178.153] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Izk7bTMXw-1.png.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\izk7btmxw-1.png.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0178.153] GetFileType (hFile=0x350) returned 0x1 [0178.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0178.154] GetFileType (hFile=0x350) returned 0x1 [0179.198] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Izk7bTMXw-1.png", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Izk7bTMXw-1.png", lpFilePart=0x0) returned 0x2e [0179.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0179.199] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Izk7bTMXw-1.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\izk7btmxw-1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0179.199] GetFileType (hFile=0x328) returned 0x1 [0179.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0179.199] GetFileType (hFile=0x328) returned 0x1 [0179.202] ReadFile (in: hFile=0x328, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e3d8*=0x4a70, lpOverlapped=0x0) returned 1 [0179.215] WriteFile (in: hFile=0x350, lpBuffer=0x21cb780*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x21cb780*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0179.216] WriteFile (in: hFile=0x350, lpBuffer=0x21cde18*, nNumberOfBytesToWrite=0x3a90, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x21cde18*, lpNumberOfBytesWritten=0x14e3c8*=0x3a90, lpOverlapped=0x0) returned 1 [0179.217] ReadFile (in: hFile=0x328, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0179.217] CloseHandle (hObject=0x328) returned 1 [0179.217] WriteFile (in: hFile=0x350, lpBuffer=0x21cb780*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x21cb780*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0179.217] CloseHandle (hObject=0x350) returned 1 [0179.219] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Izk7bTMXw-1.png", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Izk7bTMXw-1.png", lpFilePart=0x0) returned 0x2e [0179.219] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Izk7bTMXw-1.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\izk7btmxw-1.png")) returned 1 [0179.223] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ljeI.gif.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ljeI.gif.ncovid", lpFilePart=0x0) returned 0x2e [0179.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0179.223] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ljeI.gif.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ljei.gif.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0179.224] GetFileType (hFile=0x350) returned 0x1 [0179.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0179.224] GetFileType (hFile=0x350) returned 0x1 [0180.291] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ljeI.gif", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ljeI.gif", lpFilePart=0x0) returned 0x27 [0180.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0180.292] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ljeI.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ljei.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0180.293] GetFileType (hFile=0x328) returned 0x1 [0180.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0180.293] GetFileType (hFile=0x328) returned 0x1 [0180.296] ReadFile (in: hFile=0x328, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x60a1, lpOverlapped=0x0) returned 1 [0180.312] WriteFile (in: hFile=0x350, lpBuffer=0x22b1110*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x22b1110*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0180.315] WriteFile (in: hFile=0x350, lpBuffer=0x22b3790*, nNumberOfBytesToWrite=0x50c0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x22b3790*, lpNumberOfBytesWritten=0x14e3c8*=0x50c0, lpOverlapped=0x0) returned 1 [0180.316] ReadFile (in: hFile=0x328, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0180.316] CloseHandle (hObject=0x328) returned 1 [0180.316] WriteFile (in: hFile=0x350, lpBuffer=0x22b1110*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x22b1110*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0180.316] CloseHandle (hObject=0x350) returned 1 [0180.320] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ljeI.gif", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ljeI.gif", lpFilePart=0x0) returned 0x27 [0180.320] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ljeI.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ljei.gif")) returned 1 [0180.324] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ljhkhNwA93064H5W.gif.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ljhkhNwA93064H5W.gif.ncovid", lpFilePart=0x0) returned 0x3a [0180.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0180.325] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ljhkhNwA93064H5W.gif.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ljhkhnwa93064h5w.gif.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0180.326] GetFileType (hFile=0x350) returned 0x1 [0180.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0180.326] GetFileType (hFile=0x350) returned 0x1 [0181.389] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ljhkhNwA93064H5W.gif", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ljhkhNwA93064H5W.gif", lpFilePart=0x0) returned 0x33 [0181.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0181.389] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ljhkhNwA93064H5W.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ljhkhnwa93064h5w.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0181.390] GetFileType (hFile=0x328) returned 0x1 [0181.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0181.390] GetFileType (hFile=0x328) returned 0x1 [0181.445] ReadFile (in: hFile=0x328, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0xe382, lpOverlapped=0x0) returned 1 [0181.459] WriteFile (in: hFile=0x350, lpBuffer=0x219f7b8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x219f7b8*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0181.460] WriteFile (in: hFile=0x350, lpBuffer=0x21a1e68*, nNumberOfBytesToWrite=0xd3a0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x21a1e68*, lpNumberOfBytesWritten=0x14e3c8*=0xd3a0, lpOverlapped=0x0) returned 1 [0181.461] ReadFile (in: hFile=0x328, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0181.461] CloseHandle (hObject=0x328) returned 1 [0181.461] WriteFile (in: hFile=0x350, lpBuffer=0x219f7b8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x219f7b8*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0181.461] CloseHandle (hObject=0x350) returned 1 [0181.463] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ljhkhNwA93064H5W.gif", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ljhkhNwA93064H5W.gif", lpFilePart=0x0) returned 0x33 [0181.464] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ljhkhNwA93064H5W.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ljhkhnwa93064h5w.gif")) returned 1 [0181.470] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\N0pnuWNn.jpg.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\N0pnuWNn.jpg.ncovid", lpFilePart=0x0) returned 0x32 [0181.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0181.470] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\N0pnuWNn.jpg.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\n0pnuwnn.jpg.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0181.470] GetFileType (hFile=0x350) returned 0x1 [0181.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0181.471] GetFileType (hFile=0x350) returned 0x1 [0182.468] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\N0pnuWNn.jpg", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\N0pnuWNn.jpg", lpFilePart=0x0) returned 0x2b [0182.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0182.468] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\N0pnuWNn.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\n0pnuwnn.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0182.470] GetFileType (hFile=0x328) returned 0x1 [0182.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0182.470] GetFileType (hFile=0x328) returned 0x1 [0182.491] ReadFile (in: hFile=0x328, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e3d8*=0xf496, lpOverlapped=0x0) returned 1 [0182.507] WriteFile (in: hFile=0x350, lpBuffer=0x22960d0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x22960d0*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0182.508] WriteFile (in: hFile=0x350, lpBuffer=0x2298760*, nNumberOfBytesToWrite=0xe4b0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x2298760*, lpNumberOfBytesWritten=0x14e3c8*=0xe4b0, lpOverlapped=0x0) returned 1 [0182.510] ReadFile (in: hFile=0x328, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0182.510] CloseHandle (hObject=0x328) returned 1 [0182.510] WriteFile (in: hFile=0x350, lpBuffer=0x22960d0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x22960d0*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0182.510] CloseHandle (hObject=0x350) returned 1 [0182.516] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\N0pnuWNn.jpg", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\N0pnuWNn.jpg", lpFilePart=0x0) returned 0x2b [0182.516] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\N0pnuWNn.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\n0pnuwnn.jpg")) returned 1 [0182.523] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Rne6z7RphV.jpg.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Rne6z7RphV.jpg.ncovid", lpFilePart=0x0) returned 0x34 [0182.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0182.523] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Rne6z7RphV.jpg.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\rne6z7rphv.jpg.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0182.524] GetFileType (hFile=0x350) returned 0x1 [0182.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0182.524] GetFileType (hFile=0x350) returned 0x1 [0183.707] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Rne6z7RphV.jpg", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Rne6z7RphV.jpg", lpFilePart=0x0) returned 0x2d [0183.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0183.708] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Rne6z7RphV.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\rne6z7rphv.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0183.708] GetFileType (hFile=0x328) returned 0x1 [0183.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0183.708] GetFileType (hFile=0x328) returned 0x1 [0183.712] ReadFile (in: hFile=0x328, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x3ec0, lpOverlapped=0x0) returned 1 [0183.726] WriteFile (in: hFile=0x350, lpBuffer=0x21864e8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x21864e8*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0183.727] WriteFile (in: hFile=0x350, lpBuffer=0x2188b80*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x2188b80*, lpNumberOfBytesWritten=0x14e3c8*=0x2ee0, lpOverlapped=0x0) returned 1 [0183.728] ReadFile (in: hFile=0x328, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0183.728] CloseHandle (hObject=0x328) returned 1 [0183.728] WriteFile (in: hFile=0x350, lpBuffer=0x21864e8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x21864e8*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0183.728] CloseHandle (hObject=0x350) returned 1 [0183.730] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Rne6z7RphV.jpg", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Rne6z7RphV.jpg", lpFilePart=0x0) returned 0x2d [0183.730] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Rne6z7RphV.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\rne6z7rphv.jpg")) returned 1 [0183.735] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\soB3UY84J.bmp.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\soB3UY84J.bmp.ncovid", lpFilePart=0x0) returned 0x33 [0183.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0183.735] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\soB3UY84J.bmp.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\sob3uy84j.bmp.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0183.735] GetFileType (hFile=0x350) returned 0x1 [0183.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0183.735] GetFileType (hFile=0x350) returned 0x1 [0184.796] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\soB3UY84J.bmp", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\soB3UY84J.bmp", lpFilePart=0x0) returned 0x2c [0184.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0184.796] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\soB3UY84J.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\sob3uy84j.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0184.796] GetFileType (hFile=0x328) returned 0x1 [0184.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0184.797] GetFileType (hFile=0x328) returned 0x1 [0184.799] ReadFile (in: hFile=0x328, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x1612f, lpOverlapped=0x0) returned 1 [0184.816] WriteFile (in: hFile=0x350, lpBuffer=0x2272b00*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x2272b00*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0184.819] WriteFile (in: hFile=0x350, lpBuffer=0x12322980*, nNumberOfBytesToWrite=0x15140, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x12322980*, lpNumberOfBytesWritten=0x14e3c8*=0x15140, lpOverlapped=0x0) returned 1 [0184.821] ReadFile (in: hFile=0x328, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0184.822] CloseHandle (hObject=0x328) returned 1 [0184.822] WriteFile (in: hFile=0x350, lpBuffer=0x2272b00*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x2272b00*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0184.822] CloseHandle (hObject=0x350) returned 1 [0184.843] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\soB3UY84J.bmp", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\soB3UY84J.bmp", lpFilePart=0x0) returned 0x2c [0184.843] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\soB3UY84J.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\sob3uy84j.bmp")) returned 1 [0184.847] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\V1CR3ZY6XRVc7QPNQ2G3.jpg.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\V1CR3ZY6XRVc7QPNQ2G3.jpg.ncovid", lpFilePart=0x0) returned 0x3e [0184.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0184.847] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\V1CR3ZY6XRVc7QPNQ2G3.jpg.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\v1cr3zy6xrvc7qpnq2g3.jpg.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0184.848] GetFileType (hFile=0x350) returned 0x1 [0184.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0184.848] GetFileType (hFile=0x350) returned 0x1 [0186.093] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\V1CR3ZY6XRVc7QPNQ2G3.jpg", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\V1CR3ZY6XRVc7QPNQ2G3.jpg", lpFilePart=0x0) returned 0x37 [0186.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0186.093] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\V1CR3ZY6XRVc7QPNQ2G3.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\v1cr3zy6xrvc7qpnq2g3.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0186.094] GetFileType (hFile=0x328) returned 0x1 [0186.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0186.094] GetFileType (hFile=0x328) returned 0x1 [0186.097] ReadFile (in: hFile=0x328, lpBuffer=0x12337af8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12337af8*, lpNumberOfBytesRead=0x14e3d8*=0x126cf, lpOverlapped=0x0) returned 1 [0186.115] WriteFile (in: hFile=0x350, lpBuffer=0x215b430*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x215b430*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0186.116] WriteFile (in: hFile=0x350, lpBuffer=0x215daf0*, nNumberOfBytesToWrite=0x116e0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x215daf0*, lpNumberOfBytesWritten=0x14e3c8*=0x116e0, lpOverlapped=0x0) returned 1 [0186.118] ReadFile (in: hFile=0x328, lpBuffer=0x12337af8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12337af8*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0186.118] CloseHandle (hObject=0x328) returned 1 [0186.118] WriteFile (in: hFile=0x350, lpBuffer=0x215b430*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x215b430*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0186.118] CloseHandle (hObject=0x350) returned 1 [0186.124] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\V1CR3ZY6XRVc7QPNQ2G3.jpg", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\V1CR3ZY6XRVc7QPNQ2G3.jpg", lpFilePart=0x0) returned 0x37 [0186.124] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\V1CR3ZY6XRVc7QPNQ2G3.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\v1cr3zy6xrvc7qpnq2g3.jpg")) returned 1 [0186.128] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\WTv_2d9vuAAmrz9WS353.gif.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\WTv_2d9vuAAmrz9WS353.gif.ncovid", lpFilePart=0x0) returned 0x3e [0186.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0186.128] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\WTv_2d9vuAAmrz9WS353.gif.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\wtv_2d9vuaamrz9ws353.gif.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0186.129] GetFileType (hFile=0x350) returned 0x1 [0186.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0186.129] GetFileType (hFile=0x350) returned 0x1 [0187.159] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\WTv_2d9vuAAmrz9WS353.gif", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\WTv_2d9vuAAmrz9WS353.gif", lpFilePart=0x0) returned 0x37 [0187.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0187.159] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\WTv_2d9vuAAmrz9WS353.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\wtv_2d9vuaamrz9ws353.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0187.160] GetFileType (hFile=0x328) returned 0x1 [0187.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0187.160] GetFileType (hFile=0x328) returned 0x1 [0187.162] ReadFile (in: hFile=0x328, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x6c99, lpOverlapped=0x0) returned 1 [0187.178] WriteFile (in: hFile=0x350, lpBuffer=0x224e8c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x224e8c8*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0187.179] WriteFile (in: hFile=0x350, lpBuffer=0x2250f88*, nNumberOfBytesToWrite=0x5cb0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x2250f88*, lpNumberOfBytesWritten=0x14e3c8*=0x5cb0, lpOverlapped=0x0) returned 1 [0187.180] ReadFile (in: hFile=0x328, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0187.180] CloseHandle (hObject=0x328) returned 1 [0187.180] WriteFile (in: hFile=0x350, lpBuffer=0x224e8c8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x224e8c8*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0187.180] CloseHandle (hObject=0x350) returned 1 [0187.182] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\WTv_2d9vuAAmrz9WS353.gif", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\WTv_2d9vuAAmrz9WS353.gif", lpFilePart=0x0) returned 0x37 [0187.182] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\WTv_2d9vuAAmrz9WS353.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\wtv_2d9vuaamrz9ws353.gif")) returned 1 [0187.185] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Y412g.jpg.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Y412g.jpg.ncovid", lpFilePart=0x0) returned 0x2f [0187.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0187.185] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Y412g.jpg.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\y412g.jpg.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0187.186] GetFileType (hFile=0x350) returned 0x1 [0187.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0187.186] GetFileType (hFile=0x350) returned 0x1 [0188.100] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Y412g.jpg", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Y412g.jpg", lpFilePart=0x0) returned 0x28 [0188.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0188.100] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Y412g.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\y412g.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0188.100] GetFileType (hFile=0x328) returned 0x1 [0188.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0188.100] GetFileType (hFile=0x328) returned 0x1 [0188.103] ReadFile (in: hFile=0x328, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x1823a, lpOverlapped=0x0) returned 1 [0188.129] WriteFile (in: hFile=0x350, lpBuffer=0x213df60*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x213df60*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0188.131] WriteFile (in: hFile=0x350, lpBuffer=0x12322980*, nNumberOfBytesToWrite=0x17250, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x12322980*, lpNumberOfBytesWritten=0x14e3c8*=0x17250, lpOverlapped=0x0) returned 1 [0188.133] ReadFile (in: hFile=0x328, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0188.133] CloseHandle (hObject=0x328) returned 1 [0188.133] WriteFile (in: hFile=0x350, lpBuffer=0x213df60*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x213df60*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0188.134] CloseHandle (hObject=0x350) returned 1 [0188.139] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Y412g.jpg", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Y412g.jpg", lpFilePart=0x0) returned 0x28 [0188.139] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Y412g.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\y412g.jpg")) returned 1 [0188.156] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\yQmXMOnbtf7h7HFf_BA.bmp.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\yQmXMOnbtf7h7HFf_BA.bmp.ncovid", lpFilePart=0x0) returned 0x3d [0188.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0188.156] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\yQmXMOnbtf7h7HFf_BA.bmp.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\yqmxmonbtf7h7hff_ba.bmp.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0188.157] GetFileType (hFile=0x350) returned 0x1 [0188.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0188.157] GetFileType (hFile=0x350) returned 0x1 [0188.902] ResetEvent (hEvent=0x19c) returned 1 [0189.172] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\yQmXMOnbtf7h7HFf_BA.bmp", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\yQmXMOnbtf7h7HFf_BA.bmp", lpFilePart=0x0) returned 0x36 [0189.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0189.172] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\yQmXMOnbtf7h7HFf_BA.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\yqmxmonbtf7h7hff_ba.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0189.172] GetFileType (hFile=0x328) returned 0x1 [0189.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0189.172] GetFileType (hFile=0x328) returned 0x1 [0189.175] ReadFile (in: hFile=0x328, lpBuffer=0x12339c08, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12339c08*, lpNumberOfBytesRead=0x14e3d8*=0xdec1, lpOverlapped=0x0) returned 1 [0189.191] WriteFile (in: hFile=0x350, lpBuffer=0x22269e8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x22269e8*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0189.192] WriteFile (in: hFile=0x350, lpBuffer=0x22290a0*, nNumberOfBytesToWrite=0xcee0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x22290a0*, lpNumberOfBytesWritten=0x14e3c8*=0xcee0, lpOverlapped=0x0) returned 1 [0189.194] ReadFile (in: hFile=0x328, lpBuffer=0x12339c08, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12339c08*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0189.194] CloseHandle (hObject=0x328) returned 1 [0189.194] WriteFile (in: hFile=0x350, lpBuffer=0x22269e8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x22269e8*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0189.195] CloseHandle (hObject=0x350) returned 1 [0189.213] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\yQmXMOnbtf7h7HFf_BA.bmp", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\yQmXMOnbtf7h7HFf_BA.bmp", lpFilePart=0x0) returned 0x36 [0189.213] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\yQmXMOnbtf7h7HFf_BA.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\yqmxmonbtf7h7hff_ba.bmp")) returned 1 [0189.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e4f0) returned 1 [0189.218] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures", nBufferLength=0x105, lpBuffer=0x14dfe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures", lpFilePart=0x0) returned 0x1e [0189.218] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\", nBufferLength=0x105, lpBuffer=0x14df80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\", lpFilePart=0x0) returned 0x1f [0189.218] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\*", lpFindFileData=0x14e190 | out: lpFindFileData=0x14e190*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5528aa70, ftLastAccessTime.dwHighDateTime=0x1d70a81, ftLastWriteTime.dwLowDateTime=0x79343709, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x62bbd0 [0189.219] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5528aa70, ftLastAccessTime.dwHighDateTime=0x1d70a81, ftLastWriteTime.dwLowDateTime=0x79343709, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.220] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68cc7a8e, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x68cc7a8e, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x69996682, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x47b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="-TZ5rzCIOrbdbR.png.ncovid", cAlternateFileName="-TZ5RZ~1.NCO")) returned 1 [0189.220] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x699a3fd0, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x699a3fd0, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x6a70e58f, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x2dd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="35-jfpA-mtUPvs5gV4mr.jpg.ncovid", cAlternateFileName="35-JFP~1.NCO")) returned 1 [0189.220] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a71cfed, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x6a71cfed, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x6b80631a, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x8310, dwReserved0=0x0, dwReserved1=0x0, cFileName="4qcvOht-riX9J3ZGd2AN.jpg.ncovid", cAlternateFileName="4QCVOH~1.NCO")) returned 1 [0189.220] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b81375f, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x6b81375f, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x6c2e10e4, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x167d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5eGY_O6oAQYCeYF.bmp.ncovid", cAlternateFileName="5EGY_O~1.NCO")) returned 1 [0189.220] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2eb2d9, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x6c2eb2d9, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x6cd27b7c, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x3840, dwReserved0=0x0, dwReserved1=0x0, cFileName="7IGp2H4UWA.png.ncovid", cAlternateFileName="7IGP2H~1.NCO")) returned 1 [0189.220] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cd38a7f, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x6cd38a7f, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x6da5fe66, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x61f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8_L0.jpg.ncovid", cAlternateFileName="8_L0JP~1.NCO")) returned 1 [0189.220] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6da6ecb4, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x6da6ecb4, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x6e65a99d, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0xd470, dwReserved0=0x0, dwReserved1=0x0, cFileName="aEzzAV.png.ncovid", cAlternateFileName="AEZZAV~1.NCO")) returned 1 [0189.220] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b0e752d, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0189.221] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e67b7cd, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x6e67b7cd, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x6f121ee4, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x12640, dwReserved0=0x0, dwReserved1=0x0, cFileName="CfMroH.bmp.ncovid", cAlternateFileName="CFMROH~1.NCO")) returned 1 [0189.221] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f131732, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x6f131732, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x6fb99637, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x220, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ncovid", cAlternateFileName="DESKTO~1.NCO")) returned 1 [0189.221] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86645610, ftCreationTime.dwHighDateTime=0x1d7064d, ftLastAccessTime.dwLowDateTime=0x6a1d0a50, ftLastAccessTime.dwHighDateTime=0x1d7090a, ftLastWriteTime.dwLowDateTime=0x6a1d0a50, ftLastWriteTime.dwHighDateTime=0x1d7090a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gQVD1CNgqQdWgWk", cAlternateFileName="GQVD1C~1")) returned 1 [0189.221] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fba32bd, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x6fba32bd, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x706e95b8, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0xc670, dwReserved0=0x0, dwReserved1=0x0, cFileName="I7J71mzGsYDYCBoUz.gif.ncovid", cAlternateFileName="I7J71M~1.NCO")) returned 1 [0189.221] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x706f4721, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x706f4721, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x715cb661, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0xbc70, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ieiqp5qQg.gif.ncovid", cAlternateFileName="IEIQP5~1.NCO")) returned 1 [0189.221] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x715d8b59, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x715d8b59, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x71f3acbf, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0xf7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="iotg5jb-wcu3hO-.gif.ncovid", cAlternateFileName="IOTG5J~1.NCO")) returned 1 [0189.221] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f482e1, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x71f482e1, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x729b183e, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x5640, dwReserved0=0x0, dwReserved1=0x0, cFileName="iTLuTdWLR4vAu.png.ncovid", cAlternateFileName="ITLUTD~1.NCO")) returned 1 [0189.222] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729c2963, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x729c2963, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x733ebb96, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x4aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Izk7bTMXw-1.png.ncovid", cAlternateFileName="IZK7BT~1.NCO")) returned 1 [0189.222] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x733f915a, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x733f915a, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x73e6c928, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x60d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ljeI.gif.ncovid", cAlternateFileName="LJEIGI~1.NCO")) returned 1 [0189.222] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73e78c98, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x73e78c98, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x749545bf, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0xe3b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ljhkhNwA93064H5W.gif.ncovid", cAlternateFileName="LJHKHN~1.NCO")) returned 1 [0189.222] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7496576f, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x7496576f, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x7535c635, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0xf4c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="N0pnuWNn.jpg.ncovid", cAlternateFileName="N0PNUW~1.NCO")) returned 1 [0189.222] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7536fe17, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x7536fe17, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x75ef2079, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x3ef0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rne6z7RphV.jpg.ncovid", cAlternateFileName="RNE6Z7~1.NCO")) returned 1 [0189.222] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0189.222] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75efdf76, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x75efdf76, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x7698ecf2, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x16150, dwReserved0=0x0, dwReserved1=0x0, cFileName="soB3UY84J.bmp.ncovid", cAlternateFileName="SOB3UY~1.NCO")) returned 1 [0189.222] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76999d34, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x76999d34, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x775c5b10, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x126f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="V1CR3ZY6XRVc7QPNQ2G3.jpg.ncovid", cAlternateFileName="V1CR3Z~1.NCO")) returned 1 [0189.223] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x775d2028, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x775d2028, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x77fd85a4, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTv_2d9vuAAmrz9WS353.gif.ncovid", cAlternateFileName="WTV_2D~1.NCO")) returned 1 [0189.223] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77fe6f07, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x77fe6f07, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x788febcb, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x18260, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y412g.jpg.ncovid", cAlternateFileName="Y412GJ~1.NCO")) returned 1 [0189.223] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78927cb4, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x78927cb4, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x7933ae95, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0xdef0, dwReserved0=0x0, dwReserved1=0x0, cFileName="yQmXMOnbtf7h7HFf_BA.bmp.ncovid", cAlternateFileName="YQMXMO~1.NCO")) returned 1 [0189.223] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78927cb4, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x78927cb4, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x7933ae95, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0xdef0, dwReserved0=0x0, dwReserved1=0x0, cFileName="yQmXMOnbtf7h7HFf_BA.bmp.ncovid", cAlternateFileName="YQMXMO~1.NCO")) returned 0 [0189.223] FindClose (in: hFindFile=0x62bbd0 | out: hFindFile=0x62bbd0) returned 1 [0189.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e440) returned 1 [0189.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e400) returned 1 [0189.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e440) returned 1 [0189.224] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll", nBufferLength=0x105, lpBuffer=0x14df30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll", lpFilePart=0x0) returned 0x2a [0189.224] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll\\", nBufferLength=0x105, lpBuffer=0x14ded0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll\\", lpFilePart=0x0) returned 0x2b [0189.224] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll\\*", lpFindFileData=0x14e0e0 | out: lpFindFileData=0x14e0e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b0e752d, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x62bbd0 [0189.226] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b0e752d, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.226] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x2b10dbc5, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0189.226] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0189.226] FindClose (in: hFindFile=0x62bbd0 | out: hFindFile=0x62bbd0) returned 1 [0189.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e390) returned 1 [0189.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e350) returned 1 [0189.227] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll\\desktop.ini.ncovid", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll\\desktop.ini.ncovid", lpFilePart=0x0) returned 0x3d [0189.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0189.228] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll\\desktop.ini.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\camera roll\\desktop.ini.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0189.228] GetFileType (hFile=0x350) returned 0x1 [0189.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0189.228] GetFileType (hFile=0x350) returned 0x1 [0190.343] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll\\desktop.ini", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll\\desktop.ini", lpFilePart=0x0) returned 0x36 [0190.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0190.344] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll\\desktop.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\camera roll\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0190.345] GetFileType (hFile=0x328) returned 0x1 [0190.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0190.345] GetFileType (hFile=0x328) returned 0x1 [0190.348] ReadFile (in: hFile=0x328, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e328*=0xbe, lpOverlapped=0x0) returned 1 [0190.359] ReadFile (in: hFile=0x328, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e328*=0x0, lpOverlapped=0x0) returned 1 [0190.359] CloseHandle (hObject=0x328) returned 1 [0190.359] WriteFile (in: hFile=0x350, lpBuffer=0x2319c50*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x14e208, lpOverlapped=0x0 | out: lpBuffer=0x2319c50*, lpNumberOfBytesWritten=0x14e208*=0xe0, lpOverlapped=0x0) returned 1 [0190.360] CloseHandle (hObject=0x350) returned 1 [0190.387] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll\\desktop.ini", nBufferLength=0x105, lpBuffer=0x14de30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll\\desktop.ini", lpFilePart=0x0) returned 0x36 [0190.387] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll\\desktop.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\camera roll\\desktop.ini")) returned 1 [0190.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e440) returned 1 [0190.388] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll", nBufferLength=0x105, lpBuffer=0x14df30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll", lpFilePart=0x0) returned 0x2a [0190.388] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll\\", nBufferLength=0x105, lpBuffer=0x14ded0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll\\", lpFilePart=0x0) returned 0x2b [0190.389] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll\\*", lpFindFileData=0x14e0e0 | out: lpFindFileData=0x14e0e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b0e752d, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x79e6dbe8, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x62bbd0 [0190.389] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b0e752d, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x79e6dbe8, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.389] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79360bea, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x79360bea, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x79e6dbe8, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ncovid", cAlternateFileName="DESKTO~1.NCO")) returned 1 [0190.389] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79360bea, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x79360bea, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x79e6dbe8, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ncovid", cAlternateFileName="DESKTO~1.NCO")) returned 0 [0190.389] FindClose (in: hFindFile=0x62bbd0 | out: hFindFile=0x62bbd0) returned 1 [0190.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e390) returned 1 [0190.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e350) returned 1 [0190.