# Flog Txt Version 1 # Analyzer Version: 3.0.2 # Analyzer Build Date: May 15 2019 18:28:42 # Log Creation Date: 20.05.2019 11:04:48.318 Process: id = "1" image_name = "ss.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ss.exe" page_root = "0x45dc4000" os_pid = "0x9ec" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ss.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x9f0 [0051.062] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0055.638] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x24ec4c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0056.057] IsAppThemed () returned 0x1 [0056.078] CoTaskMemAlloc (cb=0xf0) returned 0x6a8628 [0056.078] CreateActCtxA (pActCtx=0x24f148) returned 0x6b9434 [0056.177] CoTaskMemFree (pv=0x6a8628) [0056.234] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc13e [0056.234] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc13c [0056.255] GetUserNameW (in: lpBuffer=0x24ef70, pcbBuffer=0x24f1e8 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x24f1e8) returned 1 [0056.258] GetComputerNameW (in: lpBuffer=0x24ef70, nSize=0x24f1e8 | out: lpBuffer="XDUWTFONO", nSize=0x24f1e8) returned 1 [0057.149] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0058.182] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x73e70000 [0059.512] AdjustWindowRectEx (in: lpRect=0x24f188, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50081 | out: lpRect=0x24f188) returned 1 [0059.583] GetCurrentProcess () returned 0xffffffff [0059.584] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x24f0a0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x24f0a0*=0x1f4) returned 1 [0059.655] GetCurrentActCtx (in: lphActCtx=0x24f000 | out: lphActCtx=0x24f000*=0x0) returned 1 [0059.655] ActivateActCtx (in: hActCtx=0x6b9434, lpCookie=0x24f010 | out: hActCtx=0x6b9434, lpCookie=0x24f010) returned 1 [0059.655] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0060.641] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x73cd0000 [0060.654] GetModuleHandleW (lpModuleName="user32.dll") returned 0x74f40000 [0060.654] GetProcAddress (hModule=0x74f40000, lpProcName="DefWindowProcW") returned 0x771625dd [0060.655] GetStockObject (i=5) returned 0x1900015 [0060.689] GetModuleHandleW (lpModuleName=0x0) returned 0x1300000 [0060.691] CoTaskMemAlloc (cb=0x5c) returned 0x6a8c38 [0060.691] RegisterClassW (lpWndClass=0x24eeb8) returned 0xc13d [0060.691] CoTaskMemFree (pv=0x6a8c38) [0060.691] GetModuleHandleW (lpModuleName=0x0) returned 0x1300000 [0060.692] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r14_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x1300000, lpParam=0x0) returned 0x301de [0060.692] SetWindowLongW (hWnd=0x301de, nIndex=-4, dwNewLong=1997940189) returned 78972902 [0060.693] GetWindowLongW (hWnd=0x301de, nIndex=-4) returned 1997940189 [0060.896] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x24e7c8 | out: phkResult=0x24e7c8*=0x210) returned 0x0 [0060.897] RegQueryValueExW (in: hKey=0x210, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x24e7e8, lpData=0x0, lpcbData=0x24e7e4*=0x0 | out: lpType=0x24e7e8*=0x0, lpData=0x0, lpcbData=0x24e7e4*=0x0) returned 0x2 [0060.897] RegQueryValueExW (in: hKey=0x210, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x24e7e8, lpData=0x0, lpcbData=0x24e7e4*=0x0 | out: lpType=0x24e7e8*=0x0, lpData=0x0, lpcbData=0x24e7e4*=0x0) returned 0x2 [0060.897] RegCloseKey (hKey=0x210) returned 0x0 [0060.924] SetWindowLongW (hWnd=0x301de, nIndex=-4, dwNewLong=78972942) returned 1997940189 [0060.924] GetWindowLongW (hWnd=0x301de, nIndex=-4) returned 78972942 [0060.924] GetWindowLongW (hWnd=0x301de, nIndex=-16) returned 113311744 [0060.925] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc059 [0060.925] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc13a [0060.925] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x301de, Msg=0x81, wParam=0x0, lParam=0x24ea94) returned 0x1 [0060.925] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x301de, Msg=0x83, wParam=0x0, lParam=0x24ea80) returned 0x0 [0060.926] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x301de, Msg=0x1, wParam=0x0, lParam=0x24ea94) returned 0x0 [0060.926] GetClientRect (in: hWnd=0x301de, lpRect=0x24e7fc | out: lpRect=0x24e7fc) returned 1 [0060.926] GetWindowRect (in: hWnd=0x301de, lpRect=0x24e7fc | out: lpRect=0x24e7fc) returned 1 [0060.927] GetParent (hWnd=0x301de) returned 0x0 [0060.927] DeactivateActCtx (dwFlags=0x0, ulCookie=0x187e0001) returned 1 [0061.074] EtwEventRegister () returned 0x0 [0061.080] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x73e70000 [0061.080] AdjustWindowRectEx (in: lpRect=0x24f134, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0x24f134) returned 1 [0061.080] GetSystemMetrics (nIndex=59) returned 1460 [0061.080] GetSystemMetrics (nIndex=60) returned 920 [0061.080] GetSystemMetrics (nIndex=34) returned 132 [0061.080] GetSystemMetrics (nIndex=35) returned 38 [0061.081] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x73e70000 [0061.081] AdjustWindowRectEx (in: lpRect=0x24f034, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0x24f034) returned 1 [0061.225] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ss.exe.config", nBufferLength=0x105, lpBuffer=0x24ea44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ss.exe.config", lpFilePart=0x0) returned 0x33 [0061.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eed8) returned 1 [0061.226] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ss.exe.config" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ss.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x24ef54 | out: lpFileInformation=0x24ef54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eed4) returned 1 [0062.004] GetSystemMetrics (nIndex=11) returned 32 [0062.004] GetSystemMetrics (nIndex=12) returned 32 [0062.013] GetDC (hWnd=0x0) returned 0xb010816 [0062.016] GetDeviceCaps (hdc=0xb010816, index=12) returned 32 [0062.016] GetDeviceCaps (hdc=0xb010816, index=14) returned 1 [0062.016] ReleaseDC (hWnd=0x0, hDC=0xb010816) returned 1 [0062.023] CreateIconFromResourceEx (presbits=0x274c20c, dwResSize=0x10a8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0xd00bf [0062.063] CreateCompatibleDC (hdc=0x0) returned 0x14010250 [0062.067] GetSystemDefaultLCID () returned 0x409 [0062.067] GetStockObject (i=17) returned 0x18a0025 [0062.076] GetObjectW (in: h=0x18a0025, c=92, pv=0x24ee98 | out: pv=0x24ee98) returned 92 [0062.076] GetDC (hWnd=0x0) returned 0xb010816 [0062.125] GdiplusStartup (in: token=0xc5e68, input=0x24e468, output=0x24e4b8 | out: token=0xc5e68, output=0x24e4b8) returned 0x0 [0062.150] CoTaskMemAlloc (cb=0x5c) returned 0x6a88f8 [0062.151] GdipCreateFontFromLogfontW (hdc=0xb010816, logfont=0x6a88f8, font=0x24ef60) returned 0x0 [0062.652] CoTaskMemFree (pv=0x6a88f8) [0062.653] CoTaskMemAlloc (cb=0x5c) returned 0x6a88f8 [0062.653] CoTaskMemFree (pv=0x6a88f8) [0062.653] CoTaskMemAlloc (cb=0x5c) returned 0x6a88f8 [0062.653] CoTaskMemFree (pv=0x6a88f8) [0062.664] GdipGetFontUnit (font=0x10e2230, unit=0x24ef2c) returned 0x0 [0062.664] GdipGetFontSize (font=0x10e2230, size=0x24ef30) returned 0x0 [0062.664] GdipGetFontStyle (font=0x10e2230, style=0x24ef28) returned 0x0 [0062.664] GdipGetFamily (font=0x10e2230, family=0x24ef24) returned 0x0 [0062.750] GdipGetFontSize (font=0x10e2230, size=0x274d778) returned 0x0 [0062.750] ReleaseDC (hWnd=0x0, hDC=0xb010816) returned 1 [0062.750] GetDC (hWnd=0x0) returned 0x301084c [0062.751] GdipCreateFromHDC (hdc=0x301084c, graphics=0x24ef4c) returned 0x0 [0062.752] GdipGetDpiY (graphics=0x4a5fcf0, dpi=0x274d88c) returned 0x0 [0062.752] GdipGetFontHeight (font=0x10e2230, graphics=0x4a5fcf0, height=0x24ef44) returned 0x0 [0062.753] GdipGetEmHeight (family=0x10ef6b8, style=0, EmHeight=0x24ef4c) returned 0x0 [0062.753] GdipGetLineSpacing (family=0x10ef6b8, style=0, LineSpacing=0x24ef4c) returned 0x0 [0062.753] GdipDeleteGraphics (graphics=0x4a5fcf0) returned 0x0 [0062.753] ReleaseDC (hWnd=0x0, hDC=0x301084c) returned 1 [0062.754] GdipCreateFont (fontFamily=0x10ef6b8, emSize=0x41040000, style=0, unit=0x3, font=0x274d84c) returned 0x0 [0062.754] GdipGetFontSize (font=0x4ab2940, size=0x274d850) returned 0x0 [0062.754] GdipDeleteFont (font=0x10e2230) returned 0x0 [0062.755] GetDC (hWnd=0x0) returned 0x301084c [0062.755] GdipCreateFromHDC (hdc=0x301084c, graphics=0x24ef70) returned 0x0 [0062.756] CoTaskMemAlloc (cb=0x5c) returned 0x6a88f8 [0062.756] GdipGetLogFontW (font=0x4ab2940, graphics=0x4a5fcf0, logfontW=0x6a88f8) returned 0x0 [0062.756] CoTaskMemFree (pv=0x6a88f8) [0062.756] CoTaskMemAlloc (cb=0x5c) returned 0x6a88f8 [0062.756] CoTaskMemFree (pv=0x6a88f8) [0062.757] CoTaskMemAlloc (cb=0x5c) returned 0x6a88f8 [0062.757] CoTaskMemFree (pv=0x6a88f8) [0062.757] GdipDeleteGraphics (graphics=0x4a5fcf0) returned 0x0 [0062.757] ReleaseDC (hWnd=0x0, hDC=0x301084c) returned 1 [0062.757] CoTaskMemAlloc (cb=0x5c) returned 0x6a88f8 [0062.757] CreateFontIndirectW (lplf=0x6a88f8) returned 0x170a07c6 [0062.757] CoTaskMemFree (pv=0x6a88f8) [0062.758] SelectObject (hdc=0x14010250, h=0x170a07c6) returned 0x18a002e [0062.758] GetTextMetricsW (in: hdc=0x14010250, lptm=0x24f07c | out: lptm=0x24f07c) returned 1 [0062.759] GetTextExtentPoint32W (in: hdc=0x14010250, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x274daa8 | out: psizl=0x274daa8) returned 1 [0062.762] SelectObject (hdc=0x14010250, h=0x18a002e) returned 0x170a07c6 [0062.773] DeleteDC (hdc=0x14010250) returned 1 [0062.774] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x73e70000 [0062.774] AdjustWindowRectEx (in: lpRect=0x24edc8, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x24edc8) returned 1 [0062.774] AdjustWindowRectEx (in: lpRect=0x24f008, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0x24f008) returned 1 [0062.774] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x73e70000 [0062.774] AdjustWindowRectEx (in: lpRect=0x24ed40, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x24ed40) returned 1 [0062.774] AdjustWindowRectEx (in: lpRect=0x24ee40, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0x24ee40) returned 1 [0062.787] GetSystemMetrics (nIndex=34) returned 132 [0062.787] GetSystemMetrics (nIndex=35) returned 38 [0062.787] GetCurrentActCtx (in: lphActCtx=0x24f1bc | out: lphActCtx=0x24f1bc*=0x0) returned 1 [0062.788] ActivateActCtx (in: hActCtx=0x6b9434, lpCookie=0x24f1cc | out: hActCtx=0x6b9434, lpCookie=0x24f1cc) returned 1 [0062.790] GetCurrentActCtx (in: lphActCtx=0x24efdc | out: lphActCtx=0x24efdc*=0x6b9434) returned 1 [0062.791] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x73cd0000 [0062.791] AdjustWindowRectEx (in: lpRect=0x24ef20, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x24ef20) returned 1 [0062.791] GetModuleHandleW (lpModuleName=0x0) returned 0x1300000 [0062.794] CreateWindowExW (dwExStyle=0x50080, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r14_ad1", lpWindowName="hidden tear", dwStyle=0x2cf0000, X=-2147483648, Y=-2147483648, nWidth=136, nHeight=57, hWndParent=0x0, hMenu=0x0, hInstance=0x1300000, lpParam=0x0) returned 0x40124 [0062.794] SetWindowLongW (hWnd=0x40124, nIndex=-4, dwNewLong=1997940189) returned 78972902 [0062.794] GetWindowLongW (hWnd=0x40124, nIndex=-4) returned 1997940189 [0062.795] SetWindowLongW (hWnd=0x40124, nIndex=-4, dwNewLong=78973022) returned 1997940189 [0062.795] GetWindowLongW (hWnd=0x40124, nIndex=-4) returned 78973022 [0062.795] GetWindowLongW (hWnd=0x40124, nIndex=-16) returned 114229248 [0062.795] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0x81, wParam=0x0, lParam=0x24ea70) returned 0x1 [0062.796] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0x83, wParam=0x0, lParam=0x24ea5c) returned 0x0 [0063.057] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0x1, wParam=0x0, lParam=0x24ea70) returned 0x0 [0063.057] GetClientRect (in: hWnd=0x40124, lpRect=0x24e7a8 | out: lpRect=0x24e7a8) returned 1 [0063.057] GetWindowRect (in: hWnd=0x40124, lpRect=0x24e7a8 | out: lpRect=0x24e7a8) returned 1 [0063.058] SetWindowTextW (hWnd=0x40124, lpString="hidden tear") returned 1 [0063.058] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0xc, wParam=0x0, lParam=0x2738a94) returned 0x1 [0063.064] GetUserObjectInformationA (in: hObj=0x5c, nIndex=1, pvInfo=0x274e050, nLength=0xc, lpnLengthNeeded=0x24e6a8 | out: pvInfo=0x274e050, lpnLengthNeeded=0x24e6a8) returned 1 [0063.066] SetConsoleCtrlHandler (HandlerRoutine=0x4b50886, Add=1) returned 1 [0063.067] GetModuleHandleW (lpModuleName=0x0) returned 0x1300000 [0063.067] GetModuleHandleW (lpModuleName=0x0) returned 0x1300000 [0063.069] GetClassInfoW (in: hInstance=0x1300000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWndClass=0x274e0b4 | out: lpWndClass=0x274e0b4) returned 0 [0063.070] CoTaskMemAlloc (cb=0x58) returned 0x68e878 [0063.070] RegisterClassW (lpWndClass=0x24e5f8) returned 0xc138 [0063.071] CoTaskMemFree (pv=0x68e878) [0063.071] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x1300000, lpParam=0x0) returned 0x6011c [0063.072] NtdllDefWindowProc_W () returned 0x0 [0063.072] NtdllDefWindowProc_W () returned 0x0 [0063.072] NtdllDefWindowProc_W () returned 0x0 [0063.072] NtdllDefWindowProc_W () returned 0x0 [0063.084] GetStartupInfoW (in: lpStartupInfo=0x274e508 | out: lpStartupInfo=0x274e508*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ss.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0063.084] GetParent (hWnd=0x40124) returned 0x0 [0063.085] SetWindowLongW (hWnd=0x40124, nIndex=-8, dwNewLong=0) returned 0 [0063.085] GetSystemMetrics (nIndex=49) returned 16 [0063.085] GetSystemMetrics (nIndex=50) returned 16 [0063.085] CreateIconFromResourceEx (presbits=0x274e588, dwResSize=0x468, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0xe01ab [0063.086] SendMessageW (hWnd=0x40124, Msg=0x80, wParam=0x0, lParam=0xe01ab) returned 0x0 [0063.086] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0x80, wParam=0x0, lParam=0xe01ab) returned 0x0 [0063.086] SendMessageW (hWnd=0x40124, Msg=0x80, wParam=0x1, lParam=0xd00bf) returned 0x0 [0063.086] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0x80, wParam=0x1, lParam=0xd00bf) returned 0x0 [0063.116] GetSystemMenu (hWnd=0x40124, bRevert=0) returned 0xd01b5 [0063.129] GetWindowPlacement (in: hWnd=0x40124, lpwndpl=0x24efec | out: lpwndpl=0x24efec) returned 1 [0063.130] EnableMenuItem (hMenu=0xd01b5, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0063.130] EnableMenuItem (hMenu=0xd01b5, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0063.130] EnableMenuItem (hMenu=0xd01b5, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0063.130] EnableMenuItem (hMenu=0xd01b5, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0063.130] EnableMenuItem (hMenu=0xd01b5, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0063.130] GetClientRect (in: hWnd=0x40124, lpRect=0x24f030 | out: lpRect=0x24f030) returned 1 [0063.130] GetClientRect (in: hWnd=0x40124, lpRect=0x24ef90 | out: lpRect=0x24ef90) returned 1 [0063.130] GetWindowRect (in: hWnd=0x40124, lpRect=0x24ef90 | out: lpRect=0x24ef90) returned 1 [0063.130] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x73cd0000 [0063.138] GetWindowLongW (hWnd=0x40124, nIndex=-16) returned 114229248 [0063.138] GetWindowTextLengthW (hWnd=0x40124) returned 11 [0063.138] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0063.139] GetSystemMetrics (nIndex=42) returned 0 [0063.139] GetWindowTextW (in: hWnd=0x40124, lpString=0x24ef08, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0063.139] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0xd, wParam=0xc, lParam=0x24ef08) returned 0xb [0063.140] GetWindowTextLengthW (hWnd=0x40124) returned 11 [0063.140] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0063.140] GetSystemMetrics (nIndex=42) returned 0 [0063.140] GetWindowTextW (in: hWnd=0x40124, lpString=0x24ef08, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0063.140] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0xd, wParam=0xc, lParam=0x24ef08) returned 0xb [0063.140] GetWindowLongW (hWnd=0x40124, nIndex=-16) returned 114229248 [0063.140] GetWindowLongW (hWnd=0x40124, nIndex=-20) returned 328064 [0063.140] SetWindowLongW (hWnd=0x40124, nIndex=-16, dwNewLong=47120384) returned 114229248 [0063.140] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0x7c, wParam=0xfffffff0, lParam=0x24ef84) returned 0x0 [0063.140] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0x7d, wParam=0xfffffff0, lParam=0x24ef84) returned 0x0 [0063.140] SetWindowLongW (hWnd=0x40124, nIndex=-20, dwNewLong=327808) returned 328064 [0063.140] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0x7c, wParam=0xffffffec, lParam=0x24ef84) returned 0x0 [0063.141] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0x7d, wParam=0xffffffec, lParam=0x24ef84) returned 0x0 [0063.150] SetWindowPos (hWnd=0x40124, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0063.150] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0x46, wParam=0x0, lParam=0x24efa4) returned 0x0 [0063.150] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0x83, wParam=0x1, lParam=0x24ef7c) returned 0x0 [0063.151] GetWindowPlacement (in: hWnd=0x40124, lpwndpl=0x24ed54 | out: lpwndpl=0x24ed54) returned 1 [0063.151] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0x47, wParam=0x0, lParam=0x24efa4) returned 0x0 [0063.151] GetClientRect (in: hWnd=0x40124, lpRect=0x24ed04 | out: lpRect=0x24ed04) returned 1 [0063.151] GetWindowRect (in: hWnd=0x40124, lpRect=0x24ed04 | out: lpRect=0x24ed04) returned 1 [0063.152] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0x83, wParam=0x1, lParam=0x24eb88) returned 0x0 [0063.152] RedrawWindow (hWnd=0x40124, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0063.152] GetSystemMenu (hWnd=0x40124, bRevert=0) returned 0xd01b5 [0063.152] GetWindowPlacement (in: hWnd=0x40124, lpwndpl=0x24efdc | out: lpwndpl=0x24efdc) returned 1 [0063.152] EnableMenuItem (hMenu=0xd01b5, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0063.152] EnableMenuItem (hMenu=0xd01b5, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0063.152] EnableMenuItem (hMenu=0xd01b5, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0063.152] EnableMenuItem (hMenu=0xd01b5, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0063.153] EnableMenuItem (hMenu=0xd01b5, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0063.153] ShowWindow (hWnd=0x40124, nCmdShow=5) [0063.153] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0063.153] GetWindowTextLengthW (hWnd=0x40124) returned 11 [0063.153] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0063.153] GetSystemMetrics (nIndex=42) returned 0 [0063.153] GetWindowTextW (in: hWnd=0x40124, lpString=0x24ec48, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0063.154] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0xd, wParam=0xc, lParam=0x24ec48) returned 0xb [0063.215] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x73cd0000 [0063.215] GetWindowLongW (hWnd=0x40124, nIndex=-16) returned 114229248 [0063.215] GetWindowTextLengthW (hWnd=0x40124) returned 11 [0063.215] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0063.215] GetSystemMetrics (nIndex=42) returned 0 [0063.215] GetWindowTextW (in: hWnd=0x40124, lpString=0x24eb28, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0063.215] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0xd, wParam=0xc, lParam=0x24eb28) returned 0xb [0063.215] GetWindowTextLengthW (hWnd=0x40124) returned 11 [0063.215] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0063.215] GetSystemMetrics (nIndex=42) returned 0 [0063.215] GetWindowTextW (in: hWnd=0x40124, lpString=0x24eb28, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0063.215] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0xd, wParam=0xc, lParam=0x24eb28) returned 0xb [0063.216] GetWindowLongW (hWnd=0x40124, nIndex=-16) returned 114229248 [0063.216] GetWindowLongW (hWnd=0x40124, nIndex=-20) returned 328064 [0063.216] SetWindowLongW (hWnd=0x40124, nIndex=-16, dwNewLong=315555840) returned 114229248 [0063.216] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0x7c, wParam=0xfffffff0, lParam=0x24eba4) returned 0x0 [0063.216] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0x7d, wParam=0xfffffff0, lParam=0x24eba4) returned 0x0 [0063.216] SetWindowLongW (hWnd=0x40124, nIndex=-20, dwNewLong=852096) returned 328064 [0063.216] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0x7c, wParam=0xffffffec, lParam=0x24eba4) returned 0x0 [0063.221] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0x7d, wParam=0xffffffec, lParam=0x24eba4) returned 0x0 [0063.222] SetWindowPos (hWnd=0x40124, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0063.222] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0x46, wParam=0x0, lParam=0x24ebc4) returned 0x0 [0063.222] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0x83, wParam=0x1, lParam=0x24eb9c) returned 0x0 [0063.222] GetWindowPlacement (in: hWnd=0x40124, lpwndpl=0x24e974 | out: lpwndpl=0x24e974) returned 1 [0063.222] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0x47, wParam=0x0, lParam=0x24ebc4) returned 0x0 [0063.222] GetClientRect (in: hWnd=0x40124, lpRect=0x24e924 | out: lpRect=0x24e924) returned 1 [0063.222] GetWindowRect (in: hWnd=0x40124, lpRect=0x24e924 | out: lpRect=0x24e924) returned 1 [0063.223] RedrawWindow (hWnd=0x40124, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0063.223] GetSystemMenu (hWnd=0x40124, bRevert=0) returned 0xd01b5 [0063.223] GetWindowPlacement (in: hWnd=0x40124, lpwndpl=0x24ebfc | out: lpwndpl=0x24ebfc) returned 1 [0063.223] EnableMenuItem (hMenu=0xd01b5, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0063.223] EnableMenuItem (hMenu=0xd01b5, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0063.223] EnableMenuItem (hMenu=0xd01b5, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0063.223] EnableMenuItem (hMenu=0xd01b5, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0063.223] EnableMenuItem (hMenu=0xd01b5, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0063.236] SetLayeredWindowAttributes (hwnd=0x40124, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0063.246] GetCurrentThreadId () returned 0x9f0 [0063.275] EnumThreadWindows (dwThreadId=0x9f0, lpfn=0x4b508d6, lParam=0x40124) returned 1 [0063.314] GetWindowLongW (hWnd=0x6011c, nIndex=-8) returned 0 [0063.314] GetWindowLongW (hWnd=0x40124, nIndex=-8) returned 0 [0063.315] GetWindowLongW (hWnd=0x4011e, nIndex=-8) returned 262436 [0063.341] SetWindowLongW (hWnd=0x4011e, nIndex=-8, dwNewLong=0) returned 262436 [0063.344] GetParent (hWnd=0x40124) returned 0x0 [0063.344] GetWindowLongW (hWnd=0x40124, nIndex=-20) returned 852352 [0063.344] DestroyWindow (hWnd=0x40124) returned 1 [0063.344] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0063.345] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0x46, wParam=0x0, lParam=0x24eb00) returned 0x0 [0063.347] GetWindowPlacement (in: hWnd=0x40124, lpwndpl=0x24e8b0 | out: lpwndpl=0x24e8b0) returned 1 [0063.347] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0x47, wParam=0x0, lParam=0x24eb00) returned 0x0 [0063.347] GetClientRect (in: hWnd=0x40124, lpRect=0x24e860 | out: lpRect=0x24e860) returned 1 [0063.347] GetWindowRect (in: hWnd=0x40124, lpRect=0x24e860 | out: lpRect=0x24e860) returned 1 [0063.367] GetWindowTextLengthW (hWnd=0x40124) returned 11 [0063.367] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0063.367] GetSystemMetrics (nIndex=42) returned 0 [0063.367] GetWindowTextW (in: hWnd=0x40124, lpString=0x24e780, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0063.367] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0xd, wParam=0xc, lParam=0x24e780) returned 0xb [0063.368] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0063.368] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x40124, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0063.370] GetCurrentActCtx (in: lphActCtx=0x24eb5c | out: lphActCtx=0x24eb5c*=0x6b9434) returned 1 [0063.370] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x73cd0000 [0063.370] GetModuleHandleW (lpModuleName=0x0) returned 0x1300000 [0063.370] CreateWindowExW (dwExStyle=0x90080, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r14_ad1", lpWindowName="hidden tear", dwStyle=0x2cf0000, X=125, Y=125, nWidth=136, nHeight=57, hWndParent=0x0, hMenu=0x0, hInstance=0x1300000, lpParam=0x0) returned 0x401b2 [0063.370] SetWindowLongW (hWnd=0x401b2, nIndex=-4, dwNewLong=1997940189) returned 78972902 [0063.370] GetWindowLongW (hWnd=0x401b2, nIndex=-4) returned 1997940189 [0063.371] SetWindowLongW (hWnd=0x401b2, nIndex=-4, dwNewLong=78973182) returned 1997940189 [0063.371] GetWindowLongW (hWnd=0x401b2, nIndex=-4) returned 78973182 [0063.371] GetWindowLongW (hWnd=0x401b2, nIndex=-16) returned 114229248 [0063.372] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x401b2, Msg=0x81, wParam=0x0, lParam=0x24e5f0) returned 0x1 [0063.372] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x401b2, Msg=0x83, wParam=0x0, lParam=0x24e5dc) returned 0x0 [0063.372] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x401b2, Msg=0x1, wParam=0x0, lParam=0x24e5f0) returned 0x0 [0063.372] GetClientRect (in: hWnd=0x401b2, lpRect=0x24e328 | out: lpRect=0x24e328) returned 1 [0063.372] GetWindowRect (in: hWnd=0x401b2, lpRect=0x24e328 | out: lpRect=0x24e328) returned 1 [0063.372] SetWindowTextW (hWnd=0x401b2, lpString="hidden tear") returned 1 [0063.372] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x401b2, Msg=0xc, wParam=0x0, lParam=0x274f00c) returned 0x1 [0063.372] SetLayeredWindowAttributes (hwnd=0x401b2, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0063.373] GetStartupInfoW (in: lpStartupInfo=0x274f2e8 | out: lpStartupInfo=0x274f2e8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ss.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0063.373] GetParent (hWnd=0x401b2) returned 0x0 [0063.373] GetStockObject (i=5) returned 0x1900015 [0063.374] GetModuleHandleW (lpModuleName=0x0) returned 0x1300000 [0063.374] CoTaskMemAlloc (cb=0x5c) returned 0x6a88f8 [0063.374] RegisterClassW (lpWndClass=0x24ea3c) returned 0xc137 [0063.374] CoTaskMemFree (pv=0x6a88f8) [0063.374] GetModuleHandleW (lpModuleName=0x0) returned 0x1300000 [0063.374] CreateWindowExW (dwExStyle=0x80, lpClassName="WindowsForms10.Window.0.app.0.141b42a_r14_ad1", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x1300000, lpParam=0x0) returned 0x1701c0 [0063.375] SetWindowLongW (hWnd=0x1701c0, nIndex=-4, dwNewLong=1997940189) returned 78973222 [0063.375] GetWindowLongW (hWnd=0x1701c0, nIndex=-4) returned 1997940189 [0063.375] SetWindowLongW (hWnd=0x1701c0, nIndex=-4, dwNewLong=78973262) returned 1997940189 [0063.375] GetWindowLongW (hWnd=0x1701c0, nIndex=-4) returned 78973262 [0063.375] GetWindowLongW (hWnd=0x1701c0, nIndex=-16) returned 79691776 [0063.376] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x1701c0, Msg=0x24, wParam=0x0, lParam=0x24e624) returned 0x0 [0063.376] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x1701c0, Msg=0x81, wParam=0x0, lParam=0x24e618) returned 0x1 [0063.377] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x1701c0, Msg=0x83, wParam=0x0, lParam=0x24e604) returned 0x0 [0063.377] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x1701c0, Msg=0x1, wParam=0x0, lParam=0x24e618) returned 0x0 [0063.377] SetWindowLongW (hWnd=0x401b2, nIndex=-8, dwNewLong=1507776) returned 0 [0063.377] SendMessageW (hWnd=0x401b2, Msg=0x80, wParam=0x0, lParam=0xe01ab) returned 0x0 [0063.377] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x401b2, Msg=0x80, wParam=0x0, lParam=0xe01ab) returned 0x0 [0063.378] SendMessageW (hWnd=0x401b2, Msg=0x80, wParam=0x1, lParam=0xd00bf) returned 0x0 [0063.378] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x401b2, Msg=0x80, wParam=0x1, lParam=0xd00bf) returned 0x0 [0063.378] GetSystemMenu (hWnd=0x401b2, bRevert=0) returned 0xe01b5 [0063.379] GetWindowPlacement (in: hWnd=0x401b2, lpwndpl=0x24eb6c | out: lpwndpl=0x24eb6c) returned 1 [0063.379] EnableMenuItem (hMenu=0xe01b5, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0063.379] EnableMenuItem (hMenu=0xe01b5, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0063.379] EnableMenuItem (hMenu=0xe01b5, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0063.379] EnableMenuItem (hMenu=0xe01b5, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0063.379] EnableMenuItem (hMenu=0xe01b5, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0063.379] GetClientRect (in: hWnd=0x401b2, lpRect=0x24ebb0 | out: lpRect=0x24ebb0) returned 1 [0063.379] GetClientRect (in: hWnd=0x401b2, lpRect=0x24eb10 | out: lpRect=0x24eb10) returned 1 [0063.379] GetWindowRect (in: hWnd=0x401b2, lpRect=0x24eb10 | out: lpRect=0x24eb10) returned 1 [0063.379] SetWindowPos (hWnd=0x401b2, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1 [0063.379] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x401b2, Msg=0x46, wParam=0x0, lParam=0x24ea78) returned 0x0 [0063.383] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x401b2, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0063.385] GetWindowPlacement (in: hWnd=0x401b2, lpwndpl=0x24e840 | out: lpwndpl=0x24e840) returned 1 [0063.385] GetClientRect (in: hWnd=0x401b2, lpRect=0x24e7ec | out: lpRect=0x24e7ec) returned 1 [0063.385] GetWindowTextLengthW (hWnd=0x401b2) returned 11 [0063.385] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x401b2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0063.385] GetSystemMetrics (nIndex=42) returned 0 [0063.385] GetWindowTextW (in: hWnd=0x401b2, lpString=0x24e6ac, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0063.385] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x401b2, Msg=0xd, wParam=0xc, lParam=0x24e6ac) returned 0xb [0063.385] GetClientRect (in: hWnd=0x401b2, lpRect=0x24e6f4 | out: lpRect=0x24e6f4) returned 1 [0063.386] GetSysColor (nIndex=10) returned 0xb4b4b4 [0063.386] GetSysColor (nIndex=2) returned 0xd1b499 [0063.387] GetSysColor (nIndex=9) returned 0x0 [0063.387] GetSysColor (nIndex=12) returned 0xababab [0063.387] GetSysColor (nIndex=15) returned 0xf0f0f0 [0063.387] GetSysColor (nIndex=20) returned 0xffffff [0063.387] GetSysColor (nIndex=16) returned 0xa0a0a0 [0063.387] GetSysColor (nIndex=15) returned 0xf0f0f0 [0063.387] GetSysColor (nIndex=16) returned 0xa0a0a0 [0063.387] GetSysColor (nIndex=21) returned 0x696969 [0063.387] GetSysColor (nIndex=22) returned 0xe3e3e3 [0063.387] GetSysColor (nIndex=20) returned 0xffffff [0063.387] GetSysColor (nIndex=18) returned 0x0 [0063.387] GetSysColor (nIndex=1) returned 0x0 [0063.387] GetSysColor (nIndex=27) returned 0xead1b9 [0063.387] GetSysColor (nIndex=28) returned 0xf2e4d7 [0063.387] GetSysColor (nIndex=17) returned 0x6d6d6d [0063.388] GetSysColor (nIndex=13) returned 0xff9933 [0063.388] GetSysColor (nIndex=14) returned 0xffffff [0063.388] GetSysColor (nIndex=26) returned 0xcc6600 [0063.388] GetSysColor (nIndex=11) returned 0xfcf7f4 [0063.388] GetSysColor (nIndex=3) returned 0xdbcdbf [0063.388] GetSysColor (nIndex=19) returned 0x544e43 [0063.388] GetSysColor (nIndex=24) returned 0xe1ffff [0063.388] GetSysColor (nIndex=23) returned 0x0 [0063.388] GetSysColor (nIndex=4) returned 0xf0f0f0 [0063.388] GetSysColor (nIndex=30) returned 0xf0f0f0 [0063.388] GetSysColor (nIndex=29) returned 0xff9933 [0063.388] GetSysColor (nIndex=7) returned 0x0 [0063.388] GetSysColor (nIndex=0) returned 0xc8c8c8 [0063.388] GetSysColor (nIndex=5) returned 0xffffff [0063.389] GetSysColor (nIndex=6) returned 0x646464 [0063.389] GetSysColor (nIndex=8) returned 0x0 [0063.390] GetSystemMetrics (nIndex=80) returned 1 [0063.392] EnumDisplayMonitors (hdc=0x0, lprcClip=0x0, lpfnEnum=0x4b50976, dwData=0x0) returned 1 [0063.392] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x24e35c | out: lpmi=0x24e35c) returned 1 [0063.393] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x58010809 [0063.393] GetDeviceCaps (hdc=0x58010809, index=12) returned 32 [0063.393] GetDeviceCaps (hdc=0x58010809, index=14) returned 1 [0063.393] DeleteDC (hdc=0x58010809) returned 1 [0063.393] GetCurrentObject (hdc=0xb010816, type=0x1) returned 0x1b00017 [0063.394] GetCurrentObject (hdc=0xb010816, type=0x2) returned 0x1900010 [0063.394] GetCurrentObject (hdc=0xb010816, type=0x7) returned 0x7050852 [0063.394] GetCurrentObject (hdc=0xb010816, type=0x6) returned 0x18a002e [0063.394] SaveDC (hdc=0xb010816) returned 1 [0063.394] GetNearestColor (hdc=0xb010816, color=0xf0f0f0) returned 0xf0f0f0 [0063.395] CreateSolidBrush (color=0xf0f0f0) returned 0xe100854 [0063.395] FillRect (hDC=0xb010816, lprc=0x24e594, hbr=0xe100854) returned 1 [0063.396] DeleteObject (ho=0xe100854) returned 1 [0063.397] RestoreDC (hdc=0xb010816, nSavedDC=-1) returned 1 [0063.397] GetWindowPlacement (in: hWnd=0x401b2, lpwndpl=0x24e828 | out: lpwndpl=0x24e828) returned 1 [0063.397] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x401b2, Msg=0x47, wParam=0x0, lParam=0x24ea78) returned 0x0 [0063.397] GetClientRect (in: hWnd=0x401b2, lpRect=0x24e7d8 | out: lpRect=0x24e7d8) returned 1 [0063.397] GetWindowRect (in: hWnd=0x401b2, lpRect=0x24e7d8 | out: lpRect=0x24e7d8) returned 1 [0063.398] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x401b2, Msg=0x83, wParam=0x1, lParam=0x24e65c) returned 0x0 [0063.400] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x401b2, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0063.401] GetWindowPlacement (in: hWnd=0x401b2, lpwndpl=0x24e44c | out: lpwndpl=0x24e44c) returned 1 [0063.401] GetClientRect (in: hWnd=0x401b2, lpRect=0x24e3f8 | out: lpRect=0x24e3f8) returned 1 [0063.401] GetWindowTextLengthW (hWnd=0x401b2) returned 11 [0063.402] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x401b2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0063.402] GetSystemMetrics (nIndex=42) returned 0 [0063.402] GetWindowTextW (in: hWnd=0x401b2, lpString=0x24e2b8, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0063.402] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x401b2, Msg=0xd, wParam=0xc, lParam=0x24e2b8) returned 0xb [0063.402] GetClientRect (in: hWnd=0x401b2, lpRect=0x24e300 | out: lpRect=0x24e300) returned 1 [0063.402] GetCurrentObject (hdc=0x6010834, type=0x1) returned 0x1b00017 [0063.402] GetCurrentObject (hdc=0x6010834, type=0x2) returned 0x1900010 [0063.402] GetCurrentObject (hdc=0x6010834, type=0x7) returned 0x7050852 [0063.402] GetCurrentObject (hdc=0x6010834, type=0x6) returned 0x18a002e [0063.402] SaveDC (hdc=0x6010834) returned 1 [0063.402] GetNearestColor (hdc=0x6010834, color=0xf0f0f0) returned 0xf0f0f0 [0063.402] CreateSolidBrush (color=0xf0f0f0) returned 0xf100854 [0063.402] FillRect (hDC=0x6010834, lprc=0x24e1a0, hbr=0xf100854) returned 1 [0063.402] DeleteObject (ho=0xf100854) returned 1 [0063.403] RestoreDC (hdc=0x6010834, nSavedDC=-1) returned 1 [0063.403] SetWindowLongW (hWnd=0x401b2, nIndex=-8, dwNewLong=1507776) returned 1507776 [0063.403] SendMessageW (hWnd=0x1701c0, Msg=0x80, wParam=0x1, lParam=0xd00bf) returned 0x0 [0063.403] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x1701c0, Msg=0x80, wParam=0x1, lParam=0xd00bf) returned 0x0 [0063.404] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x1701c0, Msg=0xd, wParam=0x104, lParam=0x4bac610) returned 0x0 [0063.404] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x1701c0, Msg=0xd, wParam=0x104, lParam=0x4bac610) returned 0x0 [0063.405] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x73cd0000 [0063.405] GetWindowLongW (hWnd=0x401b2, nIndex=-16) returned 382664704 [0063.405] GetWindowTextLengthW (hWnd=0x401b2) returned 11 [0063.405] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x401b2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0063.405] GetSystemMetrics (nIndex=42) returned 0 [0063.405] GetWindowTextW (in: hWnd=0x401b2, lpString=0x24ea88, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0063.405] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x401b2, Msg=0xd, wParam=0xc, lParam=0x24ea88) returned 0xb [0063.405] GetWindowTextLengthW (hWnd=0x401b2) returned 11 [0063.405] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x401b2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0063.405] GetSystemMetrics (nIndex=42) returned 0 [0063.405] GetWindowTextW (in: hWnd=0x401b2, lpString=0x24ea88, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0063.405] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x401b2, Msg=0xd, wParam=0xc, lParam=0x24ea88) returned 0xb [0063.405] GetWindowLongW (hWnd=0x401b2, nIndex=-16) returned 382664704 [0063.405] GetWindowLongW (hWnd=0x401b2, nIndex=-20) returned 590208 [0063.405] SetWindowLongW (hWnd=0x401b2, nIndex=-16, dwNewLong=315555840) returned 382664704 [0063.406] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x401b2, Msg=0x7c, wParam=0xfffffff0, lParam=0x24eb04) returned 0x0 [0063.406] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x401b2, Msg=0x7d, wParam=0xfffffff0, lParam=0x24eb04) returned 0x0 [0063.406] SetWindowLongW (hWnd=0x401b2, nIndex=-20, dwNewLong=589952) returned 590208 [0063.406] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x401b2, Msg=0x7c, wParam=0xffffffec, lParam=0x24eb04) returned 0x0 [0063.406] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x401b2, Msg=0x7d, wParam=0xffffffec, lParam=0x24eb04) returned 0x0 [0063.407] SetWindowPos (hWnd=0x401b2, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0063.407] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x401b2, Msg=0x46, wParam=0x0, lParam=0x24eb24) returned 0x0 [0063.407] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x401b2, Msg=0x83, wParam=0x1, lParam=0x24eafc) returned 0x0 [0063.409] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x401b2, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0063.410] GetWindowPlacement (in: hWnd=0x401b2, lpwndpl=0x24e8ec | out: lpwndpl=0x24e8ec) returned 1 [0063.410] GetClientRect (in: hWnd=0x401b2, lpRect=0x24e898 | out: lpRect=0x24e898) returned 1 [0063.410] GetWindowTextLengthW (hWnd=0x401b2) returned 11 [0063.410] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x401b2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0063.410] GetSystemMetrics (nIndex=42) returned 0 [0063.410] GetWindowTextW (in: hWnd=0x401b2, lpString=0x24e758, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0063.410] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x401b2, Msg=0xd, wParam=0xc, lParam=0x24e758) returned 0xb [0063.410] GetClientRect (in: hWnd=0x401b2, lpRect=0x24e7a0 | out: lpRect=0x24e7a0) returned 1 [0063.410] GetCurrentObject (hdc=0x1010820, type=0x1) returned 0x1b00017 [0063.410] GetCurrentObject (hdc=0x1010820, type=0x2) returned 0x1900010 [0063.410] GetCurrentObject (hdc=0x1010820, type=0x7) returned 0x7050852 [0063.410] GetCurrentObject (hdc=0x1010820, type=0x6) returned 0x18a002e [0063.410] SaveDC (hdc=0x1010820) returned 1 [0063.410] GetNearestColor (hdc=0x1010820, color=0xf0f0f0) returned 0xf0f0f0 [0063.410] CreateSolidBrush (color=0xf0f0f0) returned 0x10100854 [0063.410] FillRect (hDC=0x1010820, lprc=0x24e640, hbr=0x10100854) returned 1 [0063.410] DeleteObject (ho=0x10100854) returned 1 [0063.410] RestoreDC (hdc=0x1010820, nSavedDC=-1) returned 1 [0063.411] GetWindowPlacement (in: hWnd=0x401b2, lpwndpl=0x24e8d4 | out: lpwndpl=0x24e8d4) returned 1 [0063.411] CallWindowProcW (lpPrevWndFunc=0x771625dd, hWnd=0x401b2, Msg=0x47, wParam=0x0, lParam=0x24eb24) returned 0x0 [0063.411] GetClientRect (in: hWnd=0x401b2, lpRect=0x24e884 | out: lpRect=0x24e884) returned 1 [0063.411] GetWindowRect (in: hWnd=0x401b2, lpRect=0x24e884 | out: lpRect=0x24e884) returned 1 [0063.411] RedrawWindow (hWnd=0x401b2, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0063.411] GetSystemMenu (hWnd=0x401b2, bRevert=0) returned 0xe01b5 [0063.411] GetWindowPlacement (in: hWnd=0x401b2, lpwndpl=0x24eb5c | out: lpwndpl=0x24eb5c) returned 1 [0063.411] EnableMenuItem (hMenu=0xe01b5, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0063.411] EnableMenuItem (hMenu=0xe01b5, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0063.411] EnableMenuItem (hMenu=0xe01b5, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0063.411] EnableMenuItem (hMenu=0xe01b5, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0063.411] EnableMenuItem (hMenu=0xe01b5, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0063.411] SetWindowLongW (hWnd=0x4011e, nIndex=-8, dwNewLong=262578) returned 393500 [0063.481] GetFullPathNameW (in: lpFileName="C:\\5p5NrGJn0jS HALPmcxz\\Systems", nBufferLength=0x105, lpBuffer=0x24e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\5p5NrGJn0jS HALPmcxz\\Systems", lpFilePart=0x0) returned 0x1f [0063.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eb58) returned 1 [0063.481] GetFileAttributesExW (in: lpFileName="C:\\5p5NrGJn0jS HALPmcxz\\Systems" (normalized: "c:\\5p5nrgjn0js halpmcxz\\systems"), fInfoLevelId=0x0, lpFileInformation=0x24ebd4 | out: lpFileInformation=0x24ebd4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0063.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eb54) returned 1 [0063.481] GetFullPathNameW (in: lpFileName="C:\\5p5NrGJn0jS HALPmcxz\\Systems", nBufferLength=0x105, lpBuffer=0x24e704, lpFilePart=0x0 | out: lpBuffer="C:\\5p5NrGJn0jS HALPmcxz\\Systems", lpFilePart=0x0) returned 0x1f [0063.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eaec) returned 1 [0063.482] GetFileAttributesExW (in: lpFileName="C:\\5p5NrGJn0jS HALPmcxz\\Systems" (normalized: "c:\\5p5nrgjn0js halpmcxz\\systems"), fInfoLevelId=0x0, lpFileInformation=0x24eb68 | out: lpFileInformation=0x24eb68*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0063.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eae8) returned 1 [0063.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eaec) returned 1 [0063.483] GetFileAttributesExW (in: lpFileName="C:\\5p5NrGJn0jS HALPmcxz\\Systems" (normalized: "c:\\5p5nrgjn0js halpmcxz\\systems"), fInfoLevelId=0x0, lpFileInformation=0x24eb68 | out: lpFileInformation=0x24eb68*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0063.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eae8) returned 1 [0063.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eaec) returned 1 [0063.483] GetFileAttributesExW (in: lpFileName="C:\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\5p5nrgjn0js halpmcxz"), fInfoLevelId=0x0, lpFileInformation=0x24eb68 | out: lpFileInformation=0x24eb68*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0063.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eae8) returned 1 [0063.483] CreateDirectoryW (lpPathName="C:\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\5p5nrgjn0js halpmcxz"), lpSecurityAttributes=0x0) returned 1 [0063.487] CreateDirectoryW (lpPathName="C:\\5p5NrGJn0jS HALPmcxz\\Systems" (normalized: "c:\\5p5nrgjn0js halpmcxz\\systems"), lpSecurityAttributes=0x0) returned 1 [0063.488] GetCurrentProcessId () returned 0x9ec [0063.488] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x24e4ec | out: lpLuid=0x24e4ec*(LowPart=0x14, HighPart=0)) returned 1 [0063.489] GetCurrentProcess () returned 0xffffffff [0063.489] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x24e4e8 | out: TokenHandle=0x24e4e8*=0x230) returned 1 [0063.490] AdjustTokenPrivileges (in: TokenHandle=0x230, DisableAllPrivileges=0, NewState=0x2750c78*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0063.490] CloseHandle (hObject=0x230) returned 1 [0063.501] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3751a30, Length=0x20000, ResultLength=0x24ebc8 | out: SystemInformation=0x3751a30, ResultLength=0x24ebc8*=0x9618) returned 0x0 [0063.520] CoTaskMemAlloc (cb=0x20e) returned 0x6ca648 [0063.520] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x6ca648 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0063.520] CoTaskMemFree (pv=0x6ca648) [0063.520] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ss.exe", nBufferLength=0x105, lpBuffer=0x24e710, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ss.exe", lpFilePart=0x0) returned 0x2c [0063.520] GetFullPathNameW (in: lpFileName="C:\\5p5NrGJn0jS HALPmcxz\\Systems\\local.exe", nBufferLength=0x105, lpBuffer=0x24e710, lpFilePart=0x0 | out: lpBuffer="C:\\5p5NrGJn0jS HALPmcxz\\Systems\\local.exe", lpFilePart=0x0) returned 0x29 [0063.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eb70) returned 1 [0063.521] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ss.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ss.exe"), fInfoLevelId=0x0, lpFileInformation=0x24ebec | out: lpFileInformation=0x24ebec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5921b00, ftCreationTime.dwHighDateTime=0x1d50efb, ftLastAccessTime.dwLowDateTime=0xd5921b00, ftLastAccessTime.dwHighDateTime=0x1d50efb, ftLastWriteTime.dwLowDateTime=0x1a1cb700, ftLastWriteTime.dwHighDateTime=0x1d50efa, nFileSizeHigh=0x0, nFileSizeLow=0x1d600)) returned 1 [0063.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eb6c) returned 1 [0063.522] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ss.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ss.exe"), lpNewFileName="C:\\5p5NrGJn0jS HALPmcxz\\Systems\\local.exe" (normalized: "c:\\5p5nrgjn0js halpmcxz\\systems\\local.exe")) returned 1 [0064.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eb08) returned 1 [0064.064] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links", nBufferLength=0x105, lpBuffer=0x24e610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links", lpFilePart=0x0) returned 0x23 [0064.068] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\", nBufferLength=0x105, lpBuffer=0x24e5e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\", lpFilePart=0x0) returned 0x24 [0064.068] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*", lpFindFileData=0x24e830 | out: lpFindFileData=0x24e830*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69ada8 [0064.071] FindNextFileW (in: hFindFile=0x69ada8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.071] FindNextFileW (in: hFindFile=0x69ada8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0064.072] FindNextFileW (in: hFindFile=0x69ada8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0064.072] FindNextFileW (in: hFindFile=0x69ada8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0064.072] FindNextFileW (in: hFindFile=0x69ada8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 1 [0064.072] FindNextFileW (in: hFindFile=0x69ada8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0064.072] FindClose (in: hFindFile=0x69ada8 | out: hFindFile=0x69ada8) returned 1 [0064.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eac8) returned 1 [0064.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ead4) returned 1 [0064.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eb08) returned 1 [0064.074] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links", nBufferLength=0x105, lpBuffer=0x24e610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links", lpFilePart=0x0) returned 0x23 [0064.074] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\", nBufferLength=0x105, lpBuffer=0x24e5e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\", lpFilePart=0x0) returned 0x24 [0064.074] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*", lpFindFileData=0x24e830 | out: lpFindFileData=0x24e830*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69ada8 [0064.075] FindNextFileW (in: hFindFile=0x69ada8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.075] FindNextFileW (in: hFindFile=0x69ada8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0064.076] FindNextFileW (in: hFindFile=0x69ada8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0064.076] FindNextFileW (in: hFindFile=0x69ada8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0064.076] FindNextFileW (in: hFindFile=0x69ada8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 1 [0064.076] FindNextFileW (in: hFindFile=0x69ada8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0 [0064.076] FindClose (in: hFindFile=0x69ada8 | out: hFindFile=0x69ada8) returned 1 [0064.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eac8) returned 1 [0064.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ead4) returned 1 [0064.091] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x2f [0064.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0064.092] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x230 [0064.109] GetFileType (hFile=0x230) returned 0x1 [0064.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0064.109] GetFileType (hFile=0x230) returned 0x1 [0064.109] GetFileSize (in: hFile=0x230, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x1e6 [0064.109] ReadFile (in: hFile=0x230, lpBuffer=0x2766f0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x2766f0c*, lpNumberOfBytesRead=0x24ea60*=0x1e6, lpOverlapped=0x0) returned 1 [0064.111] CloseHandle (hObject=0x230) returned 1 [0066.994] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x24e46c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0066.995] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x24e4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0066.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e930) returned 1 [0066.995] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x24e9ac | out: lpFileInformation=0x24e9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0cc4300, ftCreationTime.dwHighDateTime=0x1cd5cf4, ftLastAccessTime.dwLowDateTime=0xcf7ee640, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc0cc4300, ftLastWriteTime.dwHighDateTime=0x1cd5cf4, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0066.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e92c) returned 1 [0067.240] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x24e6bc | out: pfEnabled=0x24e6bc) returned 0x0 [0067.557] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0067.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0067.557] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0067.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0067.558] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x2f [0067.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0067.558] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0067.559] GetFileType (hFile=0x26c) returned 0x1 [0067.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0067.559] GetFileType (hFile=0x26c) returned 0x1 [0067.559] WriteFile (in: hFile=0x26c, lpBuffer=0x27dfc48*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x24ea28, lpOverlapped=0x0 | out: lpBuffer=0x27dfc48*, lpNumberOfBytesWritten=0x24ea28*=0x1f0, lpOverlapped=0x0) returned 1 [0067.560] CloseHandle (hObject=0x26c) returned 1 [0067.564] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x2f [0067.564] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk.Crypted", lpFilePart=0x0) returned 0x37 [0067.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0067.564] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96f0b50, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1 [0067.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0067.564] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk.crypted")) returned 1 [0067.565] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x31 [0067.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0067.565] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0067.565] GetFileType (hFile=0x26c) returned 0x1 [0067.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0067.565] GetFileType (hFile=0x26c) returned 0x1 [0067.565] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x3a1 [0067.566] ReadFile (in: hFile=0x26c, lpBuffer=0x27e1274, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x27e1274*, lpNumberOfBytesRead=0x24ea60*=0x3a1, lpOverlapped=0x0) returned 1 [0067.567] CloseHandle (hObject=0x26c) returned 1 [0067.593] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0067.