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e440) returned 1 [0190.390] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk", nBufferLength=0x105, lpBuffer=0x14df30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk", lpFilePart=0x0) returned 0x2e [0190.390] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\", nBufferLength=0x105, lpBuffer=0x14ded0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\", lpFilePart=0x0) returned 0x2f [0190.390] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\*", lpFindFileData=0x14e0e0 | out: lpFindFileData=0x14e0e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86645610, ftCreationTime.dwHighDateTime=0x1d7064d, ftLastAccessTime.dwLowDateTime=0x6a1d0a50, ftLastAccessTime.dwHighDateTime=0x1d7090a, ftLastWriteTime.dwLowDateTime=0x6a1d0a50, ftLastWriteTime.dwHighDateTime=0x1d7090a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x62c050 [0190.390] FindNextFileW (in: hFindFile=0x62c050, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86645610, ftCreationTime.dwHighDateTime=0x1d7064d, ftLastAccessTime.dwLowDateTime=0x6a1d0a50, ftLastAccessTime.dwHighDateTime=0x1d7090a, ftLastWriteTime.dwLowDateTime=0x6a1d0a50, ftLastWriteTime.dwHighDateTime=0x1d7090a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.390] FindNextFileW (in: hFindFile=0x62c050, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fc68830, ftCreationTime.dwHighDateTime=0x1d70640, ftLastAccessTime.dwLowDateTime=0xd425d570, ftLastAccessTime.dwHighDateTime=0x1d70889, ftLastWriteTime.dwLowDateTime=0xd425d570, ftLastWriteTime.dwHighDateTime=0x1d70889, nFileSizeHigh=0x0, nFileSizeLow=0x7f2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="0zlvDRYF 8_DNOz.gif", cAlternateFileName="0ZLVDR~1.GIF")) returned 1 [0190.391] FindNextFileW (in: hFindFile=0x62c050, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e5760e0, ftCreationTime.dwHighDateTime=0x1d705f0, ftLastAccessTime.dwLowDateTime=0x12b70880, ftLastAccessTime.dwHighDateTime=0x1d709fd, ftLastWriteTime.dwLowDateTime=0x12b70880, ftLastWriteTime.dwHighDateTime=0x1d709fd, nFileSizeHigh=0x0, nFileSizeLow=0x17820, dwReserved0=0x0, dwReserved1=0x0, cFileName="4Sf2rxZ-7lb.gif", cAlternateFileName="4SF2RX~1.GIF")) returned 1 [0190.391] FindNextFileW (in: hFindFile=0x62c050, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6faf7b0, ftCreationTime.dwHighDateTime=0x1d704a1, ftLastAccessTime.dwLowDateTime=0xfd7dee00, ftLastAccessTime.dwHighDateTime=0x1d709b8, ftLastWriteTime.dwLowDateTime=0xfd7dee00, ftLastWriteTime.dwHighDateTime=0x1d709b8, nFileSizeHigh=0x0, nFileSizeLow=0x901d, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_3uY_z.gif", cAlternateFileName="")) returned 1 [0190.391] FindNextFileW (in: hFindFile=0x62c050, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2d2eef0, ftCreationTime.dwHighDateTime=0x1d7097b, ftLastAccessTime.dwLowDateTime=0xd178c8a0, ftLastAccessTime.dwHighDateTime=0x1d70a0f, ftLastWriteTime.dwLowDateTime=0xd178c8a0, ftLastWriteTime.dwHighDateTime=0x1d70a0f, nFileSizeHigh=0x0, nFileSizeLow=0x18fe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dYaA_F5bFWX YC4AE.jpg", cAlternateFileName="DYAA_F~1.JPG")) returned 1 [0190.391] FindNextFileW (in: hFindFile=0x62c050, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73a078e0, ftCreationTime.dwHighDateTime=0x1d6faa6, ftLastAccessTime.dwLowDateTime=0x6f7fa60, ftLastAccessTime.dwHighDateTime=0x1d7032f, ftLastWriteTime.dwLowDateTime=0x6f7fa60, ftLastWriteTime.dwHighDateTime=0x1d7032f, nFileSizeHigh=0x0, nFileSizeLow=0x11535, dwReserved0=0x0, dwReserved1=0x0, cFileName="e8vhItq tNtLt5TtE.bmp", cAlternateFileName="E8VHIT~1.BMP")) returned 1 [0190.391] FindNextFileW (in: hFindFile=0x62c050, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9df8c400, ftCreationTime.dwHighDateTime=0x1d702d3, ftLastAccessTime.dwLowDateTime=0x3cd6ac90, ftLastAccessTime.dwHighDateTime=0x1d704e6, ftLastWriteTime.dwLowDateTime=0x3cd6ac90, ftLastWriteTime.dwHighDateTime=0x1d704e6, nFileSizeHigh=0x0, nFileSizeLow=0x13acf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ffD28EQZFv-o1x82.png", cAlternateFileName="FFD28E~1.PNG")) returned 1 [0190.391] FindNextFileW (in: hFindFile=0x62c050, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4126b9e0, ftCreationTime.dwHighDateTime=0x1d70011, ftLastAccessTime.dwLowDateTime=0x84f8a260, ftLastAccessTime.dwHighDateTime=0x1d7042f, ftLastWriteTime.dwLowDateTime=0x84f8a260, ftLastWriteTime.dwHighDateTime=0x1d7042f, nFileSizeHigh=0x0, nFileSizeLow=0x7ef3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fli1a9fCj4gSy.bmp", cAlternateFileName="FLI1A9~1.BMP")) returned 1 [0190.392] FindNextFileW (in: hFindFile=0x62c050, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0654920, ftCreationTime.dwHighDateTime=0x1d7020e, ftLastAccessTime.dwLowDateTime=0x17076e20, ftLastAccessTime.dwHighDateTime=0x1d704df, ftLastWriteTime.dwLowDateTime=0x17076e20, ftLastWriteTime.dwHighDateTime=0x1d704df, nFileSizeHigh=0x0, nFileSizeLow=0x1498d, dwReserved0=0x0, dwReserved1=0x0, cFileName="fMtuTrlNKaoFFoK0.bmp", cAlternateFileName="FMTUTR~1.BMP")) returned 1 [0190.392] FindNextFileW (in: hFindFile=0x62c050, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1f178d0, ftCreationTime.dwHighDateTime=0x1d6fe68, ftLastAccessTime.dwLowDateTime=0x99afb680, ftLastAccessTime.dwHighDateTime=0x1d70150, ftLastWriteTime.dwLowDateTime=0x99afb680, ftLastWriteTime.dwHighDateTime=0x1d70150, nFileSizeHigh=0x0, nFileSizeLow=0xeea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="lO0esS 0HHYKS.jpg", cAlternateFileName="LO0ESS~1.JPG")) returned 1 [0190.392] FindNextFileW (in: hFindFile=0x62c050, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1425ea20, ftCreationTime.dwHighDateTime=0x1d70731, ftLastAccessTime.dwLowDateTime=0xef372700, ftLastAccessTime.dwHighDateTime=0x1d709a2, ftLastWriteTime.dwLowDateTime=0xef372700, ftLastWriteTime.dwHighDateTime=0x1d709a2, nFileSizeHigh=0x0, nFileSizeLow=0x14e3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OgmalY.bmp", cAlternateFileName="")) returned 1 [0190.392] FindNextFileW (in: hFindFile=0x62c050, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1afbdf70, ftCreationTime.dwHighDateTime=0x1d70935, ftLastAccessTime.dwLowDateTime=0x70f90850, ftLastAccessTime.dwHighDateTime=0x1d70988, ftLastWriteTime.dwLowDateTime=0x70f90850, ftLastWriteTime.dwHighDateTime=0x1d70988, nFileSizeHigh=0x0, nFileSizeLow=0x76e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="q2MHsGKaQ.png", cAlternateFileName="Q2MHSG~1.PNG")) returned 1 [0190.392] FindNextFileW (in: hFindFile=0x62c050, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f77e5b0, ftCreationTime.dwHighDateTime=0x1d70a2e, ftLastAccessTime.dwLowDateTime=0xb789ada0, ftLastAccessTime.dwHighDateTime=0x1d70a6f, ftLastWriteTime.dwLowDateTime=0xb789ada0, ftLastWriteTime.dwHighDateTime=0x1d70a6f, nFileSizeHigh=0x0, nFileSizeLow=0xde97, dwReserved0=0x0, dwReserved1=0x0, cFileName="rJAWas8pDAbmp.png", cAlternateFileName="RJAWAS~1.PNG")) returned 1 [0190.392] FindNextFileW (in: hFindFile=0x62c050, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1924ab0, ftCreationTime.dwHighDateTime=0x1d70903, ftLastAccessTime.dwLowDateTime=0xc6b50020, ftLastAccessTime.dwHighDateTime=0x1d709f4, ftLastWriteTime.dwLowDateTime=0xc6b50020, ftLastWriteTime.dwHighDateTime=0x1d709f4, nFileSizeHigh=0x0, nFileSizeLow=0x7af8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vnz6_hUjAg9jH3t30.bmp", cAlternateFileName="VNZ6_H~1.BMP")) returned 1 [0190.392] FindNextFileW (in: hFindFile=0x62c050, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4f09040, ftCreationTime.dwHighDateTime=0x1d7022c, ftLastAccessTime.dwLowDateTime=0x37daf2b0, ftLastAccessTime.dwHighDateTime=0x1d70328, ftLastWriteTime.dwLowDateTime=0x37daf2b0, ftLastWriteTime.dwHighDateTime=0x1d70328, nFileSizeHigh=0x0, nFileSizeLow=0xa621, dwReserved0=0x0, dwReserved1=0x0, cFileName="vuyif.gif", cAlternateFileName="")) returned 1 [0190.393] FindNextFileW (in: hFindFile=0x62c050, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc59dfb0, ftCreationTime.dwHighDateTime=0x1d70888, ftLastAccessTime.dwLowDateTime=0xde2dbd0, ftLastAccessTime.dwHighDateTime=0x1d70a58, ftLastWriteTime.dwLowDateTime=0xde2dbd0, ftLastWriteTime.dwHighDateTime=0x1d70a58, nFileSizeHigh=0x0, nFileSizeLow=0x89e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="vwnzeoQ1jDssMQY.gif", cAlternateFileName="VWNZEO~1.GIF")) returned 1 [0190.393] FindNextFileW (in: hFindFile=0x62c050, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8671300, ftCreationTime.dwHighDateTime=0x1d6ffda, ftLastAccessTime.dwLowDateTime=0x45cdf460, ftLastAccessTime.dwHighDateTime=0x1d70820, ftLastWriteTime.dwLowDateTime=0x45cdf460, ftLastWriteTime.dwHighDateTime=0x1d70820, nFileSizeHigh=0x0, nFileSizeLow=0xf59b, dwReserved0=0x0, dwReserved1=0x0, cFileName="z-t5SKb go1vNMcR4.gif", cAlternateFileName="Z-T5SK~1.GIF")) returned 1 [0190.393] FindNextFileW (in: hFindFile=0x62c050, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0190.393] FindClose (in: hFindFile=0x62c050 | out: hFindFile=0x62c050) returned 1 [0190.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e390) returned 1 [0190.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e350) returned 1 [0190.394] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\0zlvDRYF 8_DNOz.gif.ncovid", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\0zlvDRYF 8_DNOz.gif.ncovid", lpFilePart=0x0) returned 0x49 [0190.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0190.394] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\0zlvDRYF 8_DNOz.gif.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\0zlvdryf 8_dnoz.gif.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0190.395] GetFileType (hFile=0x350) returned 0x1 [0190.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0190.395] GetFileType (hFile=0x350) returned 0x1 [0191.968] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\0zlvDRYF 8_DNOz.gif", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\0zlvDRYF 8_DNOz.gif", lpFilePart=0x0) returned 0x42 [0191.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0191.968] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\0zlvDRYF 8_DNOz.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\0zlvdryf 8_dnoz.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0191.968] GetFileType (hFile=0x328) returned 0x1 [0191.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0191.968] GetFileType (hFile=0x328) returned 0x1 [0191.971] ReadFile (in: hFile=0x328, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e328*=0x7f2e, lpOverlapped=0x0) returned 1 [0191.984] WriteFile (in: hFile=0x350, lpBuffer=0x2207078*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x2207078*, lpNumberOfBytesWritten=0x14e2b8*=0x1000, lpOverlapped=0x0) returned 1 [0191.985] WriteFile (in: hFile=0x350, lpBuffer=0x2209740*, nNumberOfBytesToWrite=0x6f40, lpNumberOfBytesWritten=0x14e318, lpOverlapped=0x0 | out: lpBuffer=0x2209740*, lpNumberOfBytesWritten=0x14e318*=0x6f40, lpOverlapped=0x0) returned 1 [0191.986] ReadFile (in: hFile=0x328, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e328*=0x0, lpOverlapped=0x0) returned 1 [0191.986] CloseHandle (hObject=0x328) returned 1 [0191.986] WriteFile (in: hFile=0x350, lpBuffer=0x2207078*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e208, lpOverlapped=0x0 | out: lpBuffer=0x2207078*, lpNumberOfBytesWritten=0x14e208*=0x10, lpOverlapped=0x0) returned 1 [0191.986] CloseHandle (hObject=0x350) returned 1 [0192.011] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\0zlvDRYF 8_DNOz.gif", nBufferLength=0x105, lpBuffer=0x14de30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\0zlvDRYF 8_DNOz.gif", lpFilePart=0x0) returned 0x42 [0192.011] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\0zlvDRYF 8_DNOz.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\0zlvdryf 8_dnoz.gif")) returned 1 [0192.015] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\4Sf2rxZ-7lb.gif.ncovid", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\4Sf2rxZ-7lb.gif.ncovid", lpFilePart=0x0) returned 0x45 [0192.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0192.015] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\4Sf2rxZ-7lb.gif.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\4sf2rxz-7lb.gif.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0192.016] GetFileType (hFile=0x350) returned 0x1 [0192.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0192.016] GetFileType (hFile=0x350) returned 0x1 [0193.381] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\4Sf2rxZ-7lb.gif", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\4Sf2rxZ-7lb.gif", lpFilePart=0x0) returned 0x3e [0193.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0193.382] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\4Sf2rxZ-7lb.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\4sf2rxz-7lb.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0193.382] GetFileType (hFile=0x328) returned 0x1 [0193.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0193.382] GetFileType (hFile=0x328) returned 0x1 [0193.385] ReadFile (in: hFile=0x328, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e328*=0x17820, lpOverlapped=0x0) returned 1 [0193.406] WriteFile (in: hFile=0x350, lpBuffer=0x212c528*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x212c528*, lpNumberOfBytesWritten=0x14e2b8*=0x1000, lpOverlapped=0x0) returned 1 [0193.408] WriteFile (in: hFile=0x350, lpBuffer=0x12122910*, nNumberOfBytesToWrite=0x16840, lpNumberOfBytesWritten=0x14e318, lpOverlapped=0x0 | out: lpBuffer=0x12122910*, lpNumberOfBytesWritten=0x14e318*=0x16840, lpOverlapped=0x0) returned 1 [0193.409] ReadFile (in: hFile=0x328, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e328*=0x0, lpOverlapped=0x0) returned 1 [0193.410] CloseHandle (hObject=0x328) returned 1 [0193.410] WriteFile (in: hFile=0x350, lpBuffer=0x212c528*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e208, lpOverlapped=0x0 | out: lpBuffer=0x212c528*, lpNumberOfBytesWritten=0x14e208*=0x10, lpOverlapped=0x0) returned 1 [0193.410] CloseHandle (hObject=0x350) returned 1 [0193.415] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\4Sf2rxZ-7lb.gif", nBufferLength=0x105, lpBuffer=0x14de30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\4Sf2rxZ-7lb.gif", lpFilePart=0x0) returned 0x3e [0193.415] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\4Sf2rxZ-7lb.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\4sf2rxz-7lb.gif")) returned 1 [0193.420] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\C_3uY_z.gif.ncovid", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\C_3uY_z.gif.ncovid", lpFilePart=0x0) returned 0x41 [0193.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0193.420] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\C_3uY_z.gif.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\c_3uy_z.gif.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0193.420] GetFileType (hFile=0x350) returned 0x1 [0193.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0193.421] GetFileType (hFile=0x350) returned 0x1 [0194.992] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\C_3uY_z.gif", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\C_3uY_z.gif", lpFilePart=0x0) returned 0x3a [0194.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0194.992] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\C_3uY_z.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\c_3uy_z.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0194.993] GetFileType (hFile=0x328) returned 0x1 [0194.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0194.993] GetFileType (hFile=0x328) returned 0x1 [0194.993] ReadFile (in: hFile=0x328, lpBuffer=0x12139188, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x12139188*, lpNumberOfBytesRead=0x14e328*=0x901d, lpOverlapped=0x0) returned 1 [0194.995] WriteFile (in: hFile=0x350, lpBuffer=0x2214100*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x2214100*, lpNumberOfBytesWritten=0x14e2b8*=0x1000, lpOverlapped=0x0) returned 1 [0194.998] WriteFile (in: hFile=0x350, lpBuffer=0x22167a8*, nNumberOfBytesToWrite=0x8030, lpNumberOfBytesWritten=0x14e318, lpOverlapped=0x0 | out: lpBuffer=0x22167a8*, lpNumberOfBytesWritten=0x14e318*=0x8030, lpOverlapped=0x0) returned 1 [0194.999] ReadFile (in: hFile=0x328, lpBuffer=0x12139188, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x12139188*, lpNumberOfBytesRead=0x14e328*=0x0, lpOverlapped=0x0) returned 1 [0194.999] CloseHandle (hObject=0x328) returned 1 [0195.000] WriteFile (in: hFile=0x350, lpBuffer=0x2214100*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e208, lpOverlapped=0x0 | out: lpBuffer=0x2214100*, lpNumberOfBytesWritten=0x14e208*=0x10, lpOverlapped=0x0) returned 1 [0195.000] CloseHandle (hObject=0x350) returned 1 [0195.004] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\C_3uY_z.gif", nBufferLength=0x105, lpBuffer=0x14de30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\C_3uY_z.gif", lpFilePart=0x0) returned 0x3a [0195.004] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\C_3uY_z.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\c_3uy_z.gif")) returned 1 [0195.008] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\dYaA_F5bFWX YC4AE.jpg.ncovid", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\dYaA_F5bFWX YC4AE.jpg.ncovid", lpFilePart=0x0) returned 0x4b [0195.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0195.008] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\dYaA_F5bFWX YC4AE.jpg.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\dyaa_f5bfwx yc4ae.jpg.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0195.009] GetFileType (hFile=0x350) returned 0x1 [0195.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0195.009] GetFileType (hFile=0x350) returned 0x1 [0196.140] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\dYaA_F5bFWX YC4AE.jpg", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\dYaA_F5bFWX YC4AE.jpg", lpFilePart=0x0) returned 0x44 [0196.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0196.140] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\dYaA_F5bFWX YC4AE.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\dyaa_f5bfwx yc4ae.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0196.141] GetFileType (hFile=0x328) returned 0x1 [0196.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0196.141] GetFileType (hFile=0x328) returned 0x1 [0196.143] ReadFile (in: hFile=0x328, lpBuffer=0x124219d8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x124219d8*, lpNumberOfBytesRead=0x14e328*=0x18fe0, lpOverlapped=0x0) returned 1 [0196.158] WriteFile (in: hFile=0x350, lpBuffer=0x2306168*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x2306168*, lpNumberOfBytesWritten=0x14e2b8*=0x1000, lpOverlapped=0x0) returned 1 [0196.159] WriteFile (in: hFile=0x350, lpBuffer=0x1223a1a0*, nNumberOfBytesToWrite=0x18000, lpNumberOfBytesWritten=0x14e318, lpOverlapped=0x0 | out: lpBuffer=0x1223a1a0*, lpNumberOfBytesWritten=0x14e318*=0x18000, lpOverlapped=0x0) returned 1 [0196.161] ReadFile (in: hFile=0x328, lpBuffer=0x124219d8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x124219d8*, lpNumberOfBytesRead=0x14e328*=0x0, lpOverlapped=0x0) returned 1 [0196.161] CloseHandle (hObject=0x328) returned 1 [0196.162] WriteFile (in: hFile=0x350, lpBuffer=0x2306168*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e208, lpOverlapped=0x0 | out: lpBuffer=0x2306168*, lpNumberOfBytesWritten=0x14e208*=0x10, lpOverlapped=0x0) returned 1 [0196.162] CloseHandle (hObject=0x350) returned 1 [0196.167] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\dYaA_F5bFWX YC4AE.jpg", nBufferLength=0x105, lpBuffer=0x14de30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\dYaA_F5bFWX YC4AE.jpg", lpFilePart=0x0) returned 0x44 [0196.168] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\dYaA_F5bFWX YC4AE.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\dyaa_f5bfwx yc4ae.jpg")) returned 1 [0196.172] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\e8vhItq tNtLt5TtE.bmp.ncovid", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\e8vhItq tNtLt5TtE.bmp.ncovid", lpFilePart=0x0) returned 0x4b [0196.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0196.172] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\e8vhItq tNtLt5TtE.bmp.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\e8vhitq tntlt5tte.bmp.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0196.173] GetFileType (hFile=0x350) returned 0x1 [0196.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0196.173] GetFileType (hFile=0x350) returned 0x1 [0197.218] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\e8vhItq tNtLt5TtE.bmp", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\e8vhItq tNtLt5TtE.bmp", lpFilePart=0x0) returned 0x44 [0197.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0197.218] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\e8vhItq tNtLt5TtE.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\e8vhitq tntlt5tte.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x328 [0197.219] GetFileType (hFile=0x328) returned 0x1 [0197.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0197.219] GetFileType (hFile=0x328) returned 0x1 [0197.235] ReadFile (in: hFile=0x328, lpBuffer=0x12521a10, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x12521a10*, lpNumberOfBytesRead=0x14e328*=0x11535, lpOverlapped=0x0) returned 1 [0197.250] WriteFile (in: hFile=0x350, lpBuffer=0x21ef370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x21ef370*, lpNumberOfBytesWritten=0x14e2b8*=0x1000, lpOverlapped=0x0) returned 1 [0197.251] WriteFile (in: hFile=0x350, lpBuffer=0x21f1a48*, nNumberOfBytesToWrite=0x10550, lpNumberOfBytesWritten=0x14e318, lpOverlapped=0x0 | out: lpBuffer=0x21f1a48*, lpNumberOfBytesWritten=0x14e318*=0x10550, lpOverlapped=0x0) returned 1 [0197.253] ReadFile (in: hFile=0x328, lpBuffer=0x12521a10, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x12521a10*, lpNumberOfBytesRead=0x14e328*=0x0, lpOverlapped=0x0) returned 1 [0197.253] CloseHandle (hObject=0x328) returned 1 [0197.253] WriteFile (in: hFile=0x350, lpBuffer=0x21ef370*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e208, lpOverlapped=0x0 | out: lpBuffer=0x21ef370*, lpNumberOfBytesWritten=0x14e208*=0x10, lpOverlapped=0x0) returned 1 [0197.253] CloseHandle (hObject=0x350) returned 1 [0197.256] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\e8vhItq tNtLt5TtE.bmp", nBufferLength=0x105, lpBuffer=0x14de30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\e8vhItq tNtLt5TtE.bmp", lpFilePart=0x0) returned 0x44 [0197.256] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\e8vhItq tNtLt5TtE.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\e8vhitq tntlt5tte.bmp")) returned 1 [0197.259] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\ffD28EQZFv-o1x82.png.ncovid", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\ffD28EQZFv-o1x82.png.ncovid", lpFilePart=0x0) returned 0x4a [0197.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0197.259] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\ffD28EQZFv-o1x82.png.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\ffd28eqzfv-o1x82.png.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0197.259] GetFileType (hFile=0x350) returned 0x1 [0197.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0197.259] GetFileType (hFile=0x350) returned 0x1 [0198.327] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\ffD28EQZFv-o1x82.png", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\ffD28EQZFv-o1x82.png", lpFilePart=0x0) returned 0x43 [0198.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0198.327] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\ffD28EQZFv-o1x82.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\ffd28eqzfv-o1x82.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x368 [0198.327] GetFileType (hFile=0x368) returned 0x1 [0198.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0198.327] GetFileType (hFile=0x368) returned 0x1 [0198.330] ReadFile (in: hFile=0x368, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e328*=0x13acf, lpOverlapped=0x0) returned 1 [0198.344] WriteFile (in: hFile=0x350, lpBuffer=0x22e9eb0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x22e9eb0*, lpNumberOfBytesWritten=0x14e2b8*=0x1000, lpOverlapped=0x0) returned 1 [0198.345] WriteFile (in: hFile=0x350, lpBuffer=0x22ec580*, nNumberOfBytesToWrite=0x12ae0, lpNumberOfBytesWritten=0x14e318, lpOverlapped=0x0 | out: lpBuffer=0x22ec580*, lpNumberOfBytesWritten=0x14e318*=0x12ae0, lpOverlapped=0x0) returned 1 [0198.347] ReadFile (in: hFile=0x368, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e328*=0x0, lpOverlapped=0x0) returned 1 [0198.347] CloseHandle (hObject=0x368) returned 1 [0198.347] WriteFile (in: hFile=0x350, lpBuffer=0x22e9eb0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e208, lpOverlapped=0x0 | out: lpBuffer=0x22e9eb0*, lpNumberOfBytesWritten=0x14e208*=0x10, lpOverlapped=0x0) returned 1 [0198.348] CloseHandle (hObject=0x350) returned 1 [0198.371] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\ffD28EQZFv-o1x82.png", nBufferLength=0x105, lpBuffer=0x14de30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\ffD28EQZFv-o1x82.png", lpFilePart=0x0) returned 0x43 [0198.371] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\ffD28EQZFv-o1x82.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\ffd28eqzfv-o1x82.png")) returned 1 [0198.374] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\Fli1a9fCj4gSy.bmp.ncovid", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\Fli1a9fCj4gSy.bmp.ncovid", lpFilePart=0x0) returned 0x47 [0198.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0198.374] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\Fli1a9fCj4gSy.bmp.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\fli1a9fcj4gsy.bmp.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0198.374] GetFileType (hFile=0x350) returned 0x1 [0198.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0198.374] GetFileType (hFile=0x350) returned 0x1 [0199.482] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\Fli1a9fCj4gSy.bmp", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\Fli1a9fCj4gSy.bmp", lpFilePart=0x0) returned 0x40 [0199.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0199.482] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\Fli1a9fCj4gSy.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\fli1a9fcj4gsy.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x368 [0199.484] GetFileType (hFile=0x368) returned 0x1 [0199.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0199.484] GetFileType (hFile=0x368) returned 0x1 [0199.488] ReadFile (in: hFile=0x368, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e328*=0x7ef3, lpOverlapped=0x0) returned 1 [0199.518] WriteFile (in: hFile=0x350, lpBuffer=0x21d9ad0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x21d9ad0*, lpNumberOfBytesWritten=0x14e2b8*=0x1000, lpOverlapped=0x0) returned 1 [0199.522] WriteFile (in: hFile=0x350, lpBuffer=0x21dc198*, nNumberOfBytesToWrite=0x6f10, lpNumberOfBytesWritten=0x14e318, lpOverlapped=0x0 | out: lpBuffer=0x21dc198*, lpNumberOfBytesWritten=0x14e318*=0x6f10, lpOverlapped=0x0) returned 1 [0199.523] ReadFile (in: hFile=0x368, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e328*=0x0, lpOverlapped=0x0) returned 1 [0199.523] CloseHandle (hObject=0x368) returned 1 [0199.524] WriteFile (in: hFile=0x350, lpBuffer=0x21d9ad0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e208, lpOverlapped=0x0 | out: lpBuffer=0x21d9ad0*, lpNumberOfBytesWritten=0x14e208*=0x10, lpOverlapped=0x0) returned 1 [0199.524] CloseHandle (hObject=0x350) returned 1 [0199.527] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\Fli1a9fCj4gSy.bmp", nBufferLength=0x105, lpBuffer=0x14de30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\Fli1a9fCj4gSy.bmp", lpFilePart=0x0) returned 0x40 [0199.527] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\Fli1a9fCj4gSy.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\fli1a9fcj4gsy.bmp")) returned 1 [0199.532] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\fMtuTrlNKaoFFoK0.bmp.ncovid", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\fMtuTrlNKaoFFoK0.bmp.ncovid", lpFilePart=0x0) returned 0x4a [0199.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0199.532] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\fMtuTrlNKaoFFoK0.bmp.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\fmtutrlnkaoffok0.bmp.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0199.533] GetFileType (hFile=0x350) returned 0x1 [0199.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0199.533] GetFileType (hFile=0x350) returned 0x1 [0200.492] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\fMtuTrlNKaoFFoK0.bmp", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\fMtuTrlNKaoFFoK0.bmp", lpFilePart=0x0) returned 0x43 [0200.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0200.492] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\fMtuTrlNKaoFFoK0.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\fmtutrlnkaoffok0.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x368 [0200.493] GetFileType (hFile=0x368) returned 0x1 [0200.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0200.493] GetFileType (hFile=0x368) returned 0x1 [0200.495] ReadFile (in: hFile=0x368, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e328*=0x1498d, lpOverlapped=0x0) returned 1 [0200.514] WriteFile (in: hFile=0x350, lpBuffer=0x22cae80*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x22cae80*, lpNumberOfBytesWritten=0x14e2b8*=0x1000, lpOverlapped=0x0) returned 1 [0200.515] WriteFile (in: hFile=0x350, lpBuffer=0x22cd550*, nNumberOfBytesToWrite=0x139a0, lpNumberOfBytesWritten=0x14e318, lpOverlapped=0x0 | out: lpBuffer=0x22cd550*, lpNumberOfBytesWritten=0x14e318*=0x139a0, lpOverlapped=0x0) returned 1 [0200.516] ReadFile (in: hFile=0x368, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e328*=0x0, lpOverlapped=0x0) returned 1 [0200.516] CloseHandle (hObject=0x368) returned 1 [0200.516] WriteFile (in: hFile=0x350, lpBuffer=0x22cae80*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e208, lpOverlapped=0x0 | out: lpBuffer=0x22cae80*, lpNumberOfBytesWritten=0x14e208*=0x10, lpOverlapped=0x0) returned 1 [0200.516] CloseHandle (hObject=0x350) returned 1 [0200.519] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\fMtuTrlNKaoFFoK0.bmp", nBufferLength=0x105, lpBuffer=0x14de30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\fMtuTrlNKaoFFoK0.bmp", lpFilePart=0x0) returned 0x43 [0200.519] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\fMtuTrlNKaoFFoK0.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\fmtutrlnkaoffok0.bmp")) returned 1 [0200.523] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\lO0esS 0HHYKS.jpg.ncovid", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\lO0esS 0HHYKS.jpg.ncovid", lpFilePart=0x0) returned 0x47 [0200.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0200.523] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\lO0esS 0HHYKS.jpg.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\lo0ess 0hhyks.jpg.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0200.523] GetFileType (hFile=0x350) returned 0x1 [0200.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0200.523] GetFileType (hFile=0x350) returned 0x1 [0201.612] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\lO0esS 0HHYKS.jpg", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\lO0esS 0HHYKS.jpg", lpFilePart=0x0) returned 0x40 [0201.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0201.612] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\lO0esS 0HHYKS.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\lo0ess 0hhyks.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x368 [0201.613] GetFileType (hFile=0x368) returned 0x1 [0201.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0201.613] GetFileType (hFile=0x368) returned 0x1 [0201.616] ReadFile (in: hFile=0x368, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e328*=0xeea2, lpOverlapped=0x0) returned 1 [0201.631] WriteFile (in: hFile=0x350, lpBuffer=0x21c2d70*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x21c2d70*, lpNumberOfBytesWritten=0x14e2b8*=0x1000, lpOverlapped=0x0) returned 1 [0201.632] WriteFile (in: hFile=0x350, lpBuffer=0x21c5438*, nNumberOfBytesToWrite=0xdec0, lpNumberOfBytesWritten=0x14e318, lpOverlapped=0x0 | out: lpBuffer=0x21c5438*, lpNumberOfBytesWritten=0x14e318*=0xdec0, lpOverlapped=0x0) returned 1 [0201.634] ReadFile (in: hFile=0x368, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e328*=0x0, lpOverlapped=0x0) returned 1 [0201.634] CloseHandle (hObject=0x368) returned 1 [0201.635] WriteFile (in: hFile=0x350, lpBuffer=0x21c2d70*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e208, lpOverlapped=0x0 | out: lpBuffer=0x21c2d70*, lpNumberOfBytesWritten=0x14e208*=0x10, lpOverlapped=0x0) returned 1 [0201.635] CloseHandle (hObject=0x350) returned 1 [0201.638] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\lO0esS 0HHYKS.jpg", nBufferLength=0x105, lpBuffer=0x14de30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\lO0esS 0HHYKS.jpg", lpFilePart=0x0) returned 0x40 [0201.638] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\lO0esS 0HHYKS.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\lo0ess 0hhyks.jpg")) returned 1 [0201.642] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\OgmalY.bmp.ncovid", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\OgmalY.bmp.ncovid", lpFilePart=0x0) returned 0x40 [0201.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0201.642] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\OgmalY.bmp.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\ogmaly.bmp.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0201.655] GetFileType (hFile=0x350) returned 0x1 [0201.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0201.656] GetFileType (hFile=0x350) returned 0x1 [0202.651] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\OgmalY.bmp", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\OgmalY.bmp", lpFilePart=0x0) returned 0x39 [0202.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0202.652] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\OgmalY.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\ogmaly.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x368 [0202.653] GetFileType (hFile=0x368) returned 0x1 [0202.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0202.654] GetFileType (hFile=0x368) returned 0x1 [0202.658] ReadFile (in: hFile=0x368, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e328*=0x14e3c, lpOverlapped=0x0) returned 1 [0202.678] WriteFile (in: hFile=0x350, lpBuffer=0x22bb288*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x22bb288*, lpNumberOfBytesWritten=0x14e2b8*=0x1000, lpOverlapped=0x0) returned 1 [0202.680] WriteFile (in: hFile=0x350, lpBuffer=0x12322980*, nNumberOfBytesToWrite=0x13e50, lpNumberOfBytesWritten=0x14e318, lpOverlapped=0x0 | out: lpBuffer=0x12322980*, lpNumberOfBytesWritten=0x14e318*=0x13e50, lpOverlapped=0x0) returned 1 [0202.682] ReadFile (in: hFile=0x368, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e328*=0x0, lpOverlapped=0x0) returned 1 [0202.682] CloseHandle (hObject=0x368) returned 1 [0202.682] WriteFile (in: hFile=0x350, lpBuffer=0x22bb288*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e208, lpOverlapped=0x0 | out: lpBuffer=0x22bb288*, lpNumberOfBytesWritten=0x14e208*=0x10, lpOverlapped=0x0) returned 1 [0202.683] CloseHandle (hObject=0x350) returned 1 [0202.694] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\OgmalY.bmp", nBufferLength=0x105, lpBuffer=0x14de30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\OgmalY.bmp", lpFilePart=0x0) returned 0x39 [0202.694] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\OgmalY.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\ogmaly.bmp")) returned 1 [0202.703] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\q2MHsGKaQ.png.ncovid", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\q2MHsGKaQ.png.ncovid", lpFilePart=0x0) returned 0x43 [0202.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0202.703] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\q2MHsGKaQ.png.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\q2mhsgkaq.png.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0202.705] GetFileType (hFile=0x350) returned 0x1 [0202.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0202.705] GetFileType (hFile=0x350) returned 0x1 [0203.841] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\q2MHsGKaQ.png", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\q2MHsGKaQ.png", lpFilePart=0x0) returned 0x3c [0203.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0203.841] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\q2MHsGKaQ.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\q2mhsgkaq.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x368 [0203.842] GetFileType (hFile=0x368) returned 0x1 [0203.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0203.842] GetFileType (hFile=0x368) returned 0x1 [0203.845] ReadFile (in: hFile=0x368, lpBuffer=0x12336808, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x12336808*, lpNumberOfBytesRead=0x14e328*=0x76e6, lpOverlapped=0x0) returned 1 [0203.868] WriteFile (in: hFile=0x350, lpBuffer=0x21a4a00*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x21a4a00*, lpNumberOfBytesWritten=0x14e2b8*=0x1000, lpOverlapped=0x0) returned 1 [0203.872] WriteFile (in: hFile=0x350, lpBuffer=0x21a70b8*, nNumberOfBytesToWrite=0x6700, lpNumberOfBytesWritten=0x14e318, lpOverlapped=0x0 | out: lpBuffer=0x21a70b8*, lpNumberOfBytesWritten=0x14e318*=0x6700, lpOverlapped=0x0) returned 1 [0203.875] ReadFile (in: hFile=0x368, lpBuffer=0x12336808, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x12336808*, lpNumberOfBytesRead=0x14e328*=0x0, lpOverlapped=0x0) returned 1 [0203.875] CloseHandle (hObject=0x368) returned 1 [0203.875] WriteFile (in: hFile=0x350, lpBuffer=0x21a4a00*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e208, lpOverlapped=0x0 | out: lpBuffer=0x21a4a00*, lpNumberOfBytesWritten=0x14e208*=0x10, lpOverlapped=0x0) returned 1 [0203.875] CloseHandle (hObject=0x350) returned 1 [0203.879] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\q2MHsGKaQ.png", nBufferLength=0x105, lpBuffer=0x14de30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\q2MHsGKaQ.png", lpFilePart=0x0) returned 0x3c [0203.879] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\q2MHsGKaQ.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\q2mhsgkaq.png")) returned 1 [0203.882] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\rJAWas8pDAbmp.png.ncovid", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\rJAWas8pDAbmp.png.ncovid", lpFilePart=0x0) returned 0x47 [0203.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0203.882] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\rJAWas8pDAbmp.png.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\rjawas8pdabmp.png.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0203.883] GetFileType (hFile=0x350) returned 0x1 [0203.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0203.883] GetFileType (hFile=0x350) returned 0x1 [0205.278] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\rJAWas8pDAbmp.png", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\rJAWas8pDAbmp.png", lpFilePart=0x0) returned 0x40 [0205.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0205.279] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\rJAWas8pDAbmp.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\rjawas8pdabmp.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x368 [0205.281] GetFileType (hFile=0x368) returned 0x1 [0205.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0205.281] GetFileType (hFile=0x368) returned 0x1 [0205.321] ReadFile (in: hFile=0x368, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e328*=0xde97, lpOverlapped=0x0) returned 1 [0205.367] WriteFile (in: hFile=0x350, lpBuffer=0x228c838*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x228c838*, lpNumberOfBytesWritten=0x14e2b8*=0x1000, lpOverlapped=0x0) returned 1 [0205.369] WriteFile (in: hFile=0x350, lpBuffer=0x228ef00*, nNumberOfBytesToWrite=0xceb0, lpNumberOfBytesWritten=0x14e318, lpOverlapped=0x0 | out: lpBuffer=0x228ef00*, lpNumberOfBytesWritten=0x14e318*=0xceb0, lpOverlapped=0x0) returned 1 [0205.370] ReadFile (in: hFile=0x368, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e328*=0x0, lpOverlapped=0x0) returned 1 [0205.370] CloseHandle (hObject=0x368) returned 1 [0205.370] WriteFile (in: hFile=0x350, lpBuffer=0x228c838*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e208, lpOverlapped=0x0 | out: lpBuffer=0x228c838*, lpNumberOfBytesWritten=0x14e208*=0x10, lpOverlapped=0x0) returned 1 [0205.370] CloseHandle (hObject=0x350) returned 1 [0205.386] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\rJAWas8pDAbmp.png", nBufferLength=0x105, lpBuffer=0x14de30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\rJAWas8pDAbmp.png", lpFilePart=0x0) returned 0x40 [0205.386] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\rJAWas8pDAbmp.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\rjawas8pdabmp.png")) returned 1 [0205.391] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\Vnz6_hUjAg9jH3t30.bmp.ncovid", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\Vnz6_hUjAg9jH3t30.bmp.ncovid", lpFilePart=0x0) returned 0x4b [0205.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0205.391] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\Vnz6_hUjAg9jH3t30.bmp.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\vnz6_hujag9jh3t30.bmp.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0205.392] GetFileType (hFile=0x350) returned 0x1 [0205.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0205.392] GetFileType (hFile=0x350) returned 0x1 [0206.411] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\Vnz6_hUjAg9jH3t30.bmp", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\Vnz6_hUjAg9jH3t30.bmp", lpFilePart=0x0) returned 0x44 [0206.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0206.412] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\Vnz6_hUjAg9jH3t30.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\vnz6_hujag9jh3t30.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x368 [0206.413] GetFileType (hFile=0x368) returned 0x1 [0206.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0206.413] GetFileType (hFile=0x368) returned 0x1 [0206.415] ReadFile (in: hFile=0x368, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e328*=0x7af8, lpOverlapped=0x0) returned 1 [0206.432] WriteFile (in: hFile=0x350, lpBuffer=0x2184100*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x2184100*, lpNumberOfBytesWritten=0x14e2b8*=0x1000, lpOverlapped=0x0) returned 1 [0206.433] WriteFile (in: hFile=0x350, lpBuffer=0x21867d8*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x14e318, lpOverlapped=0x0 | out: lpBuffer=0x21867d8*, lpNumberOfBytesWritten=0x14e318*=0x6b10, lpOverlapped=0x0) returned 1 [0206.434] ReadFile (in: hFile=0x368, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e328*=0x0, lpOverlapped=0x0) returned 1 [0206.434] CloseHandle (hObject=0x368) returned 1 [0206.435] WriteFile (in: hFile=0x350, lpBuffer=0x2184100*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e208, lpOverlapped=0x0 | out: lpBuffer=0x2184100*, lpNumberOfBytesWritten=0x14e208*=0x10, lpOverlapped=0x0) returned 1 [0206.435] CloseHandle (hObject=0x350) returned 1 [0206.437] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\Vnz6_hUjAg9jH3t30.bmp", nBufferLength=0x105, lpBuffer=0x14de30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\Vnz6_hUjAg9jH3t30.bmp", lpFilePart=0x0) returned 0x44 [0206.437] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\Vnz6_hUjAg9jH3t30.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\vnz6_hujag9jh3t30.bmp")) returned 1 [0206.442] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\vuyif.gif.ncovid", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\vuyif.gif.ncovid", lpFilePart=0x0) returned 0x3f [0206.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0206.442] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\vuyif.gif.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\vuyif.gif.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0206.444] GetFileType (hFile=0x350) returned 0x1 [0206.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0206.444] GetFileType (hFile=0x350) returned 0x1 [0207.358] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\vuyif.gif", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\vuyif.gif", lpFilePart=0x0) returned 0x38 [0207.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0207.359] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\vuyif.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\vuyif.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x368 [0207.359] GetFileType (hFile=0x368) returned 0x1 [0207.