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0067.593] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0067.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0067.594] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x31 [0067.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0067.594] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0067.614] GetFileType (hFile=0x26c) returned 0x1 [0067.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0067.614] GetFileType (hFile=0x26c) returned 0x1 [0067.614] WriteFile (in: hFile=0x26c, lpBuffer=0x2830578*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x24ea28, lpOverlapped=0x0 | out: lpBuffer=0x2830578*, lpNumberOfBytesWritten=0x24ea28*=0x3b0, lpOverlapped=0x0) returned 1 [0067.614] CloseHandle (hObject=0x26c) returned 1 [0067.646] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x31 [0067.646] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk.Crypted", lpFilePart=0x0) returned 0x39 [0067.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0067.646] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf97af230, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x3b0)) returned 1 [0067.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0067.646] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk.crypted")) returned 1 [0067.647] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk", lpFilePart=0x0) returned 0x34 [0067.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0067.647] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0067.692] GetFileType (hFile=0x26c) returned 0x1 [0067.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0067.692] GetFileType (hFile=0x26c) returned 0x1 [0067.692] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x16b [0067.693] ReadFile (in: hFile=0x26c, lpBuffer=0x2831988, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x2831988*, lpNumberOfBytesRead=0x24ea60*=0x16b, lpOverlapped=0x0) returned 1 [0067.694] CloseHandle (hObject=0x26c) returned 1 [0067.718] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0067.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0067.719] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0067.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0067.719] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk", lpFilePart=0x0) returned 0x34 [0067.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0067.719] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0067.720] GetFileType (hFile=0x26c) returned 0x1 [0067.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0067.720] GetFileType (hFile=0x26c) returned 0x1 [0067.720] WriteFile (in: hFile=0x26c, lpBuffer=0x2880154*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x24ea28, lpOverlapped=0x0 | out: lpBuffer=0x2880154*, lpNumberOfBytesWritten=0x24ea28*=0x170, lpOverlapped=0x0) returned 1 [0067.721] CloseHandle (hObject=0x26c) returned 1 [0067.725] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk", lpFilePart=0x0) returned 0x34 [0067.725] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk.Crypted", lpFilePart=0x0) returned 0x3c [0067.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0067.725] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf986d910, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x170)) returned 1 [0067.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0067.726] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk.crypted")) returned 1 [0067.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eb08) returned 1 [0067.726] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts", nBufferLength=0x105, lpBuffer=0x24e610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts", lpFilePart=0x0) returned 0x26 [0067.727] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\", nBufferLength=0x105, lpBuffer=0x24e5e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\", lpFilePart=0x0) returned 0x27 [0067.727] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*", lpFindFileData=0x24e830 | out: lpFindFileData=0x24e830*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b028 [0067.729] FindNextFileW (in: hFindFile=0x69b028, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.729] FindNextFileW (in: hFindFile=0x69b028, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ea7ef20, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2ea7ef20, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2ea7ef20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x49a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aclviho ASldjfl.contact", cAlternateFileName="ACLVIH~1.CON")) returned 1 [0067.729] FindNextFileW (in: hFindFile=0x69b028, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1 [0067.729] FindNextFileW (in: hFindFile=0x69b028, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaa5080, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaa5080, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaa5080, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x0, dwReserved1=0x0, cFileName="asdlfk poopvy.contact", cAlternateFileName="ASDLFK~1.CON")) returned 1 [0067.730] FindNextFileW (in: hFindFile=0x69b028, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eacb1e0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eacb1e0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eacb1e0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x499, dwReserved0=0x0, dwReserved1=0x0, cFileName="chucu jadnvk.contact", cAlternateFileName="CHUCUJ~1.CON")) returned 1 [0067.732] FindNextFileW (in: hFindFile=0x69b028, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0067.734] FindNextFileW (in: hFindFile=0x69b028, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x496, dwReserved0=0x0, dwReserved1=0x0, cFileName="lulcit amkdfe.contact", cAlternateFileName="LULCIT~1.CON")) returned 1 [0067.734] FindNextFileW (in: hFindFile=0x69b028, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x0, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 1 [0067.735] FindNextFileW (in: hFindFile=0x69b028, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0067.735] FindClose (in: hFindFile=0x69b028 | out: hFindFile=0x69b028) returned 1 [0067.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eac8) returned 1 [0067.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ead4) returned 1 [0067.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eb08) returned 1 [0067.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts", nBufferLength=0x105, lpBuffer=0x24e610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts", lpFilePart=0x0) returned 0x26 [0067.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\", nBufferLength=0x105, lpBuffer=0x24e5e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\", lpFilePart=0x0) returned 0x27 [0067.736] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*", lpFindFileData=0x24e830 | out: lpFindFileData=0x24e830*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b028 [0067.737] FindNextFileW (in: hFindFile=0x69b028, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.738] FindNextFileW (in: hFindFile=0x69b028, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ea7ef20, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2ea7ef20, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2ea7ef20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x49a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aclviho ASldjfl.contact", cAlternateFileName="ACLVIH~1.CON")) returned 1 [0067.738] FindNextFileW (in: hFindFile=0x69b028, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1 [0067.738] FindNextFileW (in: hFindFile=0x69b028, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaa5080, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaa5080, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaa5080, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x0, dwReserved1=0x0, cFileName="asdlfk poopvy.contact", cAlternateFileName="ASDLFK~1.CON")) returned 1 [0067.738] FindNextFileW (in: hFindFile=0x69b028, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eacb1e0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eacb1e0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eacb1e0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x499, dwReserved0=0x0, dwReserved1=0x0, cFileName="chucu jadnvk.contact", cAlternateFileName="CHUCUJ~1.CON")) returned 1 [0067.739] FindNextFileW (in: hFindFile=0x69b028, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0067.740] FindNextFileW (in: hFindFile=0x69b028, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x496, dwReserved0=0x0, dwReserved1=0x0, cFileName="lulcit amkdfe.contact", cAlternateFileName="LULCIT~1.CON")) returned 1 [0067.740] FindNextFileW (in: hFindFile=0x69b028, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x0, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 1 [0067.740] FindNextFileW (in: hFindFile=0x69b028, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x0, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 0 [0067.740] FindClose (in: hFindFile=0x69b028 | out: hFindFile=0x69b028) returned 1 [0067.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eac8) returned 1 [0067.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ead4) returned 1 [0067.741] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact", lpFilePart=0x0) returned 0x3e [0067.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0067.742] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0067.743] GetFileType (hFile=0x26c) returned 0x1 [0067.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0067.744] GetFileType (hFile=0x26c) returned 0x1 [0067.744] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x49a [0067.744] ReadFile (in: hFile=0x26c, lpBuffer=0x2883f6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x2883f6c*, lpNumberOfBytesRead=0x24ea60*=0x49a, lpOverlapped=0x0) returned 1 [0067.771] CloseHandle (hObject=0x26c) returned 1 [0067.867] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0067.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0067.867] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0067.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0067.867] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact", lpFilePart=0x0) returned 0x3e [0067.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0067.867] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0067.868] GetFileType (hFile=0x26c) returned 0x1 [0067.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0067.868] GetFileType (hFile=0x26c) returned 0x1 [0067.869] WriteFile (in: hFile=0x26c, lpBuffer=0x28d3748*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x24ea28, lpOverlapped=0x0 | out: lpBuffer=0x28d3748*, lpNumberOfBytesWritten=0x24ea28*=0x4a0, lpOverlapped=0x0) returned 1 [0067.870] CloseHandle (hObject=0x26c) returned 1 [0067.872] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact", lpFilePart=0x0) returned 0x3e [0067.872] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact.Crypted", lpFilePart=0x0) returned 0x46 [0067.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0067.872] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ea7ef20, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2ea7ef20, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0xf99c4570, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x4a0)) returned 1 [0067.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0067.873] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact.crypted")) returned 1 [0067.880] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact", lpFilePart=0x0) returned 0x3c [0067.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0067.880] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0067.881] GetFileType (hFile=0x26c) returned 0x1 [0067.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0067.881] GetFileType (hFile=0x26c) returned 0x1 [0067.882] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x10b1e [0067.888] ReadFile (in: hFile=0x26c, lpBuffer=0x28d4a54, nNumberOfBytesToRead=0x10b1e, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x28d4a54*, lpNumberOfBytesRead=0x24ea60*=0x10b1e, lpOverlapped=0x0) returned 1 [0067.905] CloseHandle (hObject=0x26c) returned 1 [0067.971] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0067.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0067.971] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0067.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0067.971] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact", lpFilePart=0x0) returned 0x3c [0067.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0067.971] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0067.983] GetFileType (hFile=0x26c) returned 0x1 [0067.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0067.983] GetFileType (hFile=0x26c) returned 0x1 [0067.983] WriteFile (in: hFile=0x26c, lpBuffer=0x27698e8*, nNumberOfBytesToWrite=0x10b20, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x27698e8*, lpNumberOfBytesWritten=0x24ea54*=0x10b20, lpOverlapped=0x0) returned 1 [0067.985] CloseHandle (hObject=0x26c) returned 1 [0067.992] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact", lpFilePart=0x0) returned 0x3c [0067.992] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact.Crypted", lpFilePart=0x0) returned 0x44 [0067.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0067.992] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9af5070, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x10b20)) returned 1 [0067.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0067.993] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact.crypted")) returned 1 [0067.993] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact", lpFilePart=0x0) returned 0x3c [0067.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0067.993] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0067.994] GetFileType (hFile=0x26c) returned 0x1 [0067.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0067.994] GetFileType (hFile=0x26c) returned 0x1 [0067.994] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x493 [0067.994] ReadFile (in: hFile=0x26c, lpBuffer=0x277ae60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x277ae60*, lpNumberOfBytesRead=0x24ea60*=0x493, lpOverlapped=0x0) returned 1 [0068.013] CloseHandle (hObject=0x26c) returned 1 [0068.075] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0068.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0068.076] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0068.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0068.076] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact", lpFilePart=0x0) returned 0x3c [0068.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0068.076] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0068.077] GetFileType (hFile=0x26c) returned 0x1 [0068.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0068.077] GetFileType (hFile=0x26c) returned 0x1 [0068.077] WriteFile (in: hFile=0x26c, lpBuffer=0x27ca798*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x24ea28, lpOverlapped=0x0 | out: lpBuffer=0x27ca798*, lpNumberOfBytesWritten=0x24ea28*=0x4a0, lpOverlapped=0x0) returned 1 [0068.078] CloseHandle (hObject=0x26c) returned 1 [0068.081] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact", lpFilePart=0x0) returned 0x3c [0068.081] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact.Crypted", lpFilePart=0x0) returned 0x44 [0068.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0068.081] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaa5080, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaa5080, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0xf9bd98b0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x4a0)) returned 1 [0068.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0068.082] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact.crypted")) returned 1 [0068.082] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact", lpFilePart=0x0) returned 0x3b [0068.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0068.082] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0068.090] GetFileType (hFile=0x26c) returned 0x1 [0068.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0068.090] GetFileType (hFile=0x26c) returned 0x1 [0068.090] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x499 [0068.091] ReadFile (in: hFile=0x26c, lpBuffer=0x27cbf3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x27cbf3c*, lpNumberOfBytesRead=0x24ea60*=0x499, lpOverlapped=0x0) returned 1 [0068.130] CloseHandle (hObject=0x26c) returned 1 [0068.159] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0068.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0068.159] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0068.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0068.159] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact", lpFilePart=0x0) returned 0x3b [0068.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0068.160] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0068.163] GetFileType (hFile=0x26c) returned 0x1 [0068.