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0207.359] GetFileType (hFile=0x368) returned 0x1 [0207.381] ReadFile (in: hFile=0x368, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e328*=0xa621, lpOverlapped=0x0) returned 1 [0207.395] WriteFile (in: hFile=0x350, lpBuffer=0x2275618*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x2275618*, lpNumberOfBytesWritten=0x14e2b8*=0x1000, lpOverlapped=0x0) returned 1 [0207.397] WriteFile (in: hFile=0x350, lpBuffer=0x2277cc0*, nNumberOfBytesToWrite=0x9640, lpNumberOfBytesWritten=0x14e318, lpOverlapped=0x0 | out: lpBuffer=0x2277cc0*, lpNumberOfBytesWritten=0x14e318*=0x9640, lpOverlapped=0x0) returned 1 [0207.398] ReadFile (in: hFile=0x368, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e328*=0x0, lpOverlapped=0x0) returned 1 [0207.398] CloseHandle (hObject=0x368) returned 1 [0207.398] WriteFile (in: hFile=0x350, lpBuffer=0x2275618*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e208, lpOverlapped=0x0 | out: lpBuffer=0x2275618*, lpNumberOfBytesWritten=0x14e208*=0x10, lpOverlapped=0x0) returned 1 [0207.398] CloseHandle (hObject=0x350) returned 1 [0207.400] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\vuyif.gif", nBufferLength=0x105, lpBuffer=0x14de30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\vuyif.gif", lpFilePart=0x0) returned 0x38 [0207.401] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\vuyif.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\vuyif.gif")) returned 1 [0207.403] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\vwnzeoQ1jDssMQY.gif.ncovid", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\vwnzeoQ1jDssMQY.gif.ncovid", lpFilePart=0x0) returned 0x49 [0207.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0207.403] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\vwnzeoQ1jDssMQY.gif.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\vwnzeoq1jdssmqy.gif.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0207.405] GetFileType (hFile=0x350) returned 0x1 [0207.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0207.405] GetFileType (hFile=0x350) returned 0x1 [0208.461] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\vwnzeoQ1jDssMQY.gif", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\vwnzeoQ1jDssMQY.gif", lpFilePart=0x0) returned 0x42 [0208.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0208.461] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\vwnzeoQ1jDssMQY.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\vwnzeoq1jdssmqy.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x368 [0208.461] GetFileType (hFile=0x368) returned 0x1 [0208.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0208.462] GetFileType (hFile=0x368) returned 0x1 [0208.464] ReadFile (in: hFile=0x368, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e328*=0x89e2, lpOverlapped=0x0) returned 1 [0208.477] WriteFile (in: hFile=0x350, lpBuffer=0x2160360*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x2160360*, lpNumberOfBytesWritten=0x14e2b8*=0x1000, lpOverlapped=0x0) returned 1 [0208.478] WriteFile (in: hFile=0x350, lpBuffer=0x2162a28*, nNumberOfBytesToWrite=0x7a00, lpNumberOfBytesWritten=0x14e318, lpOverlapped=0x0 | out: lpBuffer=0x2162a28*, lpNumberOfBytesWritten=0x14e318*=0x7a00, lpOverlapped=0x0) returned 1 [0208.479] ReadFile (in: hFile=0x368, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e328*=0x0, lpOverlapped=0x0) returned 1 [0208.479] CloseHandle (hObject=0x368) returned 1 [0208.479] WriteFile (in: hFile=0x350, lpBuffer=0x2160360*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e208, lpOverlapped=0x0 | out: lpBuffer=0x2160360*, lpNumberOfBytesWritten=0x14e208*=0x10, lpOverlapped=0x0) returned 1 [0208.479] CloseHandle (hObject=0x350) returned 1 [0208.484] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\vwnzeoQ1jDssMQY.gif", nBufferLength=0x105, lpBuffer=0x14de30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\vwnzeoQ1jDssMQY.gif", lpFilePart=0x0) returned 0x42 [0208.484] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\vwnzeoQ1jDssMQY.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\vwnzeoq1jdssmqy.gif")) returned 1 [0208.488] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\z-t5SKb go1vNMcR4.gif.ncovid", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\z-t5SKb go1vNMcR4.gif.ncovid", lpFilePart=0x0) returned 0x4b [0208.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0208.488] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\z-t5SKb go1vNMcR4.gif.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\z-t5skb go1vnmcr4.gif.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0208.489] GetFileType (hFile=0x350) returned 0x1 [0208.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0208.489] GetFileType (hFile=0x350) returned 0x1 [0209.763] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\z-t5SKb go1vNMcR4.gif", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\z-t5SKb go1vNMcR4.gif", lpFilePart=0x0) returned 0x44 [0209.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0209.764] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\z-t5SKb go1vNMcR4.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\z-t5skb go1vnmcr4.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x368 [0209.764] GetFileType (hFile=0x368) returned 0x1 [0209.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0209.764] GetFileType (hFile=0x368) returned 0x1 [0209.767] ReadFile (in: hFile=0x368, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e328*=0xf59b, lpOverlapped=0x0) returned 1 [0209.787] WriteFile (in: hFile=0x350, lpBuffer=0x22529e0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x22529e0*, lpNumberOfBytesWritten=0x14e2b8*=0x1000, lpOverlapped=0x0) returned 1 [0209.788] WriteFile (in: hFile=0x350, lpBuffer=0x22550b8*, nNumberOfBytesToWrite=0xe5b0, lpNumberOfBytesWritten=0x14e318, lpOverlapped=0x0 | out: lpBuffer=0x22550b8*, lpNumberOfBytesWritten=0x14e318*=0xe5b0, lpOverlapped=0x0) returned 1 [0209.790] ReadFile (in: hFile=0x368, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e328*=0x0, lpOverlapped=0x0) returned 1 [0209.790] CloseHandle (hObject=0x368) returned 1 [0209.790] WriteFile (in: hFile=0x350, lpBuffer=0x22529e0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e208, lpOverlapped=0x0 | out: lpBuffer=0x22529e0*, lpNumberOfBytesWritten=0x14e208*=0x10, lpOverlapped=0x0) returned 1 [0209.790] CloseHandle (hObject=0x350) returned 1 [0209.804] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\z-t5SKb go1vNMcR4.gif", nBufferLength=0x105, lpBuffer=0x14de30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\z-t5SKb go1vNMcR4.gif", lpFilePart=0x0) returned 0x44 [0209.804] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\z-t5SKb go1vNMcR4.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gqvd1cngqqdwgwk\\z-t5skb go1vnmcr4.gif")) returned 1 [0209.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e440) returned 1 [0209.808] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk", nBufferLength=0x105, lpBuffer=0x14df30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk", lpFilePart=0x0) returned 0x2e [0209.808] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\", nBufferLength=0x105, lpBuffer=0x14ded0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\", lpFilePart=0x0) returned 0x2f [0209.809] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gQVD1CNgqQdWgWk\\*", lpFindFileData=0x14e0e0 | out: lpFindFileData=0x14e0e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86645610, ftCreationTime.dwHighDateTime=0x1d7064d, ftLastAccessTime.dwLowDateTime=0x6a1d0a50, ftLastAccessTime.dwHighDateTime=0x1d7090a, ftLastWriteTime.dwLowDateTime=0x857a0c39, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x62c1d0 [0209.810] FindNextFileW (in: hFindFile=0x62c1d0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86645610, ftCreationTime.dwHighDateTime=0x1d7064d, ftLastAccessTime.dwLowDateTime=0x6a1d0a50, ftLastAccessTime.dwHighDateTime=0x1d7090a, ftLastWriteTime.dwLowDateTime=0x857a0c39, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.810] FindNextFileW (in: hFindFile=0x62c1d0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79e7dc30, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x79e7dc30, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x7ade971d, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x7f50, dwReserved0=0x0, dwReserved1=0x0, cFileName="0zlvDRYF 8_DNOz.gif.ncovid", cAlternateFileName="0ZLVDR~1.NCO")) returned 1 [0209.810] FindNextFileW (in: hFindFile=0x62c1d0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7adf6ed9, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x7adf6ed9, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x7bb4e3f5, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x17850, dwReserved0=0x0, dwReserved1=0x0, cFileName="4Sf2rxZ-7lb.gif.ncovid", cAlternateFileName="4SF2RX~1.NCO")) returned 1 [0209.810] FindNextFileW (in: hFindFile=0x62c1d0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bb5b917, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x7bb5b917, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x7ca75498, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x9040, dwReserved0=0x0, dwReserved1=0x0, cFileName="C_3uY_z.gif.ncovid", cAlternateFileName="C_3UY_~1.NCO")) returned 1 [0209.810] FindNextFileW (in: hFindFile=0x62c1d0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ca814a8, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x7ca814a8, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x7d58e96b, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x19010, dwReserved0=0x0, dwReserved1=0x0, cFileName="dYaA_F5bFWX YC4AE.jpg.ncovid", cAlternateFileName="DYAA_F~1.NCO")) returned 1 [0209.811] FindNextFileW (in: hFindFile=0x62c1d0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d59ba3e, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x7d59ba3e, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x7dff0689, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x11560, dwReserved0=0x0, dwReserved1=0x0, cFileName="e8vhItq tNtLt5TtE.bmp.ncovid", cAlternateFileName="E8VHIT~1.NCO")) returned 1 [0209.811] FindNextFileW (in: hFindFile=0x62c1d0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dff890b, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x7dff890b, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x7ea9301f, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x13af0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ffD28EQZFv-o1x82.png.ncovid", cAlternateFileName="FFD28E~1.NCO")) returned 1 [0209.811] FindNextFileW (in: hFindFile=0x62c1d0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ea9a550, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x7ea9a550, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x7f5983e2, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x7f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fli1a9fCj4gSy.bmp.ncovid", cAlternateFileName="FLI1A9~1.NCO")) returned 1 [0209.811] FindNextFileW (in: hFindFile=0x62c1d0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f5a68ca, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x7f5a68ca, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x7ff00e2e, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x149b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fMtuTrlNKaoFFoK0.bmp.ncovid", cAlternateFileName="FMTUTR~1.NCO")) returned 1 [0209.811] FindNextFileW (in: hFindFile=0x62c1d0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ff189b7, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x7ff189b7, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x809ba6c6, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0xeed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lO0esS 0HHYKS.jpg.ncovid", cAlternateFileName="LO0ESS~1.NCO")) returned 1 [0209.811] FindNextFileW (in: hFindFile=0x62c1d0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x809e3d79, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x809e3d79, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x813cb5d1, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x14e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OgmalY.bmp.ncovid", cAlternateFileName="OGMALY~1.NCO")) returned 1 [0209.812] FindNextFileW (in: hFindFile=0x62c1d0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x813e5d19, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x813e5d19, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x81f19246, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x7710, dwReserved0=0x0, dwReserved1=0x0, cFileName="q2MHsGKaQ.png.ncovid", cAlternateFileName="Q2MHSG~1.NCO")) returned 1 [0209.812] FindNextFileW (in: hFindFile=0x62c1d0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f23cbd, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x81f23cbd, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x82d78cdb, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0xdec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rJAWas8pDAbmp.png.ncovid", cAlternateFileName="RJAWAS~1.NCO")) returned 1 [0209.812] FindNextFileW (in: hFindFile=0x62c1d0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d86426, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x82d86426, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x8377e71a, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x7b20, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vnz6_hUjAg9jH3t30.bmp.ncovid", cAlternateFileName="VNZ6_H~1.NCO")) returned 1 [0209.812] FindNextFileW (in: hFindFile=0x62c1d0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8378e8be, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x8378e8be, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x840af353, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0xa650, dwReserved0=0x0, dwReserved1=0x0, cFileName="vuyif.gif.ncovid", cAlternateFileName="VUYIFG~1.NCO")) returned 1 [0209.812] FindNextFileW (in: hFindFile=0x62c1d0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x840b6ee9, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x840b6ee9, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x84b05b00, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x8a10, dwReserved0=0x0, dwReserved1=0x0, cFileName="vwnzeoQ1jDssMQY.gif.ncovid", cAlternateFileName="VWNZEO~1.NCO")) returned 1 [0209.812] FindNextFileW (in: hFindFile=0x62c1d0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84b0f0ff, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x84b0f0ff, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x8579add3, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0xf5c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="z-t5SKb go1vNMcR4.gif.ncovid", cAlternateFileName="Z-T5SK~1.NCO")) returned 1 [0209.812] FindNextFileW (in: hFindFile=0x62c1d0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84b0f0ff, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x84b0f0ff, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x8579add3, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0xf5c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="z-t5SKb go1vNMcR4.gif.ncovid", cAlternateFileName="Z-T5SK~1.NCO")) returned 0 [0209.813] FindClose (in: hFindFile=0x62c1d0 | out: hFindFile=0x62c1d0) returned 1 [0209.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e390) returned 1 [0209.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e350) returned 1 [0209.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e440) returned 1 [0209.813] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures", nBufferLength=0x105, lpBuffer=0x14df30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures", lpFilePart=0x0) returned 0x2d [0209.813] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures\\", nBufferLength=0x105, lpBuffer=0x14ded0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures\\", lpFilePart=0x0) returned 0x2e [0209.813] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures\\*", lpFindFileData=0x14e0e0 | out: lpFindFileData=0x14e0e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x62c1d0 [0209.815] FindNextFileW (in: hFindFile=0x62c1d0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.815] FindNextFileW (in: hFindFile=0x62c1d0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0209.815] FindNextFileW (in: hFindFile=0x62c1d0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.816] FindClose (in: hFindFile=0x62c1d0 | out: hFindFile=0x62c1d0) returned 1 [0209.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e390) returned 1 [0209.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e350) returned 1 [0209.817] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures\\desktop.ini.ncovid", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures\\desktop.ini.ncovid", lpFilePart=0x0) returned 0x40 [0209.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0209.817] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures\\desktop.ini.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\saved pictures\\desktop.ini.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0209.818] GetFileType (hFile=0x350) returned 0x1 [0209.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0209.818] GetFileType (hFile=0x350) returned 0x1 [0210.978] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures\\desktop.ini", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures\\desktop.ini", lpFilePart=0x0) returned 0x39 [0210.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0210.978] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures\\desktop.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\saved pictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x368 [0210.980] GetFileType (hFile=0x368) returned 0x1 [0210.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0210.980] GetFileType (hFile=0x368) returned 0x1 [0210.983] ReadFile (in: hFile=0x368, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e328*=0xbe, lpOverlapped=0x0) returned 1 [0210.998] ReadFile (in: hFile=0x368, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e328*=0x0, lpOverlapped=0x0) returned 1 [0210.998] CloseHandle (hObject=0x368) returned 1 [0210.998] WriteFile (in: hFile=0x350, lpBuffer=0x214f608*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x14e208, lpOverlapped=0x0 | out: lpBuffer=0x214f608*, lpNumberOfBytesWritten=0x14e208*=0xe0, lpOverlapped=0x0) returned 1 [0211.000] CloseHandle (hObject=0x350) returned 1 [0211.003] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures\\desktop.ini", nBufferLength=0x105, lpBuffer=0x14de30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures\\desktop.ini", lpFilePart=0x0) returned 0x39 [0211.003] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures\\desktop.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\saved pictures\\desktop.ini")) returned 1 [0211.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e440) returned 1 [0211.005] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures", nBufferLength=0x105, lpBuffer=0x14df30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures", lpFilePart=0x0) returned 0x2d [0211.005] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures\\", nBufferLength=0x105, lpBuffer=0x14ded0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures\\", lpFilePart=0x0) returned 0x2e [0211.005] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures\\*", lpFindFileData=0x14e0e0 | out: lpFindFileData=0x14e0e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x8630c1b9, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x62bbd0 [0211.005] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x8630c1b9, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.006] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x857bb9d7, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x857bb9d7, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x8630b0cc, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ncovid", cAlternateFileName="DESKTO~1.NCO")) returned 1 [0211.006] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x857bb9d7, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x857bb9d7, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x8630b0cc, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ncovid", cAlternateFileName="DESKTO~1.NCO")) returned 0 [0211.006] FindClose (in: hFindFile=0x62bbd0 | out: hFindFile=0x62bbd0) returned 1 [0211.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e390) returned 1 [0211.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e350) returned 1 [0211.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e4f0) returned 1 [0211.006] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x14dfe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0211.006] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\", nBufferLength=0x105, lpBuffer=0x14df80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\", lpFilePart=0x0) returned 0x20 [0211.007] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\*", lpFindFileData=0x14e190 | out: lpFindFileData=0x14e190*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x55927dd2, ftLastAccessTime.dwHighDateTime=0x1d70a81, ftLastWriteTime.dwLowDateTime=0x55927dd2, ftLastWriteTime.dwHighDateTime=0x1d70a81, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x62bbd0 [0211.007] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x55927dd2, ftLastAccessTime.dwHighDateTime=0x1d70a81, ftLastWriteTime.dwLowDateTime=0x55927dd2, ftLastWriteTime.dwHighDateTime=0x1d70a81, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.007] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87490610, ftCreationTime.dwHighDateTime=0x1d707d4, ftLastAccessTime.dwLowDateTime=0xbc02cfc0, ftLastAccessTime.dwHighDateTime=0x1d70a19, ftLastWriteTime.dwLowDateTime=0xbc02cfc0, ftLastWriteTime.dwHighDateTime=0x1d70a19, nFileSizeHigh=0x0, nFileSizeLow=0xeb4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="0Qov66TFlL71Vr.ods", cAlternateFileName="0QOV66~1.ODS")) returned 1 [0211.008] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97a72900, ftCreationTime.dwHighDateTime=0x1d70384, ftLastAccessTime.dwLowDateTime=0xec5de150, ftLastAccessTime.dwHighDateTime=0x1d707cb, ftLastWriteTime.dwLowDateTime=0xec5de150, ftLastWriteTime.dwHighDateTime=0x1d707cb, nFileSizeHigh=0x0, nFileSizeLow=0x17056, dwReserved0=0x0, dwReserved1=0x0, cFileName="568KyO2WPqAyIkKb6J.xlsx", cAlternateFileName="568KYO~1.XLS")) returned 1 [0211.008] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa4036f0, ftCreationTime.dwHighDateTime=0x1d69d82, ftLastAccessTime.dwLowDateTime=0xe88deb40, ftLastAccessTime.dwHighDateTime=0x1d6c759, ftLastWriteTime.dwLowDateTime=0xe88deb40, ftLastWriteTime.dwHighDateTime=0x1d6c759, nFileSizeHigh=0x0, nFileSizeLow=0x98f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="70YjXp03IqF wav.docx", cAlternateFileName="70YJXP~1.DOC")) returned 1 [0211.008] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bd28b30, ftCreationTime.dwHighDateTime=0x1d6c38b, ftLastAccessTime.dwLowDateTime=0x8cada7c0, ftLastAccessTime.dwHighDateTime=0x1d6ecf2, ftLastWriteTime.dwLowDateTime=0x8cada7c0, ftLastWriteTime.dwHighDateTime=0x1d6ecf2, nFileSizeHigh=0x0, nFileSizeLow=0xe8e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="76lI28SHkOO1S5RZA.pptx", cAlternateFileName="76LI28~1.PPT")) returned 1 [0211.010] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea6e9d0, ftCreationTime.dwHighDateTime=0x1d6fbc5, ftLastAccessTime.dwLowDateTime=0x920115d0, ftLastAccessTime.dwHighDateTime=0x1d7046d, ftLastWriteTime.dwLowDateTime=0x920115d0, ftLastWriteTime.dwHighDateTime=0x1d7046d, nFileSizeHigh=0x0, nFileSizeLow=0x13c42, dwReserved0=0x0, dwReserved1=0x0, cFileName="7p-yfll45o4qAG-.rtf", cAlternateFileName="7P-YFL~1.RTF")) returned 1 [0211.010] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfff69fb0, ftCreationTime.dwHighDateTime=0x1d6fad1, ftLastAccessTime.dwLowDateTime=0x302d6920, ftLastAccessTime.dwHighDateTime=0x1d70284, ftLastWriteTime.dwLowDateTime=0x302d6920, ftLastWriteTime.dwHighDateTime=0x1d70284, nFileSizeHigh=0x0, nFileSizeLow=0xddb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="9duwNE_vpUogUDNE1V.xlsx", cAlternateFileName="9DUWNE~1.XLS")) returned 1 [0211.010] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x971c92d0, ftCreationTime.dwHighDateTime=0x1d6aa0c, ftLastAccessTime.dwLowDateTime=0xf60f7220, ftLastAccessTime.dwHighDateTime=0x1d6e80b, ftLastWriteTime.dwLowDateTime=0xf60f7220, ftLastWriteTime.dwHighDateTime=0x1d6e80b, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x0, dwReserved1=0x0, cFileName="9Jh63.docx", cAlternateFileName="9JH63~1.DOC")) returned 1 [0211.011] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45d77a0, ftCreationTime.dwHighDateTime=0x1d6ca30, ftLastAccessTime.dwLowDateTime=0xd8cd6490, ftLastAccessTime.dwHighDateTime=0x1d6e326, ftLastWriteTime.dwLowDateTime=0xd8cd6490, ftLastWriteTime.dwHighDateTime=0x1d6e326, nFileSizeHigh=0x0, nFileSizeLow=0x105bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="9pqheIL3CaaI.docx", cAlternateFileName="9PQHEI~1.DOC")) returned 1 [0211.011] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0cb0f10, ftCreationTime.dwHighDateTime=0x1d6ff09, ftLastAccessTime.dwLowDateTime=0x8c7818b0, ftLastAccessTime.dwHighDateTime=0x1d70473, ftLastWriteTime.dwLowDateTime=0x8c7818b0, ftLastWriteTime.dwHighDateTime=0x1d70473, nFileSizeHigh=0x0, nFileSizeLow=0x7a46, dwReserved0=0x0, dwReserved1=0x0, cFileName="axFXeggj.pdf", cAlternateFileName="")) returned 1 [0211.011] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x443acf10, ftCreationTime.dwHighDateTime=0x1d6a669, ftLastAccessTime.dwLowDateTime=0x40c686a0, ftLastAccessTime.dwHighDateTime=0x1d6c728, ftLastWriteTime.dwLowDateTime=0x40c686a0, ftLastWriteTime.dwHighDateTime=0x1d6c728, nFileSizeHigh=0x0, nFileSizeLow=0x3902, dwReserved0=0x0, dwReserved1=0x0, cFileName="bTgBDM_BLCIn 9g.pptx", cAlternateFileName="BTGBDM~1.PPT")) returned 1 [0211.011] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0ea3d0, ftCreationTime.dwHighDateTime=0x1d6fc71, ftLastAccessTime.dwLowDateTime=0xc251b5b0, ftLastAccessTime.dwHighDateTime=0x1d700e3, ftLastWriteTime.dwLowDateTime=0xc251b5b0, ftLastWriteTime.dwHighDateTime=0x1d700e3, nFileSizeHigh=0x0, nFileSizeLow=0xbaca, dwReserved0=0x0, dwReserved1=0x0, cFileName="c--oDETPCZEmFkX9R.docx", cAlternateFileName="C--ODE~1.DOC")) returned 1 [0211.011] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9e1cf0, ftCreationTime.dwHighDateTime=0x1d6e3b2, ftLastAccessTime.dwLowDateTime=0x9334c940, ftLastAccessTime.dwHighDateTime=0x1d70a5f, ftLastWriteTime.dwLowDateTime=0x9334c940, ftLastWriteTime.dwHighDateTime=0x1d70a5f, nFileSizeHigh=0x0, nFileSizeLow=0x7b6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="c1uWbuECVbO7GtKW39T.pptx", cAlternateFileName="C1UWBU~1.PPT")) returned 1 [0211.011] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b4d0710, ftCreationTime.dwHighDateTime=0x1d704df, ftLastAccessTime.dwLowDateTime=0xd4d6d8d0, ftLastAccessTime.dwHighDateTime=0x1d7050e, ftLastWriteTime.dwLowDateTime=0xd4d6d8d0, ftLastWriteTime.dwHighDateTime=0x1d7050e, nFileSizeHigh=0x0, nFileSizeLow=0x6be1, dwReserved0=0x0, dwReserved1=0x0, cFileName="cDJMQ767y 9NDJF.csv", cAlternateFileName="CDJMQ7~1.CSV")) returned 1 [0211.012] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67b54b80, ftCreationTime.dwHighDateTime=0x1d69e82, ftLastAccessTime.dwLowDateTime=0x6c132670, ftLastAccessTime.dwHighDateTime=0x1d6b151, ftLastWriteTime.dwLowDateTime=0x6c132670, ftLastWriteTime.dwHighDateTime=0x1d6b151, nFileSizeHigh=0x0, nFileSizeLow=0x128e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="cWSN5bi9vhUj73qO.xlsx", cAlternateFileName="CWSN5B~1.XLS")) returned 1 [0211.012] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43649a85, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43649a85, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x4372e947, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0211.012] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7610370, ftCreationTime.dwHighDateTime=0x1d70924, ftLastAccessTime.dwLowDateTime=0x2adc8270, ftLastAccessTime.dwHighDateTime=0x1d70a1e, ftLastWriteTime.dwLowDateTime=0x2adc8270, ftLastWriteTime.dwHighDateTime=0x1d70a1e, nFileSizeHigh=0x0, nFileSizeLow=0x33e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="e cwv2Je8.docx", cAlternateFileName="ECWV2J~1.DOC")) returned 1 [0211.012] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ddaf8d0, ftCreationTime.dwHighDateTime=0x1d6fbc7, ftLastAccessTime.dwLowDateTime=0xd936abc0, ftLastAccessTime.dwHighDateTime=0x1d6ffc4, ftLastWriteTime.dwLowDateTime=0xd936abc0, ftLastWriteTime.dwHighDateTime=0x1d6ffc4, nFileSizeHigh=0x0, nFileSizeLow=0xa8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="e3we HsPkukwCQ_rD1.pdf", cAlternateFileName="E3WEHS~1.PDF")) returned 1 [0211.012] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57010570, ftCreationTime.dwHighDateTime=0x1d708b0, ftLastAccessTime.dwLowDateTime=0x38c9fff0, ftLastAccessTime.dwHighDateTime=0x1d709b2, ftLastWriteTime.dwLowDateTime=0x38c9fff0, ftLastWriteTime.dwHighDateTime=0x1d709b2, nFileSizeHigh=0x0, nFileSizeLow=0xa1f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="EgsQo0UhXKVeTvl3SU4.xlsx", cAlternateFileName="EGSQO0~1.XLS")) returned 1 [0211.013] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c3420, ftCreationTime.dwHighDateTime=0x1d6b3e9, ftLastAccessTime.dwLowDateTime=0x9299a530, ftLastAccessTime.dwHighDateTime=0x1d6f2ba, ftLastWriteTime.dwLowDateTime=0x9299a530, ftLastWriteTime.dwHighDateTime=0x1d6f2ba, nFileSizeHigh=0x0, nFileSizeLow=0xb97a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ez15cqKrqd8C42.xlsx", cAlternateFileName="EZ15CQ~1.XLS")) returned 1 [0211.013] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fc66690, ftCreationTime.dwHighDateTime=0x1d70716, ftLastAccessTime.dwLowDateTime=0x29856a60, ftLastAccessTime.dwHighDateTime=0x1d7080f, ftLastWriteTime.dwLowDateTime=0x29856a60, ftLastWriteTime.dwHighDateTime=0x1d7080f, nFileSizeHigh=0x0, nFileSizeLow=0x9683, dwReserved0=0x0, dwReserved1=0x0, cFileName="fIJgDYKYDnkfXH1E5C.csv", cAlternateFileName="FIJGDY~1.CSV")) returned 1 [0211.013] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eaeb790, ftCreationTime.dwHighDateTime=0x1d6cb29, ftLastAccessTime.dwLowDateTime=0x266b24e0, ftLastAccessTime.dwHighDateTime=0x1d6da16, ftLastWriteTime.dwLowDateTime=0x266b24e0, ftLastWriteTime.dwHighDateTime=0x1d6da16, nFileSizeHigh=0x0, nFileSizeLow=0x11de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FKV_Um7s1AtkG6SwRc.xlsx", cAlternateFileName="FKV_UM~1.XLS")) returned 1 [0211.013] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ba9020, ftCreationTime.dwHighDateTime=0x1d70205, ftLastAccessTime.dwLowDateTime=0xe4b18bb0, ftLastAccessTime.dwHighDateTime=0x1d706e4, ftLastWriteTime.dwLowDateTime=0xe4b18bb0, ftLastWriteTime.dwHighDateTime=0x1d706e4, nFileSizeHigh=0x0, nFileSizeLow=0x15fb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="fvN5PmwQa.odt", cAlternateFileName="FVN5PM~1.ODT")) returned 1 [0211.013] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb8616f0, ftCreationTime.dwHighDateTime=0x1d6fe5f, ftLastAccessTime.dwLowDateTime=0xbb9b2820, ftLastAccessTime.dwHighDateTime=0x1d70a78, ftLastWriteTime.dwLowDateTime=0xbb9b2820, ftLastWriteTime.dwHighDateTime=0x1d70a78, nFileSizeHigh=0x0, nFileSizeLow=0x2503, dwReserved0=0x0, dwReserved1=0x0, cFileName="HjIAFUmQscCo 2L.ppt", cAlternateFileName="HJIAFU~1.PPT")) returned 1 [0211.013] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4930460, ftCreationTime.dwHighDateTime=0x1d6b624, ftLastAccessTime.dwLowDateTime=0x17b77f70, ftLastAccessTime.dwHighDateTime=0x1d70059, ftLastWriteTime.dwLowDateTime=0x17b77f70, ftLastWriteTime.dwHighDateTime=0x1d70059, nFileSizeHigh=0x0, nFileSizeLow=0xf9dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="hJTYe7eOwos.pptx", cAlternateFileName="HJTYE7~1.PPT")) returned 1 [0211.014] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb12a5cb0, ftCreationTime.dwHighDateTime=0x1d6fd9b, ftLastAccessTime.dwLowDateTime=0xfe5b32d0, ftLastAccessTime.dwHighDateTime=0x1d704cf, ftLastWriteTime.dwLowDateTime=0xfe5b32d0, ftLastWriteTime.dwHighDateTime=0x1d704cf, nFileSizeHigh=0x0, nFileSizeLow=0x8e92, dwReserved0=0x0, dwReserved1=0x0, cFileName="JDRimLeWPyHLTdjUoJ.ppt", cAlternateFileName="JDRIML~1.PPT")) returned 1 [0211.014] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbadb020, ftCreationTime.dwHighDateTime=0x1d7096a, ftLastAccessTime.dwLowDateTime=0x295d6c80, ftLastAccessTime.dwHighDateTime=0x1d7096e, ftLastWriteTime.dwLowDateTime=0x295d6c80, ftLastWriteTime.dwHighDateTime=0x1d7096e, nFileSizeHigh=0x0, nFileSizeLow=0x9cc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ji5Tbajt.xls", cAlternateFileName="")) returned 1 [0211.014] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9b23140, ftCreationTime.dwHighDateTime=0x1d6ff85, ftLastAccessTime.dwLowDateTime=0x8ab6bcd0, ftLastAccessTime.dwHighDateTime=0x1d70959, ftLastWriteTime.dwLowDateTime=0x8ab6bcd0, ftLastWriteTime.dwHighDateTime=0x1d70959, nFileSizeHigh=0x0, nFileSizeLow=0x850b, dwReserved0=0x0, dwReserved1=0x0, cFileName="jXu_ngddt0WmrHz3gEIW.pptx", cAlternateFileName="JXU_NG~1.PPT")) returned 1 [0211.014] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x747f56c0, ftCreationTime.dwHighDateTime=0x1d70594, ftLastAccessTime.dwLowDateTime=0x7a554740, ftLastAccessTime.dwHighDateTime=0x1d70903, ftLastWriteTime.dwLowDateTime=0x7a554740, ftLastWriteTime.dwHighDateTime=0x1d70903, nFileSizeHigh=0x0, nFileSizeLow=0x4291, dwReserved0=0x0, dwReserved1=0x0, cFileName="KtLEO.rtf", cAlternateFileName="")) returned 1 [0211.014] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ff9b20, ftCreationTime.dwHighDateTime=0x1d702dd, ftLastAccessTime.dwLowDateTime=0x165585d0, ftLastAccessTime.dwHighDateTime=0x1d707a9, ftLastWriteTime.dwLowDateTime=0x165585d0, ftLastWriteTime.dwHighDateTime=0x1d707a9, nFileSizeHigh=0x0, nFileSizeLow=0x3d91, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lgwxj.doc", cAlternateFileName="")) returned 1 [0211.014] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6be2710, ftCreationTime.dwHighDateTime=0x1d6fdef, ftLastAccessTime.dwLowDateTime=0xf824e9d0, ftLastAccessTime.dwHighDateTime=0x1d702d4, ftLastWriteTime.dwLowDateTime=0xf824e9d0, ftLastWriteTime.dwHighDateTime=0x1d702d4, nFileSizeHigh=0x0, nFileSizeLow=0x9eb5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mho1kAIrYCh.docx", cAlternateFileName="MHO1KA~1.DOC")) returned 1 [0211.015] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d374e80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d374e80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d374e80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0211.015] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d374e80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d374e80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d374e80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0211.015] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0211.015] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6361c260, ftCreationTime.dwHighDateTime=0x1d6ff86, ftLastAccessTime.dwLowDateTime=0xa1f4e6e0, ftLastAccessTime.dwHighDateTime=0x1d70870, ftLastWriteTime.dwLowDateTime=0xa1f4e6e0, ftLastWriteTime.dwHighDateTime=0x1d70870, nFileSizeHigh=0x0, nFileSizeLow=0x4190, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="n4XNFeLI8Mi4SE.docx", cAlternateFileName="N4XNFE~1.DOC")) returned 1 [0211.016] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99226210, ftCreationTime.dwHighDateTime=0x1d6fec8, ftLastAccessTime.dwLowDateTime=0x27532920, ftLastAccessTime.dwHighDateTime=0x1d70211, ftLastWriteTime.dwLowDateTime=0x27532920, ftLastWriteTime.dwHighDateTime=0x1d70211, nFileSizeHigh=0x0, nFileSizeLow=0x29dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="nnMQFmGNl.xlsx", cAlternateFileName="NNMQFM~1.XLS")) returned 1 [0211.016] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9932670, ftCreationTime.dwHighDateTime=0x1d7017a, ftLastAccessTime.dwLowDateTime=0x99e6d9a0, ftLastAccessTime.dwHighDateTime=0x1d70883, ftLastWriteTime.dwLowDateTime=0x99e6d9a0, ftLastWriteTime.dwHighDateTime=0x1d70883, nFileSizeHigh=0x0, nFileSizeLow=0x122a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NOwnJ6AGI50mPI.pps", cAlternateFileName="NOWNJ6~1.PPS")) returned 1 [0211.016] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4109d340, ftCreationTime.dwHighDateTime=0x1d70839, ftLastAccessTime.dwLowDateTime=0x79b4bf30, ftLastAccessTime.dwHighDateTime=0x1d70a7c, ftLastWriteTime.dwLowDateTime=0x79b4bf30, ftLastWriteTime.dwHighDateTime=0x1d70a7c, nFileSizeHigh=0x0, nFileSizeLow=0x5533, dwReserved0=0x0, dwReserved1=0x0, cFileName="nzlHK8NwMZ86oh.docx", cAlternateFileName="NZLHK8~1.DOC")) returned 1 [0211.016] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd029c010, ftCreationTime.dwHighDateTime=0x1d70872, ftLastAccessTime.dwLowDateTime=0xab6cb150, ftLastAccessTime.dwHighDateTime=0x1d708e1, ftLastWriteTime.dwLowDateTime=0xab6cb150, ftLastWriteTime.dwHighDateTime=0x1d708e1, nFileSizeHigh=0x0, nFileSizeLow=0x16f7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OKqg.pptx", cAlternateFileName="OKQG~1.PPT")) returned 1 [0211.016] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63954f0d, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x65ef9a5c, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x65ef9a5c, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0211.016] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x151fd2b0, ftCreationTime.dwHighDateTime=0x1d702cc, ftLastAccessTime.dwLowDateTime=0x19afa450, ftLastAccessTime.dwHighDateTime=0x1d7059b, ftLastWriteTime.dwLowDateTime=0x19afa450, ftLastWriteTime.dwHighDateTime=0x1d7059b, nFileSizeHigh=0x0, nFileSizeLow=0x17707, dwReserved0=0x0, dwReserved1=0x0, cFileName="pEpUMw_9Zcoad.csv", cAlternateFileName="PEPUMW~1.CSV")) returned 1 [0211.017] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x494f28d0, ftCreationTime.dwHighDateTime=0x1d70905, ftLastAccessTime.dwLowDateTime=0x2518ae90, ftLastAccessTime.dwHighDateTime=0x1d709c9, ftLastWriteTime.dwLowDateTime=0x2518ae90, ftLastWriteTime.dwHighDateTime=0x1d709c9, nFileSizeHigh=0x0, nFileSizeLow=0x1e21, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pxigi.rtf", cAlternateFileName="")) returned 1 [0211.017] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43ad6dd0, ftCreationTime.dwHighDateTime=0x1d703cc, ftLastAccessTime.dwLowDateTime=0x42e89840, ftLastAccessTime.dwHighDateTime=0x1d7056e, ftLastWriteTime.dwLowDateTime=0x42e89840, ftLastWriteTime.dwHighDateTime=0x1d7056e, nFileSizeHigh=0x0, nFileSizeLow=0x11d9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="qes9g8fLDZ.odt", cAlternateFileName="QES9G8~1.ODT")) returned 1 [0211.017] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22e51c00, ftCreationTime.dwHighDateTime=0x1d70774, ftLastAccessTime.dwLowDateTime=0xc2b4ead0, ftLastAccessTime.dwHighDateTime=0x1d70927, ftLastWriteTime.dwLowDateTime=0xc2b4ead0, ftLastWriteTime.dwHighDateTime=0x1d70927, nFileSizeHigh=0x0, nFileSizeLow=0x29b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="QOSULyfBxbm7V7 _F.odt", cAlternateFileName="QOSULY~1.ODT")) returned 1 [0211.017] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c9360, ftCreationTime.dwHighDateTime=0x1d70100, ftLastAccessTime.dwLowDateTime=0xc2e2af80, ftLastAccessTime.dwHighDateTime=0x1d7051f, ftLastWriteTime.dwLowDateTime=0xc2e2af80, ftLastWriteTime.dwHighDateTime=0x1d7051f, nFileSizeHigh=0x0, nFileSizeLow=0x4455, dwReserved0=0x0, dwReserved1=0x0, cFileName="rHZ_lf-3p.docx", cAlternateFileName="RHZ_LF~1.DOC")) returned 1 [0211.017] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe88c65e0, ftCreationTime.dwHighDateTime=0x1d70629, ftLastAccessTime.dwLowDateTime=0x524562f0, ftLastAccessTime.dwHighDateTime=0x1d707d0, ftLastWriteTime.dwLowDateTime=0x524562f0, ftLastWriteTime.dwHighDateTime=0x1d707d0, nFileSizeHigh=0x0, nFileSizeLow=0x4ca6, dwReserved0=0x0, dwReserved1=0x0, cFileName="sD-nmkQy yW.docx", cAlternateFileName="SD-NMK~1.DOC")) returned 1 [0211.017] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39c116d0, ftCreationTime.dwHighDateTime=0x1d705a4, ftLastAccessTime.dwLowDateTime=0x31e24690, ftLastAccessTime.dwHighDateTime=0x1d7088e, ftLastWriteTime.dwLowDateTime=0x31e24690, ftLastWriteTime.dwHighDateTime=0x1d7088e, nFileSizeHigh=0x0, nFileSizeLow=0x17f9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="UjcF5Fxqgs2AfHh9_uwc.doc", cAlternateFileName="UJCF5F~1.DOC")) returned 1 [0211.018] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbf0bf50, ftCreationTime.dwHighDateTime=0x1d6ff4d, ftLastAccessTime.dwLowDateTime=0xfb697330, ftLastAccessTime.dwHighDateTime=0x1d70a37, ftLastWriteTime.dwLowDateTime=0xfb697330, ftLastWriteTime.dwHighDateTime=0x1d70a37, nFileSizeHigh=0x0, nFileSizeLow=0xa88d, dwReserved0=0x0, dwReserved1=0x0, cFileName="uK_cajxxD7q1FH6.docx", cAlternateFileName="UK_CAJ~1.DOC")) returned 1 [0211.018] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2da3c1a0, ftCreationTime.dwHighDateTime=0x1d68ec0, ftLastAccessTime.dwLowDateTime=0xee8f31a0, ftLastAccessTime.dwHighDateTime=0x1d69119, ftLastWriteTime.dwLowDateTime=0xee8f31a0, ftLastWriteTime.dwHighDateTime=0x1d69119, nFileSizeHigh=0x0, nFileSizeLow=0x9eea, dwReserved0=0x0, dwReserved1=0x0, cFileName="VgCrC4n9vd-j-Mu8i.pptx", cAlternateFileName="VGCRC4~1.PPT")) returned 1 [0211.018] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da4f680, ftCreationTime.dwHighDateTime=0x1d6ced7, ftLastAccessTime.dwLowDateTime=0x4216f6e0, ftLastAccessTime.dwHighDateTime=0x1d6f2d7, ftLastWriteTime.dwLowDateTime=0x4216f6e0, ftLastWriteTime.dwHighDateTime=0x1d6f2d7, nFileSizeHigh=0x0, nFileSizeLow=0xc074, dwReserved0=0x0, dwReserved1=0x0, cFileName="VkzL2G-1q5yzVgCvx.docx", cAlternateFileName="VKZL2G~1.DOC")) returned 1 [0211.018] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefbc3200, ftCreationTime.dwHighDateTime=0x1d6fecc, ftLastAccessTime.dwLowDateTime=0x1959dbc0, ftLastAccessTime.dwHighDateTime=0x1d70180, ftLastWriteTime.dwLowDateTime=0x1959dbc0, ftLastWriteTime.dwHighDateTime=0x1d70180, nFileSizeHigh=0x0, nFileSizeLow=0xeda3, dwReserved0=0x0, dwReserved1=0x0, cFileName="XGb73bZ.odt", cAlternateFileName="")) returned 1 [0211.018] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59347060, ftCreationTime.dwHighDateTime=0x1d705b4, ftLastAccessTime.dwLowDateTime=0x4808b530, ftLastAccessTime.dwHighDateTime=0x1d7068b, ftLastWriteTime.dwLowDateTime=0x4808b530, ftLastWriteTime.dwHighDateTime=0x1d7068b, nFileSizeHigh=0x0, nFileSizeLow=0x18686, dwReserved0=0x0, dwReserved1=0x0, cFileName="XuhXtcsvkk4kAz8BQGV3.docx", cAlternateFileName="XUHXTC~1.DOC")) returned 1 [0211.019] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa66ad520, ftCreationTime.dwHighDateTime=0x1d6c0d3, ftLastAccessTime.dwLowDateTime=0x6fd7f860, ftLastAccessTime.dwHighDateTime=0x1d6eee3, ftLastWriteTime.dwLowDateTime=0x6fd7f860, ftLastWriteTime.dwHighDateTime=0x1d6eee3, nFileSizeHigh=0x0, nFileSizeLow=0x14cbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="XzpwLTxYTuIIcq9.xlsx", cAlternateFileName="XZPWLT~1.XLS")) returned 1 [0211.019] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46ed4d20, ftCreationTime.dwHighDateTime=0x1d6fae5, ftLastAccessTime.dwLowDateTime=0x4b749800, ftLastAccessTime.dwHighDateTime=0x1d7008d, ftLastWriteTime.dwLowDateTime=0x4b749800, ftLastWriteTime.dwHighDateTime=0x1d7008d, nFileSizeHigh=0x0, nFileSizeLow=0x14cc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="yGgVErNaD-GX.odp", cAlternateFileName="YGGVER~1.ODP")) returned 1 [0211.019] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60d2c8f0, ftCreationTime.dwHighDateTime=0x1d709e0, ftLastAccessTime.dwLowDateTime=0xc3d08290, ftLastAccessTime.dwHighDateTime=0x1d70a5c, ftLastWriteTime.dwLowDateTime=0xc3d08290, ftLastWriteTime.dwHighDateTime=0x1d70a5c, nFileSizeHigh=0x0, nFileSizeLow=0x27f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yngu.csv", cAlternateFileName="")) returned 1 [0211.019] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0211.019] FindClose (in: hFindFile=0x62bbd0 | out: hFindFile=0x62bbd0) returned 1 [0211.