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0068.163] GetFileType (hFile=0x26c) returned 0x1 [0068.163] WriteFile (in: hFile=0x26c, lpBuffer=0x281b70c*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x24ea28, lpOverlapped=0x0 | out: lpBuffer=0x281b70c*, lpNumberOfBytesWritten=0x24ea28*=0x4a0, lpOverlapped=0x0) returned 1 [0068.164] CloseHandle (hObject=0x26c) returned 1 [0068.180] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact", lpFilePart=0x0) returned 0x3b [0068.180] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact.Crypted", lpFilePart=0x0) returned 0x43 [0068.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0068.180] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eacb1e0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eacb1e0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0xf9cbe0f0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x4a0)) returned 1 [0068.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0068.180] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact.crypted")) returned 1 [0068.181] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact", lpFilePart=0x0) returned 0x3c [0068.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0068.181] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0068.184] GetFileType (hFile=0x26c) returned 0x1 [0068.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0068.184] GetFileType (hFile=0x26c) returned 0x1 [0068.184] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x496 [0068.184] ReadFile (in: hFile=0x26c, lpBuffer=0x281cebc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x281cebc*, lpNumberOfBytesRead=0x24ea60*=0x496, lpOverlapped=0x0) returned 1 [0068.197] CloseHandle (hObject=0x26c) returned 1 [0068.219] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0068.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0068.219] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0068.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0068.219] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact", lpFilePart=0x0) returned 0x3c [0068.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0068.219] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0068.220] GetFileType (hFile=0x26c) returned 0x1 [0068.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0068.220] GetFileType (hFile=0x26c) returned 0x1 [0068.221] WriteFile (in: hFile=0x26c, lpBuffer=0x286c694*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x24ea28, lpOverlapped=0x0 | out: lpBuffer=0x286c694*, lpNumberOfBytesWritten=0x24ea28*=0x4a0, lpOverlapped=0x0) returned 1 [0068.222] CloseHandle (hObject=0x26c) returned 1 [0068.230] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact", lpFilePart=0x0) returned 0x3c [0068.230] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact.Crypted", lpFilePart=0x0) returned 0x44 [0068.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0068.230] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0xf9d30510, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x4a0)) returned 1 [0068.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0068.230] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact.crypted")) returned 1 [0068.231] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact", lpFilePart=0x0) returned 0x3c [0068.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0068.231] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0068.232] GetFileType (hFile=0x26c) returned 0x1 [0068.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0068.232] GetFileType (hFile=0x26c) returned 0x1 [0068.232] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x494 [0068.232] ReadFile (in: hFile=0x26c, lpBuffer=0x286de34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x286de34*, lpNumberOfBytesRead=0x24ea60*=0x494, lpOverlapped=0x0) returned 1 [0068.260] CloseHandle (hObject=0x26c) returned 1 [0068.288] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0068.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0068.289] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0068.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0068.289] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact", lpFilePart=0x0) returned 0x3c [0068.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0068.289] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0068.292] GetFileType (hFile=0x26c) returned 0x1 [0068.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0068.293] GetFileType (hFile=0x26c) returned 0x1 [0068.294] WriteFile (in: hFile=0x26c, lpBuffer=0x28bd60c*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x24ea28, lpOverlapped=0x0 | out: lpBuffer=0x28bd60c*, lpNumberOfBytesWritten=0x24ea28*=0x4a0, lpOverlapped=0x0) returned 1 [0068.295] CloseHandle (hObject=0x26c) returned 1 [0068.301] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact", lpFilePart=0x0) returned 0x3c [0068.301] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact.Crypted", lpFilePart=0x0) returned 0x44 [0068.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0068.301] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0xf9deebf0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x4a0)) returned 1 [0068.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0068.301] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact.crypted")) returned 1 [0068.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eb08) returned 1 [0068.302] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x24e610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0068.302] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x105, lpBuffer=0x24e5e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x0) returned 0x26 [0068.302] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x24e830 | out: lpFindFileData=0x24e830*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf8d6b350, ftLastAccessTime.dwHighDateTime=0x1d50efb, ftLastWriteTime.dwLowDateTime=0xf8d6b350, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b128 [0068.302] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf8d6b350, ftLastAccessTime.dwHighDateTime=0x1d50efb, ftLastWriteTime.dwLowDateTime=0xf8d6b350, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.303] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7622b9a0, ftCreationTime.dwHighDateTime=0x1d4ca62, ftLastAccessTime.dwLowDateTime=0xb7597ca0, ftLastAccessTime.dwHighDateTime=0x1d4d459, ftLastWriteTime.dwLowDateTime=0xb7597ca0, ftLastWriteTime.dwHighDateTime=0x1d4d459, nFileSizeHigh=0x0, nFileSizeLow=0xfd5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="0OLU_WDuO-G.avi", cAlternateFileName="0OLU_W~1.AVI")) returned 1 [0068.303] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24739f10, ftCreationTime.dwHighDateTime=0x1d4d16b, ftLastAccessTime.dwLowDateTime=0x77cc720, ftLastAccessTime.dwHighDateTime=0x1d4d3e0, ftLastWriteTime.dwLowDateTime=0x77cc720, ftLastWriteTime.dwHighDateTime=0x1d4d3e0, nFileSizeHigh=0x0, nFileSizeLow=0x729c, dwReserved0=0x0, dwReserved1=0x0, cFileName="7pUxu.png", cAlternateFileName="")) returned 1 [0068.303] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52672e70, ftCreationTime.dwHighDateTime=0x1d4cf89, ftLastAccessTime.dwLowDateTime=0x2d3efa40, ftLastAccessTime.dwHighDateTime=0x1d4cd65, ftLastWriteTime.dwLowDateTime=0x2d3efa40, ftLastWriteTime.dwHighDateTime=0x1d4cd65, nFileSizeHigh=0x0, nFileSizeLow=0x16263, dwReserved0=0x0, dwReserved1=0x0, cFileName="bUlZ.wav", cAlternateFileName="")) returned 1 [0068.303] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x180aadf0, ftCreationTime.dwHighDateTime=0x1d4c6cf, ftLastAccessTime.dwLowDateTime=0xe6c351e0, ftLastAccessTime.dwHighDateTime=0x1d4d333, ftLastWriteTime.dwLowDateTime=0xe6c351e0, ftLastWriteTime.dwHighDateTime=0x1d4d333, nFileSizeHigh=0x0, nFileSizeLow=0x957f, dwReserved0=0x0, dwReserved1=0x0, cFileName="C7Tgr_.mp3", cAlternateFileName="")) returned 1 [0068.303] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0068.304] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa36ad200, ftCreationTime.dwHighDateTime=0x1d4c9d9, ftLastAccessTime.dwLowDateTime=0xe44280a0, ftLastAccessTime.dwHighDateTime=0x1d4d205, ftLastWriteTime.dwLowDateTime=0xe44280a0, ftLastWriteTime.dwHighDateTime=0x1d4d205, nFileSizeHigh=0x0, nFileSizeLow=0xac78, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehKvWyeZ2fgJX_l-SQv.odt", cAlternateFileName="EHKVWY~1.ODT")) returned 1 [0068.304] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x330f14a0, ftCreationTime.dwHighDateTime=0x1d4c950, ftLastAccessTime.dwLowDateTime=0x207b1130, ftLastAccessTime.dwHighDateTime=0x1d4d53b, ftLastWriteTime.dwLowDateTime=0x207b1130, ftLastWriteTime.dwHighDateTime=0x1d4d53b, nFileSizeHigh=0x0, nFileSizeLow=0x45ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="epsNS8Zd30l2YZ.wav", cAlternateFileName="EPSNS8~1.WAV")) returned 1 [0068.304] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a65e080, ftCreationTime.dwHighDateTime=0x1d4cfec, ftLastAccessTime.dwLowDateTime=0x24c63e70, ftLastAccessTime.dwHighDateTime=0x1d4d385, ftLastWriteTime.dwLowDateTime=0x24c63e70, ftLastWriteTime.dwHighDateTime=0x1d4d385, nFileSizeHigh=0x0, nFileSizeLow=0x17541, dwReserved0=0x0, dwReserved1=0x0, cFileName="fgwF.gif", cAlternateFileName="")) returned 1 [0068.304] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9818ac90, ftCreationTime.dwHighDateTime=0x1d4ca08, ftLastAccessTime.dwLowDateTime=0x776582b0, ftLastAccessTime.dwHighDateTime=0x1d4c8c9, ftLastWriteTime.dwLowDateTime=0x776582b0, ftLastWriteTime.dwHighDateTime=0x1d4c8c9, nFileSizeHigh=0x0, nFileSizeLow=0xdd65, dwReserved0=0x0, dwReserved1=0x0, cFileName="fOu vb-KkZCDXb9.jpg", cAlternateFileName="FOUVB-~1.JPG")) returned 1 [0068.304] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33dcb9b0, ftCreationTime.dwHighDateTime=0x1d4cc15, ftLastAccessTime.dwLowDateTime=0x72684d50, ftLastAccessTime.dwHighDateTime=0x1d4cc5d, ftLastWriteTime.dwLowDateTime=0x72684d50, ftLastWriteTime.dwHighDateTime=0x1d4cc5d, nFileSizeHigh=0x0, nFileSizeLow=0x15383, dwReserved0=0x0, dwReserved1=0x0, cFileName="g_9K8WeNfm7cNWN.avi", cAlternateFileName="G_9K8W~1.AVI")) returned 1 [0068.305] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b06ef50, ftCreationTime.dwHighDateTime=0x1d4d57a, ftLastAccessTime.dwLowDateTime=0x93e98300, ftLastAccessTime.dwHighDateTime=0x1d4ca22, ftLastWriteTime.dwLowDateTime=0x93e98300, ftLastWriteTime.dwHighDateTime=0x1d4ca22, nFileSizeHigh=0x0, nFileSizeLow=0x15e99, dwReserved0=0x0, dwReserved1=0x0, cFileName="i WSBk_FJLr5B.swf", cAlternateFileName="IWSBK_~1.SWF")) returned 1 [0068.305] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x579a5a10, ftCreationTime.dwHighDateTime=0x1d4d4cb, ftLastAccessTime.dwLowDateTime=0x62419550, ftLastAccessTime.dwHighDateTime=0x1d4c5fd, ftLastWriteTime.dwLowDateTime=0x62419550, ftLastWriteTime.dwHighDateTime=0x1d4c5fd, nFileSizeHigh=0x0, nFileSizeLow=0x163bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="jmcbdzrWyd.bmp", cAlternateFileName="JMCBDZ~1.BMP")) returned 1 [0068.305] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c2bb620, ftCreationTime.dwHighDateTime=0x1d4cf81, ftLastAccessTime.dwLowDateTime=0x8cf2c530, ftLastAccessTime.dwHighDateTime=0x1d4d4d5, ftLastWriteTime.dwLowDateTime=0x8cf2c530, ftLastWriteTime.dwHighDateTime=0x1d4d4d5, nFileSizeHigh=0x0, nFileSizeLow=0x15f62, dwReserved0=0x0, dwReserved1=0x0, cFileName="L3ak099rEdj LwgUyNK1.avi", cAlternateFileName="L3AK09~1.AVI")) returned 1 [0068.305] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ace7530, ftCreationTime.dwHighDateTime=0x1d4cd9b, ftLastAccessTime.dwLowDateTime=0x5ced7c90, ftLastAccessTime.dwHighDateTime=0x1d4cce2, ftLastWriteTime.dwLowDateTime=0x5ced7c90, ftLastWriteTime.dwHighDateTime=0x1d4cce2, nFileSizeHigh=0x0, nFileSizeLow=0x85b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LPK_cvxMn51.flv", cAlternateFileName="LPK_CV~1.FLV")) returned 1 [0068.305] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3404ca0, ftCreationTime.dwHighDateTime=0x1d4cbba, ftLastAccessTime.dwLowDateTime=0xb44536b0, ftLastAccessTime.dwHighDateTime=0x1d4cb64, ftLastWriteTime.dwLowDateTime=0xb44536b0, ftLastWriteTime.dwHighDateTime=0x1d4cb64, nFileSizeHigh=0x0, nFileSizeLow=0x110c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MvpDo gJgfX3JI6.wav", cAlternateFileName="MVPDOG~1.WAV")) returned 1 [0068.306] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x285e5d50, ftCreationTime.dwHighDateTime=0x1d4d359, ftLastAccessTime.dwLowDateTime=0xb4f103f0, ftLastAccessTime.dwHighDateTime=0x1d4cd0d, ftLastWriteTime.dwLowDateTime=0xb4f103f0, ftLastWriteTime.dwHighDateTime=0x1d4cd0d, nFileSizeHigh=0x0, nFileSizeLow=0x6028, dwReserved0=0x0, dwReserved1=0x0, cFileName="nJXrOz1j2S6p.jpg", cAlternateFileName="NJXROZ~1.JPG")) returned 1 [0068.306] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4a31750, ftCreationTime.dwHighDateTime=0x1d4d008, ftLastAccessTime.dwLowDateTime=0x56af3fc0, ftLastAccessTime.dwHighDateTime=0x1d4c5c2, ftLastWriteTime.dwLowDateTime=0x56af3fc0, ftLastWriteTime.dwHighDateTime=0x1d4c5c2, nFileSizeHigh=0x0, nFileSizeLow=0x128c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="OJ5vU.pdf", cAlternateFileName="")) returned 1 [0068.306] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0ffa5a0, ftCreationTime.dwHighDateTime=0x1d4c6f1, ftLastAccessTime.dwLowDateTime=0xf45b3070, ftLastAccessTime.dwHighDateTime=0x1d4d176, ftLastWriteTime.dwLowDateTime=0xf45b3070, ftLastWriteTime.dwHighDateTime=0x1d4d176, nFileSizeHigh=0x0, nFileSizeLow=0x17bf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="p62r5li3xXj_mf.xlsx", cAlternateFileName="P62R5L~1.XLS")) returned 1 [0068.306] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee597350, ftCreationTime.dwHighDateTime=0x1d4c567, ftLastAccessTime.dwLowDateTime=0x5f4dee0, ftLastAccessTime.dwHighDateTime=0x1d4d180, ftLastWriteTime.dwLowDateTime=0x5f4dee0, ftLastWriteTime.dwHighDateTime=0x1d4d180, nFileSizeHigh=0x0, nFileSizeLow=0x1d02, dwReserved0=0x0, dwReserved1=0x0, cFileName="pb2 NStFVGwaAZx.mp4", cAlternateFileName="PB2NST~1.MP4")) returned 1 [0068.306] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b13850, ftCreationTime.dwHighDateTime=0x1d4d1f6, ftLastAccessTime.dwLowDateTime=0x418f19a0, ftLastAccessTime.dwHighDateTime=0x1d4d0f1, ftLastWriteTime.dwLowDateTime=0x418f19a0, ftLastWriteTime.dwHighDateTime=0x1d4d0f1, nFileSizeHigh=0x0, nFileSizeLow=0x16932, dwReserved0=0x0, dwReserved1=0x0, cFileName="pqSzgB SaW6XQP.mp3", cAlternateFileName="PQSZGB~1.MP3")) returned 1 [0068.307] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedd1b1a0, ftCreationTime.dwHighDateTime=0x1d4ccfa, ftLastAccessTime.dwLowDateTime=0x7ffbc380, ftLastAccessTime.dwHighDateTime=0x1d4d3be, ftLastWriteTime.dwLowDateTime=0x7ffbc380, ftLastWriteTime.dwHighDateTime=0x1d4d3be, nFileSizeHigh=0x0, nFileSizeLow=0x7923, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReEoWMb1tgQr2M.avi", cAlternateFileName="REEOWM~1.AVI")) returned 1 [0068.307] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc40ce7c0, ftCreationTime.dwHighDateTime=0x1d4cc7f, ftLastAccessTime.dwLowDateTime=0x22bd1e90, ftLastAccessTime.dwHighDateTime=0x1d4cd0f, ftLastWriteTime.dwLowDateTime=0x22bd1e90, ftLastWriteTime.dwHighDateTime=0x1d4cd0f, nFileSizeHigh=0x0, nFileSizeLow=0xb164, dwReserved0=0x0, dwReserved1=0x0, cFileName="RLbcXhJHI.bmp", cAlternateFileName="RLBCXH~1.BMP")) returned 1 [0068.307] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca9f78f0, ftCreationTime.dwHighDateTime=0x1d4ccb6, ftLastAccessTime.dwLowDateTime=0xb8c5720, ftLastAccessTime.dwHighDateTime=0x1d4cf5a, ftLastWriteTime.dwLowDateTime=0xb8c5720, ftLastWriteTime.dwHighDateTime=0x1d4cf5a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rLFrgATixAVohSfL9n", cAlternateFileName="RLFRGA~1")) returned 1 [0068.307] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b8a4cf0, ftCreationTime.dwHighDateTime=0x1d4caef, ftLastAccessTime.dwLowDateTime=0xc9dd0990, ftLastAccessTime.dwHighDateTime=0x1d4cef6, ftLastWriteTime.dwLowDateTime=0xc9dd0990, ftLastWriteTime.dwHighDateTime=0x1d4cef6, nFileSizeHigh=0x0, nFileSizeLow=0xc4d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpQ8TM.mp4", cAlternateFileName="")) returned 1 [0068.307] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf539e80, ftCreationTime.dwHighDateTime=0x1d4d111, ftLastAccessTime.dwLowDateTime=0x2e87c7f0, ftLastAccessTime.dwHighDateTime=0x1d4cb36, ftLastWriteTime.dwLowDateTime=0x2e87c7f0, ftLastWriteTime.dwHighDateTime=0x1d4cb36, nFileSizeHigh=0x0, nFileSizeLow=0xcf47, dwReserved0=0x0, dwReserved1=0x0, cFileName="vbMHGI79vM_PtDv8.avi", cAlternateFileName="VBMHGI~1.AVI")) returned 1 [0068.308] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13d3ebe0, ftCreationTime.dwHighDateTime=0x1d4cb1e, ftLastAccessTime.dwLowDateTime=0x7c2c3590, ftLastAccessTime.dwHighDateTime=0x1d4c7e4, ftLastWriteTime.dwLowDateTime=0x7c2c3590, ftLastWriteTime.dwHighDateTime=0x1d4c7e4, nFileSizeHigh=0x0, nFileSizeLow=0xb03e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vwzr.pps", cAlternateFileName="")) returned 1 [0068.308] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12e8e160, ftCreationTime.dwHighDateTime=0x1d4c9e6, ftLastAccessTime.dwLowDateTime=0xf865da00, ftLastAccessTime.dwHighDateTime=0x1d4d007, ftLastWriteTime.dwLowDateTime=0xf865da00, ftLastWriteTime.dwHighDateTime=0x1d4d007, nFileSizeHigh=0x0, nFileSizeLow=0x10ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x4IIvHjetTqBaG.xlsx", cAlternateFileName="X4IIVH~1.XLS")) returned 1 [0068.308] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5abc7d90, ftCreationTime.dwHighDateTime=0x1d4ce68, ftLastAccessTime.dwLowDateTime=0x74830d0, ftLastAccessTime.dwHighDateTime=0x1d4cb54, ftLastWriteTime.dwLowDateTime=0x74830d0, ftLastWriteTime.dwHighDateTime=0x1d4cb54, nFileSizeHigh=0x0, nFileSizeLow=0xec96, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z3XMtXvu.doc", cAlternateFileName="")) returned 1 [0068.308] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6139640, ftCreationTime.dwHighDateTime=0x1d4cfec, ftLastAccessTime.dwLowDateTime=0xf5afc3e0, ftLastAccessTime.dwHighDateTime=0x1d4cfc9, ftLastWriteTime.dwLowDateTime=0xf5afc3e0, ftLastWriteTime.dwHighDateTime=0x1d4cfc9, nFileSizeHigh=0x0, nFileSizeLow=0x461b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zIHHqGfcI.mp3", cAlternateFileName="ZIHHQG~1.MP3")) returned 1 [0068.308] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7868ce30, ftCreationTime.dwHighDateTime=0x1d4c953, ftLastAccessTime.dwLowDateTime=0xf30618c0, ftLastAccessTime.dwHighDateTime=0x1d4d48c, ftLastWriteTime.dwLowDateTime=0xf30618c0, ftLastWriteTime.dwHighDateTime=0x1d4d48c, nFileSizeHigh=0x0, nFileSizeLow=0xa43f, dwReserved0=0x0, dwReserved1=0x0, cFileName="zUV-2s2ldl.rtf", cAlternateFileName="ZUV-2S~1.RTF")) returned 1 [0068.308] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2499cb0, ftCreationTime.dwHighDateTime=0x1d4d372, ftLastAccessTime.dwLowDateTime=0x56aef580, ftLastAccessTime.dwHighDateTime=0x1d4c98f, ftLastWriteTime.dwLowDateTime=0x56aef580, ftLastWriteTime.dwHighDateTime=0x1d4c98f, nFileSizeHigh=0x0, nFileSizeLow=0x8fb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="_aeDeuxDfMl6neBTOKj.wav", cAlternateFileName="_AEDEU~1.WAV")) returned 1 [0068.309] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0068.309] FindClose (in: hFindFile=0x69b128 | out: hFindFile=0x69b128) returned 1 [0068.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eac8) returned 1 [0068.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ead4) returned 1 [0068.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eb08) returned 1 [0068.309] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x24e610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0068.309] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x105, lpBuffer=0x24e5e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x0) returned 0x26 [0068.309] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x24e830 | out: lpFindFileData=0x24e830*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf8d6b350, ftLastAccessTime.dwHighDateTime=0x1d50efb, ftLastWriteTime.dwLowDateTime=0xf8d6b350, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b128 [0068.310] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf8d6b350, ftLastAccessTime.dwHighDateTime=0x1d50efb, ftLastWriteTime.dwLowDateTime=0xf8d6b350, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.310] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7622b9a0, ftCreationTime.dwHighDateTime=0x1d4ca62, ftLastAccessTime.dwLowDateTime=0xb7597ca0, ftLastAccessTime.dwHighDateTime=0x1d4d459, ftLastWriteTime.dwLowDateTime=0xb7597ca0, ftLastWriteTime.dwHighDateTime=0x1d4d459, nFileSizeHigh=0x0, nFileSizeLow=0xfd5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="0OLU_WDuO-G.avi", cAlternateFileName="0OLU_W~1.AVI")) returned 1 [0068.310] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24739f10, ftCreationTime.dwHighDateTime=0x1d4d16b, ftLastAccessTime.dwLowDateTime=0x77cc720, ftLastAccessTime.dwHighDateTime=0x1d4d3e0, ftLastWriteTime.dwLowDateTime=0x77cc720, ftLastWriteTime.dwHighDateTime=0x1d4d3e0, nFileSizeHigh=0x0, nFileSizeLow=0x729c, dwReserved0=0x0, dwReserved1=0x0, cFileName="7pUxu.png", cAlternateFileName="")) returned 1 [0068.310] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52672e70, ftCreationTime.dwHighDateTime=0x1d4cf89, ftLastAccessTime.dwLowDateTime=0x2d3efa40, ftLastAccessTime.dwHighDateTime=0x1d4cd65, ftLastWriteTime.dwLowDateTime=0x2d3efa40, ftLastWriteTime.dwHighDateTime=0x1d4cd65, nFileSizeHigh=0x0, nFileSizeLow=0x16263, dwReserved0=0x0, dwReserved1=0x0, cFileName="bUlZ.wav", cAlternateFileName="")) returned 1 [0068.311] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x180aadf0, ftCreationTime.dwHighDateTime=0x1d4c6cf, ftLastAccessTime.dwLowDateTime=0xe6c351e0, ftLastAccessTime.dwHighDateTime=0x1d4d333, ftLastWriteTime.dwLowDateTime=0xe6c351e0, ftLastWriteTime.dwHighDateTime=0x1d4d333, nFileSizeHigh=0x0, nFileSizeLow=0x957f, dwReserved0=0x0, dwReserved1=0x0, cFileName="C7Tgr_.mp3", cAlternateFileName="")) returned 1 [0068.311] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0068.311] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa36ad200, ftCreationTime.dwHighDateTime=0x1d4c9d9, ftLastAccessTime.dwLowDateTime=0xe44280a0, ftLastAccessTime.dwHighDateTime=0x1d4d205, ftLastWriteTime.dwLowDateTime=0xe44280a0, ftLastWriteTime.dwHighDateTime=0x1d4d205, nFileSizeHigh=0x0, nFileSizeLow=0xac78, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehKvWyeZ2fgJX_l-SQv.odt", cAlternateFileName="EHKVWY~1.ODT")) returned 1 [0068.311] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x330f14a0, ftCreationTime.dwHighDateTime=0x1d4c950, ftLastAccessTime.dwLowDateTime=0x207b1130, ftLastAccessTime.dwHighDateTime=0x1d4d53b, ftLastWriteTime.dwLowDateTime=0x207b1130, ftLastWriteTime.dwHighDateTime=0x1d4d53b, nFileSizeHigh=0x0, nFileSizeLow=0x45ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="epsNS8Zd30l2YZ.wav", cAlternateFileName="EPSNS8~1.WAV")) returned 1 [0068.312] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a65e080, ftCreationTime.dwHighDateTime=0x1d4cfec, ftLastAccessTime.dwLowDateTime=0x24c63e70, ftLastAccessTime.dwHighDateTime=0x1d4d385, ftLastWriteTime.dwLowDateTime=0x24c63e70, ftLastWriteTime.dwHighDateTime=0x1d4d385, nFileSizeHigh=0x0, nFileSizeLow=0x17541, dwReserved0=0x0, dwReserved1=0x0, cFileName="fgwF.gif", cAlternateFileName="")) returned 1 [0068.312] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9818ac90, ftCreationTime.dwHighDateTime=0x1d4ca08, ftLastAccessTime.dwLowDateTime=0x776582b0, ftLastAccessTime.dwHighDateTime=0x1d4c8c9, ftLastWriteTime.dwLowDateTime=0x776582b0, ftLastWriteTime.dwHighDateTime=0x1d4c8c9, nFileSizeHigh=0x0, nFileSizeLow=0xdd65, dwReserved0=0x0, dwReserved1=0x0, cFileName="fOu vb-KkZCDXb9.jpg", cAlternateFileName="FOUVB-~1.JPG")) returned 1 [0068.312] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33dcb9b0, ftCreationTime.dwHighDateTime=0x1d4cc15, ftLastAccessTime.dwLowDateTime=0x72684d50, ftLastAccessTime.dwHighDateTime=0x1d4cc5d, ftLastWriteTime.dwLowDateTime=0x72684d50, ftLastWriteTime.dwHighDateTime=0x1d4cc5d, nFileSizeHigh=0x0, nFileSizeLow=0x15383, dwReserved0=0x0, dwReserved1=0x0, cFileName="g_9K8WeNfm7cNWN.avi", cAlternateFileName="G_9K8W~1.AVI")) returned 1 [0068.312] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b06ef50, ftCreationTime.dwHighDateTime=0x1d4d57a, ftLastAccessTime.dwLowDateTime=0x93e98300, ftLastAccessTime.dwHighDateTime=0x1d4ca22, ftLastWriteTime.dwLowDateTime=0x93e98300, ftLastWriteTime.dwHighDateTime=0x1d4ca22, nFileSizeHigh=0x0, nFileSizeLow=0x15e99, dwReserved0=0x0, dwReserved1=0x0, cFileName="i WSBk_FJLr5B.swf", cAlternateFileName="IWSBK_~1.SWF")) returned 1 [0068.313] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x579a5a10, ftCreationTime.dwHighDateTime=0x1d4d4cb, ftLastAccessTime.dwLowDateTime=0x62419550, ftLastAccessTime.dwHighDateTime=0x1d4c5fd, ftLastWriteTime.dwLowDateTime=0x62419550, ftLastWriteTime.dwHighDateTime=0x1d4c5fd, nFileSizeHigh=0x0, nFileSizeLow=0x163bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="jmcbdzrWyd.bmp", cAlternateFileName="JMCBDZ~1.BMP")) returned 1 [0068.313] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c2bb620, ftCreationTime.dwHighDateTime=0x1d4cf81, ftLastAccessTime.dwLowDateTime=0x8cf2c530, ftLastAccessTime.dwHighDateTime=0x1d4d4d5, ftLastWriteTime.dwLowDateTime=0x8cf2c530, ftLastWriteTime.dwHighDateTime=0x1d4d4d5, nFileSizeHigh=0x0, nFileSizeLow=0x15f62, dwReserved0=0x0, dwReserved1=0x0, cFileName="L3ak099rEdj LwgUyNK1.avi", cAlternateFileName="L3AK09~1.AVI")) returned 1 [0068.313] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ace7530, ftCreationTime.dwHighDateTime=0x1d4cd9b, ftLastAccessTime.dwLowDateTime=0x5ced7c90, ftLastAccessTime.dwHighDateTime=0x1d4cce2, ftLastWriteTime.dwLowDateTime=0x5ced7c90, ftLastWriteTime.dwHighDateTime=0x1d4cce2, nFileSizeHigh=0x0, nFileSizeLow=0x85b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LPK_cvxMn51.flv", cAlternateFileName="LPK_CV~1.FLV")) returned 1 [0068.313] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3404ca0, ftCreationTime.dwHighDateTime=0x1d4cbba, ftLastAccessTime.dwLowDateTime=0xb44536b0, ftLastAccessTime.dwHighDateTime=0x1d4cb64, ftLastWriteTime.dwLowDateTime=0xb44536b0, ftLastWriteTime.dwHighDateTime=0x1d4cb64, nFileSizeHigh=0x0, nFileSizeLow=0x110c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MvpDo gJgfX3JI6.wav", cAlternateFileName="MVPDOG~1.WAV")) returned 1 [0068.313] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x285e5d50, ftCreationTime.dwHighDateTime=0x1d4d359, ftLastAccessTime.dwLowDateTime=0xb4f103f0, ftLastAccessTime.dwHighDateTime=0x1d4cd0d, ftLastWriteTime.dwLowDateTime=0xb4f103f0, ftLastWriteTime.dwHighDateTime=0x1d4cd0d, nFileSizeHigh=0x0, nFileSizeLow=0x6028, dwReserved0=0x0, dwReserved1=0x0, cFileName="nJXrOz1j2S6p.jpg", cAlternateFileName="NJXROZ~1.JPG")) returned 1 [0068.314] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4a31750, ftCreationTime.dwHighDateTime=0x1d4d008, ftLastAccessTime.dwLowDateTime=0x56af3fc0, ftLastAccessTime.dwHighDateTime=0x1d4c5c2, ftLastWriteTime.dwLowDateTime=0x56af3fc0, ftLastWriteTime.dwHighDateTime=0x1d4c5c2, nFileSizeHigh=0x0, nFileSizeLow=0x128c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="OJ5vU.pdf", cAlternateFileName="")) returned 1 [0068.314] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0ffa5a0, ftCreationTime.dwHighDateTime=0x1d4c6f1, ftLastAccessTime.dwLowDateTime=0xf45b3070, ftLastAccessTime.dwHighDateTime=0x1d4d176, ftLastWriteTime.dwLowDateTime=0xf45b3070, ftLastWriteTime.dwHighDateTime=0x1d4d176, nFileSizeHigh=0x0, nFileSizeLow=0x17bf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="p62r5li3xXj_mf.xlsx", cAlternateFileName="P62R5L~1.XLS")) returned 1 [0068.314] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee597350, ftCreationTime.dwHighDateTime=0x1d4c567, ftLastAccessTime.dwLowDateTime=0x5f4dee0, ftLastAccessTime.dwHighDateTime=0x1d4d180, ftLastWriteTime.dwLowDateTime=0x5f4dee0, ftLastWriteTime.dwHighDateTime=0x1d4d180, nFileSizeHigh=0x0, nFileSizeLow=0x1d02, dwReserved0=0x0, dwReserved1=0x0, cFileName="pb2 NStFVGwaAZx.mp4", cAlternateFileName="PB2NST~1.MP4")) returned 1 [0068.314] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b13850, ftCreationTime.dwHighDateTime=0x1d4d1f6, ftLastAccessTime.dwLowDateTime=0x418f19a0, ftLastAccessTime.dwHighDateTime=0x1d4d0f1, ftLastWriteTime.dwLowDateTime=0x418f19a0, ftLastWriteTime.dwHighDateTime=0x1d4d0f1, nFileSizeHigh=0x0, nFileSizeLow=0x16932, dwReserved0=0x0, dwReserved1=0x0, cFileName="pqSzgB SaW6XQP.mp3", cAlternateFileName="PQSZGB~1.MP3")) returned 1 [0068.315] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedd1b1a0, ftCreationTime.dwHighDateTime=0x1d4ccfa, ftLastAccessTime.dwLowDateTime=0x7ffbc380, ftLastAccessTime.dwHighDateTime=0x1d4d3be, ftLastWriteTime.dwLowDateTime=0x7ffbc380, ftLastWriteTime.dwHighDateTime=0x1d4d3be, nFileSizeHigh=0x0, nFileSizeLow=0x7923, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReEoWMb1tgQr2M.avi", cAlternateFileName="REEOWM~1.AVI")) returned 1 [0068.315] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc40ce7c0, ftCreationTime.dwHighDateTime=0x1d4cc7f, ftLastAccessTime.dwLowDateTime=0x22bd1e90, ftLastAccessTime.dwHighDateTime=0x1d4cd0f, ftLastWriteTime.dwLowDateTime=0x22bd1e90, ftLastWriteTime.dwHighDateTime=0x1d4cd0f, nFileSizeHigh=0x0, nFileSizeLow=0xb164, dwReserved0=0x0, dwReserved1=0x0, cFileName="RLbcXhJHI.bmp", cAlternateFileName="RLBCXH~1.BMP")) returned 1 [0068.315] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca9f78f0, ftCreationTime.dwHighDateTime=0x1d4ccb6, ftLastAccessTime.dwLowDateTime=0xb8c5720, ftLastAccessTime.dwHighDateTime=0x1d4cf5a, ftLastWriteTime.dwLowDateTime=0xb8c5720, ftLastWriteTime.dwHighDateTime=0x1d4cf5a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rLFrgATixAVohSfL9n", cAlternateFileName="RLFRGA~1")) returned 1 [0068.315] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b8a4cf0, ftCreationTime.dwHighDateTime=0x1d4caef, ftLastAccessTime.dwLowDateTime=0xc9dd0990, ftLastAccessTime.dwHighDateTime=0x1d4cef6, ftLastWriteTime.dwLowDateTime=0xc9dd0990, ftLastWriteTime.dwHighDateTime=0x1d4cef6, nFileSizeHigh=0x0, nFileSizeLow=0xc4d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpQ8TM.mp4", cAlternateFileName="")) returned 1 [0068.316] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf539e80, ftCreationTime.dwHighDateTime=0x1d4d111, ftLastAccessTime.dwLowDateTime=0x2e87c7f0, ftLastAccessTime.dwHighDateTime=0x1d4cb36, ftLastWriteTime.dwLowDateTime=0x2e87c7f0, ftLastWriteTime.dwHighDateTime=0x1d4cb36, nFileSizeHigh=0x0, nFileSizeLow=0xcf47, dwReserved0=0x0, dwReserved1=0x0, cFileName="vbMHGI79vM_PtDv8.avi", cAlternateFileName="VBMHGI~1.AVI")) returned 1 [0068.316] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13d3ebe0, ftCreationTime.dwHighDateTime=0x1d4cb1e, ftLastAccessTime.dwLowDateTime=0x7c2c3590, ftLastAccessTime.dwHighDateTime=0x1d4c7e4, ftLastWriteTime.dwLowDateTime=0x7c2c3590, ftLastWriteTime.dwHighDateTime=0x1d4c7e4, nFileSizeHigh=0x0, nFileSizeLow=0xb03e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vwzr.pps", cAlternateFileName="")) returned 1 [0068.316] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12e8e160, ftCreationTime.dwHighDateTime=0x1d4c9e6, ftLastAccessTime.dwLowDateTime=0xf865da00, ftLastAccessTime.dwHighDateTime=0x1d4d007, ftLastWriteTime.dwLowDateTime=0xf865da00, ftLastWriteTime.dwHighDateTime=0x1d4d007, nFileSizeHigh=0x0, nFileSizeLow=0x10ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x4IIvHjetTqBaG.xlsx", cAlternateFileName="X4IIVH~1.XLS")) returned 1 [0068.316] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5abc7d90, ftCreationTime.dwHighDateTime=0x1d4ce68, ftLastAccessTime.dwLowDateTime=0x74830d0, ftLastAccessTime.dwHighDateTime=0x1d4cb54, ftLastWriteTime.dwLowDateTime=0x74830d0, ftLastWriteTime.dwHighDateTime=0x1d4cb54, nFileSizeHigh=0x0, nFileSizeLow=0xec96, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z3XMtXvu.doc", cAlternateFileName="")) returned 1 [0068.316] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6139640, ftCreationTime.dwHighDateTime=0x1d4cfec, ftLastAccessTime.dwLowDateTime=0xf5afc3e0, ftLastAccessTime.dwHighDateTime=0x1d4cfc9, ftLastWriteTime.dwLowDateTime=0xf5afc3e0, ftLastWriteTime.dwHighDateTime=0x1d4cfc9, nFileSizeHigh=0x0, nFileSizeLow=0x461b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zIHHqGfcI.mp3", cAlternateFileName="ZIHHQG~1.MP3")) returned 1 [0068.317] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7868ce30, ftCreationTime.dwHighDateTime=0x1d4c953, ftLastAccessTime.dwLowDateTime=0xf30618c0, ftLastAccessTime.dwHighDateTime=0x1d4d48c, ftLastWriteTime.dwLowDateTime=0xf30618c0, ftLastWriteTime.dwHighDateTime=0x1d4d48c, nFileSizeHigh=0x0, nFileSizeLow=0xa43f, dwReserved0=0x0, dwReserved1=0x0, cFileName="zUV-2s2ldl.rtf", cAlternateFileName="ZUV-2S~1.RTF")) returned 1 [0068.317] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2499cb0, ftCreationTime.dwHighDateTime=0x1d4d372, ftLastAccessTime.dwLowDateTime=0x56aef580, ftLastAccessTime.dwHighDateTime=0x1d4c98f, ftLastWriteTime.dwLowDateTime=0x56aef580, ftLastWriteTime.dwHighDateTime=0x1d4c98f, nFileSizeHigh=0x0, nFileSizeLow=0x8fb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="_aeDeuxDfMl6neBTOKj.wav", cAlternateFileName="_AEDEU~1.WAV")) returned 1 [0068.317] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2499cb0, ftCreationTime.dwHighDateTime=0x1d4d372, ftLastAccessTime.dwLowDateTime=0x56aef580, ftLastAccessTime.dwHighDateTime=0x1d4c98f, ftLastWriteTime.dwLowDateTime=0x56aef580, ftLastWriteTime.dwHighDateTime=0x1d4c98f, nFileSizeHigh=0x0, nFileSizeLow=0x8fb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="_aeDeuxDfMl6neBTOKj.wav", cAlternateFileName="_AEDEU~1.WAV")) returned 0 [0068.317] FindClose (in: hFindFile=0x69b128 | out: hFindFile=0x69b128) returned 1 [0068.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eac8) returned 1 [0068.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ead4) returned 1 [0068.318] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0OLU_WDuO-G.avi", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0OLU_WDuO-G.avi", lpFilePart=0x0) returned 0x35 [0068.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0068.318] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0OLU_WDuO-G.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0olu_wduo-g.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0068.318] GetFileType (hFile=0x26c) returned 0x1 [0068.