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e440) returned 1 [0211.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e400) returned 1 [0211.021] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0Qov66TFlL71Vr.ods.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\0Qov66TFlL71Vr.ods.ncovid", lpFilePart=0x0) returned 0x39 [0211.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0211.021] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0Qov66TFlL71Vr.ods.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\0qov66tfll71vr.ods.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0211.022] GetFileType (hFile=0x350) returned 0x1 [0211.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0211.022] GetFileType (hFile=0x350) returned 0x1 [0212.090] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0Qov66TFlL71Vr.ods", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\0Qov66TFlL71Vr.ods", lpFilePart=0x0) returned 0x32 [0212.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0212.091] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0Qov66TFlL71Vr.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\0qov66tfll71vr.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x368 [0212.092] GetFileType (hFile=0x368) returned 0x1 [0212.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0212.092] GetFileType (hFile=0x368) returned 0x1 [0212.094] ReadFile (in: hFile=0x368, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0xeb4f, lpOverlapped=0x0) returned 1 [0212.107] WriteFile (in: hFile=0x350, lpBuffer=0x2237d28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x2237d28*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0212.109] WriteFile (in: hFile=0x350, lpBuffer=0x223a3d0*, nNumberOfBytesToWrite=0xdb60, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x223a3d0*, lpNumberOfBytesWritten=0x14e3c8*=0xdb60, lpOverlapped=0x0) returned 1 [0212.111] ReadFile (in: hFile=0x368, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0212.111] CloseHandle (hObject=0x368) returned 1 [0212.111] WriteFile (in: hFile=0x350, lpBuffer=0x2237d28*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x2237d28*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0212.111] CloseHandle (hObject=0x350) returned 1 [0212.116] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0Qov66TFlL71Vr.ods", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\0Qov66TFlL71Vr.ods", lpFilePart=0x0) returned 0x32 [0212.116] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0Qov66TFlL71Vr.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\0qov66tfll71vr.ods")) returned 1 [0212.121] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\568KyO2WPqAyIkKb6J.xlsx.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\568KyO2WPqAyIkKb6J.xlsx.ncovid", lpFilePart=0x0) returned 0x3e [0212.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0212.122] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\568KyO2WPqAyIkKb6J.xlsx.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\568kyo2wpqayikkb6j.xlsx.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0212.123] GetFileType (hFile=0x350) returned 0x1 [0212.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0212.123] GetFileType (hFile=0x350) returned 0x1 [0213.115] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\568KyO2WPqAyIkKb6J.xlsx", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\568KyO2WPqAyIkKb6J.xlsx", lpFilePart=0x0) returned 0x37 [0213.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0213.115] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\568KyO2WPqAyIkKb6J.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\568kyo2wpqayikkb6j.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x368 [0213.116] GetFileType (hFile=0x368) returned 0x1 [0213.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0213.117] GetFileType (hFile=0x368) returned 0x1 [0213.119] ReadFile (in: hFile=0x368, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x17056, lpOverlapped=0x0) returned 1 [0213.141] WriteFile (in: hFile=0x350, lpBuffer=0x2130c48*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x2130c48*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0213.143] WriteFile (in: hFile=0x350, lpBuffer=0x12322980*, nNumberOfBytesToWrite=0x16070, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x12322980*, lpNumberOfBytesWritten=0x14e3c8*=0x16070, lpOverlapped=0x0) returned 1 [0213.145] ReadFile (in: hFile=0x368, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0213.145] CloseHandle (hObject=0x368) returned 1 [0213.146] WriteFile (in: hFile=0x350, lpBuffer=0x2130c48*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x2130c48*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0213.146] CloseHandle (hObject=0x350) returned 1 [0213.232] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\568KyO2WPqAyIkKb6J.xlsx", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\568KyO2WPqAyIkKb6J.xlsx", lpFilePart=0x0) returned 0x37 [0213.232] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\568KyO2WPqAyIkKb6J.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\568kyo2wpqayikkb6j.xlsx")) returned 1 [0213.237] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\70YjXp03IqF wav.docx.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\70YjXp03IqF wav.docx.ncovid", lpFilePart=0x0) returned 0x3b [0213.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0213.237] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\70YjXp03IqF wav.docx.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\70yjxp03iqf wav.docx.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0213.238] GetFileType (hFile=0x350) returned 0x1 [0213.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0213.238] GetFileType (hFile=0x350) returned 0x1 [0214.367] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\70YjXp03IqF wav.docx", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\70YjXp03IqF wav.docx", lpFilePart=0x0) returned 0x34 [0214.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0214.367] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\70YjXp03IqF wav.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\70yjxp03iqf wav.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x368 [0214.368] GetFileType (hFile=0x368) returned 0x1 [0214.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0214.368] GetFileType (hFile=0x368) returned 0x1 [0214.371] ReadFile (in: hFile=0x368, lpBuffer=0x12338a28, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12338a28*, lpNumberOfBytesRead=0x14e3d8*=0x98f9, lpOverlapped=0x0) returned 1 [0214.384] WriteFile (in: hFile=0x350, lpBuffer=0x2219b08*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x2219b08*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0214.386] WriteFile (in: hFile=0x350, lpBuffer=0x221c1c0*, nNumberOfBytesToWrite=0x8910, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x221c1c0*, lpNumberOfBytesWritten=0x14e3c8*=0x8910, lpOverlapped=0x0) returned 1 [0214.387] ReadFile (in: hFile=0x368, lpBuffer=0x12338a28, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12338a28*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0214.387] CloseHandle (hObject=0x368) returned 1 [0214.387] WriteFile (in: hFile=0x350, lpBuffer=0x2219b08*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x2219b08*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0214.387] CloseHandle (hObject=0x350) returned 1 [0214.389] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\70YjXp03IqF wav.docx", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\70YjXp03IqF wav.docx", lpFilePart=0x0) returned 0x34 [0214.390] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\70YjXp03IqF wav.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\70yjxp03iqf wav.docx")) returned 1 [0214.392] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\76lI28SHkOO1S5RZA.pptx.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\76lI28SHkOO1S5RZA.pptx.ncovid", lpFilePart=0x0) returned 0x3d [0214.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0214.392] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\76lI28SHkOO1S5RZA.pptx.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\76li28shkoo1s5rza.pptx.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0214.393] GetFileType (hFile=0x350) returned 0x1 [0214.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0214.393] GetFileType (hFile=0x350) returned 0x1 [0215.554] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\76lI28SHkOO1S5RZA.pptx", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\76lI28SHkOO1S5RZA.pptx", lpFilePart=0x0) returned 0x36 [0215.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0215.555] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\76lI28SHkOO1S5RZA.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\76li28shkoo1s5rza.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x368 [0215.556] GetFileType (hFile=0x368) returned 0x1 [0215.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0215.557] GetFileType (hFile=0x368) returned 0x1 [0215.626] ReadFile (in: hFile=0x368, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0xe8e2, lpOverlapped=0x0) returned 1 [0215.653] WriteFile (in: hFile=0x350, lpBuffer=0x23033e8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x23033e8*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0215.656] WriteFile (in: hFile=0x350, lpBuffer=0x2305aa0*, nNumberOfBytesToWrite=0xd900, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x2305aa0*, lpNumberOfBytesWritten=0x14e3c8*=0xd900, lpOverlapped=0x0) returned 1 [0215.657] ReadFile (in: hFile=0x368, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0215.658] CloseHandle (hObject=0x368) returned 1 [0215.658] WriteFile (in: hFile=0x350, lpBuffer=0x23033e8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x23033e8*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0215.658] CloseHandle (hObject=0x350) returned 1 [0215.662] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\76lI28SHkOO1S5RZA.pptx", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\76lI28SHkOO1S5RZA.pptx", lpFilePart=0x0) returned 0x36 [0215.663] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\76lI28SHkOO1S5RZA.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\76li28shkoo1s5rza.pptx")) returned 1 [0215.668] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\7p-yfll45o4qAG-.rtf.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\7p-yfll45o4qAG-.rtf.ncovid", lpFilePart=0x0) returned 0x3a [0215.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0215.668] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\7p-yfll45o4qAG-.rtf.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\7p-yfll45o4qag-.rtf.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0215.670] GetFileType (hFile=0x350) returned 0x1 [0215.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0215.670] GetFileType (hFile=0x350) returned 0x1 [0216.894] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\7p-yfll45o4qAG-.rtf", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\7p-yfll45o4qAG-.rtf", lpFilePart=0x0) returned 0x33 [0216.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0216.894] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\7p-yfll45o4qAG-.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\7p-yfll45o4qag-.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x368 [0216.895] GetFileType (hFile=0x368) returned 0x1 [0216.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0216.895] GetFileType (hFile=0x368) returned 0x1 [0216.898] ReadFile (in: hFile=0x368, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x13c42, lpOverlapped=0x0) returned 1 [0216.917] WriteFile (in: hFile=0x350, lpBuffer=0x21fbe68*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x21fbe68*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0216.922] WriteFile (in: hFile=0x350, lpBuffer=0x21fe510*, nNumberOfBytesToWrite=0x12c60, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x21fe510*, lpNumberOfBytesWritten=0x14e3c8*=0x12c60, lpOverlapped=0x0) returned 1 [0216.924] ReadFile (in: hFile=0x368, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0216.924] CloseHandle (hObject=0x368) returned 1 [0216.925] WriteFile (in: hFile=0x350, lpBuffer=0x21fbe68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x21fbe68*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0216.925] CloseHandle (hObject=0x350) returned 1 [0216.931] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\7p-yfll45o4qAG-.rtf", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\7p-yfll45o4qAG-.rtf", lpFilePart=0x0) returned 0x33 [0216.931] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\7p-yfll45o4qAG-.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\7p-yfll45o4qag-.rtf")) returned 1 [0216.935] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\9duwNE_vpUogUDNE1V.xlsx.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\9duwNE_vpUogUDNE1V.xlsx.ncovid", lpFilePart=0x0) returned 0x3e [0216.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0216.936] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\9duwNE_vpUogUDNE1V.xlsx.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\9duwne_vpuogudne1v.xlsx.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0216.936] GetFileType (hFile=0x350) returned 0x1 [0216.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0216.936] GetFileType (hFile=0x350) returned 0x1 [0218.040] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\9duwNE_vpUogUDNE1V.xlsx", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\9duwNE_vpUogUDNE1V.xlsx", lpFilePart=0x0) returned 0x37 [0218.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0218.040] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\9duwNE_vpUogUDNE1V.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\9duwne_vpuogudne1v.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0218.041] GetFileType (hFile=0x360) returned 0x1 [0218.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0218.041] GetFileType (hFile=0x360) returned 0x1 [0218.044] ReadFile (in: hFile=0x360, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e3d8*=0xddb3, lpOverlapped=0x0) returned 1 [0218.058] WriteFile (in: hFile=0x350, lpBuffer=0x22f9c68*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x22f9c68*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0218.060] WriteFile (in: hFile=0x350, lpBuffer=0x22fc320*, nNumberOfBytesToWrite=0xcdd0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x22fc320*, lpNumberOfBytesWritten=0x14e3c8*=0xcdd0, lpOverlapped=0x0) returned 1 [0218.061] ReadFile (in: hFile=0x360, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0218.061] CloseHandle (hObject=0x360) returned 1 [0218.062] WriteFile (in: hFile=0x350, lpBuffer=0x22f9c68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x22f9c68*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0218.062] CloseHandle (hObject=0x350) returned 1 [0218.065] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\9duwNE_vpUogUDNE1V.xlsx", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\9duwNE_vpUogUDNE1V.xlsx", lpFilePart=0x0) returned 0x37 [0218.065] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\9duwNE_vpUogUDNE1V.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\9duwne_vpuogudne1v.xlsx")) returned 1 [0218.069] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\9Jh63.docx.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\9Jh63.docx.ncovid", lpFilePart=0x0) returned 0x31 [0218.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0218.069] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\9Jh63.docx.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\9jh63.docx.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0218.070] GetFileType (hFile=0x350) returned 0x1 [0218.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0218.070] GetFileType (hFile=0x350) returned 0x1 [0219.022] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\9Jh63.docx", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\9Jh63.docx", lpFilePart=0x0) returned 0x2a [0219.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0219.023] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\9Jh63.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\9jh63.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0219.023] GetFileType (hFile=0x360) returned 0x1 [0219.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0219.023] GetFileType (hFile=0x360) returned 0x1 [0219.026] ReadFile (in: hFile=0x360, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x493, lpOverlapped=0x0) returned 1 [0219.038] ReadFile (in: hFile=0x360, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0219.039] CloseHandle (hObject=0x360) returned 1 [0219.039] WriteFile (in: hFile=0x350, lpBuffer=0x21e7be8*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x21e7be8*, lpNumberOfBytesWritten=0x14e2b8*=0x4c0, lpOverlapped=0x0) returned 1 [0219.040] CloseHandle (hObject=0x350) returned 1 [0219.046] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\9Jh63.docx", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\9Jh63.docx", lpFilePart=0x0) returned 0x2a [0219.046] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\9Jh63.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\9jh63.docx")) returned 1 [0219.053] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\9pqheIL3CaaI.docx.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\9pqheIL3CaaI.docx.ncovid", lpFilePart=0x0) returned 0x38 [0219.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0219.053] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\9pqheIL3CaaI.docx.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\9pqheil3caai.docx.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0219.054] GetFileType (hFile=0x350) returned 0x1 [0219.054] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0219.054] GetFileType (hFile=0x350) returned 0x1 [0220.202] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\9pqheIL3CaaI.docx", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\9pqheIL3CaaI.docx", lpFilePart=0x0) returned 0x31 [0220.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0220.202] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\9pqheIL3CaaI.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\9pqheil3caai.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0220.203] GetFileType (hFile=0x360) returned 0x1 [0220.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0220.203] GetFileType (hFile=0x360) returned 0x1 [0220.206] ReadFile (in: hFile=0x360, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x105bd, lpOverlapped=0x0) returned 1 [0220.225] WriteFile (in: hFile=0x350, lpBuffer=0x22d2358*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x22d2358*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0220.227] WriteFile (in: hFile=0x350, lpBuffer=0x22d4a00*, nNumberOfBytesToWrite=0xf5d0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x22d4a00*, lpNumberOfBytesWritten=0x14e3c8*=0xf5d0, lpOverlapped=0x0) returned 1 [0220.228] ReadFile (in: hFile=0x360, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0220.229] CloseHandle (hObject=0x360) returned 1 [0220.229] WriteFile (in: hFile=0x350, lpBuffer=0x22d2358*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x22d2358*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0220.229] CloseHandle (hObject=0x350) returned 1 [0220.233] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\9pqheIL3CaaI.docx", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\9pqheIL3CaaI.docx", lpFilePart=0x0) returned 0x31 [0220.233] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\9pqheIL3CaaI.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\9pqheil3caai.docx")) returned 1 [0220.237] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\axFXeggj.pdf.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\axFXeggj.pdf.ncovid", lpFilePart=0x0) returned 0x33 [0220.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0220.237] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\axFXeggj.pdf.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\axfxeggj.pdf.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0220.238] GetFileType (hFile=0x350) returned 0x1 [0220.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0220.238] GetFileType (hFile=0x350) returned 0x1 [0221.457] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\axFXeggj.pdf", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\axFXeggj.pdf", lpFilePart=0x0) returned 0x2c [0221.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0221.457] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\axFXeggj.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\axfxeggj.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0221.458] GetFileType (hFile=0x360) returned 0x1 [0221.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0221.458] GetFileType (hFile=0x360) returned 0x1 [0221.461] ReadFile (in: hFile=0x360, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e3d8*=0x7a46, lpOverlapped=0x0) returned 1 [0221.474] WriteFile (in: hFile=0x350, lpBuffer=0x21ccd70*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x21ccd70*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0221.475] WriteFile (in: hFile=0x350, lpBuffer=0x21cf408*, nNumberOfBytesToWrite=0x6a60, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x21cf408*, lpNumberOfBytesWritten=0x14e3c8*=0x6a60, lpOverlapped=0x0) returned 1 [0221.476] ReadFile (in: hFile=0x360, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0221.476] CloseHandle (hObject=0x360) returned 1 [0221.477] WriteFile (in: hFile=0x350, lpBuffer=0x21ccd70*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x21ccd70*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0221.477] CloseHandle (hObject=0x350) returned 1 [0221.478] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\axFXeggj.pdf", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\axFXeggj.pdf", lpFilePart=0x0) returned 0x2c [0221.479] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\axFXeggj.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\axfxeggj.pdf")) returned 1 [0221.482] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\bTgBDM_BLCIn 9g.pptx.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\bTgBDM_BLCIn 9g.pptx.ncovid", lpFilePart=0x0) returned 0x3b [0221.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0221.483] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\bTgBDM_BLCIn 9g.pptx.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\btgbdm_blcin 9g.pptx.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0221.483] GetFileType (hFile=0x350) returned 0x1 [0221.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0221.483] GetFileType (hFile=0x350) returned 0x1 [0222.551] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\bTgBDM_BLCIn 9g.pptx", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\bTgBDM_BLCIn 9g.pptx", lpFilePart=0x0) returned 0x34 [0222.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0222.551] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\bTgBDM_BLCIn 9g.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\btgbdm_blcin 9g.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0222.552] GetFileType (hFile=0x360) returned 0x1 [0222.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0222.552] GetFileType (hFile=0x360) returned 0x1 [0222.554] ReadFile (in: hFile=0x360, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x3902, lpOverlapped=0x0) returned 1 [0222.587] WriteFile (in: hFile=0x350, lpBuffer=0x22b4798*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x22b4798*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0222.589] WriteFile (in: hFile=0x350, lpBuffer=0x22b6e50*, nNumberOfBytesToWrite=0x2920, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x22b6e50*, lpNumberOfBytesWritten=0x14e3c8*=0x2920, lpOverlapped=0x0) returned 1 [0222.590] ReadFile (in: hFile=0x360, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0222.590] CloseHandle (hObject=0x360) returned 1 [0222.590] WriteFile (in: hFile=0x350, lpBuffer=0x22b4798*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x22b4798*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0222.590] CloseHandle (hObject=0x350) returned 1 [0222.606] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\bTgBDM_BLCIn 9g.pptx", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\bTgBDM_BLCIn 9g.pptx", lpFilePart=0x0) returned 0x34 [0222.606] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\bTgBDM_BLCIn 9g.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\btgbdm_blcin 9g.pptx")) returned 1 [0222.610] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\c--oDETPCZEmFkX9R.docx.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\c--oDETPCZEmFkX9R.docx.ncovid", lpFilePart=0x0) returned 0x3d [0222.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0222.611] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\c--oDETPCZEmFkX9R.docx.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\c--odetpczemfkx9r.docx.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0222.612] GetFileType (hFile=0x350) returned 0x1 [0222.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0222.612] GetFileType (hFile=0x350) returned 0x1 [0223.842] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\c--oDETPCZEmFkX9R.docx", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\c--oDETPCZEmFkX9R.docx", lpFilePart=0x0) returned 0x36 [0223.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0223.843] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\c--oDETPCZEmFkX9R.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\c--odetpczemfkx9r.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0223.844] GetFileType (hFile=0x360) returned 0x1 [0223.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0223.845] GetFileType (hFile=0x360) returned 0x1 [0223.847] ReadFile (in: hFile=0x360, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0xbaca, lpOverlapped=0x0) returned 1 [0223.890] WriteFile (in: hFile=0x350, lpBuffer=0x21a2748*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x21a2748*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0223.892] WriteFile (in: hFile=0x350, lpBuffer=0x21a4e00*, nNumberOfBytesToWrite=0xaae0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x21a4e00*, lpNumberOfBytesWritten=0x14e3c8*=0xaae0, lpOverlapped=0x0) returned 1 [0223.893] ReadFile (in: hFile=0x360, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0223.896] CloseHandle (hObject=0x360) returned 1 [0223.897] WriteFile (in: hFile=0x350, lpBuffer=0x21a2748*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x21a2748*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0223.897] CloseHandle (hObject=0x350) returned 1 [0223.900] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\c--oDETPCZEmFkX9R.docx", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\c--oDETPCZEmFkX9R.docx", lpFilePart=0x0) returned 0x36 [0223.900] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\c--oDETPCZEmFkX9R.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\c--odetpczemfkx9r.docx")) returned 1 [0223.904] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\c1uWbuECVbO7GtKW39T.pptx.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\c1uWbuECVbO7GtKW39T.pptx.ncovid", lpFilePart=0x0) returned 0x3f [0223.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0223.904] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\c1uWbuECVbO7GtKW39T.pptx.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\c1uwbuecvbo7gtkw39t.pptx.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0223.905] GetFileType (hFile=0x350) returned 0x1 [0223.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0223.905] GetFileType (hFile=0x350) returned 0x1 [0224.999] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\c1uWbuECVbO7GtKW39T.pptx", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\c1uWbuECVbO7GtKW39T.pptx", lpFilePart=0x0) returned 0x38 [0224.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0224.999] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\c1uWbuECVbO7GtKW39T.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\c1uwbuecvbo7gtkw39t.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0225.001] GetFileType (hFile=0x360) returned 0x1 [0225.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0225.001] GetFileType (hFile=0x360) returned 0x1 [0225.005] ReadFile (in: hFile=0x360, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e3d8*=0x7b6a, lpOverlapped=0x0) returned 1 [0225.019] WriteFile (in: hFile=0x350, lpBuffer=0x22988f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x22988f8*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0225.021] WriteFile (in: hFile=0x350, lpBuffer=0x229afc0*, nNumberOfBytesToWrite=0x6b80, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x229afc0*, lpNumberOfBytesWritten=0x14e3c8*=0x6b80, lpOverlapped=0x0) returned 1 [0225.022] ReadFile (in: hFile=0x360, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0225.022] CloseHandle (hObject=0x360) returned 1 [0225.023] WriteFile (in: hFile=0x350, lpBuffer=0x22988f8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x22988f8*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0225.023] CloseHandle (hObject=0x350) returned 1 [0225.026] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\c1uWbuECVbO7GtKW39T.pptx", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\c1uWbuECVbO7GtKW39T.pptx", lpFilePart=0x0) returned 0x38 [0225.026] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\c1uWbuECVbO7GtKW39T.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\c1uwbuecvbo7gtkw39t.pptx")) returned 1 [0225.033] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\cDJMQ767y 9NDJF.csv.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\cDJMQ767y 9NDJF.csv.ncovid", lpFilePart=0x0) returned 0x3a [0225.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0225.033] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\cDJMQ767y 9NDJF.csv.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\cdjmq767y 9ndjf.csv.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0225.034] GetFileType (hFile=0x350) returned 0x1 [0225.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0225.034] GetFileType (hFile=0x350) returned 0x1 [0226.152] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\cDJMQ767y 9NDJF.csv", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\cDJMQ767y 9NDJF.csv", lpFilePart=0x0) returned 0x33 [0226.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0226.152] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\cDJMQ767y 9NDJF.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\cdjmq767y 9ndjf.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0226.153] GetFileType (hFile=0x360) returned 0x1 [0226.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0226.153] GetFileType (hFile=0x360) returned 0x1 [0226.155] ReadFile (in: hFile=0x360, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x6be1, lpOverlapped=0x0) returned 1 [0226.167] WriteFile (in: hFile=0x350, lpBuffer=0x2180440*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x2180440*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0226.168] WriteFile (in: hFile=0x350, lpBuffer=0x2182ae8*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x2182ae8*, lpNumberOfBytesWritten=0x14e3c8*=0x5c00, lpOverlapped=0x0) returned 1 [0226.169] ReadFile (in: hFile=0x360, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0226.169] CloseHandle (hObject=0x360) returned 1 [0226.169] WriteFile (in: hFile=0x350, lpBuffer=0x2180440*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x2180440*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0226.170] CloseHandle (hObject=0x350) returned 1 [0226.172] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\cDJMQ767y 9NDJF.csv", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\cDJMQ767y 9NDJF.csv", lpFilePart=0x0) returned 0x33 [0226.172] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\cDJMQ767y 9NDJF.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\cdjmq767y 9ndjf.csv")) returned 1 [0226.175] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\cWSN5bi9vhUj73qO.xlsx.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\cWSN5bi9vhUj73qO.xlsx.ncovid", lpFilePart=0x0) returned 0x3c [0226.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0226.175] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\cWSN5bi9vhUj73qO.xlsx.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\cwsn5bi9vhuj73qo.xlsx.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0226.176] GetFileType (hFile=0x350) returned 0x1 [0226.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0226.176] GetFileType (hFile=0x350) returned 0x1 [0227.319] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\cWSN5bi9vhUj73qO.xlsx", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\cWSN5bi9vhUj73qO.xlsx", lpFilePart=0x0) returned 0x35 [0227.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0227.319] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\cWSN5bi9vhUj73qO.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\cwsn5bi9vhuj73qo.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0227.319] GetFileType (hFile=0x360) returned 0x1 [0227.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0227.319] GetFileType (hFile=0x360) returned 0x1 [0227.329] ReadFile (in: hFile=0x360, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x128e2, lpOverlapped=0x0) returned 1 [0227.343] WriteFile (in: hFile=0x350, lpBuffer=0x2271870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x2271870*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0227.345] WriteFile (in: hFile=0x350, lpBuffer=0x2273f28*, nNumberOfBytesToWrite=0x11900, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x2273f28*, lpNumberOfBytesWritten=0x14e3c8*=0x11900, lpOverlapped=0x0) returned 1 [0227.347] ReadFile (in: hFile=0x360, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0227.347] CloseHandle (hObject=0x360) returned 1 [0227.347] WriteFile (in: hFile=0x350, lpBuffer=0x2271870*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x2271870*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0227.347] CloseHandle (hObject=0x350) returned 1 [0227.351] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\cWSN5bi9vhUj73qO.xlsx", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\cWSN5bi9vhUj73qO.xlsx", lpFilePart=0x0) returned 0x35 [0227.351] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\cWSN5bi9vhUj73qO.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\cwsn5bi9vhuj73qo.xlsx")) returned 1 [0227.391] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\desktop.ini.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\desktop.ini.ncovid", lpFilePart=0x0) returned 0x32 [0227.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0227.391] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\desktop.ini.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\desktop.ini.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0227.391] GetFileType (hFile=0x350) returned 0x1 [0227.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0227.392] GetFileType (hFile=0x350) returned 0x1 [0228.663] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\desktop.ini", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\desktop.ini", lpFilePart=0x0) returned 0x2b [0228.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0228.663] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\desktop.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0228.663] GetFileType (hFile=0x360) returned 0x1 [0228.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0228.663] GetFileType (hFile=0x360) returned 0x1 [0228.666] ReadFile (in: hFile=0x360, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e3d8*=0x192, lpOverlapped=0x0) returned 1 [0228.679] ReadFile (in: hFile=0x360, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0228.679] CloseHandle (hObject=0x360) returned 1 [0228.680] WriteFile (in: hFile=0x350, lpBuffer=0x216ea78*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x216ea78*, lpNumberOfBytesWritten=0x14e2b8*=0x1c0, lpOverlapped=0x0) returned 1 [0228.681] CloseHandle (hObject=0x350) returned 1 [0228.683] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\desktop.ini", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\desktop.ini", lpFilePart=0x0) returned 0x2b [0228.683] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\desktop.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\desktop.ini")) returned 1 [0228.686] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\e cwv2Je8.docx.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\e cwv2Je8.docx.ncovid", lpFilePart=0x0) returned 0x35 [0228.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0228.686] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\e cwv2Je8.docx.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\e cwv2je8.docx.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0228.686] GetFileType (hFile=0x350) returned 0x1 [0228.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0228.687] GetFileType (hFile=0x350) returned 0x1 [0229.762] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\e cwv2Je8.docx", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\e cwv2Je8.docx", lpFilePart=0x0) returned 0x2e [0229.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0229.762] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\e cwv2Je8.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\e cwv2je8.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0229.763] GetFileType (hFile=0x360) returned 0x1 [0229.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0229.763] GetFileType (hFile=0x360) returned 0x1 [0229.765] ReadFile (in: hFile=0x360, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x33e5, lpOverlapped=0x0) returned 1 [0229.777] WriteFile (in: hFile=0x350, lpBuffer=0x224e8d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x224e8d8*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0229.778] WriteFile (in: hFile=0x350, lpBuffer=0x2250f70*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x2250f70*, lpNumberOfBytesWritten=0x14e3c8*=0x2400, lpOverlapped=0x0) returned 1 [0229.779] ReadFile (in: hFile=0x360, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0229.779] CloseHandle (hObject=0x360) returned 1 [0229.779] WriteFile (in: hFile=0x350, lpBuffer=0x224e8d8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x224e8d8*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0229.779] CloseHandle (hObject=0x350) returned 1 [0229.781] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\e cwv2Je8.docx", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\e cwv2Je8.docx", lpFilePart=0x0) returned 0x2e [0229.781] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\e cwv2Je8.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\e cwv2je8.docx")) returned 1 [0229.784] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\e3we HsPkukwCQ_rD1.pdf.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\e3we HsPkukwCQ_rD1.pdf.ncovid", lpFilePart=0x0) returned 0x3d [0229.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0229.784] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\e3we HsPkukwCQ_rD1.pdf.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\e3we hspkukwcq_rd1.pdf.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0229.785] GetFileType (hFile=0x350) returned 0x1 [0229.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0229.785] GetFileType (hFile=0x350) returned 0x1 [0230.926] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\e3we HsPkukwCQ_rD1.pdf", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\e3we HsPkukwCQ_rD1.pdf", lpFilePart=0x0) returned 0x36 [0230.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0230.926] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\e3we HsPkukwCQ_rD1.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\e3we hspkukwcq_rd1.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0230.928] GetFileType (hFile=0x360) returned 0x1 [0230.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0230.928] GetFileType (hFile=0x360) returned 0x1 [0230.931] ReadFile (in: hFile=0x360, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0xa8b, lpOverlapped=0x0) returned 1 [0230.995] ReadFile (in: hFile=0x360, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0230.995] CloseHandle (hObject=0x360) returned 1 [0230.996] WriteFile (in: hFile=0x350, lpBuffer=0x213c7d8*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x213c7d8*, lpNumberOfBytesWritten=0x14e2b8*=0xab0, lpOverlapped=0x0) returned 1 [0230.998] CloseHandle (hObject=0x350) returned 1 [0231.000] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\e3we HsPkukwCQ_rD1.pdf", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\e3we HsPkukwCQ_rD1.pdf", lpFilePart=0x0) returned 0x36 [0231.000] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\e3we HsPkukwCQ_rD1.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\e3we hspkukwcq_rd1.pdf")) returned 1 [0231.007] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\EgsQo0UhXKVeTvl3SU4.xlsx.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\EgsQo0UhXKVeTvl3SU4.xlsx.ncovid", lpFilePart=0x0) returned 0x3f [0231.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0231.007] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\EgsQo0UhXKVeTvl3SU4.xlsx.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\egsqo0uhxkvetvl3su4.xlsx.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0231.008] GetFileType (hFile=0x350) returned 0x1 [0231.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0231.008] GetFileType (hFile=0x350) returned 0x1 [0232.123] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\EgsQo0UhXKVeTvl3SU4.xlsx", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\EgsQo0UhXKVeTvl3SU4.xlsx", lpFilePart=0x0) returned 0x38 [0232.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0232.123] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\EgsQo0UhXKVeTvl3SU4.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\egsqo0uhxkvetvl3su4.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0232.124] GetFileType (hFile=0x360) returned 0x1 [0232.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0232.124] GetFileType (hFile=0x360) returned 0x1 [0232.126] ReadFile (in: hFile=0x360, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e3d8*=0xa1f2, lpOverlapped=0x0) returned 1 [0232.142] WriteFile (in: hFile=0x350, lpBuffer=0x2227e00*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x2227e00*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0232.143] WriteFile (in: hFile=0x350, lpBuffer=0x222a4c8*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x222a4c8*, lpNumberOfBytesWritten=0x14e3c8*=0x9210, lpOverlapped=0x0) returned 1 [0232.145] ReadFile (in: hFile=0x360, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0232.145] CloseHandle (hObject=0x360) returned 1 [0232.145] WriteFile (in: hFile=0x350, lpBuffer=0x2227e00*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x2227e00*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0232.145] CloseHandle (hObject=0x350) returned 1 [0232.156] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\EgsQo0UhXKVeTvl3SU4.xlsx", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\EgsQo0UhXKVeTvl3SU4.xlsx", lpFilePart=0x0) returned 0x38 [0232.156] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\EgsQo0UhXKVeTvl3SU4.