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0068.318] GetFileType (hFile=0x26c) returned 0x1 [0068.319] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0xfd5f [0068.319] ReadFile (in: hFile=0x26c, lpBuffer=0x28c5378, nNumberOfBytesToRead=0xfd5f, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x28c5378*, lpNumberOfBytesRead=0x24ea60*=0xfd5f, lpOverlapped=0x0) returned 1 [0068.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0068.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0068.353] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0068.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0068.354] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0OLU_WDuO-G.avi", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0OLU_WDuO-G.avi", lpFilePart=0x0) returned 0x35 [0068.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0068.354] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0OLU_WDuO-G.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0olu_wduo-g.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0068.355] GetFileType (hFile=0x26c) returned 0x1 [0068.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0068.355] GetFileType (hFile=0x26c) returned 0x1 [0068.356] WriteFile (in: hFile=0x26c, lpBuffer=0x2941998*, nNumberOfBytesToWrite=0xfd60, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x2941998*, lpNumberOfBytesWritten=0x24ea54*=0xfd60, lpOverlapped=0x0) returned 1 [0068.358] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0OLU_WDuO-G.avi", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0OLU_WDuO-G.avi", lpFilePart=0x0) returned 0x35 [0068.358] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0OLU_WDuO-G.avi.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0OLU_WDuO-G.avi.Crypted", lpFilePart=0x0) returned 0x3d [0068.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0068.358] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0OLU_WDuO-G.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0olu_wduo-g.avi"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7622b9a0, ftCreationTime.dwHighDateTime=0x1d4ca62, ftLastAccessTime.dwLowDateTime=0xb7597ca0, ftLastAccessTime.dwHighDateTime=0x1d4d459, ftLastWriteTime.dwLowDateTime=0xf9e61010, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xfd60)) returned 1 [0068.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0068.359] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0OLU_WDuO-G.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0olu_wduo-g.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0OLU_WDuO-G.avi.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0olu_wduo-g.avi.crypted")) returned 1 [0068.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7pUxu.png", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7pUxu.png", lpFilePart=0x0) returned 0x2f [0068.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0068.364] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7pUxu.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7puxu.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0068.365] GetFileType (hFile=0x26c) returned 0x1 [0068.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0068.365] GetFileType (hFile=0x26c) returned 0x1 [0068.365] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x729c [0068.365] ReadFile (in: hFile=0x26c, lpBuffer=0x2951c28, nNumberOfBytesToRead=0x729c, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x2951c28*, lpNumberOfBytesRead=0x24ea60*=0x729c, lpOverlapped=0x0) returned 1 [0068.431] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0068.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0068.431] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0068.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0068.431] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7pUxu.png", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7pUxu.png", lpFilePart=0x0) returned 0x2f [0068.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0068.431] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7pUxu.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7puxu.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0068.433] GetFileType (hFile=0x26c) returned 0x1 [0068.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0068.433] GetFileType (hFile=0x26c) returned 0x1 [0068.433] WriteFile (in: hFile=0x26c, lpBuffer=0x279c87c*, nNumberOfBytesToWrite=0x72a0, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x279c87c*, lpNumberOfBytesWritten=0x24ea54*=0x72a0, lpOverlapped=0x0) returned 1 [0068.435] CloseHandle (hObject=0x26c) returned 1 [0068.436] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7pUxu.png", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7pUxu.png", lpFilePart=0x0) returned 0x2f [0068.437] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7pUxu.png.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7pUxu.png.Crypted", lpFilePart=0x0) returned 0x37 [0068.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0068.437] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7pUxu.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7puxu.png"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24739f10, ftCreationTime.dwHighDateTime=0x1d4d16b, ftLastAccessTime.dwLowDateTime=0x77cc720, ftLastAccessTime.dwHighDateTime=0x1d4d3e0, ftLastWriteTime.dwLowDateTime=0xf9f1f6f0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x72a0)) returned 1 [0068.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0068.437] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7pUxu.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7puxu.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7pUxu.png.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7puxu.png.crypted")) returned 1 [0068.438] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C7Tgr_.mp3", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C7Tgr_.mp3", lpFilePart=0x0) returned 0x30 [0068.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0068.438] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C7Tgr_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\c7tgr_.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0068.439] GetFileType (hFile=0x26c) returned 0x1 [0068.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0068.439] GetFileType (hFile=0x26c) returned 0x1 [0068.439] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x957f [0068.439] ReadFile (in: hFile=0x26c, lpBuffer=0x27a4030, nNumberOfBytesToRead=0x957f, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x27a4030*, lpNumberOfBytesRead=0x24ea60*=0x957f, lpOverlapped=0x0) returned 1 [0068.441] CloseHandle (hObject=0x26c) returned 1 [0068.463] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0068.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0068.463] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0068.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0068.463] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C7Tgr_.mp3", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C7Tgr_.mp3", lpFilePart=0x0) returned 0x30 [0068.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0068.463] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C7Tgr_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\c7tgr_.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0068.465] GetFileType (hFile=0x26c) returned 0x1 [0068.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0068.465] GetFileType (hFile=0x26c) returned 0x1 [0068.465] WriteFile (in: hFile=0x26c, lpBuffer=0x281faf8*, nNumberOfBytesToWrite=0x9580, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x281faf8*, lpNumberOfBytesWritten=0x24ea54*=0x9580, lpOverlapped=0x0) returned 1 [0068.467] CloseHandle (hObject=0x26c) returned 1 [0068.477] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C7Tgr_.mp3", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C7Tgr_.mp3", lpFilePart=0x0) returned 0x30 [0068.478] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C7Tgr_.mp3.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C7Tgr_.mp3.Crypted", lpFilePart=0x0) returned 0x38 [0068.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0068.478] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C7Tgr_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\c7tgr_.mp3"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x180aadf0, ftCreationTime.dwHighDateTime=0x1d4c6cf, ftLastAccessTime.dwLowDateTime=0xe6c351e0, ftLastAccessTime.dwHighDateTime=0x1d4d333, ftLastWriteTime.dwLowDateTime=0xf9f91b10, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x9580)) returned 1 [0068.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0068.478] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C7Tgr_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\c7tgr_.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C7Tgr_.mp3.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\c7tgr_.mp3.crypted")) returned 1 [0068.479] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ehKvWyeZ2fgJX_l-SQv.odt", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ehKvWyeZ2fgJX_l-SQv.odt", lpFilePart=0x0) returned 0x3d [0068.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0068.479] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ehKvWyeZ2fgJX_l-SQv.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ehkvwyez2fgjx_l-sqv.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0068.480] GetFileType (hFile=0x26c) returned 0x1 [0068.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0068.480] GetFileType (hFile=0x26c) returned 0x1 [0068.480] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0xac78 [0068.480] ReadFile (in: hFile=0x26c, lpBuffer=0x28295d0, nNumberOfBytesToRead=0xac78, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x28295d0*, lpNumberOfBytesRead=0x24ea60*=0xac78, lpOverlapped=0x0) returned 1 [0068.482] CloseHandle (hObject=0x26c) returned 1 [0068.505] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0068.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0068.506] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0068.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0068.506] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ehKvWyeZ2fgJX_l-SQv.odt", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ehKvWyeZ2fgJX_l-SQv.odt", lpFilePart=0x0) returned 0x3d [0068.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0068.506] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ehKvWyeZ2fgJX_l-SQv.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ehkvwyez2fgjx_l-sqv.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0068.507] GetFileType (hFile=0x26c) returned 0x1 [0068.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0068.508] GetFileType (hFile=0x26c) returned 0x1 [0068.508] WriteFile (in: hFile=0x26c, lpBuffer=0x289694c*, nNumberOfBytesToWrite=0xac80, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x289694c*, lpNumberOfBytesWritten=0x24ea54*=0xac80, lpOverlapped=0x0) returned 1 [0068.510] CloseHandle (hObject=0x26c) returned 1 [0068.524] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ehKvWyeZ2fgJX_l-SQv.odt", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ehKvWyeZ2fgJX_l-SQv.odt", lpFilePart=0x0) returned 0x3d [0068.524] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ehKvWyeZ2fgJX_l-SQv.odt.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ehKvWyeZ2fgJX_l-SQv.odt.Crypted", lpFilePart=0x0) returned 0x45 [0068.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0068.525] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ehKvWyeZ2fgJX_l-SQv.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ehkvwyez2fgjx_l-sqv.odt"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa36ad200, ftCreationTime.dwHighDateTime=0x1d4c9d9, ftLastAccessTime.dwLowDateTime=0xe44280a0, ftLastAccessTime.dwHighDateTime=0x1d4d205, ftLastWriteTime.dwLowDateTime=0xfa003f30, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xac80)) returned 1 [0068.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0068.525] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ehKvWyeZ2fgJX_l-SQv.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ehkvwyez2fgjx_l-sqv.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ehKvWyeZ2fgJX_l-SQv.odt.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ehkvwyez2fgjx_l-sqv.odt.crypted")) returned 1 [0068.526] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fOu vb-KkZCDXb9.jpg", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fOu vb-KkZCDXb9.jpg", lpFilePart=0x0) returned 0x39 [0068.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0068.526] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fOu vb-KkZCDXb9.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fou vb-kkzcdxb9.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0068.527] GetFileType (hFile=0x26c) returned 0x1 [0068.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0068.527] GetFileType (hFile=0x26c) returned 0x1 [0068.527] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0xdd65 [0068.527] ReadFile (in: hFile=0x26c, lpBuffer=0x28a1ba4, nNumberOfBytesToRead=0xdd65, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x28a1ba4*, lpNumberOfBytesRead=0x24ea60*=0xdd65, lpOverlapped=0x0) returned 1 [0068.529] CloseHandle (hObject=0x26c) returned 1 [0068.553] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0068.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0068.553] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0068.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0068.554] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fOu vb-KkZCDXb9.jpg", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fOu vb-KkZCDXb9.jpg", lpFilePart=0x0) returned 0x39 [0068.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0068.554] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fOu vb-KkZCDXb9.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fou vb-kkzcdxb9.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0068.555] GetFileType (hFile=0x26c) returned 0x1 [0068.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0068.555] GetFileType (hFile=0x26c) returned 0x1 [0068.555] WriteFile (in: hFile=0x26c, lpBuffer=0x29181f4*, nNumberOfBytesToWrite=0xdd70, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x29181f4*, lpNumberOfBytesWritten=0x24ea54*=0xdd70, lpOverlapped=0x0) returned 1 [0068.557] CloseHandle (hObject=0x26c) returned 1 [0068.565] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fOu vb-KkZCDXb9.jpg", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fOu vb-KkZCDXb9.jpg", lpFilePart=0x0) returned 0x39 [0068.565] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fOu vb-KkZCDXb9.jpg.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fOu vb-KkZCDXb9.jpg.Crypted", lpFilePart=0x0) returned 0x41 [0068.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0068.565] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fOu vb-KkZCDXb9.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fou vb-kkzcdxb9.jpg"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9818ac90, ftCreationTime.dwHighDateTime=0x1d4ca08, ftLastAccessTime.dwLowDateTime=0x776582b0, ftLastAccessTime.dwHighDateTime=0x1d4c8c9, ftLastWriteTime.dwLowDateTime=0xfa076350, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xdd70)) returned 1 [0068.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0068.565] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fOu vb-KkZCDXb9.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fou vb-kkzcdxb9.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fOu vb-KkZCDXb9.jpg.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fou vb-kkzcdxb9.jpg.crypted")) returned 1 [0068.567] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\g_9K8WeNfm7cNWN.avi", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\g_9K8WeNfm7cNWN.avi", lpFilePart=0x0) returned 0x39 [0068.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0068.567] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\g_9K8WeNfm7cNWN.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\g_9k8wenfm7cnwn.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0068.571] GetFileType (hFile=0x26c) returned 0x1 [0068.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0068.571] GetFileType (hFile=0x26c) returned 0x1 [0068.571] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x15383 [0068.572] ReadFile (in: hFile=0x26c, lpBuffer=0x37e3f30, nNumberOfBytesToRead=0x15383, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x37e3f30*, lpNumberOfBytesRead=0x24ea60*=0x15383, lpOverlapped=0x0) returned 1 [0068.585] CloseHandle (hObject=0x26c) returned 1 [0068.643] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0068.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0068.643] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0068.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0068.643] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\g_9K8WeNfm7cNWN.avi", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\g_9K8WeNfm7cNWN.avi", lpFilePart=0x0) returned 0x39 [0068.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0068.644] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\g_9K8WeNfm7cNWN.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\g_9k8wenfm7cnwn.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0068.645] GetFileType (hFile=0x26c) returned 0x1 [0068.