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\egsqo0uhxkvetvl3su4.xlsx")) returned 1 [0232.160] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ez15cqKrqd8C42.xlsx.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ez15cqKrqd8C42.xlsx.ncovid", lpFilePart=0x0) returned 0x3a [0232.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0232.160] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ez15cqKrqd8C42.xlsx.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ez15cqkrqd8c42.xlsx.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0232.161] GetFileType (hFile=0x350) returned 0x1 [0232.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0232.161] GetFileType (hFile=0x350) returned 0x1 [0233.330] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ez15cqKrqd8C42.xlsx", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ez15cqKrqd8C42.xlsx", lpFilePart=0x0) returned 0x33 [0233.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0233.330] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ez15cqKrqd8C42.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ez15cqkrqd8c42.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0233.332] GetFileType (hFile=0x360) returned 0x1 [0233.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0233.332] GetFileType (hFile=0x360) returned 0x1 [0233.335] ReadFile (in: hFile=0x360, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0xb97a, lpOverlapped=0x0) returned 1 [0233.353] WriteFile (in: hFile=0x350, lpBuffer=0x2311cc8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x2311cc8*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0233.356] WriteFile (in: hFile=0x350, lpBuffer=0x2314370*, nNumberOfBytesToWrite=0xa990, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x2314370*, lpNumberOfBytesWritten=0x14e3c8*=0xa990, lpOverlapped=0x0) returned 1 [0233.358] ReadFile (in: hFile=0x360, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0233.358] CloseHandle (hObject=0x360) returned 1 [0233.359] WriteFile (in: hFile=0x350, lpBuffer=0x2311cc8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x2311cc8*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0233.359] CloseHandle (hObject=0x350) returned 1 [0233.363] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ez15cqKrqd8C42.xlsx", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ez15cqKrqd8C42.xlsx", lpFilePart=0x0) returned 0x33 [0233.363] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ez15cqKrqd8C42.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ez15cqkrqd8c42.xlsx")) returned 1 [0233.369] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\fIJgDYKYDnkfXH1E5C.csv.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\fIJgDYKYDnkfXH1E5C.csv.ncovid", lpFilePart=0x0) returned 0x3d [0233.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0233.369] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\fIJgDYKYDnkfXH1E5C.csv.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fijgdykydnkfxh1e5c.csv.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0233.370] GetFileType (hFile=0x350) returned 0x1 [0233.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0233.370] GetFileType (hFile=0x350) returned 0x1 [0234.505] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\fIJgDYKYDnkfXH1E5C.csv", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\fIJgDYKYDnkfXH1E5C.csv", lpFilePart=0x0) returned 0x36 [0234.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0234.505] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\fIJgDYKYDnkfXH1E5C.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fijgdykydnkfxh1e5c.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0234.505] GetFileType (hFile=0x360) returned 0x1 [0234.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0234.506] GetFileType (hFile=0x360) returned 0x1 [0234.508] ReadFile (in: hFile=0x360, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x9683, lpOverlapped=0x0) returned 1 [0234.524] WriteFile (in: hFile=0x350, lpBuffer=0x22083f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x22083f0*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0234.526] WriteFile (in: hFile=0x350, lpBuffer=0x220aaa8*, nNumberOfBytesToWrite=0x86a0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x220aaa8*, lpNumberOfBytesWritten=0x14e3c8*=0x86a0, lpOverlapped=0x0) returned 1 [0234.527] ReadFile (in: hFile=0x360, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0234.527] CloseHandle (hObject=0x360) returned 1 [0234.527] WriteFile (in: hFile=0x350, lpBuffer=0x22083f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x22083f0*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0234.528] CloseHandle (hObject=0x350) returned 1 [0234.540] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\fIJgDYKYDnkfXH1E5C.csv", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\fIJgDYKYDnkfXH1E5C.csv", lpFilePart=0x0) returned 0x36 [0234.540] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\fIJgDYKYDnkfXH1E5C.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fijgdykydnkfxh1e5c.csv")) returned 1 [0234.544] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FKV_Um7s1AtkG6SwRc.xlsx.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\FKV_Um7s1AtkG6SwRc.xlsx.ncovid", lpFilePart=0x0) returned 0x3e [0234.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0234.544] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FKV_Um7s1AtkG6SwRc.xlsx.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fkv_um7s1atkg6swrc.xlsx.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0234.546] GetFileType (hFile=0x350) returned 0x1 [0234.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0234.546] GetFileType (hFile=0x350) returned 0x1 [0235.646] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FKV_Um7s1AtkG6SwRc.xlsx", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\FKV_Um7s1AtkG6SwRc.xlsx", lpFilePart=0x0) returned 0x37 [0235.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0235.646] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FKV_Um7s1AtkG6SwRc.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fkv_um7s1atkg6swrc.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0235.646] GetFileType (hFile=0x360) returned 0x1 [0235.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0235.647] GetFileType (hFile=0x360) returned 0x1 [0235.649] ReadFile (in: hFile=0x360, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e3d8*=0x11de8, lpOverlapped=0x0) returned 1 [0235.667] WriteFile (in: hFile=0x350, lpBuffer=0x22fc8c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x22fc8c8*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0235.668] WriteFile (in: hFile=0x350, lpBuffer=0x22fef80*, nNumberOfBytesToWrite=0x10e00, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x22fef80*, lpNumberOfBytesWritten=0x14e3c8*=0x10e00, lpOverlapped=0x0) returned 1 [0235.670] ReadFile (in: hFile=0x360, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0235.670] CloseHandle (hObject=0x360) returned 1 [0235.670] WriteFile (in: hFile=0x350, lpBuffer=0x22fc8c8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x22fc8c8*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0235.671] CloseHandle (hObject=0x350) returned 1 [0235.696] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FKV_Um7s1AtkG6SwRc.xlsx", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\FKV_Um7s1AtkG6SwRc.xlsx", lpFilePart=0x0) returned 0x37 [0235.696] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FKV_Um7s1AtkG6SwRc.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fkv_um7s1atkg6swrc.xlsx")) returned 1 [0235.699] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\fvN5PmwQa.odt.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\fvN5PmwQa.odt.ncovid", lpFilePart=0x0) returned 0x34 [0235.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0235.699] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\fvN5PmwQa.odt.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fvn5pmwqa.odt.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0235.700] GetFileType (hFile=0x350) returned 0x1 [0235.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0235.700] GetFileType (hFile=0x350) returned 0x1 [0236.672] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\fvN5PmwQa.odt", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\fvN5PmwQa.odt", lpFilePart=0x0) returned 0x2d [0236.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0236.672] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\fvN5PmwQa.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fvn5pmwqa.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0236.673] GetFileType (hFile=0x360) returned 0x1 [0236.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0236.673] GetFileType (hFile=0x360) returned 0x1 [0236.675] ReadFile (in: hFile=0x360, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x15fb6, lpOverlapped=0x0) returned 1 [0236.693] WriteFile (in: hFile=0x350, lpBuffer=0x21ee2e0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x21ee2e0*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0236.694] WriteFile (in: hFile=0x350, lpBuffer=0x12222948*, nNumberOfBytesToWrite=0x14fd0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x12222948*, lpNumberOfBytesWritten=0x14e3c8*=0x14fd0, lpOverlapped=0x0) returned 1 [0236.697] ReadFile (in: hFile=0x360, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0236.697] CloseHandle (hObject=0x360) returned 1 [0236.698] WriteFile (in: hFile=0x350, lpBuffer=0x21ee2e0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x21ee2e0*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0236.698] CloseHandle (hObject=0x350) returned 1 [0236.714] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\fvN5PmwQa.odt", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\fvN5PmwQa.odt", lpFilePart=0x0) returned 0x2d [0236.714] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\fvN5PmwQa.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fvn5pmwqa.odt")) returned 1 [0236.719] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\HjIAFUmQscCo 2L.ppt.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\HjIAFUmQscCo 2L.ppt.ncovid", lpFilePart=0x0) returned 0x3a [0236.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0236.719] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\HjIAFUmQscCo 2L.ppt.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\hjiafumqscco 2l.ppt.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0236.720] GetFileType (hFile=0x350) returned 0x1 [0236.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0236.720] GetFileType (hFile=0x350) returned 0x1 [0237.713] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\HjIAFUmQscCo 2L.ppt", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\HjIAFUmQscCo 2L.ppt", lpFilePart=0x0) returned 0x33 [0237.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0237.713] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\HjIAFUmQscCo 2L.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\hjiafumqscco 2l.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0237.714] GetFileType (hFile=0x360) returned 0x1 [0237.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0237.714] GetFileType (hFile=0x360) returned 0x1 [0237.717] ReadFile (in: hFile=0x360, lpBuffer=0x12237950, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12237950*, lpNumberOfBytesRead=0x14e3d8*=0x2503, lpOverlapped=0x0) returned 1 [0237.732] WriteFile (in: hFile=0x350, lpBuffer=0x22d91f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x22d91f8*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0237.734] WriteFile (in: hFile=0x350, lpBuffer=0x22db8a0*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x22db8a0*, lpNumberOfBytesWritten=0x14e3c8*=0x1520, lpOverlapped=0x0) returned 1 [0237.734] ReadFile (in: hFile=0x360, lpBuffer=0x12237950, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12237950*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0237.734] CloseHandle (hObject=0x360) returned 1 [0237.735] WriteFile (in: hFile=0x350, lpBuffer=0x22d91f8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x22d91f8*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0237.735] CloseHandle (hObject=0x350) returned 1 [0237.739] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\HjIAFUmQscCo 2L.ppt", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\HjIAFUmQscCo 2L.ppt", lpFilePart=0x0) returned 0x33 [0237.740] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\HjIAFUmQscCo 2L.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\hjiafumqscco 2l.ppt")) returned 1 [0237.745] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\hJTYe7eOwos.pptx.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\hJTYe7eOwos.pptx.ncovid", lpFilePart=0x0) returned 0x37 [0237.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0237.745] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\hJTYe7eOwos.pptx.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\hjtye7eowos.pptx.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0237.746] GetFileType (hFile=0x350) returned 0x1 [0237.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0237.746] GetFileType (hFile=0x350) returned 0x1 [0239.009] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\hJTYe7eOwos.pptx", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\hJTYe7eOwos.pptx", lpFilePart=0x0) returned 0x30 [0239.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0239.009] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\hJTYe7eOwos.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\hjtye7eowos.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0239.010] GetFileType (hFile=0x360) returned 0x1 [0239.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0239.010] GetFileType (hFile=0x360) returned 0x1 [0239.013] ReadFile (in: hFile=0x360, lpBuffer=0x12337988, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12337988*, lpNumberOfBytesRead=0x14e3d8*=0xf9dd, lpOverlapped=0x0) returned 1 [0239.044] WriteFile (in: hFile=0x350, lpBuffer=0x21c67c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x21c67c8*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0239.046] WriteFile (in: hFile=0x350, lpBuffer=0x21c8e70*, nNumberOfBytesToWrite=0xe9f0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x21c8e70*, lpNumberOfBytesWritten=0x14e3c8*=0xe9f0, lpOverlapped=0x0) returned 1 [0239.048] ReadFile (in: hFile=0x360, lpBuffer=0x12337988, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12337988*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0239.048] CloseHandle (hObject=0x360) returned 1 [0239.048] WriteFile (in: hFile=0x350, lpBuffer=0x21c67c8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x21c67c8*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0239.049] CloseHandle (hObject=0x350) returned 1 [0239.053] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\hJTYe7eOwos.pptx", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\hJTYe7eOwos.pptx", lpFilePart=0x0) returned 0x30 [0239.053] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\hJTYe7eOwos.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\hjtye7eowos.pptx")) returned 1 [0239.059] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\JDRimLeWPyHLTdjUoJ.ppt.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\JDRimLeWPyHLTdjUoJ.ppt.ncovid", lpFilePart=0x0) returned 0x3d [0239.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0239.059] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\JDRimLeWPyHLTdjUoJ.ppt.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\jdrimlewpyhltdjuoj.ppt.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0239.060] GetFileType (hFile=0x350) returned 0x1 [0239.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0239.060] GetFileType (hFile=0x350) returned 0x1 [0240.136] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\JDRimLeWPyHLTdjUoJ.ppt", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\JDRimLeWPyHLTdjUoJ.ppt", lpFilePart=0x0) returned 0x36 [0240.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0240.136] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\JDRimLeWPyHLTdjUoJ.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\jdrimlewpyhltdjuoj.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0240.137] GetFileType (hFile=0x360) returned 0x1 [0240.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0240.137] GetFileType (hFile=0x360) returned 0x1 [0240.141] ReadFile (in: hFile=0x360, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x8e92, lpOverlapped=0x0) returned 1 [0240.156] WriteFile (in: hFile=0x350, lpBuffer=0x22b5b80*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x22b5b80*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0240.158] WriteFile (in: hFile=0x350, lpBuffer=0x22b8238*, nNumberOfBytesToWrite=0x7eb0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x22b8238*, lpNumberOfBytesWritten=0x14e3c8*=0x7eb0, lpOverlapped=0x0) returned 1 [0240.159] ReadFile (in: hFile=0x360, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0240.160] CloseHandle (hObject=0x360) returned 1 [0240.160] WriteFile (in: hFile=0x350, lpBuffer=0x22b5b80*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x22b5b80*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0240.161] CloseHandle (hObject=0x350) returned 1 [0240.165] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\JDRimLeWPyHLTdjUoJ.ppt", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\JDRimLeWPyHLTdjUoJ.ppt", lpFilePart=0x0) returned 0x36 [0240.165] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\JDRimLeWPyHLTdjUoJ.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\jdrimlewpyhltdjuoj.ppt")) returned 1 [0240.169] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ji5Tbajt.xls.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ji5Tbajt.xls.ncovid", lpFilePart=0x0) returned 0x33 [0240.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0240.169] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ji5Tbajt.xls.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ji5tbajt.xls.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0240.170] GetFileType (hFile=0x350) returned 0x1 [0240.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0240.170] GetFileType (hFile=0x350) returned 0x1 [0241.291] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ji5Tbajt.xls", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ji5Tbajt.xls", lpFilePart=0x0) returned 0x2c [0241.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0241.291] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ji5Tbajt.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ji5tbajt.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0241.292] GetFileType (hFile=0x360) returned 0x1 [0241.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0241.292] GetFileType (hFile=0x360) returned 0x1 [0241.295] ReadFile (in: hFile=0x360, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x9cc7, lpOverlapped=0x0) returned 1 [0241.312] WriteFile (in: hFile=0x350, lpBuffer=0x21a9c70*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x21a9c70*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0241.313] WriteFile (in: hFile=0x350, lpBuffer=0x21ac308*, nNumberOfBytesToWrite=0x8ce0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x21ac308*, lpNumberOfBytesWritten=0x14e3c8*=0x8ce0, lpOverlapped=0x0) returned 1 [0241.314] ReadFile (in: hFile=0x360, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0241.314] CloseHandle (hObject=0x360) returned 1 [0241.315] WriteFile (in: hFile=0x350, lpBuffer=0x21a9c70*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x21a9c70*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0241.315] CloseHandle (hObject=0x350) returned 1 [0241.317] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ji5Tbajt.xls", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ji5Tbajt.xls", lpFilePart=0x0) returned 0x2c [0241.318] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ji5Tbajt.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ji5tbajt.xls")) returned 1 [0241.322] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\jXu_ngddt0WmrHz3gEIW.pptx.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\jXu_ngddt0WmrHz3gEIW.pptx.ncovid", lpFilePart=0x0) returned 0x40 [0241.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0241.322] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\jXu_ngddt0WmrHz3gEIW.pptx.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\jxu_ngddt0wmrhz3geiw.pptx.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0241.323] GetFileType (hFile=0x350) returned 0x1 [0241.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0241.323] GetFileType (hFile=0x350) returned 0x1 [0242.218] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\jXu_ngddt0WmrHz3gEIW.pptx", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\jXu_ngddt0WmrHz3gEIW.pptx", lpFilePart=0x0) returned 0x39 [0242.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0242.219] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\jXu_ngddt0WmrHz3gEIW.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\jxu_ngddt0wmrhz3geiw.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0242.219] GetFileType (hFile=0x360) returned 0x1 [0242.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0242.219] GetFileType (hFile=0x360) returned 0x1 [0242.222] ReadFile (in: hFile=0x360, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e3d8*=0x850b, lpOverlapped=0x0) returned 1 [0242.236] WriteFile (in: hFile=0x350, lpBuffer=0x229ebd8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x229ebd8*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0242.237] WriteFile (in: hFile=0x350, lpBuffer=0x22a12a0*, nNumberOfBytesToWrite=0x7520, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x22a12a0*, lpNumberOfBytesWritten=0x14e3c8*=0x7520, lpOverlapped=0x0) returned 1 [0242.238] ReadFile (in: hFile=0x360, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0242.238] CloseHandle (hObject=0x360) returned 1 [0242.238] WriteFile (in: hFile=0x350, lpBuffer=0x229ebd8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x229ebd8*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0242.238] CloseHandle (hObject=0x350) returned 1 [0242.241] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\jXu_ngddt0WmrHz3gEIW.pptx", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\jXu_ngddt0WmrHz3gEIW.pptx", lpFilePart=0x0) returned 0x39 [0242.241] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\jXu_ngddt0WmrHz3gEIW.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\jxu_ngddt0wmrhz3geiw.pptx")) returned 1 [0242.245] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\KtLEO.rtf.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\KtLEO.rtf.ncovid", lpFilePart=0x0) returned 0x30 [0242.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0242.245] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\KtLEO.rtf.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ktleo.rtf.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0242.245] GetFileType (hFile=0x350) returned 0x1 [0242.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0242.246] GetFileType (hFile=0x350) returned 0x1 [0243.173] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\KtLEO.rtf", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\KtLEO.rtf", lpFilePart=0x0) returned 0x29 [0243.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0243.173] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\KtLEO.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ktleo.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0243.173] GetFileType (hFile=0x360) returned 0x1 [0243.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0243.173] GetFileType (hFile=0x360) returned 0x1 [0243.175] ReadFile (in: hFile=0x360, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x4291, lpOverlapped=0x0) returned 1 [0243.187] WriteFile (in: hFile=0x350, lpBuffer=0x2186a78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x2186a78*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0243.188] WriteFile (in: hFile=0x350, lpBuffer=0x2189100*, nNumberOfBytesToWrite=0x32b0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x2189100*, lpNumberOfBytesWritten=0x14e3c8*=0x32b0, lpOverlapped=0x0) returned 1 [0243.191] ReadFile (in: hFile=0x360, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0243.191] CloseHandle (hObject=0x360) returned 1 [0243.191] WriteFile (in: hFile=0x350, lpBuffer=0x2186a78*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x2186a78*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0243.192] CloseHandle (hObject=0x350) returned 1 [0243.200] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\KtLEO.rtf", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\KtLEO.rtf", lpFilePart=0x0) returned 0x29 [0243.200] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\KtLEO.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ktleo.rtf")) returned 1 [0243.204] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lgwxj.doc.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lgwxj.doc.ncovid", lpFilePart=0x0) returned 0x30 [0243.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0243.204] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lgwxj.doc.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lgwxj.doc.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0243.204] GetFileType (hFile=0x350) returned 0x1 [0243.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0243.204] GetFileType (hFile=0x350) returned 0x1 [0244.734] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lgwxj.doc", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lgwxj.doc", lpFilePart=0x0) returned 0x29 [0244.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0244.735] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lgwxj.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lgwxj.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0244.735] GetFileType (hFile=0x360) returned 0x1 [0244.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0244.735] GetFileType (hFile=0x360) returned 0x1 [0244.738] ReadFile (in: hFile=0x360, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x3d91, lpOverlapped=0x0) returned 1 [0244.753] WriteFile (in: hFile=0x350, lpBuffer=0x2276068*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x2276068*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0244.755] WriteFile (in: hFile=0x350, lpBuffer=0x22786f0*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x22786f0*, lpNumberOfBytesWritten=0x14e3c8*=0x2db0, lpOverlapped=0x0) returned 1 [0244.756] ReadFile (in: hFile=0x360, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0244.756] CloseHandle (hObject=0x360) returned 1 [0244.756] WriteFile (in: hFile=0x350, lpBuffer=0x2276068*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x2276068*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0244.756] CloseHandle (hObject=0x350) returned 1 [0244.759] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lgwxj.doc", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lgwxj.doc", lpFilePart=0x0) returned 0x29 [0244.760] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lgwxj.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lgwxj.doc")) returned 1 [0244.764] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Mho1kAIrYCh.docx.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Mho1kAIrYCh.docx.ncovid", lpFilePart=0x0) returned 0x37 [0244.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0244.765] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Mho1kAIrYCh.docx.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\mho1kairych.docx.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0244.766] GetFileType (hFile=0x350) returned 0x1 [0244.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0244.766] GetFileType (hFile=0x350) returned 0x1 [0245.792] ResetEvent (hEvent=0x19c) returned 1 [0245.876] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Mho1kAIrYCh.docx", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Mho1kAIrYCh.docx", lpFilePart=0x0) returned 0x30 [0245.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0245.877] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Mho1kAIrYCh.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\mho1kairych.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0245.878] GetFileType (hFile=0x360) returned 0x1 [0245.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0245.878] GetFileType (hFile=0x360) returned 0x1 [0245.880] ReadFile (in: hFile=0x360, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e3d8*=0x9eb5, lpOverlapped=0x0) returned 1 [0245.893] WriteFile (in: hFile=0x350, lpBuffer=0x21652e0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x21652e0*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0245.894] WriteFile (in: hFile=0x350, lpBuffer=0x2167988*, nNumberOfBytesToWrite=0x8ed0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x2167988*, lpNumberOfBytesWritten=0x14e3c8*=0x8ed0, lpOverlapped=0x0) returned 1 [0245.896] ReadFile (in: hFile=0x360, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0245.896] CloseHandle (hObject=0x360) returned 1 [0245.896] WriteFile (in: hFile=0x350, lpBuffer=0x21652e0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x21652e0*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0245.897] CloseHandle (hObject=0x350) returned 1 [0245.899] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Mho1kAIrYCh.docx", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Mho1kAIrYCh.docx", lpFilePart=0x0) returned 0x30 [0245.899] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Mho1kAIrYCh.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\mho1kairych.docx")) returned 1 [0245.902] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\n4XNFeLI8Mi4SE.docx.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\n4XNFeLI8Mi4SE.docx.ncovid", lpFilePart=0x0) returned 0x3a [0245.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0245.902] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\n4XNFeLI8Mi4SE.docx.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\n4xnfeli8mi4se.docx.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0245.903] GetFileType (hFile=0x350) returned 0x1 [0245.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0245.903] GetFileType (hFile=0x350) returned 0x1 [0246.190] CryptHashData (hHash=0x6580d0, pbData=0x212d960, dwDataLen=0x40, dwFlags=0x0) returned 1 [0246.985] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\n4XNFeLI8Mi4SE.docx", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\n4XNFeLI8Mi4SE.docx", lpFilePart=0x0) returned 0x33 [0246.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0246.985] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\n4XNFeLI8Mi4SE.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\n4xnfeli8mi4se.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0246.985] GetFileType (hFile=0x360) returned 0x1 [0246.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0246.986] GetFileType (hFile=0x360) returned 0x1 [0246.988] ReadFile (in: hFile=0x360, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x4190, lpOverlapped=0x0) returned 1 [0246.998] WriteFile (in: hFile=0x350, lpBuffer=0x224e908*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x224e908*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0246.999] WriteFile (in: hFile=0x350, lpBuffer=0x2250fb0*, nNumberOfBytesToWrite=0x31b0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x2250fb0*, lpNumberOfBytesWritten=0x14e3c8*=0x31b0, lpOverlapped=0x0) returned 1 [0247.000] ReadFile (in: hFile=0x360, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0247.000] CloseHandle (hObject=0x360) returned 1 [0247.000] WriteFile (in: hFile=0x350, lpBuffer=0x224e908*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x224e908*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0247.000] CloseHandle (hObject=0x350) returned 1 [0247.002] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\n4XNFeLI8Mi4SE.docx", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\n4XNFeLI8Mi4SE.docx", lpFilePart=0x0) returned 0x33 [0247.002] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\n4XNFeLI8Mi4SE.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\n4xnfeli8mi4se.docx")) returned 1 [0247.008] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\nnMQFmGNl.xlsx.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\nnMQFmGNl.xlsx.ncovid", lpFilePart=0x0) returned 0x35 [0247.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0247.008] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\nnMQFmGNl.xlsx.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\nnmqfmgnl.xlsx.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0247.009] GetFileType (hFile=0x350) returned 0x1 [0247.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0247.009] GetFileType (hFile=0x350) returned 0x1 [0248.301] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\nnMQFmGNl.xlsx", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\nnMQFmGNl.xlsx", lpFilePart=0x0) returned 0x2e [0248.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0248.302] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\nnMQFmGNl.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\nnmqfmgnl.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0248.302] GetFileType (hFile=0x360) returned 0x1 [0248.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0248.302] GetFileType (hFile=0x360) returned 0x1 [0248.318] ReadFile (in: hFile=0x360, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x29dd, lpOverlapped=0x0) returned 1 [0248.368] WriteFile (in: hFile=0x350, lpBuffer=0x213e170*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x213e170*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0248.369] WriteFile (in: hFile=0x350, lpBuffer=0x2140808*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x2140808*, lpNumberOfBytesWritten=0x14e3c8*=0x19f0, lpOverlapped=0x0) returned 1 [0248.370] ReadFile (in: hFile=0x360, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0248.370] CloseHandle (hObject=0x360) returned 1 [0248.370] WriteFile (in: hFile=0x350, lpBuffer=0x213e170*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x213e170*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0248.370] CloseHandle (hObject=0x350) returned 1 [0248.374] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\nnMQFmGNl.xlsx", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\nnMQFmGNl.xlsx", lpFilePart=0x0) returned 0x2e [0248.374] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\nnMQFmGNl.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\nnmqfmgnl.xlsx")) returned 1 [0248.381] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\NOwnJ6AGI50mPI.pps.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\NOwnJ6AGI50mPI.pps.ncovid", lpFilePart=0x0) returned 0x39 [0248.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0248.382] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\NOwnJ6AGI50mPI.pps.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\nownj6agi50mpi.pps.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0248.382] GetFileType (hFile=0x350) returned 0x1 [0248.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0248.383] GetFileType (hFile=0x350) returned 0x1 [0249.656] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\NOwnJ6AGI50mPI.pps", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\NOwnJ6AGI50mPI.pps", lpFilePart=0x0) returned 0x32 [0249.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0249.657] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\NOwnJ6AGI50mPI.pps" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\nownj6agi50mpi.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0249.657] GetFileType (hFile=0x360) returned 0x1 [0249.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0249.658] GetFileType (hFile=0x360) returned 0x1 [0249.661] ReadFile (in: hFile=0x360, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e3d8*=0x122a1, lpOverlapped=0x0) returned 1 [0249.681] WriteFile (in: hFile=0x350, lpBuffer=0x222c250*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x222c250*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0249.682] WriteFile (in: hFile=0x350, lpBuffer=0x222e8f8*, nNumberOfBytesToWrite=0x112c0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x222e8f8*, lpNumberOfBytesWritten=0x14e3c8*=0x112c0, lpOverlapped=0x0) returned 1 [0249.684] ReadFile (in: hFile=0x360, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0249.684] CloseHandle (hObject=0x360) returned 1 [0249.685] WriteFile (in: hFile=0x350, lpBuffer=0x222c250*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x222c250*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0249.685] CloseHandle (hObject=0x350) returned 1 [0249.706] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\NOwnJ6AGI50mPI.pps", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\NOwnJ6AGI50mPI.pps", lpFilePart=0x0) returned 0x32 [0249.706] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\NOwnJ6AGI50mPI.pps" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\nownj6agi50mpi.pps")) returned 1 [0249.712] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\nzlHK8NwMZ86oh.docx.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\nzlHK8NwMZ86oh.docx.ncovid", lpFilePart=0x0) returned 0x3a [0249.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0249.712] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\nzlHK8NwMZ86oh.docx.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\nzlhk8nwmz86oh.docx.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0249.713] GetFileType (hFile=0x350) returned 0x1 [0249.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0249.713] GetFileType (hFile=0x350) returned 0x1 [0250.723] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\nzlHK8NwMZ86oh.docx", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\nzlHK8NwMZ86oh.docx", lpFilePart=0x0) returned 0x33 [0250.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0250.725] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\nzlHK8NwMZ86oh.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\nzlhk8nwmz86oh.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0250.725] GetFileType (hFile=0x360) returned 0x1 [0250.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0250.725] GetFileType (hFile=0x360) returned 0x1 [0250.727] ReadFile (in: hFile=0x360, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x5533, lpOverlapped=0x0) returned 1 [0250.739] WriteFile (in: hFile=0x350, lpBuffer=0x231dba0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x231dba0*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0250.740] WriteFile (in: hFile=0x350, lpBuffer=0x2320248*, nNumberOfBytesToWrite=0x4550, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x2320248*, lpNumberOfBytesWritten=0x14e3c8*=0x4550, lpOverlapped=0x0) returned 1 [0250.741] ReadFile (in: hFile=0x360, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0250.741] CloseHandle (hObject=0x360) returned 1 [0250.741] WriteFile (in: hFile=0x350, lpBuffer=0x231dba0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x231dba0*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0250.741] CloseHandle (hObject=0x350) returned 1 [0250.744] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\nzlHK8NwMZ86oh.docx", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\nzlHK8NwMZ86oh.docx", lpFilePart=0x0) returned 0x33 [0250.744] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\nzlHK8NwMZ86oh.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\nzlhk8nwmz86oh.docx")) returned 1 [0250.749] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\OKqg.pptx.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\OKqg.pptx.ncovid", lpFilePart=0x0) returned 0x30 [0250.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0250.749] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\OKqg.pptx.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\okqg.pptx.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0250.750] GetFileType (hFile=0x350) returned 0x1 [0250.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0250.750] GetFileType (hFile=0x350) returned 0x1 [0251.791] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\OKqg.pptx", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\OKqg.pptx", lpFilePart=0x0) returned 0x29 [0251.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0251.791] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\OKqg.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\okqg.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0251.792] GetFileType (hFile=0x360) returned 0x1 [0251.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0251.792] GetFileType (hFile=0x360) returned 0x1 [0251.795] ReadFile (in: hFile=0x360, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x16f7a, lpOverlapped=0x0) returned 1 [0251.816] WriteFile (in: hFile=0x350, lpBuffer=0x220e9a0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x220e9a0*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0251.818] WriteFile (in: hFile=0x350, lpBuffer=0x12322980*, nNumberOfBytesToWrite=0x15f90, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x12322980*, lpNumberOfBytesWritten=0x14e3c8*=0x15f90, lpOverlapped=0x0) returned 1 [0251.820] ReadFile (in: hFile=0x360, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0251.820] CloseHandle (hObject=0x360) returned 1 [0251.820] WriteFile (in: hFile=0x350, lpBuffer=0x220e9a0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x220e9a0*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0251.821] CloseHandle (hObject=0x350) returned 1 [0251.826] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\OKqg.pptx", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\OKqg.pptx", lpFilePart=0x0) returned 0x29 [0251.826] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\OKqg.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\okqg.pptx")) returned 1 [0251.830] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pEpUMw_9Zcoad.csv.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\pEpUMw_9Zcoad.csv.ncovid", lpFilePart=0x0) returned 0x38 [0251.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0251.830] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pEpUMw_9Zcoad.csv.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\pepumw_9zcoad.csv.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0251.831] GetFileType (hFile=0x350) returned 0x1 [0251.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0251.832] GetFileType (hFile=0x350) returned 0x1 [0252.873] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pEpUMw_9Zcoad.csv", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\pEpUMw_9Zcoad.csv", lpFilePart=0x0) returned 0x31 [0252.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0252.873] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pEpUMw_9Zcoad.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\pepumw_9zcoad.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0252.874] GetFileType (hFile=0x360) returned 0x1 [0252.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0252.874] GetFileType (hFile=0x360) returned 0x1 [0252.878] ReadFile (in: hFile=0x360, lpBuffer=0x12338948, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12338948*, lpNumberOfBytesRead=0x14e3d8*=0x17707, lpOverlapped=0x0) returned 1 [0252.901] WriteFile (in: hFile=0x350, lpBuffer=0x212dd48*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x212dd48*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0252.902] WriteFile (in: hFile=0x350, lpBuffer=0x12122910*, nNumberOfBytesToWrite=0x16720, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x12122910*, lpNumberOfBytesWritten=0x14e3c8*=0x16720, lpOverlapped=0x0) returned 1 [0252.904] ReadFile (in: hFile=0x360, lpBuffer=0x12338948, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12338948*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0252.904] CloseHandle (hObject=0x360) returned 1 [0252.904] WriteFile (in: hFile=0x350, lpBuffer=0x212dd48*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x212dd48*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0252.905] CloseHandle (hObject=0x350) returned 1 [0253.104] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pEpUMw_9Zcoad.csv", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\pEpUMw_9Zcoad.csv", lpFilePart=0x0) returned 0x31 [0253.105] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pEpUMw_9Zcoad.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\pepumw_9zcoad.csv")) returned 1 [0253.118] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Pxigi.rtf.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Pxigi.rtf.ncovid", lpFilePart=0x0) returned 0x30 [0253.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0253.118] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Pxigi.rtf.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\pxigi.rtf.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0253.121] GetFileType (hFile=0x350) returned 0x1 [0253.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0253.121] GetFileType (hFile=0x350) returned 0x1 [0254.570] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Pxigi.rtf", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Pxigi.rtf", lpFilePart=0x0) returned 0x29 [0254.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0254.571] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Pxigi.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\pxigi.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0254.628] GetFileType (hFile=0x360) returned 0x1 [0254.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0254.628] GetFileType (hFile=0x360) returned 0x1 [0254.633] ReadFile (in: hFile=0x360, lpBuffer=0x12139068, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12139068*, lpNumberOfBytesRead=0x14e3d8*=0x1e21, lpOverlapped=0x0) returned 1 [0254.636] WriteFile (in: hFile=0x350, lpBuffer=0x22183f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x22183f8*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0254.639] ReadFile (in: hFile=0x360, lpBuffer=0x12139068, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12139068*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0254.640] CloseHandle (hObject=0x360) returned 1 [0254.640] WriteFile (in: hFile=0x350, lpBuffer=0x22183f8*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x22183f8*, lpNumberOfBytesWritten=0x14e2b8*=0xe50, lpOverlapped=0x0) returned 1 [0254.641] CloseHandle (hObject=0x350) returned 1 [0254.648] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Pxigi.rtf", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Pxigi.rtf", lpFilePart=0x0) returned 0x29 [0254.648] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Pxigi.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\pxigi.rtf")) returned 1 [0254.655] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\qes9g8fLDZ.odt.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\qes9g8fLDZ.odt.ncovid", lpFilePart=0x0) returned 0x35 [0254.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0254.655] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\qes9g8fLDZ.odt.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qes9g8fldz.odt.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0254.656] GetFileType (hFile=0x350) returned 0x1 [0254.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0254.657] GetFileType (hFile=0x350) returned 0x1 [0256.003] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\qes9g8fLDZ.odt", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\qes9g8fLDZ.odt", lpFilePart=0x0) returned 0x2e [0256.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0256.003] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\qes9g8fLDZ.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qes9g8fldz.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0256.005] GetFileType (hFile=0x360) returned 0x1 [0256.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0256.005] GetFileType (hFile=0x360) returned 0x1 [0256.008] ReadFile (in: hFile=0x360, lpBuffer=0x12438980, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12438980*, lpNumberOfBytesRead=0x14e3d8*=0x11d9b, lpOverlapped=0x0) returned 1 [0256.028] WriteFile (in: hFile=0x350, lpBuffer=0x2305ca0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x2305ca0*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0256.031] WriteFile (in: hFile=0x350, lpBuffer=0x2308338*, nNumberOfBytesToWrite=0x10db0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x2308338*, lpNumberOfBytesWritten=0x14e3c8*=0x10db0, lpOverlapped=0x0) returned 1 [0256.033] ReadFile (in: hFile=0x360, lpBuffer=0x12438980, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12438980*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0256.033] CloseHandle (hObject=0x360) returned 1 [0256.033] WriteFile (in: hFile=0x350, lpBuffer=0x2305ca0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x2305ca0*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0256.033] CloseHandle (hObject=0x350) returned 1 [0256.039] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\qes9g8fLDZ.odt", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\qes9g8fLDZ.odt", lpFilePart=0x0) returned 0x2e [0256.039] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\qes9g8fLDZ.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qes9g8fldz.odt")) returned 1 [0256.045] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\QOSULyfBxbm7V7 _F.odt.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\QOSULyfBxbm7V7 _F.odt.ncovid", lpFilePart=0x0) returned 0x3c [0256.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0256.045] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\QOSULyfBxbm7V7 _F.odt.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qosulyfbxbm7v7 _f.odt.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0256.046] GetFileType (hFile=0x350) returned 0x1 [0256.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0256.046] GetFileType (hFile=0x350) returned 0x1 [0257.031] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\QOSULyfBxbm7V7 _F.odt", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\QOSULyfBxbm7V7 _F.odt", lpFilePart=0x0) returned 0x35 [0257.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0257.032] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\QOSULyfBxbm7V7 _F.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qosulyfbxbm7v7 _f.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0257.033] GetFileType (hFile=0x360) returned 0x1 [0257.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0257.033] GetFileType (hFile=0x360) returned 0x1 [0257.036] ReadFile (in: hFile=0x360, lpBuffer=0x125389b8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x125389b8*, lpNumberOfBytesRead=0x14e3d8*=0x29b8, lpOverlapped=0x0) returned 1 [0257.049] WriteFile (in: hFile=0x350, lpBuffer=0x22036b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x22036b0*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0257.051] WriteFile (in: hFile=0x350, lpBuffer=0x2205d68*, nNumberOfBytesToWrite=0x19d0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x2205d68*, lpNumberOfBytesWritten=0x14e3c8*=0x19d0, lpOverlapped=0x0) returned 1 [0257.052] ReadFile (in: hFile=0x360, lpBuffer=0x125389b8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x125389b8*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0257.052] CloseHandle (hObject=0x360) returned 1 [0257.052] WriteFile (in: hFile=0x350, lpBuffer=0x22036b0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x22036b0*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0257.052] CloseHandle (hObject=0x350) returned 1 [0258.493] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\QOSULyfBxbm7V7 _F.odt", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\QOSULyfBxbm7V7 _F.odt", lpFilePart=0x0) returned 0x35 [0258.493] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\QOSULyfBxbm7V7 _F.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qosulyfbxbm7v7 _f.odt")) returned 1 [0258.500] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\rHZ_lf-3p.docx.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\rHZ_lf-3p.docx.ncovid", lpFilePart=0x0) returned 0x35 [0258.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0258.500] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\rHZ_lf-3p.docx.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\rhz_lf-3p.docx.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0258.501] GetFileType (hFile=0x350) returned 0x1 [0258.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0258.501] GetFileType (hFile=0x350) returned 0x1 [0259.554] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\rHZ_lf-3p.docx", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\rHZ_lf-3p.docx", lpFilePart=0x0) returned 0x2e [0259.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0259.554] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\rHZ_lf-3p.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\rhz_lf-3p.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x368 [0259.555] GetFileType (hFile=0x368) returned 0x1 [0259.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0259.555] GetFileType (hFile=0x368) returned 0x1 [0259.558] ReadFile (in: hFile=0x368, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x4455, lpOverlapped=0x0) returned 1 [0259.570] WriteFile (in: hFile=0x350, lpBuffer=0x22f14e0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x22f14e0*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0259.572] WriteFile (in: hFile=0x350, lpBuffer=0x22f3b78*, nNumberOfBytesToWrite=0x3470, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x22f3b78*, lpNumberOfBytesWritten=0x14e3c8*=0x3470, lpOverlapped=0x0) returned 1 [0259.573] ReadFile (in: hFile=0x368, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0259.573] CloseHandle (hObject=0x368) returned 1 [0259.573] WriteFile (in: hFile=0x350, lpBuffer=0x22f14e0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x22f14e0*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0259.573] CloseHandle (hObject=0x350) returned 1 [0259.718] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\rHZ_lf-3p.docx", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\rHZ_lf-3p.docx", lpFilePart=0x0) returned 0x2e [0259.718] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\rHZ_lf-3p.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\rhz_lf-3p.docx")) returned 1 [0259.727] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\sD-nmkQy yW.docx.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\sD-nmkQy yW.docx.ncovid", lpFilePart=0x0) returned 0x37 [0259.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0259.727] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\sD-nmkQy yW.docx.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\sd-nmkqy yw.docx.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0259.728] GetFileType (hFile=0x350) returned 0x1 [0259.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0259.728] GetFileType (hFile=0x350) returned 0x1 [0260.812] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\sD-nmkQy yW.docx", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\sD-nmkQy yW.docx", lpFilePart=0x0) returned 0x30 [0260.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0260.812] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\sD-nmkQy yW.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\sd-nmkqy yw.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x368 [0260.814] GetFileType (hFile=0x368) returned 0x1 [0260.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0260.814] GetFileType (hFile=0x368) returned 0x1 [0260.817] ReadFile (in: hFile=0x368, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x4ca6, lpOverlapped=0x0) returned 1 [0260.835] WriteFile (in: hFile=0x350, lpBuffer=0x21cd930*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x21cd930*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0260.837] WriteFile (in: hFile=0x350, lpBuffer=0x21cffd8*, nNumberOfBytesToWrite=0x3cc0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x21cffd8*, lpNumberOfBytesWritten=0x14e3c8*=0x3cc0, lpOverlapped=0x0) returned 1 [0260.838] ReadFile (in: hFile=0x368, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0260.838] CloseHandle (hObject=0x368) returned 1 [0260.839] WriteFile (in: hFile=0x350, lpBuffer=0x21cd930*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x21cd930*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0260.839] CloseHandle (hObject=0x350) returned 1 [0260.842] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\sD-nmkQy yW.docx", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\sD-nmkQy yW.docx", lpFilePart=0x0) returned 0x30 [0260.842] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\sD-nmkQy yW.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\sd-nmkqy yw.docx")) returned 1 [0260.846] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\UjcF5Fxqgs2AfHh9_uwc.doc.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\UjcF5Fxqgs2AfHh9_uwc.doc.ncovid", lpFilePart=0x0) returned 0x3f [0260.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0260.846] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\UjcF5Fxqgs2AfHh9_uwc.doc.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ujcf5fxqgs2afhh9_uwc.doc.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0260.847] GetFileType (hFile=0x350) returned 0x1 [0260.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0260.847] GetFileType (hFile=0x350) returned 0x1 [0262.063] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\UjcF5Fxqgs2AfHh9_uwc.doc", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\UjcF5Fxqgs2AfHh9_uwc.doc", lpFilePart=0x0) returned 0x38 [0262.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0262.063] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\UjcF5Fxqgs2AfHh9_uwc.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ujcf5fxqgs2afhh9_uwc.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x368 [0262.065] GetFileType (hFile=0x368) returned 0x1 [0262.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0262.065] GetFileType (hFile=0x368) returned 0x1 [0262.068] ReadFile (in: hFile=0x368, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e3d8*=0x17f9f, lpOverlapped=0x0) returned 1 [0262.134] WriteFile (in: hFile=0x350, lpBuffer=0x212df60*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x212df60*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0262.136] WriteFile (in: hFile=0x350, lpBuffer=0x12122910*, nNumberOfBytesToWrite=0x16fb0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x12122910*, lpNumberOfBytesWritten=0x14e3c8*=0x16fb0, lpOverlapped=0x0) returned 1 [0262.139] ReadFile (in: hFile=0x368, lpBuffer=0x123219a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x123219a0*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0262.139] CloseHandle (hObject=0x368) returned 1 [0262.139] WriteFile (in: hFile=0x350, lpBuffer=0x212df60*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x212df60*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0262.140] CloseHandle (hObject=0x350) returned 1 [0262.149] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\UjcF5Fxqgs2AfHh9_uwc.doc", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\UjcF5Fxqgs2AfHh9_uwc.doc", lpFilePart=0x0) returned 0x38 [0262.149] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\UjcF5Fxqgs2AfHh9_uwc.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ujcf5fxqgs2afhh9_uwc.doc")) returned 1 [0262.157] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uK_cajxxD7q1FH6.docx.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\uK_cajxxD7q1FH6.docx.ncovid", lpFilePart=0x0) returned 0x3b [0262.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0262.157] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uK_cajxxD7q1FH6.docx.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\uk_cajxxd7q1fh6.docx.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0262.158] GetFileType (hFile=0x350) returned 0x1 [0262.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0262.158] GetFileType (hFile=0x350) returned 0x1 [0263.396] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uK_cajxxD7q1FH6.docx", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\uK_cajxxD7q1FH6.docx", lpFilePart=0x0) returned 0x34 [0263.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0263.397] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uK_cajxxD7q1FH6.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\uk_cajxxd7q1fh6.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x368 [0263.398] GetFileType (hFile=0x368) returned 0x1 [0263.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0263.398] GetFileType (hFile=0x368) returned 0x1 [0263.402] ReadFile (in: hFile=0x368, lpBuffer=0x121398f8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x121398f8*, lpNumberOfBytesRead=0x14e3d8*=0xa88d, lpOverlapped=0x0) returned 1 [0263.405] WriteFile (in: hFile=0x350, lpBuffer=0x2218b78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x2218b78*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0263.408] WriteFile (in: hFile=0x350, lpBuffer=0x221b230*, nNumberOfBytesToWrite=0x98a0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x221b230*, lpNumberOfBytesWritten=0x14e3c8*=0x98a0, lpOverlapped=0x0) returned 1 [0263.409] ReadFile (in: hFile=0x368, lpBuffer=0x121398f8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x121398f8*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0263.409] CloseHandle (hObject=0x368) returned 1 [0263.410] WriteFile (in: hFile=0x350, lpBuffer=0x2218b78*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x2218b78*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0263.410] CloseHandle (hObject=0x350) returned 1 [0263.486] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uK_cajxxD7q1FH6.docx", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\uK_cajxxD7q1FH6.docx", lpFilePart=0x0) returned 0x34 [0263.486] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uK_cajxxD7q1FH6.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\uk_cajxxd7q1fh6.docx")) returned 1 [0263.494] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\VgCrC4n9vd-j-Mu8i.pptx.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\VgCrC4n9vd-j-Mu8i.pptx.ncovid", lpFilePart=0x0) returned 0x3d [0263.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0263.494] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\VgCrC4n9vd-j-Mu8i.pptx.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\vgcrc4n9vd-j-mu8i.pptx.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0263.495] GetFileType (hFile=0x350) returned 0x1 [0263.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0263.495] GetFileType (hFile=0x350) returned 0x1 [0264.456] CryptGetHashParam (in: hHash=0x6585a0, dwParam=0x4, pbData=0x14e200, pdwDataLen=0x14e208, dwFlags=0x0 | out: pbData=0x14e200, pdwDataLen=0x14e208) returned 1 [0264.761] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\VgCrC4n9vd-j-Mu8i.pptx", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\VgCrC4n9vd-j-Mu8i.pptx", lpFilePart=0x0) returned 0x36 [0264.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0264.762] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\VgCrC4n9vd-j-Mu8i.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\vgcrc4n9vd-j-mu8i.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x368 [0264.762] GetFileType (hFile=0x368) returned 0x1 [0264.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0264.762] GetFileType (hFile=0x368) returned 0x1 [0264.768] ReadFile (in: hFile=0x368, lpBuffer=0x124219d8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x124219d8*, lpNumberOfBytesRead=0x14e3d8*=0x9eea, lpOverlapped=0x0) returned 1 [0264.785] WriteFile (in: hFile=0x350, lpBuffer=0x230f418*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x230f418*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0264.786] WriteFile (in: hFile=0x350, lpBuffer=0x2311ad0*, nNumberOfBytesToWrite=0x8f00, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x2311ad0*, lpNumberOfBytesWritten=0x14e3c8*=0x8f00, lpOverlapped=0x0) returned 1 [0264.790] ReadFile (in: hFile=0x368, lpBuffer=0x124219d8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x124219d8*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0264.790] CloseHandle (hObject=0x368) returned 1 [0264.790] WriteFile (in: hFile=0x350, lpBuffer=0x230f418*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x230f418*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0264.791] CloseHandle (hObject=0x350) returned 1 [0264.802] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\VgCrC4n9vd-j-Mu8i.pptx", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\VgCrC4n9vd-j-Mu8i.pptx", lpFilePart=0x0) returned 0x36 [0264.802] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\VgCrC4n9vd-j-Mu8i.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\vgcrc4n9vd-j-mu8i.pptx")) returned 1 [0264.807] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\VkzL2G-1q5yzVgCvx.docx.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\VkzL2G-1q5yzVgCvx.docx.ncovid", lpFilePart=0x0) returned 0x3d [0264.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0264.807] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\VkzL2G-1q5yzVgCvx.docx.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\vkzl2g-1q5yzvgcvx.docx.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0264.808] GetFileType (hFile=0x350) returned 0x1 [0264.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0264.808] GetFileType (hFile=0x350) returned 0x1 [0265.967] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\VkzL2G-1q5yzVgCvx.docx", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\VkzL2G-1q5yzVgCvx.docx", lpFilePart=0x0) returned 0x36 [0265.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0265.967] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\VkzL2G-1q5yzVgCvx.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\vkzl2g-1q5yzvgcvx.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x368 [0265.968] GetFileType (hFile=0x368) returned 0x1 [0265.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0265.968] GetFileType (hFile=0x368) returned 0x1 [0265.972] ReadFile (in: hFile=0x368, lpBuffer=0x12521a10, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12521a10*, lpNumberOfBytesRead=0x14e3d8*=0xc074, lpOverlapped=0x0) returned 1 [0265.991] WriteFile (in: hFile=0x350, lpBuffer=0x2205438*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x2205438*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0265.993] WriteFile (in: hFile=0x350, lpBuffer=0x2207af0*, nNumberOfBytesToWrite=0xb090, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x2207af0*, lpNumberOfBytesWritten=0x14e3c8*=0xb090, lpOverlapped=0x0) returned 1 [0265.995] ReadFile (in: hFile=0x368, lpBuffer=0x12521a10, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12521a10*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0265.995] CloseHandle (hObject=0x368) returned 1 [0265.996] WriteFile (in: hFile=0x350, lpBuffer=0x2205438*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x2205438*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0265.996] CloseHandle (hObject=0x350) returned 1 [0265.999] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\VkzL2G-1q5yzVgCvx.docx", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\VkzL2G-1q5yzVgCvx.docx", lpFilePart=0x0) returned 0x36 [0265.999] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\VkzL2G-1q5yzVgCvx.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\vkzl2g-1q5yzvgcvx.docx")) returned 1 [0266.006] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XGb73bZ.odt.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\XGb73bZ.odt.ncovid", lpFilePart=0x0) returned 0x32 [0266.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0266.006] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XGb73bZ.odt.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\xgb73bz.odt.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0266.007] GetFileType (hFile=0x350) returned 0x1 [0266.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0266.007] GetFileType (hFile=0x350) returned 0x1 [0267.171] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XGb73bZ.odt", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\XGb73bZ.odt", lpFilePart=0x0) returned 0x2b [0267.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0267.171] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XGb73bZ.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\xgb73bz.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x368 [0267.171] GetFileType (hFile=0x368) returned 0x1 [0267.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0267.172] GetFileType (hFile=0x368) returned 0x1 [0267.175] ReadFile (in: hFile=0x368, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0xeda3, lpOverlapped=0x0) returned 1 [0267.188] WriteFile (in: hFile=0x350, lpBuffer=0x22fd810*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x22fd810*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0267.190] WriteFile (in: hFile=0x350, lpBuffer=0x22ffe98*, nNumberOfBytesToWrite=0xddc0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x22ffe98*, lpNumberOfBytesWritten=0x14e3c8*=0xddc0, lpOverlapped=0x0) returned 1 [0267.191] ReadFile (in: hFile=0x368, lpBuffer=0x12121930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12121930*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0267.191] CloseHandle (hObject=0x368) returned 1 [0267.192] WriteFile (in: hFile=0x350, lpBuffer=0x22fd810*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x22fd810*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0267.192] CloseHandle (hObject=0x350) returned 1 [0267.195] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XGb73bZ.odt", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\XGb73bZ.odt", lpFilePart=0x0) returned 0x2b [0267.195] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XGb73bZ.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\xgb73bz.odt")) returned 1 [0267.201] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XuhXtcsvkk4kAz8BQGV3.docx.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\XuhXtcsvkk4kAz8BQGV3.docx.ncovid", lpFilePart=0x0) returned 0x40 [0267.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0267.201] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XuhXtcsvkk4kAz8BQGV3.docx.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\xuhxtcsvkk4kaz8bqgv3.docx.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0267.202] GetFileType (hFile=0x350) returned 0x1 [0267.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0267.202] GetFileType (hFile=0x350) returned 0x1 [0268.192] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XuhXtcsvkk4kAz8BQGV3.docx", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\XuhXtcsvkk4kAz8BQGV3.docx", lpFilePart=0x0) returned 0x39 [0268.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0268.192] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XuhXtcsvkk4kAz8BQGV3.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\xuhxtcsvkk4kaz8bqgv3.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x368 [0268.194] GetFileType (hFile=0x368) returned 0x1 [0268.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0268.194] GetFileType (hFile=0x368) returned 0x1 [0268.199] ReadFile (in: hFile=0x368, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x18686, lpOverlapped=0x0) returned 1 [0268.220] WriteFile (in: hFile=0x350, lpBuffer=0x21e3ea0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x21e3ea0*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0268.223] WriteFile (in: hFile=0x350, lpBuffer=0x12322980*, nNumberOfBytesToWrite=0x176a0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x12322980*, lpNumberOfBytesWritten=0x14e3c8*=0x176a0, lpOverlapped=0x0) returned 1 [0268.225] ReadFile (in: hFile=0x368, lpBuffer=0x12221968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12221968*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0268.225] CloseHandle (hObject=0x368) returned 1 [0268.226] WriteFile (in: hFile=0x350, lpBuffer=0x21e3ea0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x21e3ea0*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0268.226] CloseHandle (hObject=0x350) returned 1 [0268.231] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XuhXtcsvkk4kAz8BQGV3.docx", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\XuhXtcsvkk4kAz8BQGV3.docx", lpFilePart=0x0) returned 0x39 [0268.231] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XuhXtcsvkk4kAz8BQGV3.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\xuhxtcsvkk4kaz8bqgv3.docx")) returned 1 [0268.237] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XzpwLTxYTuIIcq9.xlsx.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\XzpwLTxYTuIIcq9.xlsx.ncovid", lpFilePart=0x0) returned 0x3b [0268.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0268.237] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XzpwLTxYTuIIcq9.xlsx.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\xzpwltxytuiicq9.xlsx.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0268.238] GetFileType (hFile=0x350) returned 0x1 [0268.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0268.238] GetFileType (hFile=0x350) returned 0x1 [0269.383] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XzpwLTxYTuIIcq9.xlsx", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\XzpwLTxYTuIIcq9.xlsx", lpFilePart=0x0) returned 0x34 [0269.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0269.383] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XzpwLTxYTuIIcq9.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\xzpwltxytuiicq9.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x368 [0269.383] GetFileType (hFile=0x368) returned 0x1 [0269.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0269.383] GetFileType (hFile=0x368) returned 0x1 [0269.386] ReadFile (in: hFile=0x368, lpBuffer=0x1233a058, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x1233a058*, lpNumberOfBytesRead=0x14e3d8*=0x14cbd, lpOverlapped=0x0) returned 1 [0269.459] WriteFile (in: hFile=0x350, lpBuffer=0x212e1d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x212e1d8*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0269.460] WriteFile (in: hFile=0x350, lpBuffer=0x12122910*, nNumberOfBytesToWrite=0x13cd0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x12122910*, lpNumberOfBytesWritten=0x14e3c8*=0x13cd0, lpOverlapped=0x0) returned 1 [0269.462] ReadFile (in: hFile=0x368, lpBuffer=0x1233a058, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x1233a058*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0269.462] CloseHandle (hObject=0x368) returned 1 [0269.462] WriteFile (in: hFile=0x350, lpBuffer=0x212e1d8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x212e1d8*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0269.462] CloseHandle (hObject=0x350) returned 1 [0269.468] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XzpwLTxYTuIIcq9.xlsx", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\XzpwLTxYTuIIcq9.xlsx", lpFilePart=0x0) returned 0x34 [0269.468] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XzpwLTxYTuIIcq9.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\xzpwltxytuiicq9.xlsx")) returned 1 [0269.472] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\yGgVErNaD-GX.odp.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\yGgVErNaD-GX.odp.ncovid", lpFilePart=0x0) returned 0x37 [0269.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0269.472] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\yGgVErNaD-GX.odp.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\yggvernad-gx.odp.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0269.476] GetFileType (hFile=0x350) returned 0x1 [0269.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0269.476] GetFileType (hFile=0x350) returned 0x1 [0270.728] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\yGgVErNaD-GX.odp", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\yGgVErNaD-GX.odp", lpFilePart=0x0) returned 0x30 [0270.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0270.728] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\yGgVErNaD-GX.odp" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\yggvernad-gx.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x368 [0270.729] GetFileType (hFile=0x368) returned 0x1 [0270.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0270.729] GetFileType (hFile=0x368) returned 0x1 [0270.730] ReadFile (in: hFile=0x368, lpBuffer=0x12136618, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12136618*, lpNumberOfBytesRead=0x14e3d8*=0x14cc3, lpOverlapped=0x0) returned 1 [0270.735] WriteFile (in: hFile=0x350, lpBuffer=0x2219270*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x2219270*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0270.737] WriteFile (in: hFile=0x350, lpBuffer=0x12237630*, nNumberOfBytesToWrite=0x13ce0, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x12237630*, lpNumberOfBytesWritten=0x14e3c8*=0x13ce0, lpOverlapped=0x0) returned 1 [0270.739] ReadFile (in: hFile=0x368, lpBuffer=0x12136618, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x12136618*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0270.739] CloseHandle (hObject=0x368) returned 1 [0270.739] WriteFile (in: hFile=0x350, lpBuffer=0x2219270*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x2219270*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0270.740] CloseHandle (hObject=0x350) returned 1 [0270.743] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\yGgVErNaD-GX.odp", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\yGgVErNaD-GX.odp", lpFilePart=0x0) returned 0x30 [0270.744] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\yGgVErNaD-GX.odp" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\yggvernad-gx.odp")) returned 1 [0270.749] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Yngu.csv.ncovid", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Yngu.csv.ncovid", lpFilePart=0x0) returned 0x2f [0270.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0270.750] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Yngu.csv.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\yngu.csv.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0270.751] GetFileType (hFile=0x350) returned 0x1 [0270.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0270.751] GetFileType (hFile=0x350) returned 0x1 [0271.932] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Yngu.csv", nBufferLength=0x105, lpBuffer=0x14ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Yngu.csv", lpFilePart=0x0) returned 0x28 [0271.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e2a0) returned 1 [0271.933] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Yngu.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\yngu.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x368 [0271.934] GetFileType (hFile=0x368) returned 0x1 [0271.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e210) returned 1 [0271.934] GetFileType (hFile=0x368) returned 0x1 [0271.937] ReadFile (in: hFile=0x368, lpBuffer=0x1243a090, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x1243a090*, lpNumberOfBytesRead=0x14e3d8*=0x27f4, lpOverlapped=0x0) returned 1 [0271.952] WriteFile (in: hFile=0x350, lpBuffer=0x2305638*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e368, lpOverlapped=0x0 | out: lpBuffer=0x2305638*, lpNumberOfBytesWritten=0x14e368*=0x1000, lpOverlapped=0x0) returned 1 [0271.954] WriteFile (in: hFile=0x350, lpBuffer=0x2307cc0*, nNumberOfBytesToWrite=0x1810, lpNumberOfBytesWritten=0x14e3c8, lpOverlapped=0x0 | out: lpBuffer=0x2307cc0*, lpNumberOfBytesWritten=0x14e3c8*=0x1810, lpOverlapped=0x0) returned 1 [0271.955] ReadFile (in: hFile=0x368, lpBuffer=0x1243a090, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e3d8, lpOverlapped=0x0 | out: lpBuffer=0x1243a090*, lpNumberOfBytesRead=0x14e3d8*=0x0, lpOverlapped=0x0) returned 1 [0271.955] CloseHandle (hObject=0x368) returned 1 [0271.955] WriteFile (in: hFile=0x350, lpBuffer=0x2305638*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x2305638*, lpNumberOfBytesWritten=0x14e2b8*=0x10, lpOverlapped=0x0) returned 1 [0271.955] CloseHandle (hObject=0x350) returned 1 [0271.962] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Yngu.csv", nBufferLength=0x105, lpBuffer=0x14dee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Yngu.csv", lpFilePart=0x0) returned 0x28 [0271.962] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Yngu.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\yngu.csv")) returned 1 [0271.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e4f0) returned 1 [0271.966] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x14dfe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0271.966] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\", nBufferLength=0x105, lpBuffer=0x14df80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\", lpFilePart=0x0) returned 0x20 [0271.966] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\*", lpFindFileData=0x14e190 | out: lpFindFileData=0x14e190*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x55927dd2, ftLastAccessTime.dwHighDateTime=0x1d70a81, ftLastWriteTime.dwLowDateTime=0xaa86a522, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x62bbd0 [0271.968] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x55927dd2, ftLastAccessTime.dwHighDateTime=0x1d70a81, ftLastWriteTime.dwLowDateTime=0xaa86a522, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.968] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x863380b7, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x863380b7, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x86da5ecf, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0xeb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="0Qov66TFlL71Vr.ods.ncovid", cAlternateFileName="0QOV66~1.NCO")) returned 1 [0271.968] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86db7115, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x86db7115, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x8784b641, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x17080, dwReserved0=0x0, dwReserved1=0x0, cFileName="568KyO2WPqAyIkKb6J.xlsx.ncovid", cAlternateFileName="568KYO~1.NCO")) returned 1 [0271.969] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8785a0a2, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x8785a0a2, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x88356496, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x9920, dwReserved0=0x0, dwReserved1=0x0, cFileName="70YjXp03IqF wav.docx.ncovid", cAlternateFileName="70YJXP~1.NCO")) returned 1 [0271.969] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8835dde2, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x8835dde2, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x88f78d14, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0xe910, dwReserved0=0x0, dwReserved1=0x0, cFileName="76lI28SHkOO1S5RZA.pptx.ncovid", cAlternateFileName="76LI28~1.NCO")) returned 1 [0271.969] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88f89ce1, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x88f89ce1, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x89b92e6a, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x13c70, dwReserved0=0x0, dwReserved1=0x0, cFileName="7p-yfll45o4qAG-.rtf.ncovid", cAlternateFileName="7P-YFL~1.NCO")) returned 1 [0271.969] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b92e6a, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x89b92e6a, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x8a661bfe, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0xdde0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9duwNE_vpUogUDNE1V.xlsx.ncovid", cAlternateFileName="9DUWNE~1.NCO")) returned 1 [0271.970] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a66f3a9, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x8a66f3a9, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x8afbd21f, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9Jh63.docx.ncovid", cAlternateFileName="9JH63D~1.NCO")) returned 1 [0271.970] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8afd16ac, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x8afd16ac, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x8bb0eb0e, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x105e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9pqheIL3CaaI.docx.ncovid", cAlternateFileName="9PQHEI~1.NCO")) returned 1 [0271.970] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bb1acc2, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x8bb1acc2, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x8c6f1585, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x7a70, dwReserved0=0x0, dwReserved1=0x0, cFileName="axFXeggj.pdf.ncovid", cAlternateFileName="AXFXEG~1.NCO")) returned 1 [0271.970] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c6fbbfb, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x8c6fbbfb, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x8d1b07d9, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x3930, dwReserved0=0x0, dwReserved1=0x0, cFileName="bTgBDM_BLCIn 9g.pptx.ncovid", cAlternateFileName="BTGBDM~1.NCO")) returned 1 [0271.971] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d1be686, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x8d1be686, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x8de07be2, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0xbaf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="c--oDETPCZEmFkX9R.docx.ncovid", cAlternateFileName="C--ODE~1.NCO")) returned 1 [0271.971] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8de14ccb, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x8de14ccb, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x8e8c4b0f, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x7b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="c1uWbuECVbO7GtKW39T.pptx.ncovid", cAlternateFileName="C1UWBU~1.NCO")) returned 1 [0271.971] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e8da00f, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x8e8da00f, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x8f3b36ee, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x6c10, dwReserved0=0x0, dwReserved1=0x0, cFileName="cDJMQ767y 9NDJF.csv.ncovid", cAlternateFileName="CDJMQ7~1.NCO")) returned 1 [0271.971] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3bca1d, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x8f3bca1d, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x8fef16c4, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x12910, dwReserved0=0x0, dwReserved1=0x0, cFileName="cWSN5bi9vhUj73qO.xlsx.ncovid", cAlternateFileName="CWSN5B~1.NCO")) returned 1 [0271.972] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ff54798, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x8ff54798, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x90ba7196, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x1c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.ncovid", cAlternateFileName="DESKTO~1.NCO")) returned 1 [0271.972] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90badcd0, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x90badcd0, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x9161ece5, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x3410, dwReserved0=0x0, dwReserved1=0x0, cFileName="e cwv2Je8.docx.ncovid", cAlternateFileName="ECWV2J~1.NCO")) returned 1 [0271.972] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91628184, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x91628184, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x921be617, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0xab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="e3we HsPkukwCQ_rD1.pdf.ncovid", cAlternateFileName="E3WEHS~1.NCO")) returned 1 [0271.973] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x921d1a9e, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x921d1a9e, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x92cb129f, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0xa220, dwReserved0=0x0, dwReserved1=0x0, cFileName="EgsQo0UhXKVeTvl3SU4.xlsx.ncovid", cAlternateFileName="EGSQO0~1.NCO")) returned 1 [0271.973] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92cd0334, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x92cd0334, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x9384718f, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0xb9a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ez15cqKrqd8C42.xlsx.ncovid", cAlternateFileName="EZ15CQ~1.NCO")) returned 1 [0271.973] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93858e3b, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x93858e3b, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x9437fe06, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x96b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fIJgDYKYDnkfXH1E5C.csv.ncovid", cAlternateFileName="FIJGDY~1.NCO")) returned 1 [0271.973] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9438c07a, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x9438c07a, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x94e861e2, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x11e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="FKV_Um7s1AtkG6SwRc.xlsx.ncovid", cAlternateFileName="FKV_UM~1.NCO")) returned 1 [0271.974] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94e91220, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x94e91220, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x9583bd94, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x15fe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fvN5PmwQa.odt.ncovid", cAlternateFileName="FVN5PM~1.NCO")) returned 1 [0271.974] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9584b82e, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x9584b82e, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x96204941, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x2530, dwReserved0=0x0, dwReserved1=0x0, cFileName="HjIAFUmQscCo 2L.ppt.ncovid", cAlternateFileName="HJIAFU~1.NCO")) returned 1 [0271.974] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96213c3b, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x96213c3b, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x96e8ae91, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hJTYe7eOwos.pptx.ncovid", cAlternateFileName="HJTYE7~1.NCO")) returned 1 [0271.975] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e9b0b1, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x96e9b0b1, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x97925fc2, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x8ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JDRimLeWPyHLTdjUoJ.ppt.ncovid", cAlternateFileName="JDRIML~1.NCO")) returned 1 [0271.975] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97931682, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x97931682, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x98423c0e, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x9cf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ji5Tbajt.xls.ncovid", cAlternateFileName="JI5TBA~1.NCO")) returned 1 [0271.975] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98430054, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x98430054, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x98cf16ef, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x8530, dwReserved0=0x0, dwReserved1=0x0, cFileName="jXu_ngddt0WmrHz3gEIW.pptx.ncovid", cAlternateFileName="JXU_NG~1.NCO")) returned 1 [0271.976] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98cfd935, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x98cfd935, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x9961914b, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x42c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KtLEO.rtf.ncovid", cAlternateFileName="KTLEOR~1.NCO")) returned 1 [0271.976] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99621a10, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x99621a10, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x9a4f702c, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x3dc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lgwxj.doc.ncovid", cAlternateFileName="LGWXJD~1.NCO")) returned 1 [0271.977] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a505a18, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x9a505a18, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x9afd46bc, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x9ee0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mho1kAIrYCh.docx.ncovid", cAlternateFileName="MHO1KA~1.NCO")) returned 1 [0271.977] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d374e80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d374e80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d374e80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0271.977] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d374e80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d374e80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d374e80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0271.978] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0271.978] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9afde0ea, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x9afde0ea, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x9ba5ad02, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x41c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="n4XNFeLI8Mi4SE.docx.ncovid", cAlternateFileName="N4XNFE~1.NCO")) returned 1 [0271.978] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ba6aa77, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x9ba6aa77, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x9c7706aa, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nnMQFmGNl.xlsx.ncovid", cAlternateFileName="NNMQFM~1.NCO")) returned 1 [0271.978] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c7849e0, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x9c7849e0, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x9d423b4a, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x122d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NOwnJ6AGI50mPI.pps.ncovid", cAlternateFileName="NOWNJ6~1.NCO")) returned 1 [0271.979] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d434c70, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x9d434c70, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x9de08c55, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x5560, dwReserved0=0x0, dwReserved1=0x0, cFileName="nzlHK8NwMZ86oh.docx.ncovid", cAlternateFileName="NZLHK8~1.NCO")) returned 1 [0271.979] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de1737f, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x9de1737f, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x9e85c795, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x16fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OKqg.pptx.ncovid", cAlternateFileName="OKQGPP~1.NCO")) returned 1 [0271.979] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63954f0d, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x65ef9a5c, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x65ef9a5c, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0271.980] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e867750, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x9e867750, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0x9f48cb2e, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x17730, dwReserved0=0x0, dwReserved1=0x0, cFileName="pEpUMw_9Zcoad.csv.ncovid", cAlternateFileName="PEPUMW~1.NCO")) returned 1 [0271.980] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f4b3727, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0x9f4b3727, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0xa034304f, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x1e50, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pxigi.rtf.ncovid", cAlternateFileName="PXIGIR~1.NCO")) returned 1 [0271.980] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0358d25, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0xa0358d25, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0xa108898f, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x11dc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qes9g8fLDZ.odt.ncovid", cAlternateFileName="QES9G8~1.NCO")) returned 1 [0271.981] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1098803, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0xa1098803, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0xa27ee0f4, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x29e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QOSULyfBxbm7V7 _F.odt.ncovid", cAlternateFileName="QOSULY~1.NCO")) returned 1 [0271.981] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2802cab, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0xa2802cab, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0xa339e7a4, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x4480, dwReserved0=0x0, dwReserved1=0x0, cFileName="rHZ_lf-3p.docx.ncovid", cAlternateFileName="RHZ_LF~1.NCO")) returned 1 [0271.981] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa33b6d44, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0xa33b6d44, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0xa3e55b4a, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x4cd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sD-nmkQy yW.docx.ncovid", cAlternateFileName="SD-NMK~1.NCO")) returned 1 [0271.982] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3e6309f, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0xa3e6309f, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0xa4acd38e, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x17fc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UjcF5Fxqgs2AfHh9_uwc.doc.ncovid", cAlternateFileName="UJCF5F~1.NCO")) returned 1 [0271.982] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ae3054, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0xa4ae3054, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0xa578c830, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0xa8b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uK_cajxxD7q1FH6.docx.ncovid", cAlternateFileName="UK_CAJ~1.NCO")) returned 1 [0271.982] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa57a3b74, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0xa57a3b74, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0xa641a917, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x9f10, dwReserved0=0x0, dwReserved1=0x0, cFileName="VgCrC4n9vd-j-Mu8i.pptx.ncovid", cAlternateFileName="VGCRC4~1.NCO")) returned 1 [0271.983] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa642a03c, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0xa642a03c, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0xa6f8696c, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0xc0a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VkzL2G-1q5yzVgCvx.docx.ncovid", cAlternateFileName="VKZL2G~1.NCO")) returned 1 [0271.983] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6f9771f, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0xa6f9771f, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0xa7aee9c5, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0xedd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XGb73bZ.odt.ncovid", cAlternateFileName="XGB73B~1.NCO")) returned 1 [0271.983] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7afd888, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0xa7afd888, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0xa84cebb1, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x186b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XuhXtcsvkk4kAz8BQGV3.docx.ncovid", cAlternateFileName="XUHXTC~1.NCO")) returned 1 [0271.983] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa84de9c4, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0xa84de9c4, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0xa909a6c3, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x14ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XzpwLTxYTuIIcq9.xlsx.ncovid", cAlternateFileName="XZPWLT~1.NCO")) returned 1 [0271.984] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa90a6b6e, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0xa90a6b6e, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0xa9cc437f, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x14cf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="yGgVErNaD-GX.odp.ncovid", cAlternateFileName="YGGVER~1.NCO")) returned 1 [0271.984] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9cd5003, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0xa9cd5003, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0xaa8633d3, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x2820, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yngu.csv.ncovid", cAlternateFileName="YNGUCS~1.NCO")) returned 1 [0271.984] FindNextFileW (in: hFindFile=0x62bbd0, lpFindFileData=0x14e1e0 | out: lpFindFileData=0x14e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9cd5003, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0xa9cd5003, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0xaa8633d3, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x2820, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yngu.csv.ncovid", cAlternateFileName="YNGUCS~1.NCO")) returned 0 [0271.985] FindClose (in: hFindFile=0x62bbd0 | out: hFindFile=0x62bbd0) returned 1 [0271.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e440) returned 1 [0271.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e400) returned 1 [0271.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e440) returned 1 [0271.986] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x14df30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Music", lpFilePart=0x0) returned 0x28 [0271.986] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Music\\", nBufferLength=0x105, lpBuffer=0x14ded0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Music\\", lpFilePart=0x0) returned 0x29 [0271.986] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Music\\*", lpFindFileData=0x14e0e0 | out: lpFindFileData=0x14e0e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0271.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e370) returned 1 [0272.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e440) returned 1 [0272.006] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x14df30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Pictures", lpFilePart=0x0) returned 0x2b [0272.006] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Pictures\\", nBufferLength=0x105, lpBuffer=0x14ded0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Pictures\\", lpFilePart=0x0) returned 0x2c [0272.006] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Pictures\\*", lpFindFileData=0x14e0e0 | out: lpFindFileData=0x14e0e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0272.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e370) returned 1 [0272.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e440) returned 1 [0272.011] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x14df30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Videos", lpFilePart=0x0) returned 0x29 [0272.011] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Videos\\", nBufferLength=0x105, lpBuffer=0x14ded0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Videos\\", lpFilePart=0x0) returned 0x2a [0272.011] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Videos\\*", lpFindFileData=0x14e0e0 | out: lpFindFileData=0x14e0e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0272.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e370) returned 1 [0272.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e440) returned 1 [0272.015] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x14df30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x2d [0272.015] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\", nBufferLength=0x105, lpBuffer=0x14ded0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\", lpFilePart=0x0) returned 0x2e [0272.015] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\*", lpFindFileData=0x14e0e0 | out: lpFindFileData=0x14e0e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63954f0d, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x65ef9a5c, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x878c65f2, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x62c1d0 [0272.020] FindNextFileW (in: hFindFile=0x62c1d0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63954f0d, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x65ef9a5c, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x878c65f2, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.021] FindNextFileW (in: hFindFile=0x62c1d0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6397affd, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x6397affd, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x878917cb, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="achoo@gdllo.de.pst", cAlternateFileName="ACHOO@~1.PST")) returned 1 [0272.021] FindNextFileW (in: hFindFile=0x62c1d0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0272.021] FindClose (in: hFindFile=0x62c1d0 | out: hFindFile=0x62c1d0) returned 1 [0272.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e390) returned 1 [0272.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e350) returned 1 [0272.025] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst.ncovid", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst.ncovid", lpFilePart=0x0) returned 0x47 [0272.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0272.026] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst.ncovid" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\outlook files\\achoo@gdllo.de.pst.ncovid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0272.026] GetFileType (hFile=0x350) returned 0x1 [0272.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0272.026] GetFileType (hFile=0x350) returned 0x1 [0273.129] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst", nBufferLength=0x105, lpBuffer=0x14dd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst", lpFilePart=0x0) returned 0x40 [0273.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e1f0) returned 1 [0273.129] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\outlook files\\achoo@gdllo.de.pst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x368 [0273.130] GetFileType (hFile=0x368) returned 0x1 [0273.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e160) returned 1 [0273.130] GetFileType (hFile=0x368) returned 0x1 [0273.133] ReadFile (in: hFile=0x368, lpBuffer=0x1253a0c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x1253a0c8*, lpNumberOfBytesRead=0x14e328*=0x42400, lpOverlapped=0x0) returned 1 [0273.202] WriteFile (in: hFile=0x350, lpBuffer=0x21fec40*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e2b8, lpOverlapped=0x0 | out: lpBuffer=0x21fec40*, lpNumberOfBytesWritten=0x14e2b8*=0x1000, lpOverlapped=0x0) returned 1 [0273.204] WriteFile (in: hFile=0x350, lpBuffer=0x12122910*, nNumberOfBytesToWrite=0x41420, lpNumberOfBytesWritten=0x14e318, lpOverlapped=0x0 | out: lpBuffer=0x12122910*, lpNumberOfBytesWritten=0x14e318*=0x41420, lpOverlapped=0x0) returned 1 [0273.210] ReadFile (in: hFile=0x368, lpBuffer=0x1253a0c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x14e328, lpOverlapped=0x0 | out: lpBuffer=0x1253a0c8*, lpNumberOfBytesRead=0x14e328*=0x0, lpOverlapped=0x0) returned 1 [0273.213] CloseHandle (hObject=0x368) returned 1 [0273.214] WriteFile (in: hFile=0x350, lpBuffer=0x21fec40*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14e208, lpOverlapped=0x0 | out: lpBuffer=0x21fec40*, lpNumberOfBytesWritten=0x14e208*=0x10, lpOverlapped=0x0) returned 1 [0273.214] CloseHandle (hObject=0x350) returned 1 [0273.223] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst", nBufferLength=0x105, lpBuffer=0x14de30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst", lpFilePart=0x0) returned 0x40 [0273.223] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\outlook files\\achoo@gdllo.de.pst")) returned 1 [0273.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e440) returned 1 [0273.228] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x14df30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x2d [0273.228] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\", nBufferLength=0x105, lpBuffer=0x14ded0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\", lpFilePart=0x0) returned 0x2e [0273.228] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\*", lpFindFileData=0x14e0e0 | out: lpFindFileData=0x14e0e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63954f0d, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x65ef9a5c, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0xab46cd9a, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x62c1d0 [0273.229] FindNextFileW (in: hFindFile=0x62c1d0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63954f0d, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x65ef9a5c, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0xab46cd9a, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.229] FindNextFileW (in: hFindFile=0x62c1d0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa900782, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0xaa900782, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0xab46aad7, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x42430, dwReserved0=0x0, dwReserved1=0x0, cFileName="achoo@gdllo.de.pst.ncovid", cAlternateFileName="ACHOO@~1.NCO")) returned 1 [0273.229] FindNextFileW (in: hFindFile=0x62c1d0, lpFindFileData=0x14e130 | out: lpFindFileData=0x14e130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa900782, ftCreationTime.dwHighDateTime=0x1d71fce, ftLastAccessTime.dwLowDateTime=0xaa900782, ftLastAccessTime.dwHighDateTime=0x1d71fce, ftLastWriteTime.dwLowDateTime=0xab46aad7, ftLastWriteTime.dwHighDateTime=0x1d71fce, nFileSizeHigh=0x0, nFileSizeLow=0x42430, dwReserved0=0x0, dwReserved1=0x0, cFileName="achoo@gdllo.de.pst.ncovid", cAlternateFileName="ACHOO@~1.NCO")) returned 0 [0273.230] FindClose (in: hFindFile=0x62c1d0 | out: hFindFile=0x62c1d0) returned 1 [0273.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e390) returned 1 [0273.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e350) returned 1 [0273.250] GetWindowLongPtrW (hWnd=0x703a0, nIndex=-20) returned 0x90000 [0273.251] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83ef20000 [0273.252] GetWindowLongPtrW (hWnd=0x703a0, nIndex=-16) returned 0x16010000 [0273.252] GetCursorPos (in: lpPoint=0x213f8b8 | out: lpPoint=0x213f8b8*(x=34, y=330)) returned 1 [0273.252] MonitorFromPoint (pt=0x14a00000022, dwFlags=0x2) returned 0x10001 [0273.253] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x14e1d0 | out: lpmi=0x14e1d0) returned 1 [0273.253] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x1f0105e2 [0273.255] GetDeviceCaps (hdc=0x1f0105e2, index=12) returned 32 [0273.255] GetDeviceCaps (hdc=0x1f0105e2, index=14) returned 1 [0273.255] DeleteDC (hdc=0x1f0105e2) returned 1 [0273.256] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x14e2a0 | out: lpmi=0x14e2a0) returned 1 [0273.256] SetWindowLongPtrW (hWnd=0x703a0, nIndex=-20, dwNewLong=0x10000) returned 0x90000 [0273.257] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x7c, wParam=0xffffffffffffffec, lParam=0x14e400) returned 0x0 [0273.263] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x7d, wParam=0xffffffffffffffec, lParam=0x14e400) returned 0x0 [0273.264] GetWindowTextLengthW (hWnd=0xb0370) returned 6 [0273.264] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xb0370, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x6 [0273.264] GetSystemMetrics (nIndex=42) returned 0 [0273.264] GetWindowTextW (in: hWnd=0xb0370, lpString=0x14e490, nMaxCount=7 | out: lpString="label1") returned 6 [0273.264] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xb0370, Msg=0xd, wParam=0x7, lParam=0x14e490) returned 0x6 [0273.265] GetWindowTextLengthW (hWnd=0xb0370) returned 6 [0273.265] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xb0370, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x6 [0273.265] GetSystemMetrics (nIndex=42) returned 0 [0273.265] GetWindowTextW (in: hWnd=0xb0370, lpString=0x14e430, nMaxCount=7 | out: lpString="label1") returned 6 [0273.265] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xb0370, Msg=0xd, wParam=0x7, lParam=0x14e430) returned 0x6 [0273.265] SetWindowTextW (hWnd=0xb0370, lpString="Your files (count: 99) have been encrypted!") returned 1 [0273.265] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xb0370, Msg=0xc, wParam=0x0, lParam=0x213fbdc) returned 0x1 [0273.266] GetStockObject (i=5) returned 0x1900015 [0273.266] GetDlgItem (hDlg=0x703a0, nIDDlgItem=721776) returned 0xb0370 [0273.266] SendMessageW (hWnd=0xb0370, Msg=0x202b, wParam=0xb0370, lParam=0x14dc70) returned 0x0 [0273.266] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xb0370, Msg=0x202b, wParam=0xb0370, lParam=0x14dc70) returned 0x0 [0273.267] GetWindowTextLengthW (hWnd=0xb0370) returned 43 [0273.267] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xb0370, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x2b [0273.267] GetSystemMetrics (nIndex=42) returned 0 [0273.267] GetWindowTextW (in: hWnd=0xb0370, lpString=0x14e2b0, nMaxCount=44 | out: lpString="Your files (count: 99) have been encrypted!") returned 43 [0273.267] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xb0370, Msg=0xd, wParam=0x2c, lParam=0x14e2b0) returned 0x2b [0273.268] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83ef20000 [0273.268] AdjustWindowRectEx (in: lpRect=0x14e318, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14e318) returned 1 [0273.269] DrawTextExW (in: hdc=0x1a010941, lpchText="Your files (count: 99) have been encrypted!", cchText=43, lprc=0x14e288, format=0x102400, lpdtp=0x21400c0 | out: lpchText="Your files (count: 99) have been encrypted!", lprc=0x14e288) returned 13 [0273.270] SetWindowPos (hWnd=0xb0370, hWndInsertAfter=0x0, X=13, Y=13, cx=211, cy=13, uFlags=0x16) returned 1 [0273.271] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xb0370, Msg=0x46, wParam=0x0, lParam=0x14e2c0) returned 0x0 [0273.271] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xb0370, Msg=0x83, wParam=0x1, lParam=0x14e290) returned 0x0 [0273.274] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xb0370, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0273.276] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xb0370, Msg=0x47, wParam=0x0, lParam=0x14e2c0) returned 0x0 [0273.276] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xb0370, Msg=0x5, wParam=0x0, lParam=0xd00d3) returned 0x0 [0273.276] GetClientRect (in: hWnd=0xb0370, lpRect=0x14dcc0 | out: lpRect=0x14dcc0) returned 1 [0273.276] GetWindowRect (in: hWnd=0xb0370, lpRect=0x14dcc0 | out: lpRect=0x14dcc0) returned 1 [0273.276] GetParent (hWnd=0xb0370) returned 0x703a0 [0273.276] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x703a0, lpPoints=0x14dcc0, cPoints=0x2 | out: lpPoints=0x14dcc0) returned -1638469 [0273.276] InvalidateRect (hWnd=0xb0370, lpRect=0x0, bErase=1) returned 1 [0273.276] GetWindowTextLengthW (hWnd=0xb0370) returned 43 [0273.276] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xb0370, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x2b [0273.276] GetSystemMetrics (nIndex=42) returned 0 [0273.276] GetWindowTextW (in: hWnd=0xb0370, lpString=0x14d8f0, nMaxCount=44 | out: lpString="Your files (count: 99) have been encrypted!") returned 43 [0273.276] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xb0370, Msg=0xd, wParam=0x2c, lParam=0x14d8f0) returned 0x2b [0273.277] GetParent (hWnd=0xb0370) returned 0x703a0 [0273.277] InvalidateRect (hWnd=0xb0370, lpRect=0x0, bErase=1) returned 1 [0273.277] GetWindowTextLengthW (hWnd=0x703a0) returned 5 [0273.277] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0273.277] GetSystemMetrics (nIndex=42) returned 0 [0273.277] GetWindowTextW (in: hWnd=0x703a0, lpString=0x14e280, nMaxCount=6 | out: lpString="Form1") returned 5 [0273.277] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xd, wParam=0x6, lParam=0x14e280) returned 0x5 [0273.359] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\___RECOVER__FILES__.ncovid.txt", nBufferLength=0x105, lpBuffer=0x14deb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\___RECOVER__FILES__.ncovid.txt", lpFilePart=0x0) returned 0x3c [0273.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x14e390) returned 1 [0273.360] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\___RECOVER__FILES__.ncovid.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\___recover__files__.ncovid.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x350 [0273.361] GetFileType (hFile=0x350) returned 0x1 [0273.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x14e300) returned 1 [0273.361] GetFileType (hFile=0x350) returned 0x1 [0273.361] WriteFile (in: hFile=0x350, lpBuffer=0x2144738*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x14e4c8, lpOverlapped=0x0 | out: lpBuffer=0x2144738*, lpNumberOfBytesWritten=0x14e4c8*=0x1000, lpOverlapped=0x0) returned 1 [0273.362] WriteFile (in: hFile=0x350, lpBuffer=0x2144738*, nNumberOfBytesToWrite=0x578, lpNumberOfBytesWritten=0x14e498, lpOverlapped=0x0 | out: lpBuffer=0x2144738*, lpNumberOfBytesWritten=0x14e498*=0x578, lpOverlapped=0x0) returned 1 [0273.363] CloseHandle (hObject=0x350) returned 1 [0273.365] InvalidateRect (hWnd=0xa005a, lpRect=0x0, bErase=1) returned 1 [0273.365] InvalidateRect (hWnd=0xa036a, lpRect=0x0, bErase=1) returned 1 [0273.365] InvalidateRect (hWnd=0x70298, lpRect=0x0, bErase=1) returned 1 [0273.365] InvalidateRect (hWnd=0xb0370, lpRect=0x0, bErase=1) returned 1 [0273.367] GetWindowThreadProcessId (in: hWnd=0x703a0, lpdwProcessId=0x14e670 | out: lpdwProcessId=0x14e670) returned 0xe20 [0273.367] GetCurrentThreadId () returned 0xe20 [0273.369] RegisterClipboardFormatW (lpszFormat="WindowsForms12_ThreadCallbackMessage") returned 0xc1e6 [0273.370] PostMessageW (hWnd=0x703a0, Msg=0xc1e6, wParam=0x0, lParam=0x0) returned 1 [0273.370] GetWindowTextLengthW (hWnd=0x703a0) returned 5 [0273.370] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0273.370] GetSystemMetrics (nIndex=42) returned 0 [0273.370] GetWindowTextW (in: hWnd=0x703a0, lpString=0x14e580, nMaxCount=6 | out: lpString="Form1") returned 5 [0273.370] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xd, wParam=0x6, lParam=0x14e580) returned 0x5 [0273.377] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 1 [0273.377] IsWindowUnicode (hWnd=0x703a0) returned 1 [0273.378] GetMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x14ef30) returned 1 [0273.384] TranslateMessage (lpMsg=0x14ef30) returned 0 [0273.384] DispatchMessageW (lpMsg=0x14ef30) returned 0x0 [0273.384] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x46, wParam=0x0, lParam=0x14eb00) returned 0x0 [0273.384] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x83, wParam=0x1, lParam=0x14ead0) returned 0x0 [0273.386] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0273.386] GetWindowPlacement (in: hWnd=0x703a0, lpwndpl=0x14e6c8 | out: lpwndpl=0x14e6c8) returned 1 [0273.386] GetClientRect (in: hWnd=0x703a0, lpRect=0x14e5e0 | out: lpRect=0x14e5e0) returned 1 [0273.386] GetWindowTextLengthW (hWnd=0x703a0) returned 5 [0273.386] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0273.386] GetSystemMetrics (nIndex=42) returned 0 [0273.386] GetWindowTextW (in: hWnd=0x703a0, lpString=0x14e350, nMaxCount=6 | out: lpString="Form1") returned 5 [0273.386] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xd, wParam=0x6, lParam=0x14e350) returned 0x5 [0273.387] GetClientRect (in: hWnd=0x703a0, lpRect=0x14e3c8 | out: lpRect=0x14e3c8) returned 1 [0273.387] GetCurrentObject (hdc=0xffffffff9801080a, type=0x1) returned 0x1b00017 [0273.387] GetCurrentObject (hdc=0xffffffff9801080a, type=0x2) returned 0x1900010 [0273.387] GetCurrentObject (hdc=0xffffffff9801080a, type=0x7) returned 0x5305067a [0273.387] GetCurrentObject (hdc=0xffffffff9801080a, type=0x6) returned 0x18a0048 [0273.387] SaveDC (hdc=0xffffffff9801080a) returned 1 [0273.387] GetNearestColor (hdc=0xffffffff9801080a, color=0xf0f0f0) returned 0xf0f0f0 [0273.388] CreateSolidBrush (color=0xf0f0f0) returned 0x27100999 [0273.388] FillRect (hDC=0xffffffff9801080a, lprc=0x14e0b8, hbr=0x27100999) returned 1 [0273.455] DeleteObject (ho=0x27100999) returned 1 [0273.455] RestoreDC (hdc=0xffffffff9801080a, nSavedDC=-1) returned 1 [0273.455] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa005a, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0273.455] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa036a, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0273.456] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0273.456] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xb0370, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0273.456] GetWindowPlacement (in: hWnd=0x703a0, lpwndpl=0x14e6a8 | out: lpwndpl=0x14e6a8) returned 1 [0273.457] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x47, wParam=0x0, lParam=0x14eb00) returned 0x0 [0273.457] GetClientRect (in: hWnd=0x703a0, lpRect=0x14e540 | out: lpRect=0x14e540) returned 1 [0273.457] GetWindowRect (in: hWnd=0x703a0, lpRect=0x14e540 | out: lpRect=0x14e540) returned 1 [0273.457] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0273.457] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 1 [0273.457] IsWindowUnicode (hWnd=0x30372) returned 1 [0273.457] GetMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x14ef30) returned 1 [0273.457] TranslateMessage (lpMsg=0x14ef30) returned 0 [0273.457] DispatchMessageW (lpMsg=0x14ef30) returned 0x0 [0273.457] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x30372, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0273.457] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 1 [0273.457] IsWindowUnicode (hWnd=0x703a0) returned 1 [0273.457] GetMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x14ef30) returned 1 [0273.458] TranslateMessage (lpMsg=0x14ef30) returned 0 [0273.458] DispatchMessageW (lpMsg=0x14ef30) returned 0x0 [0273.458] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x46, wParam=0x0, lParam=0x14eb00) returned 0x0 [0273.458] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x83, wParam=0x1, lParam=0x14ead0) returned 0x0 [0273.459] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0273.460] GetWindowPlacement (in: hWnd=0x703a0, lpwndpl=0x14e6c8 | out: lpwndpl=0x14e6c8) returned 1 [0273.460] GetClientRect (in: hWnd=0x703a0, lpRect=0x14e5e0 | out: lpRect=0x14e5e0) returned 1 [0273.460] GetWindowTextLengthW (hWnd=0x703a0) returned 5 [0273.460] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0273.460] GetSystemMetrics (nIndex=42) returned 0 [0273.460] GetWindowTextW (in: hWnd=0x703a0, lpString=0x14e350, nMaxCount=6 | out: lpString="Form1") returned 5 [0273.460] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xd, wParam=0x6, lParam=0x14e350) returned 0x5 [0273.461] GetClientRect (in: hWnd=0x703a0, lpRect=0x14e3c8 | out: lpRect=0x14e3c8) returned 1 [0273.461] GetCurrentObject (hdc=0x4010184, type=0x1) returned 0x1b00017 [0273.461] GetCurrentObject (hdc=0x4010184, type=0x2) returned 0x1900010 [0273.461] GetCurrentObject (hdc=0x4010184, type=0x7) returned 0x5305067a [0273.461] GetCurrentObject (hdc=0x4010184, type=0x6) returned 0x18a0048 [0273.461] SaveDC (hdc=0x4010184) returned 1 [0273.461] GetNearestColor (hdc=0x4010184, color=0xf0f0f0) returned 0xf0f0f0 [0273.461] CreateSolidBrush (color=0xf0f0f0) returned 0x28100999 [0273.461] FillRect (hDC=0x4010184, lprc=0x14e0b8, hbr=0x28100999) returned 1 [0273.462] DeleteObject (ho=0x28100999) returned 1 [0273.462] RestoreDC (hdc=0x4010184, nSavedDC=-1) returned 1 [0273.462] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa005a, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0273.463] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa036a, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0273.463] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0273.463] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xb0370, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0273.463] GetWindowPlacement (in: hWnd=0x703a0, lpwndpl=0x14e6a8 | out: lpwndpl=0x14e6a8) returned 1 [0273.463] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x47, wParam=0x0, lParam=0x14eb00) returned 0x0 [0273.463] GetClientRect (in: hWnd=0x703a0, lpRect=0x14e540 | out: lpRect=0x14e540) returned 1 [0273.464] GetWindowRect (in: hWnd=0x703a0, lpRect=0x14e540 | out: lpRect=0x14e540) returned 1 [0273.464] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x31f, wParam=0x0, lParam=0x0) returned 0x0 [0273.464] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 1 [0273.464] IsWindowUnicode (hWnd=0x703a0) returned 1 [0273.464] GetMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x14ef30) returned 1 [0273.464] TranslateMessage (lpMsg=0x14ef30) returned 0 [0273.464] DispatchMessageW (lpMsg=0x14ef30) returned 0x0 [0273.468] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 1 [0273.468] IsWindowUnicode (hWnd=0x703a0) returned 1 [0273.468] GetMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x14ef30) returned 1 [0273.468] TranslateMessage (lpMsg=0x14ef30) returned 0 [0273.469] DispatchMessageW (lpMsg=0x14ef30) returned 0x0 [0273.470] BeginPaint (in: hWnd=0x703a0, lpPaint=0x14e638 | out: lpPaint=0x14e638) returned 0x4010184 [0273.472] GdipCreateHalftonePalette () returned 0x420805e2 [0273.473] SelectPalette (hdc=0x4010184, hPal=0x420805e2, bForceBkgd=1) returned 0x188000b [0273.473] GetWindowTextLengthW (hWnd=0x703a0) returned 5 [0273.473] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0273.473] GetSystemMetrics (nIndex=42) returned 0 [0273.473] GetWindowTextW (in: hWnd=0x703a0, lpString=0x14e4e0, nMaxCount=6 | out: lpString="Form1") returned 5 [0273.473] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xd, wParam=0x6, lParam=0x14e4e0) returned 0x5 [0273.473] SelectPalette (hdc=0x4010184, hPal=0x188000b, bForceBkgd=0) returned 0x420805e2 [0273.474] EndPaint (hWnd=0x703a0, lpPaint=0x14e5d8) returned 1 [0273.474] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 1 [0273.474] IsWindowUnicode (hWnd=0xa005a) returned 1 [0273.474] GetMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x14ef30) returned 1 [0273.474] TranslateMessage (lpMsg=0x14ef30) returned 0 [0273.474] DispatchMessageW (lpMsg=0x14ef30) returned 0x0 [0273.474] BeginPaint (in: hWnd=0xa005a, lpPaint=0x14e5f8 | out: lpPaint=0x14e5f8) returned 0xa0100d0 [0273.474] SelectPalette (hdc=0xa0100d0, hPal=0x420805e2, bForceBkgd=1) returned 0x188000b [0273.523] CreateCompatibleDC (hdc=0xa0100d0) returned 0x1e01096e [0273.523] GetObjectType (h=0xa0100d0) returned 0x3 [0273.524] CreateCompatibleBitmap (hdc=0xa0100d0, cx=1, cy=1) returned 0x50506e6 [0273.525] GetDIBits (in: hdc=0xa0100d0, hbm=0x50506e6, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x14df88, usage=0x0 | out: lpvBits=0x0, lpbmi=0x14df88) returned 1 [0273.526] GetDIBits (in: hdc=0xa0100d0, hbm=0x50506e6, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x14df88, usage=0x0 | out: lpvBits=0x0, lpbmi=0x14df88) returned 1 [0273.526] DeleteObject (ho=0x50506e6) returned 1 [0273.527] CreateDIBSection (in: hdc=0xa0100d0, lpbmi=0x14e038, usage=0x0, ppvBits=0x14e5f8, hSection=0x0, offset=0x0 | out: ppvBits=0x14e5f8) returned 0x7b05096d [0273.528] SelectObject (hdc=0x1e01096e, h=0x7b05096d) returned 0x185000f [0273.528] GdipCreateFromHDC (hdc=0x1e01096e, graphics=0x14e578) returned 0x0 [0273.532] GdipTranslateWorldTransform (graphics=0x1bef67f0, dx=0x7ff828beee82, dy=0x4d0dd32c1c7a, order=0x0) returned 0x0 [0273.535] GdipSetClipRectI (graphics=0x1bef67f0, x=0, y=0, width=139, height=13, combineMode=0x0) returned 0x0 [0273.538] GdipCreateMatrix (matrix=0x14e5a0) returned 0x0 [0273.539] GdipGetWorldTransform (graphics=0x1bef67f0, matrix=0x9734f0) returned 0x0 [0273.540] GdipIsMatrixIdentity (matrix=0x9734f0, result=0x14e608) returned 0x0 [0273.541] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x634dd0 [0273.541] GdipGetMatrixElements (matrix=0x9734f0, matrixOut=0x634dd0) returned 0x0 [0273.543] LocalFree (hMem=0x634dd0) returned 0x0 [0273.543] GdipDeleteMatrix (matrix=0x9734f0) returned 0x0 [0273.545] GdipCreateRegion (region=0x14e5a0) returned 0x0 [0273.546] GdipGetClip (graphics=0x1bef67f0, region=0x1bef15e0) returned 0x0 [0273.565] GdipIsInfiniteRegion (region=0x1bef15e0, graphics=0x1bef67f0, result=0x14e600) returned 0x0 [0273.566] GdipSaveGraphics (graphics=0x1bef67f0, state=0x14e6a0) returned 0x0 [0273.567] GetWindowTextLengthW (hWnd=0xa005a) returned 25 [0273.567] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa005a, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x19 [0273.568] GetSystemMetrics (nIndex=42) returned 0 [0273.568] GetWindowTextW (in: hWnd=0xa005a, lpString=0x14e470, nMaxCount=26 | out: lpString="Ciastko.zlukrem@gmail.com") returned 25 [0273.568] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa005a, Msg=0xd, wParam=0x1a, lParam=0x14e470) returned 0x19 [0273.568] GetClientRect (in: hWnd=0xa005a, lpRect=0x14e648 | out: lpRect=0x14e648) returned 1 [0273.569] GdipCreateRegion (region=0x14e230) returned 0x0 [0273.570] GdipGetClip (graphics=0x1bef67f0, region=0x1bef16a0) returned 0x0 [0273.570] GdipCreateMatrix (matrix=0x14e230) returned 0x0 [0273.570] GdipGetWorldTransform (graphics=0x1bef67f0, matrix=0x97edb0) returned 0x0 [0273.570] GdipIsMatrixIdentity (matrix=0x97edb0, result=0x14e298) returned 0x0 [0273.570] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x634450 [0273.570] GdipGetMatrixElements (matrix=0x97edb0, matrixOut=0x634450) returned 0x0 [0273.571] LocalFree (hMem=0x634450) returned 0x0 [0273.572] GdipCombineRegionRegion (region=0x1bef16a0, region2=0x1bef15e0, combineMode=0x1) returned 0x0 [0273.572] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x635110 [0273.572] GdipGetMatrixElements (matrix=0x97edb0, matrixOut=0x635110) returned 0x0 [0273.572] LocalFree (hMem=0x635110) returned 0x0 [0273.572] GdipDeleteMatrix (matrix=0x97edb0) returned 0x0 [0273.573] GdipIsInfiniteRegion (region=0x1bef16a0, graphics=0x1bef67f0, result=0x14e300) returned 0x0 [0273.573] GdipIsInfiniteRegion (region=0x1bef16a0, graphics=0x1bef67f0, result=0x14e2c0) returned 0x0 [0273.575] GdipGetRegionHRgn (region=0x1bef16a0, graphics=0x1bef67f0, hRgn=0x14e2c0) returned 0x0 [0273.578] GdipDeleteRegion (region=0x1bef16a0) returned 0x0 [0273.581] GdipGetDC (graphics=0x1bef67f0, hdc=0x14e308) returned 0x0 [0273.581] GetCurrentObject (hdc=0x1e01096e, type=0x1) returned 0x1b00017 [0273.581] GetCurrentObject (hdc=0x1e01096e, type=0x2) returned 0x1900010 [0273.581] GetCurrentObject (hdc=0x1e01096e, type=0x7) returned 0x7b05096d [0273.581] GetCurrentObject (hdc=0x1e01096e, type=0x6) returned 0x18a0048 [0273.581] SaveDC (hdc=0x1e01096e) returned 1 [0273.586] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x37040940 [0273.586] GetClipRgn (hdc=0x1e01096e, hrgn=0x37040940) returned 0 [0273.587] SelectClipRgn (hdc=0x1e01096e, hrgn=0x610409b0) returned 2 [0273.587] DeleteObject (ho=0x37040940) returned 1 [0273.587] DeleteObject (ho=0x610409b0) returned 1 [0273.589] OffsetViewportOrgEx (in: hdc=0x1e01096e, x=0, y=0, lppt=0x2148238 | out: lppt=0x2148238) returned 1 [0273.589] GetNearestColor (hdc=0x1e01096e, color=0xf0f0f0) returned 0xf0f0f0 [0273.589] CreateSolidBrush (color=0xf0f0f0) returned 0x29100999 [0273.589] FillRect (hDC=0x1e01096e, lprc=0x14e338, hbr=0x29100999) returned 1 [0273.589] DeleteObject (ho=0x29100999) returned 1 [0273.589] RestoreDC (hdc=0x1e01096e, nSavedDC=-1) returned 1 [0273.591] GdipReleaseDC (graphics=0x1bef67f0, hdc=0x1e01096e) returned 0x0 [0273.592] GdipRestoreGraphics (graphics=0x1bef67f0, state=0xfffffffffdb80dbd) returned 0x0 [0273.592] GdipDeleteRegion (region=0x1bef15e0) returned 0x0 [0273.593] GetWindowTextLengthW (hWnd=0xa005a) returned 25 [0273.593] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa005a, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x19 [0273.593] GetSystemMetrics (nIndex=42) returned 0 [0273.593] GetWindowTextW (in: hWnd=0xa005a, lpString=0x14e470, nMaxCount=26 | out: lpString="Ciastko.zlukrem@gmail.com") returned 25 [0273.593] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa005a, Msg=0xd, wParam=0x1a, lParam=0x14e470) returned 0x19 [0273.595] GdipGetDC (graphics=0x1bef67f0, hdc=0x14e498) returned 0x0 [0273.595] GetCurrentObject (hdc=0x1e01096e, type=0x1) returned 0x1b00017 [0273.595] GetCurrentObject (hdc=0x1e01096e, type=0x2) returned 0x1900010 [0273.595] GetCurrentObject (hdc=0x1e01096e, type=0x7) returned 0x7b05096d [0273.595] GetCurrentObject (hdc=0x1e01096e, type=0x6) returned 0x18a0048 [0273.595] SaveDC (hdc=0x1e01096e) returned 1 [0273.595] GetNearestColor (hdc=0x1e01096e, color=0x0) returned 0x0 [0273.596] RestoreDC (hdc=0x1e01096e, nSavedDC=-1) returned 1 [0273.596] GdipReleaseDC (graphics=0x1bef67f0, hdc=0x1e01096e) returned 0x0 [0273.596] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83ef20000 [0273.597] AdjustWindowRectEx (in: lpRect=0x14e348, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14e348) returned 1 [0273.598] GdipGetTextRenderingHint (graphics=0x1bef67f0, mode=0x14e3a8) returned 0x0 [0273.598] GdipGetDC (graphics=0x1bef67f0, hdc=0x14e388) returned 0x0 [0273.598] GetCurrentObject (hdc=0x1e01096e, type=0x1) returned 0x1b00017 [0273.599] GetCurrentObject (hdc=0x1e01096e, type=0x2) returned 0x1900010 [0273.599] GetCurrentObject (hdc=0x1e01096e, type=0x7) returned 0x7b05096d [0273.599] GetCurrentObject (hdc=0x1e01096e, type=0x6) returned 0x18a0048 [0273.599] SaveDC (hdc=0x1e01096e) returned 1 [0273.602] GetTextAlign (hdc=0x1e01096e) returned 0x0 [0273.604] GetTextColor (hdc=0x1e01096e) returned 0x0 [0273.604] GetCurrentObject (hdc=0x1e01096e, type=0x6) returned 0x18a0048 [0273.604] GetObjectW (in: h=0x18a0048, c=92, pv=0x14dec0 | out: pv=0x14dec0) returned 92 [0273.604] SelectObject (hdc=0x1e01096e, h=0xffffffff9b0a094a) returned 0x18a0048 [0273.606] GetBkMode (hdc=0x1e01096e) returned 2 [0273.607] SetBkMode (hdc=0x1e01096e, mode=1) returned 2 [0273.607] DrawTextExW (in: hdc=0x1e01096e, lpchText="Ciastko.zlukrem@gmail.com", cchText=25, lprc=0x14e318, format=0x100000, lpdtp=0x2148bb0 | out: lpchText="Ciastko.zlukrem@gmail.com", lprc=0x14e318) returned 13 [0273.613] RestoreDC (hdc=0x1e01096e, nSavedDC=-1) returned 1 [0273.613] GdipReleaseDC (graphics=0x1bef67f0, hdc=0x1e01096e) returned 0x0 [0273.613] GdipGetDC (graphics=0x1bef67f0, hdc=0x14e5b8) returned 0x0 [0273.614] BitBlt (hdc=0xa0100d0, x=0, y=0, cx=139, cy=13, hdcSrc=0x1e01096e, x1=0, y1=0, rop=0xcc0020) returned 1 [0273.616] GdipReleaseDC (graphics=0x1bef67f0, hdc=0x1e01096e) returned 0x0 [0273.616] SelectPalette (hdc=0xa0100d0, hPal=0x188000b, bForceBkgd=0) returned 0x420805e2 [0273.616] SelectObject (hdc=0x1e01096e, h=0x185000f) returned 0x7b05096d [0273.616] DeleteDC (hdc=0x1e01096e) returned 1 [0273.616] GdipDeleteGraphics (graphics=0x1bef67f0) returned 0x0 [0273.617] EndPaint (hWnd=0xa005a, lpPaint=0x14e598) returned 1 [0273.617] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 1 [0273.617] IsWindowUnicode (hWnd=0xa036a) returned 1 [0273.617] GetMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x14ef30) returned 1 [0273.617] TranslateMessage (lpMsg=0x14ef30) returned 0 [0273.617] DispatchMessageW (lpMsg=0x14ef30) returned 0x0 [0273.617] BeginPaint (in: hWnd=0xa036a, lpPaint=0x14e5f8 | out: lpPaint=0x14e5f8) returned 0x4010184 [0273.617] SelectPalette (hdc=0x4010184, hPal=0x420805e2, bForceBkgd=1) returned 0x188000b [0273.617] CreateCompatibleDC (hdc=0x4010184) returned 0x2001096e [0273.617] SelectObject (hdc=0x2001096e, h=0x7b05096d) returned 0x185000f [0273.618] GdipCreateFromHDC (hdc=0x2001096e, graphics=0x14e578) returned 0x0 [0273.618] GdipTranslateWorldTransform (graphics=0x1bef67f0, dx=0x7ff828beee82, dy=0x4d0dd32c1c7a, order=0x0) returned 0x0 [0273.618] GdipSetClipRectI (graphics=0x1bef67f0, x=0, y=0, width=127, height=13, combineMode=0x0) returned 0x0 [0273.618] GdipCreateMatrix (matrix=0x14e5a0) returned 0x0 [0273.618] GdipGetWorldTransform (graphics=0x1bef67f0, matrix=0x9734f0) returned 0x0 [0273.618] GdipIsMatrixIdentity (matrix=0x9734f0, result=0x14e608) returned 0x0 [0273.618] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x635110 [0273.618] GdipGetMatrixElements (matrix=0x9734f0, matrixOut=0x635110) returned 0x0 [0273.619] LocalFree (hMem=0x635110) returned 0x0 [0273.619] GdipDeleteMatrix (matrix=0x9734f0) returned 0x0 [0273.619] GdipCreateRegion (region=0x14e5a0) returned 0x0 [0273.619] GdipGetClip (graphics=0x1bef67f0, region=0x1bef15e0) returned 0x0 [0273.619] GdipIsInfiniteRegion (region=0x1bef15e0, graphics=0x1bef67f0, result=0x14e600) returned 0x0 [0273.619] GdipSaveGraphics (graphics=0x1bef67f0, state=0x14e6a0) returned 0x0 [0273.619] GetWindowTextLengthW (hWnd=0xa036a) returned 21 [0273.619] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa036a, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x15 [0273.619] GetSystemMetrics (nIndex=42) returned 0 [0273.619] GetWindowTextW (in: hWnd=0xa036a, lpString=0x14e480, nMaxCount=22 | out: lpString="4HD74J5gd6G6f6jj49786") returned 21 [0273.619] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa036a, Msg=0xd, wParam=0x16, lParam=0x14e480) returned 0x15 [0273.620] GetClientRect (in: hWnd=0xa036a, lpRect=0x14e648 | out: lpRect=0x14e648) returned 1 [0273.620] GdipCreateRegion (region=0x14e230) returned 0x0 [0273.620] GdipGetClip (graphics=0x1bef67f0, region=0x1bef16a0) returned 0x0 [0273.620] GdipCreateMatrix (matrix=0x14e230) returned 0x0 [0273.620] GdipGetWorldTransform (graphics=0x1bef67f0, matrix=0x97edb0) returned 0x0 [0273.620] GdipIsMatrixIdentity (matrix=0x97edb0, result=0x14e298) returned 0x0 [0273.620] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x634710 [0273.620] GdipGetMatrixElements (matrix=0x97edb0, matrixOut=0x634710) returned 0x0 [0273.620] LocalFree (hMem=0x634710) returned 0x0 [0273.620] GdipCombineRegionRegion (region=0x1bef16a0, region2=0x1bef15e0, combineMode=0x1) returned 0x0 [0273.620] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x634450 [0273.621] GdipGetMatrixElements (matrix=0x97edb0, matrixOut=0x634450) returned 0x0 [0273.621] LocalFree (hMem=0x634450) returned 0x0 [0273.621] GdipDeleteMatrix (matrix=0x97edb0) returned 0x0 [0273.621] GdipIsInfiniteRegion (region=0x1bef16a0, graphics=0x1bef67f0, result=0x14e300) returned 0x0 [0273.621] GdipIsInfiniteRegion (region=0x1bef16a0, graphics=0x1bef67f0, result=0x14e2c0) returned 0x0 [0273.621] GdipGetRegionHRgn (region=0x1bef16a0, graphics=0x1bef67f0, hRgn=0x14e2c0) returned 0x0 [0273.621] GdipDeleteRegion (region=0x1bef16a0) returned 0x0 [0273.621] GdipGetDC (graphics=0x1bef67f0, hdc=0x14e308) returned 0x0 [0273.621] GetCurrentObject (hdc=0x2001096e, type=0x1) returned 0x1b00017 [0273.621] GetCurrentObject (hdc=0x2001096e, type=0x2) returned 0x1900010 [0273.621] GetCurrentObject (hdc=0x2001096e, type=0x7) returned 0x7b05096d [0273.621] GetCurrentObject (hdc=0x2001096e, type=0x6) returned 0x18a0048 [0273.621] SaveDC (hdc=0x2001096e) returned 1 [0273.621] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x620409b0 [0273.622] GetClipRgn (hdc=0x2001096e, hrgn=0x620409b0) returned 0 [0273.622] SelectClipRgn (hdc=0x2001096e, hrgn=0x39040940) returned 2 [0273.622] DeleteObject (ho=0x620409b0) returned 1 [0273.622] DeleteObject (ho=0x39040940) returned 1 [0273.622] OffsetViewportOrgEx (in: hdc=0x2001096e, x=0, y=0, lppt=0x2149228 | out: lppt=0x2149228) returned 1 [0273.622] GetNearestColor (hdc=0x2001096e, color=0xf0f0f0) returned 0xf0f0f0 [0273.622] CreateSolidBrush (color=0xf0f0f0) returned 0x2a100999 [0273.622] FillRect (hDC=0x2001096e, lprc=0x14e338, hbr=0x2a100999) returned 1 [0273.622] DeleteObject (ho=0x2a100999) returned 1 [0273.622] RestoreDC (hdc=0x2001096e, nSavedDC=-1) returned 1 [0273.622] GdipReleaseDC (graphics=0x1bef67f0, hdc=0x2001096e) returned 0x0 [0273.622] GdipRestoreGraphics (graphics=0x1bef67f0, state=0xfffffffffdb60dbd) returned 0x0 [0273.622] GdipDeleteRegion (region=0x1bef15e0) returned 0x0 [0273.623] GetWindowTextLengthW (hWnd=0xa036a) returned 21 [0273.623] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa036a, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x15 [0273.623] GetSystemMetrics (nIndex=42) returned 0 [0273.623] GetWindowTextW (in: hWnd=0xa036a, lpString=0x14e480, nMaxCount=22 | out: lpString="4HD74J5gd6G6f6jj49786") returned 21 [0273.623] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xa036a, Msg=0xd, wParam=0x16, lParam=0x14e480) returned 0x15 [0273.623] GdipGetDC (graphics=0x1bef67f0, hdc=0x14e498) returned 0x0 [0273.623] GetCurrentObject (hdc=0x2001096e, type=0x1) returned 0x1b00017 [0273.623] GetCurrentObject (hdc=0x2001096e, type=0x2) returned 0x1900010 [0273.623] GetCurrentObject (hdc=0x2001096e, type=0x7) returned 0x7b05096d [0273.623] GetCurrentObject (hdc=0x2001096e, type=0x6) returned 0x18a0048 [0273.623] SaveDC (hdc=0x2001096e) returned 1 [0273.624] GetNearestColor (hdc=0x2001096e, color=0x0) returned 0x0 [0273.624] RestoreDC (hdc=0x2001096e, nSavedDC=-1) returned 1 [0273.624] GdipReleaseDC (graphics=0x1bef67f0, hdc=0x2001096e) returned 0x0 [0273.624] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83ef20000 [0273.624] AdjustWindowRectEx (in: lpRect=0x14e348, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14e348) returned 1 [0273.624] GdipGetTextRenderingHint (graphics=0x1bef67f0, mode=0x14e3a8) returned 0x0 [0273.625] GdipGetDC (graphics=0x1bef67f0, hdc=0x14e388) returned 0x0 [0273.625] GetCurrentObject (hdc=0x2001096e, type=0x1) returned 0x1b00017 [0273.625] GetCurrentObject (hdc=0x2001096e, type=0x2) returned 0x1900010 [0273.625] GetCurrentObject (hdc=0x2001096e, type=0x7) returned 0x7b05096d [0273.625] GetCurrentObject (hdc=0x2001096e, type=0x6) returned 0x18a0048 [0273.625] SaveDC (hdc=0x2001096e) returned 1 [0273.625] GetTextAlign (hdc=0x2001096e) returned 0x0 [0273.625] GetTextColor (hdc=0x2001096e) returned 0x0 [0273.625] GetCurrentObject (hdc=0x2001096e, type=0x6) returned 0x18a0048 [0273.625] GetObjectW (in: h=0x18a0048, c=92, pv=0x14dec0 | out: pv=0x14dec0) returned 92 [0273.626] SelectObject (hdc=0x2001096e, h=0xffffffff9b0a094a) returned 0x18a0048 [0273.626] GetBkMode (hdc=0x2001096e) returned 2 [0273.626] SetBkMode (hdc=0x2001096e, mode=1) returned 2 [0273.626] DrawTextExW (in: hdc=0x2001096e, lpchText="4HD74J5gd6G6f6jj49786", cchText=21, lprc=0x14e318, format=0x100000, lpdtp=0x2149b48 | out: lpchText="4HD74J5gd6G6f6jj49786", lprc=0x14e318) returned 13 [0273.628] RestoreDC (hdc=0x2001096e, nSavedDC=-1) returned 1 [0273.628] GdipReleaseDC (graphics=0x1bef67f0, hdc=0x2001096e) returned 0x0 [0273.628] GdipGetDC (graphics=0x1bef67f0, hdc=0x14e5b8) returned 0x0 [0273.628] BitBlt (hdc=0x4010184, x=0, y=0, cx=127, cy=13, hdcSrc=0x2001096e, x1=0, y1=0, rop=0xcc0020) returned 1 [0273.629] GdipReleaseDC (graphics=0x1bef67f0, hdc=0x2001096e) returned 0x0 [0273.629] SelectPalette (hdc=0x4010184, hPal=0x188000b, bForceBkgd=0) returned 0x420805e2 [0273.629] SelectObject (hdc=0x2001096e, h=0x185000f) returned 0x7b05096d [0273.629] DeleteDC (hdc=0x2001096e) returned 1 [0273.629] GdipDeleteGraphics (graphics=0x1bef67f0) returned 0x0 [0273.629] EndPaint (hWnd=0xa036a, lpPaint=0x14e598) returned 1 [0273.629] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 1 [0273.630] IsWindowUnicode (hWnd=0x70298) returned 1 [0273.630] GetMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x14ef30) returned 1 [0273.630] TranslateMessage (lpMsg=0x14ef30) returned 0 [0273.630] DispatchMessageW (lpMsg=0x14ef30) returned 0x0 [0273.630] BeginPaint (in: hWnd=0x70298, lpPaint=0x14e5f8 | out: lpPaint=0x14e5f8) returned 0xffffffff9801080a [0273.630] SelectPalette (hdc=0xffffffff9801080a, hPal=0x420805e2, bForceBkgd=1) returned 0x188000b [0273.630] CreateCompatibleDC (hdc=0xffffffff9801080a) returned 0x2201096e [0273.630] DeleteObject (ho=0x7b05096d) returned 1 [0273.631] GetObjectType (h=0xffffffff9801080a) returned 0x3 [0273.631] CreateCompatibleBitmap (hdc=0xffffffff9801080a, cx=1, cy=1) returned 0x70506e6 [0273.631] GetDIBits (in: hdc=0xffffffff9801080a, hbm=0x70506e6, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x14df88, usage=0x0 | out: lpvBits=0x0, lpbmi=0x14df88) returned 1 [0273.632] GetDIBits (in: hdc=0xffffffff9801080a, hbm=0x70506e6, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x14df88, usage=0x0 | out: lpvBits=0x0, lpbmi=0x14df88) returned 1 [0273.632] DeleteObject (ho=0x70506e6) returned 1 [0273.632] CreateDIBSection (in: hdc=0xffffffff9801080a, lpbmi=0x14e038, usage=0x0, ppvBits=0x14e5f8, hSection=0x0, offset=0x0 | out: ppvBits=0x14e5f8) returned 0x7c05096d [0273.632] SelectObject (hdc=0x2201096e, h=0x7c05096d) returned 0x185000f [0273.632] GdipCreateFromHDC (hdc=0x2201096e, graphics=0x14e578) returned 0x0 [0273.633] GdipTranslateWorldTransform (graphics=0x1bef67f0, dx=0x7ff828beee82, dy=0x4d0dd32c1c7a, order=0x0) returned 0x0 [0273.633] GdipSetClipRectI (graphics=0x1bef67f0, x=0, y=0, width=261, height=13, combineMode=0x0) returned 0x0 [0273.633] GdipCreateMatrix (matrix=0x14e5a0) returned 0x0 [0273.633] GdipGetWorldTransform (graphics=0x1bef67f0, matrix=0x9734f0) returned 0x0 [0273.633] GdipIsMatrixIdentity (matrix=0x9734f0, result=0x14e608) returned 0x0 [0273.633] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x634f50 [0273.633] GdipGetMatrixElements (matrix=0x9734f0, matrixOut=0x634f50) returned 0x0 [0273.633] LocalFree (hMem=0x634f50) returned 0x0 [0273.633] GdipDeleteMatrix (matrix=0x9734f0) returned 0x0 [0273.633] GdipCreateRegion (region=0x14e5a0) returned 0x0 [0273.633] GdipGetClip (graphics=0x1bef67f0, region=0x1bef15e0) returned 0x0 [0273.634] GdipIsInfiniteRegion (region=0x1bef15e0, graphics=0x1bef67f0, result=0x14e600) returned 0x0 [0273.634] GdipSaveGraphics (graphics=0x1bef67f0, state=0x14e6a0) returned 0x0 [0273.634] GetWindowTextLengthW (hWnd=0x70298) returned 54 [0273.634] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x36 [0273.634] GetSystemMetrics (nIndex=42) returned 0 [0273.634] GetWindowTextW (in: hWnd=0x70298, lpString=0x14e430, nMaxCount=55 | out: lpString="Please send 1 Bitcoin(s) to the following BTC address:") returned 54 [0273.634] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0xd, wParam=0x37, lParam=0x14e430) returned 0x36 [0273.634] GetClientRect (in: hWnd=0x70298, lpRect=0x14e648 | out: lpRect=0x14e648) returned 1 [0273.634] GdipCreateRegion (region=0x14e230) returned 0x0 [0273.634] GdipGetClip (graphics=0x1bef67f0, region=0x1bef16a0) returned 0x0 [0273.635] GdipCreateMatrix (matrix=0x14e230) returned 0x0 [0273.635] GdipGetWorldTransform (graphics=0x1bef67f0, matrix=0x97edb0) returned 0x0 [0273.635] GdipIsMatrixIdentity (matrix=0x97edb0, result=0x14e298) returned 0x0 [0273.635] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x6345d0 [0273.635] GdipGetMatrixElements (matrix=0x97edb0, matrixOut=0x6345d0) returned 0x0 [0273.635] LocalFree (hMem=0x6345d0) returned 0x0 [0273.635] GdipCombineRegionRegion (region=0x1bef16a0, region2=0x1bef15e0, combineMode=0x1) returned 0x0 [0273.635] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x635110 [0273.635] GdipGetMatrixElements (matrix=0x97edb0, matrixOut=0x635110) returned 0x0 [0273.635] LocalFree (hMem=0x635110) returned 0x0 [0273.635] GdipDeleteMatrix (matrix=0x97edb0) returned 0x0 [0273.636] GdipIsInfiniteRegion (region=0x1bef16a0, graphics=0x1bef67f0, result=0x14e300) returned 0x0 [0273.636] GdipIsInfiniteRegion (region=0x1bef16a0, graphics=0x1bef67f0, result=0x14e2c0) returned 0x0 [0273.636] GdipGetRegionHRgn (region=0x1bef16a0, graphics=0x1bef67f0, hRgn=0x14e2c0) returned 0x0 [0273.636] GdipDeleteRegion (region=0x1bef16a0) returned 0x0 [0273.636] GdipGetDC (graphics=0x1bef67f0, hdc=0x14e308) returned 0x0 [0273.636] GetCurrentObject (hdc=0x2201096e, type=0x1) returned 0x1b00017 [0273.636] GetCurrentObject (hdc=0x2201096e, type=0x2) returned 0x1900010 [0273.636] GetCurrentObject (hdc=0x2201096e, type=0x7) returned 0x7c05096d [0273.636] GetCurrentObject (hdc=0x2201096e, type=0x6) returned 0x18a0048 [0273.636] SaveDC (hdc=0x2201096e) returned 1 [0273.636] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3a040940 [0273.636] GetClipRgn (hdc=0x2201096e, hrgn=0x3a040940) returned 0 [0273.637] SelectClipRgn (hdc=0x2201096e, hrgn=0x640409b0) returned 2 [0273.637] DeleteObject (ho=0x3a040940) returned 1 [0273.637] DeleteObject (ho=0x640409b0) returned 1 [0273.637] OffsetViewportOrgEx (in: hdc=0x2201096e, x=0, y=0, lppt=0x214b2e0 | out: lppt=0x214b2e0) returned 1 [0273.637] GetNearestColor (hdc=0x2201096e, color=0xf0f0f0) returned 0xf0f0f0 [0273.637] CreateSolidBrush (color=0xf0f0f0) returned 0x2b100999 [0273.637] FillRect (hDC=0x2201096e, lprc=0x14e338, hbr=0x2b100999) returned 1 [0273.638] DeleteObject (ho=0x2b100999) returned 1 [0273.638] RestoreDC (hdc=0x2201096e, nSavedDC=-1) returned 1 [0273.638] GdipReleaseDC (graphics=0x1bef67f0, hdc=0x2201096e) returned 0x0 [0273.638] GdipRestoreGraphics (graphics=0x1bef67f0, state=0xfffffffffdb40dbd) returned 0x0 [0273.638] GdipDeleteRegion (region=0x1bef15e0) returned 0x0 [0273.638] GetWindowTextLengthW (hWnd=0x70298) returned 54 [0273.638] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x36 [0273.638] GetSystemMetrics (nIndex=42) returned 0 [0273.638] GetWindowTextW (in: hWnd=0x70298, lpString=0x14e430, nMaxCount=55 | out: lpString="Please send 1 Bitcoin(s) to the following BTC address:") returned 54 [0273.639] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0x70298, Msg=0xd, wParam=0x37, lParam=0x14e430) returned 0x36 [0273.639] GdipGetDC (graphics=0x1bef67f0, hdc=0x14e498) returned 0x0 [0273.639] GetCurrentObject (hdc=0x2201096e, type=0x1) returned 0x1b00017 [0273.639] GetCurrentObject (hdc=0x2201096e, type=0x2) returned 0x1900010 [0273.639] GetCurrentObject (hdc=0x2201096e, type=0x7) returned 0x7c05096d [0273.639] GetCurrentObject (hdc=0x2201096e, type=0x6) returned 0x18a0048 [0273.639] SaveDC (hdc=0x2201096e) returned 1 [0273.640] GetNearestColor (hdc=0x2201096e, color=0x0) returned 0x0 [0273.640] RestoreDC (hdc=0x2201096e, nSavedDC=-1) returned 1 [0273.640] GdipReleaseDC (graphics=0x1bef67f0, hdc=0x2201096e) returned 0x0 [0273.640] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83ef20000 [0273.641] AdjustWindowRectEx (in: lpRect=0x14e348, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14e348) returned 1 [0273.641] GdipGetTextRenderingHint (graphics=0x1bef67f0, mode=0x14e3a8) returned 0x0 [0273.641] GdipGetDC (graphics=0x1bef67f0, hdc=0x14e388) returned 0x0 [0273.641] GetCurrentObject (hdc=0x2201096e, type=0x1) returned 0x1b00017 [0273.641] GetCurrentObject (hdc=0x2201096e, type=0x2) returned 0x1900010 [0273.641] GetCurrentObject (hdc=0x2201096e, type=0x7) returned 0x7c05096d [0273.642] GetCurrentObject (hdc=0x2201096e, type=0x6) returned 0x18a0048 [0273.642] SaveDC (hdc=0x2201096e) returned 1 [0273.642] GetTextAlign (hdc=0x2201096e) returned 0x0 [0273.642] GetTextColor (hdc=0x2201096e) returned 0x0 [0273.642] GetCurrentObject (hdc=0x2201096e, type=0x6) returned 0x18a0048 [0273.642] GetObjectW (in: h=0x18a0048, c=92, pv=0x14dec0 | out: pv=0x14dec0) returned 92 [0273.643] SelectObject (hdc=0x2201096e, h=0xffffffff9b0a094a) returned 0x18a0048 [0273.643] GetBkMode (hdc=0x2201096e) returned 2 [0273.643] SetBkMode (hdc=0x2201096e, mode=1) returned 2 [0273.653] DrawTextExW (in: hdc=0x2201096e, lpchText="Please send 1 Bitcoin(s) to the following BTC address:", cchText=54, lprc=0x14e318, format=0x100000, lpdtp=0x214bcc0 | out: lpchText="Please send 1 Bitcoin(s) to the following BTC address:", lprc=0x14e318) returned 13 [0273.654] RestoreDC (hdc=0x2201096e, nSavedDC=-1) returned 1 [0273.655] GdipReleaseDC (graphics=0x1bef67f0, hdc=0x2201096e) returned 0x0 [0273.655] GdipGetDC (graphics=0x1bef67f0, hdc=0x14e5b8) returned 0x0 [0273.655] BitBlt (hdc=0xffffffff9801080a, x=0, y=0, cx=261, cy=13, hdcSrc=0x2201096e, x1=0, y1=0, rop=0xcc0020) returned 1 [0273.657] GdipReleaseDC (graphics=0x1bef67f0, hdc=0x2201096e) returned 0x0 [0273.657] SelectPalette (hdc=0xffffffff9801080a, hPal=0x188000b, bForceBkgd=0) returned 0x420805e2 [0273.657] SelectObject (hdc=0x2201096e, h=0x185000f) returned 0x7c05096d [0273.657] DeleteDC (hdc=0x2201096e) returned 1 [0273.657] GdipDeleteGraphics (graphics=0x1bef67f0) returned 0x0 [0273.658] EndPaint (hWnd=0x70298, lpPaint=0x14e598) returned 1 [0273.658] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 1 [0273.658] IsWindowUnicode (hWnd=0xb0370) returned 1 [0273.658] GetMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x14ef30) returned 1 [0273.658] TranslateMessage (lpMsg=0x14ef30) returned 0 [0273.658] DispatchMessageW (lpMsg=0x14ef30) returned 0x0 [0273.658] BeginPaint (in: hWnd=0xb0370, lpPaint=0x14e5f8 | out: lpPaint=0x14e5f8) returned 0xa0100d0 [0273.658] SelectPalette (hdc=0xa0100d0, hPal=0x420805e2, bForceBkgd=1) returned 0x188000b [0273.658] CreateCompatibleDC (hdc=0xa0100d0) returned 0x2401096e [0273.659] SelectObject (hdc=0x2401096e, h=0x7c05096d) returned 0x185000f [0273.659] GdipCreateFromHDC (hdc=0x2401096e, graphics=0x14e578) returned 0x0 [0273.660] GdipTranslateWorldTransform (graphics=0x1bef67f0, dx=0x7ff828beee82, dy=0x4d0dd32c1c7a, order=0x0) returned 0x0 [0273.660] GdipSetClipRectI (graphics=0x1bef67f0, x=0, y=0, width=211, height=13, combineMode=0x0) returned 0x0 [0273.660] GdipCreateMatrix (matrix=0x14e5a0) returned 0x0 [0273.660] GdipGetWorldTransform (graphics=0x1bef67f0, matrix=0x9734f0) returned 0x0 [0273.660] GdipIsMatrixIdentity (matrix=0x9734f0, result=0x14e608) returned 0x0 [0273.660] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x635150 [0273.660] GdipGetMatrixElements (matrix=0x9734f0, matrixOut=0x635150) returned 0x0 [0273.660] LocalFree (hMem=0x635150) returned 0x0 [0273.661] GdipDeleteMatrix (matrix=0x9734f0) returned 0x0 [0273.661] GdipCreateRegion (region=0x14e5a0) returned 0x0 [0273.661] GdipGetClip (graphics=0x1bef67f0, region=0x1bef15e0) returned 0x0 [0273.661] GdipIsInfiniteRegion (region=0x1bef15e0, graphics=0x1bef67f0, result=0x14e600) returned 0x0 [0273.661] GdipSaveGraphics (graphics=0x1bef67f0, state=0x14e6a0) returned 0x0 [0273.661] GetWindowTextLengthW (hWnd=0xb0370) returned 43 [0273.661] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xb0370, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x2b [0273.661] GetSystemMetrics (nIndex=42) returned 0 [0273.661] GetWindowTextW (in: hWnd=0xb0370, lpString=0x14e450, nMaxCount=44 | out: lpString="Your files (count: 99) have been encrypted!") returned 43 [0273.661] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xb0370, Msg=0xd, wParam=0x2c, lParam=0x14e450) returned 0x2b [0273.662] GetClientRect (in: hWnd=0xb0370, lpRect=0x14e648 | out: lpRect=0x14e648) returned 1 [0273.662] GdipCreateRegion (region=0x14e230) returned 0x0 [0273.662] GdipGetClip (graphics=0x1bef67f0, region=0x1bef16a0) returned 0x0 [0273.662] GdipCreateMatrix (matrix=0x14e230) returned 0x0 [0273.662] GdipGetWorldTransform (graphics=0x1bef67f0, matrix=0x97edb0) returned 0x0 [0273.662] GdipIsMatrixIdentity (matrix=0x97edb0, result=0x14e298) returned 0x0 [0273.662] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x634b10 [0273.662] GdipGetMatrixElements (matrix=0x97edb0, matrixOut=0x634b10) returned 0x0 [0273.662] LocalFree (hMem=0x634b10) returned 0x0 [0273.663] GdipCombineRegionRegion (region=0x1bef16a0, region2=0x1bef15e0, combineMode=0x1) returned 0x0 [0273.663] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x634710 [0273.663] GdipGetMatrixElements (matrix=0x97edb0, matrixOut=0x634710) returned 0x0 [0273.663] LocalFree (hMem=0x634710) returned 0x0 [0273.663] GdipDeleteMatrix (matrix=0x97edb0) returned 0x0 [0273.663] GdipIsInfiniteRegion (region=0x1bef16a0, graphics=0x1bef67f0, result=0x14e300) returned 0x0 [0273.663] GdipIsInfiniteRegion (region=0x1bef16a0, graphics=0x1bef67f0, result=0x14e2c0) returned 0x0 [0273.663] GdipGetRegionHRgn (region=0x1bef16a0, graphics=0x1bef67f0, hRgn=0x14e2c0) returned 0x0 [0273.663] GdipDeleteRegion (region=0x1bef16a0) returned 0x0 [0273.664] GdipGetDC (graphics=0x1bef67f0, hdc=0x14e308) returned 0x0 [0273.664] GetCurrentObject (hdc=0x2401096e, type=0x1) returned 0x1b00017 [0273.664] GetCurrentObject (hdc=0x2401096e, type=0x2) returned 0x1900010 [0273.664] GetCurrentObject (hdc=0x2401096e, type=0x7) returned 0x7c05096d [0273.664] GetCurrentObject (hdc=0x2401096e, type=0x6) returned 0x18a0048 [0273.665] SaveDC (hdc=0x2401096e) returned 1 [0273.665] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x650409b0 [0273.665] GetClipRgn (hdc=0x2401096e, hrgn=0x650409b0) returned 0 [0273.665] SelectClipRgn (hdc=0x2401096e, hrgn=0x3c040940) returned 2 [0273.665] DeleteObject (ho=0x650409b0) returned 1 [0273.665] DeleteObject (ho=0x3c040940) returned 1 [0273.665] OffsetViewportOrgEx (in: hdc=0x2401096e, x=0, y=0, lppt=0x214c3b0 | out: lppt=0x214c3b0) returned 1 [0273.665] GetNearestColor (hdc=0x2401096e, color=0xf0f0f0) returned 0xf0f0f0 [0273.665] CreateSolidBrush (color=0xf0f0f0) returned 0x2c100999 [0273.665] FillRect (hDC=0x2401096e, lprc=0x14e338, hbr=0x2c100999) returned 1 [0273.665] DeleteObject (ho=0x2c100999) returned 1 [0273.666] RestoreDC (hdc=0x2401096e, nSavedDC=-1) returned 1 [0273.666] GdipReleaseDC (graphics=0x1bef67f0, hdc=0x2401096e) returned 0x0 [0273.666] GdipRestoreGraphics (graphics=0x1bef67f0, state=0xfffffffffdb20dbd) returned 0x0 [0273.666] GdipDeleteRegion (region=0x1bef15e0) returned 0x0 [0273.666] GetWindowTextLengthW (hWnd=0xb0370) returned 43 [0273.666] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xb0370, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x2b [0273.666] GetSystemMetrics (nIndex=42) returned 0 [0273.666] GetWindowTextW (in: hWnd=0xb0370, lpString=0x14e450, nMaxCount=44 | out: lpString="Your files (count: 99) have been encrypted!") returned 43 [0273.666] CallWindowProcW (lpPrevWndFunc=0x7ff83ef340d0, hWnd=0xb0370, Msg=0xd, wParam=0x2c, lParam=0x14e450) returned 0x2b [0273.666] GdipGetDC (graphics=0x1bef67f0, hdc=0x14e498) returned 0x0 [0273.667] GetCurrentObject (hdc=0x2401096e, type=0x1) returned 0x1b00017 [0273.667] GetCurrentObject (hdc=0x2401096e, type=0x2) returned 0x1900010 [0273.667] GetCurrentObject (hdc=0x2401096e, type=0x7) returned 0x7c05096d [0273.667] GetCurrentObject (hdc=0x2401096e, type=0x6) returned 0x18a0048 [0273.667] SaveDC (hdc=0x2401096e) returned 1 [0273.667] GetNearestColor (hdc=0x2401096e, color=0x0) returned 0x0 [0273.667] RestoreDC (hdc=0x2401096e, nSavedDC=-1) returned 1 [0273.667] GdipReleaseDC (graphics=0x1bef67f0, hdc=0x2401096e) returned 0x0 [0273.668] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ff83ef20000 [0273.668] AdjustWindowRectEx (in: lpRect=0x14e348, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x14e348) returned 1 [0273.668] GdipGetTextRenderingHint (graphics=0x1bef67f0, mode=0x14e3a8) returned 0x0 [0273.668] GdipGetDC (graphics=0x1bef67f0, hdc=0x14e388) returned 0x0 [0273.668] GetCurrentObject (hdc=0x2401096e, type=0x1) returned 0x1b00017 [0273.669] GetCurrentObject (hdc=0x2401096e, type=0x2) returned 0x1900010 [0273.669] GetCurrentObject (hdc=0x2401096e, type=0x7) returned 0x7c05096d [0273.669] GetCurrentObject (hdc=0x2401096e, type=0x6) returned 0x18a0048 [0273.670] SaveDC (hdc=0x2401096e) returned 1 [0273.670] GetTextAlign (hdc=0x2401096e) returned 0x0 [0273.670] GetTextColor (hdc=0x2401096e) returned 0x0 [0273.670] GetCurrentObject (hdc=0x2401096e, type=0x6) returned 0x18a0048 [0273.670] GetObjectW (in: h=0x18a0048, c=92, pv=0x14dec0 | out: pv=0x14dec0) returned 92 [0273.670] SelectObject (hdc=0x2401096e, h=0xffffffff9b0a094a) returned 0x18a0048 [0273.670] GetBkMode (hdc=0x2401096e) returned 2 [0273.670] SetBkMode (hdc=0x2401096e, mode=1) returned 2 [0273.670] DrawTextExW (in: hdc=0x2401096e, lpchText="Your files (count: 99) have been encrypted!", cchText=43, lprc=0x14e318, format=0x100000, lpdtp=0x214cd48 | out: lpchText="Your files (count: 99) have been encrypted!", lprc=0x14e318) returned 13 [0273.671] RestoreDC (hdc=0x2401096e, nSavedDC=-1) returned 1 [0273.671] GdipReleaseDC (graphics=0x1bef67f0, hdc=0x2401096e) returned 0x0 [0273.671] GdipGetDC (graphics=0x1bef67f0, hdc=0x14e5b8) returned 0x0 [0273.671] BitBlt (hdc=0xa0100d0, x=0, y=0, cx=211, cy=13, hdcSrc=0x2401096e, x1=0, y1=0, rop=0xcc0020) returned 1 [0273.672] GdipReleaseDC (graphics=0x1bef67f0, hdc=0x2401096e) returned 0x0 [0273.672] SelectPalette (hdc=0xa0100d0, hPal=0x188000b, bForceBkgd=0) returned 0x420805e2 [0273.672] SelectObject (hdc=0x2401096e, h=0x185000f) returned 0x7c05096d [0273.672] DeleteDC (hdc=0x2401096e) returned 1 [0273.672] GdipDeleteGraphics (graphics=0x1bef67f0) returned 0x0 [0273.672] EndPaint (hWnd=0xb0370, lpPaint=0x14e598) returned 1 [0273.672] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 1 [0273.673] IsWindowUnicode (hWnd=0x40292) returned 1 [0273.673] GetMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x14ef30) returned 1 [0273.673] TranslateMessage (lpMsg=0x14ef30) returned 0 [0273.673] DispatchMessageW (lpMsg=0x14ef30) returned 0x0 [0273.673] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 0 [0273.674] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 0 [0273.674] WaitMessage () returned 1 [0274.015] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 1 [0274.016] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x84, wParam=0x0, lParam=0x20500b8) returned 0x1 [0274.016] IsWindowUnicode (hWnd=0x703a0) returned 1 [0274.016] GetMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x14ef30) returned 1 [0274.016] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x84, wParam=0x0, lParam=0x20500b8) returned 0x1 [0274.018] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0274.018] SetCursor (hCursor=0x10003) returned 0x10003 [0274.018] TranslateMessage (lpMsg=0x14ef30) returned 0 [0274.018] DispatchMessageW (lpMsg=0x14ef30) returned 0x0 [0274.027] _TrackMouseEvent (in: lpEventTrack=0x214ce30 | out: lpEventTrack=0x214ce30) returned 1 [0274.028] SendMessageW (hWnd=0x703a0, Msg=0xc14f, wParam=0x0, lParam=0x0) returned 0x0 [0274.028] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xc14f, wParam=0x0, lParam=0x0) returned 0x0 [0274.029] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x200, wParam=0x0, lParam=0x1eb0073) returned 0x0 [0274.029] GetKeyState (nVirtKey=1) returned 0 [0274.029] GetKeyState (nVirtKey=2) returned 0 [0274.029] GetKeyState (nVirtKey=4) returned 0 [0274.029] GetKeyState (nVirtKey=5) returned 0 [0274.029] GetKeyState (nVirtKey=6) returned 0 [0274.029] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 0 [0274.029] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 0 [0274.029] WaitMessage () returned 1 [0274.127] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 1 [0274.127] IsWindowUnicode (hWnd=0x703a0) returned 1 [0274.127] GetMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x14ef30) returned 1 [0274.127] TranslateMessage (lpMsg=0x14ef30) returned 0 [0274.127] DispatchMessageW (lpMsg=0x14ef30) returned 0x0 [0274.127] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 1 [0274.127] IsWindowUnicode (hWnd=0x703a0) returned 1 [0274.127] GetMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x14ef30) returned 1 [0274.127] TranslateMessage (lpMsg=0x14ef30) returned 0 [0274.127] DispatchMessageW (lpMsg=0x14ef30) returned 0x0 [0274.127] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x2a1, wParam=0x0, lParam=0x1eb0073) returned 0x0 [0274.127] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 0 [0274.127] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 0 [0274.128] WaitMessage () returned 1 [0285.228] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 1 [0285.230] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x84, wParam=0x0, lParam=0x2b6036b) returned 0x1 [0285.231] IsWindowUnicode (hWnd=0x703a0) returned 1 [0285.231] GetMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x14ef30) returned 1 [0285.231] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x84, wParam=0x0, lParam=0x2b6036b) returned 0x1 [0285.232] SetCursor (hCursor=0x10003) returned 0x10003 [0285.232] TranslateMessage (lpMsg=0x14ef30) returned 0 [0285.232] DispatchMessageW (lpMsg=0x14ef30) returned 0x0 [0285.232] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x200, wParam=0x0, lParam=0x29c0326) returned 0x0 [0285.232] GetKeyState (nVirtKey=1) returned 0 [0285.233] GetKeyState (nVirtKey=2) returned 0 [0285.233] GetKeyState (nVirtKey=4) returned 0 [0285.233] GetKeyState (nVirtKey=5) returned 0 [0285.233] GetKeyState (nVirtKey=6) returned 0 [0285.233] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 0 [0285.233] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 0 [0285.233] WaitMessage () returned 1 [0295.277] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 1 [0295.278] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x84, wParam=0x0, lParam=0x1f401c9) returned 0x1 [0295.280] IsWindowUnicode (hWnd=0x703a0) returned 1 [0295.280] GetMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x14ef30) returned 1 [0295.280] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x84, wParam=0x0, lParam=0x1f401c9) returned 0x1 [0295.281] SetCursor (hCursor=0x10003) returned 0x10003 [0295.281] TranslateMessage (lpMsg=0x14ef30) returned 0 [0295.281] DispatchMessageW (lpMsg=0x14ef30) returned 0x0 [0295.281] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x200, wParam=0x0, lParam=0x1da0184) returned 0x0 [0295.281] GetKeyState (nVirtKey=1) returned 0 [0295.281] GetKeyState (nVirtKey=2) returned 0 [0295.281] GetKeyState (nVirtKey=4) returned 0 [0295.281] GetKeyState (nVirtKey=5) returned 0 [0295.281] GetKeyState (nVirtKey=6) returned 0 [0295.281] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 0 [0295.281] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 0 [0295.281] WaitMessage () returned 1 [0305.341] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 1 [0305.342] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x84, wParam=0x0, lParam=0x99007f) returned 0x1 [0305.343] IsWindowUnicode (hWnd=0x703a0) returned 1 [0305.343] GetMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x14ef30) returned 1 [0305.343] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x84, wParam=0x0, lParam=0x99007f) returned 0x1 [0305.343] SetCursor (hCursor=0x10003) returned 0x10003 [0305.343] TranslateMessage (lpMsg=0x14ef30) returned 0 [0305.343] DispatchMessageW (lpMsg=0x14ef30) returned 0x0 [0305.343] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x200, wParam=0x0, lParam=0x7f003a) returned 0x0 [0305.344] GetKeyState (nVirtKey=1) returned 0 [0305.344] GetKeyState (nVirtKey=2) returned 0 [0305.344] GetKeyState (nVirtKey=4) returned 0 [0305.344] GetKeyState (nVirtKey=5) returned 0 [0305.344] GetKeyState (nVirtKey=6) returned 0 [0305.344] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 0 [0305.344] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 0 [0305.344] WaitMessage () returned 1 [0315.411] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 0 [0315.412] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 1 [0315.412] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 1 [0315.412] IsWindowUnicode (hWnd=0x703a0) returned 1 [0315.412] GetMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x14ef30) returned 1 [0315.412] TranslateMessage (lpMsg=0x14ef30) returned 0 [0315.413] DispatchMessageW (lpMsg=0x14ef30) returned 0x0 [0315.420] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x2a3, wParam=0x0, lParam=0x0) returned 0x0 [0315.420] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 0 [0315.420] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 0 [0315.420] WaitMessage () returned 1 [0325.455] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 1 [0325.456] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x84, wParam=0x0, lParam=0x10b02ce) returned 0x1 [0325.456] IsWindowUnicode (hWnd=0x703a0) returned 1 [0325.456] GetMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x14ef30) returned 1 [0325.456] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x84, wParam=0x0, lParam=0x10b02ce) returned 0x1 [0325.457] SetCursor (hCursor=0x10003) returned 0x10003 [0325.457] TranslateMessage (lpMsg=0x14ef30) returned 0 [0325.457] DispatchMessageW (lpMsg=0x14ef30) returned 0x0 [0325.457] _TrackMouseEvent (in: lpEventTrack=0x214ce30 | out: lpEventTrack=0x214ce30) returned 1 [0325.457] SendMessageW (hWnd=0x703a0, Msg=0xc14f, wParam=0x0, lParam=0x0) returned 0x0 [0325.457] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0xc14f, wParam=0x0, lParam=0x0) returned 0x0 [0325.458] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x200, wParam=0x0, lParam=0xf10289) returned 0x0 [0325.458] GetKeyState (nVirtKey=1) returned 0 [0325.458] GetKeyState (nVirtKey=2) returned 0 [0325.458] GetKeyState (nVirtKey=4) returned 0 [0325.458] GetKeyState (nVirtKey=5) returned 0 [0325.458] GetKeyState (nVirtKey=6) returned 0 [0325.458] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 0 [0325.458] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 0 [0325.458] WaitMessage () returned 1 [0325.567] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 1 [0325.567] IsWindowUnicode (hWnd=0x703a0) returned 1 [0325.567] GetMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x14ef30) returned 1 [0325.567] TranslateMessage (lpMsg=0x14ef30) returned 0 [0325.567] DispatchMessageW (lpMsg=0x14ef30) returned 0x0 [0325.567] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 1 [0325.568] IsWindowUnicode (hWnd=0x703a0) returned 1 [0325.568] GetMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x14ef30) returned 1 [0325.568] TranslateMessage (lpMsg=0x14ef30) returned 0 [0325.568] DispatchMessageW (lpMsg=0x14ef30) returned 0x0 [0325.568] CallWindowProcW (lpPrevWndFunc=0x7ff8463f4a40, hWnd=0x703a0, Msg=0x2a1, wParam=0x0, lParam=0xf10289) returned 0x0 [0325.568] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 0 [0325.568] PeekMessageW (in: lpMsg=0x14ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x14ef30) returned 0 [0325.568] WaitMessage () Thread: id = 2 os_tid = 0x3a0 Thread: id = 3 os_tid = 0x1cc Thread: id = 4 os_tid = 0xac4 [0115.338] CoGetContextToken (in: pToken=0x1a69fa80 | out: pToken=0x1a69fa80) returned 0x800401f0 [0115.338] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0115.338] RoInitialize () returned 0x1 [0115.338] RoUninitialize () returned 0x0 [0164.529] WriteFile (in: hFile=0x328, lpBuffer=0x2126778*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1a69f868, lpOverlapped=0x0 | out: lpBuffer=0x2126778*, lpNumberOfBytesWritten=0x1a69f868*=0x20, lpOverlapped=0x0) returned 1 [0164.531] CloseHandle (hObject=0x328) returned 1 Thread: id = 5 os_tid = 0xd6c Thread: id = 6 os_tid = 0xd34 Thread: id = 7 os_tid = 0xd50 Thread: id = 8 os_tid = 0xaa8 [0217.496] CoGetContextToken (in: pToken=0x1dc1fbc0 | out: pToken=0x1dc1fbc0) returned 0x0 [0217.497] CObjectContext::QueryInterface () returned 0x0 [0217.497] CObjectContext::GetCurrentThreadType () returned 0x0 [0217.497] Release () returned 0x0 Thread: id = 9 os_tid = 0xa2c [0293.229] CoGetContextToken (in: pToken=0x1dd1fb40 | out: pToken=0x1dd1fb40) returned 0x0 [0293.229] CObjectContext::QueryInterface () returned 0x0 [0293.229] CObjectContext::GetCurrentThreadType () returned 0x0 [0293.229] Release () returned 0x0 Thread: id = 10 os_tid = 0x840 Thread: id = 11 os_tid = 0x1334