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0068.646] GetFileType (hFile=0x26c) returned 0x1 [0068.646] WriteFile (in: hFile=0x26c, lpBuffer=0x384e130*, nNumberOfBytesToWrite=0x15390, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x384e130*, lpNumberOfBytesWritten=0x24ea54*=0x15390, lpOverlapped=0x0) returned 1 [0068.648] CloseHandle (hObject=0x26c) returned 1 [0068.659] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\g_9K8WeNfm7cNWN.avi", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\g_9K8WeNfm7cNWN.avi", lpFilePart=0x0) returned 0x39 [0068.659] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\g_9K8WeNfm7cNWN.avi.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\g_9K8WeNfm7cNWN.avi.Crypted", lpFilePart=0x0) returned 0x41 [0068.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0068.659] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\g_9K8WeNfm7cNWN.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\g_9k8wenfm7cnwn.avi"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33dcb9b0, ftCreationTime.dwHighDateTime=0x1d4cc15, ftLastAccessTime.dwLowDateTime=0x72684d50, ftLastAccessTime.dwHighDateTime=0x1d4cc5d, ftLastWriteTime.dwLowDateTime=0xfa134a30, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x15390)) returned 1 [0068.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0068.659] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\g_9K8WeNfm7cNWN.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\g_9k8wenfm7cnwn.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\g_9K8WeNfm7cNWN.avi.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\g_9k8wenfm7cnwn.avi.crypted")) returned 1 [0068.661] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jmcbdzrWyd.bmp", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jmcbdzrWyd.bmp", lpFilePart=0x0) returned 0x34 [0068.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0068.661] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jmcbdzrWyd.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jmcbdzrwyd.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0068.661] GetFileType (hFile=0x26c) returned 0x1 [0068.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0068.661] GetFileType (hFile=0x26c) returned 0x1 [0068.661] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x163bf [0068.662] ReadFile (in: hFile=0x26c, lpBuffer=0x38634e0, nNumberOfBytesToRead=0x163bf, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x38634e0*, lpNumberOfBytesRead=0x24ea60*=0x163bf, lpOverlapped=0x0) returned 1 [0068.666] CloseHandle (hObject=0x26c) returned 1 [0068.714] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0068.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0068.714] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0068.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0068.715] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jmcbdzrWyd.bmp", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jmcbdzrWyd.bmp", lpFilePart=0x0) returned 0x34 [0068.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0068.715] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jmcbdzrWyd.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jmcbdzrwyd.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0068.717] GetFileType (hFile=0x26c) returned 0x1 [0068.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0068.717] GetFileType (hFile=0x26c) returned 0x1 [0068.717] WriteFile (in: hFile=0x26c, lpBuffer=0x38d27e0*, nNumberOfBytesToWrite=0x163c0, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x38d27e0*, lpNumberOfBytesWritten=0x24ea54*=0x163c0, lpOverlapped=0x0) returned 1 [0068.719] CloseHandle (hObject=0x26c) returned 1 [0068.730] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jmcbdzrWyd.bmp", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jmcbdzrWyd.bmp", lpFilePart=0x0) returned 0x34 [0068.731] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jmcbdzrWyd.bmp.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jmcbdzrWyd.bmp.Crypted", lpFilePart=0x0) returned 0x3c [0068.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0068.731] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jmcbdzrWyd.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jmcbdzrwyd.bmp"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x579a5a10, ftCreationTime.dwHighDateTime=0x1d4d4cb, ftLastAccessTime.dwLowDateTime=0x62419550, ftLastAccessTime.dwHighDateTime=0x1d4c5fd, ftLastWriteTime.dwLowDateTime=0xfa1f3110, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x163c0)) returned 1 [0068.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0068.731] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jmcbdzrWyd.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jmcbdzrwyd.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jmcbdzrWyd.bmp.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jmcbdzrwyd.bmp.crypted")) returned 1 [0068.733] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\L3ak099rEdj LwgUyNK1.avi", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\L3ak099rEdj LwgUyNK1.avi", lpFilePart=0x0) returned 0x3e [0068.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0068.733] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\L3ak099rEdj LwgUyNK1.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\l3ak099redj lwguynk1.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0068.734] GetFileType (hFile=0x26c) returned 0x1 [0068.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0068.734] GetFileType (hFile=0x26c) returned 0x1 [0068.734] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x15f62 [0068.734] ReadFile (in: hFile=0x26c, lpBuffer=0x38e8bc0, nNumberOfBytesToRead=0x15f62, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x38e8bc0*, lpNumberOfBytesRead=0x24ea60*=0x15f62, lpOverlapped=0x0) returned 1 [0068.738] CloseHandle (hObject=0x26c) returned 1 [0068.777] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0068.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0068.777] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0068.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0068.777] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\L3ak099rEdj LwgUyNK1.avi", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\L3ak099rEdj LwgUyNK1.avi", lpFilePart=0x0) returned 0x3e [0068.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0068.778] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\L3ak099rEdj LwgUyNK1.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\l3ak099redj lwguynk1.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0068.779] GetFileType (hFile=0x26c) returned 0x1 [0068.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0068.783] GetFileType (hFile=0x26c) returned 0x1 [0068.783] WriteFile (in: hFile=0x26c, lpBuffer=0x3956920*, nNumberOfBytesToWrite=0x15f70, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x3956920*, lpNumberOfBytesWritten=0x24ea54*=0x15f70, lpOverlapped=0x0) returned 1 [0068.785] CloseHandle (hObject=0x26c) returned 1 [0068.789] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\L3ak099rEdj LwgUyNK1.avi", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\L3ak099rEdj LwgUyNK1.avi", lpFilePart=0x0) returned 0x3e [0068.789] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\L3ak099rEdj LwgUyNK1.avi.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\L3ak099rEdj LwgUyNK1.avi.Crypted", lpFilePart=0x0) returned 0x46 [0068.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0068.789] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\L3ak099rEdj LwgUyNK1.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\l3ak099redj lwguynk1.avi"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c2bb620, ftCreationTime.dwHighDateTime=0x1d4cf81, ftLastAccessTime.dwLowDateTime=0x8cf2c530, ftLastAccessTime.dwHighDateTime=0x1d4d4d5, ftLastWriteTime.dwLowDateTime=0xfa28b690, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x15f70)) returned 1 [0068.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0068.789] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\L3ak099rEdj LwgUyNK1.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\l3ak099redj lwguynk1.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\L3ak099rEdj LwgUyNK1.avi.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\l3ak099redj lwguynk1.avi.crypted")) returned 1 [0068.791] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\nJXrOz1j2S6p.jpg", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\nJXrOz1j2S6p.jpg", lpFilePart=0x0) returned 0x36 [0068.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0068.791] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\nJXrOz1j2S6p.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\njxroz1j2s6p.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0068.792] GetFileType (hFile=0x26c) returned 0x1 [0068.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0068.792] GetFileType (hFile=0x26c) returned 0x1 [0068.792] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x6028 [0068.793] ReadFile (in: hFile=0x26c, lpBuffer=0x27e6aac, nNumberOfBytesToRead=0x6028, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x27e6aac*, lpNumberOfBytesRead=0x24ea60*=0x6028, lpOverlapped=0x0) returned 1 [0068.795] CloseHandle (hObject=0x26c) returned 1 [0068.849] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0068.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0068.849] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0068.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0068.849] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\nJXrOz1j2S6p.jpg", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\nJXrOz1j2S6p.jpg", lpFilePart=0x0) returned 0x36 [0068.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0068.849] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\nJXrOz1j2S6p.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\njxroz1j2s6p.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0068.850] GetFileType (hFile=0x26c) returned 0x1 [0068.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0068.850] GetFileType (hFile=0x26c) returned 0x1 [0068.850] WriteFile (in: hFile=0x26c, lpBuffer=0x2851984*, nNumberOfBytesToWrite=0x6030, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x2851984*, lpNumberOfBytesWritten=0x24ea54*=0x6030, lpOverlapped=0x0) returned 1 [0068.851] CloseHandle (hObject=0x26c) returned 1 [0068.860] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\nJXrOz1j2S6p.jpg", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\nJXrOz1j2S6p.jpg", lpFilePart=0x0) returned 0x36 [0068.860] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\nJXrOz1j2S6p.jpg.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\nJXrOz1j2S6p.jpg.Crypted", lpFilePart=0x0) returned 0x3e [0068.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0068.860] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\nJXrOz1j2S6p.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\njxroz1j2s6p.jpg"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x285e5d50, ftCreationTime.dwHighDateTime=0x1d4d359, ftLastAccessTime.dwLowDateTime=0xb4f103f0, ftLastAccessTime.dwHighDateTime=0x1d4cd0d, ftLastWriteTime.dwLowDateTime=0xfa323c10, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x6030)) returned 1 [0068.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0068.860] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\nJXrOz1j2S6p.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\njxroz1j2s6p.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\nJXrOz1j2S6p.jpg.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\njxroz1j2s6p.jpg.crypted")) returned 1 [0068.862] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OJ5vU.pdf", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OJ5vU.pdf", lpFilePart=0x0) returned 0x2f [0068.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0068.862] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OJ5vU.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\oj5vu.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0068.862] GetFileType (hFile=0x26c) returned 0x1 [0068.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0068.863] GetFileType (hFile=0x26c) returned 0x1 [0068.863] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x128c3 [0068.863] ReadFile (in: hFile=0x26c, lpBuffer=0x2857ef8, nNumberOfBytesToRead=0x128c3, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x2857ef8*, lpNumberOfBytesRead=0x24ea60*=0x128c3, lpOverlapped=0x0) returned 1 [0068.872] CloseHandle (hObject=0x26c) returned 1 [0068.896] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0068.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0068.896] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0068.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0068.896] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OJ5vU.pdf", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OJ5vU.pdf", lpFilePart=0x0) returned 0x2f [0068.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0068.896] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OJ5vU.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\oj5vu.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0068.898] GetFileType (hFile=0x26c) returned 0x1 [0068.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0068.898] GetFileType (hFile=0x26c) returned 0x1 [0068.898] WriteFile (in: hFile=0x26c, lpBuffer=0x28dc768*, nNumberOfBytesToWrite=0x128d0, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x28dc768*, lpNumberOfBytesWritten=0x24ea54*=0x128d0, lpOverlapped=0x0) returned 1 [0068.900] CloseHandle (hObject=0x26c) returned 1 [0068.906] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OJ5vU.pdf", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OJ5vU.pdf", lpFilePart=0x0) returned 0x2f [0068.906] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OJ5vU.pdf.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OJ5vU.pdf.Crypted", lpFilePart=0x0) returned 0x37 [0068.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0068.906] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OJ5vU.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\oj5vu.pdf"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4a31750, ftCreationTime.dwHighDateTime=0x1d4d008, ftLastAccessTime.dwLowDateTime=0x56af3fc0, ftLastAccessTime.dwHighDateTime=0x1d4c5c2, ftLastWriteTime.dwLowDateTime=0xfa3bc190, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x128d0)) returned 1 [0068.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0068.907] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OJ5vU.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\oj5vu.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OJ5vU.pdf.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\oj5vu.pdf.crypted")) returned 1 [0068.924] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p62r5li3xXj_mf.xlsx", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p62r5li3xXj_mf.xlsx", lpFilePart=0x0) returned 0x39 [0068.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0068.924] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p62r5li3xXj_mf.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p62r5li3xxj_mf.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0068.924] GetFileType (hFile=0x26c) returned 0x1 [0068.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0068.924] GetFileType (hFile=0x26c) returned 0x1 [0068.925] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x17bf1 [0068.925] ReadFile (in: hFile=0x26c, lpBuffer=0x3991a50, nNumberOfBytesToRead=0x17bf1, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x3991a50*, lpNumberOfBytesRead=0x24ea60*=0x17bf1, lpOverlapped=0x0) returned 1 [0068.947] CloseHandle (hObject=0x26c) returned 1 [0068.978] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0068.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0068.978] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0068.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0068.978] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p62r5li3xXj_mf.xlsx", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p62r5li3xXj_mf.xlsx", lpFilePart=0x0) returned 0x39 [0068.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0068.979] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p62r5li3xXj_mf.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p62r5li3xxj_mf.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0068.981] GetFileType (hFile=0x26c) returned 0x1 [0068.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0068.981] GetFileType (hFile=0x26c) returned 0x1 [0068.981] WriteFile (in: hFile=0x26c, lpBuffer=0x3a08680*, nNumberOfBytesToWrite=0x17c00, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x3a08680*, lpNumberOfBytesWritten=0x24ea54*=0x17c00, lpOverlapped=0x0) returned 1 [0068.983] CloseHandle (hObject=0x26c) returned 1 [0068.986] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p62r5li3xXj_mf.xlsx", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p62r5li3xXj_mf.xlsx", lpFilePart=0x0) returned 0x39 [0068.986] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p62r5li3xXj_mf.xlsx.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p62r5li3xXj_mf.xlsx.Crypted", lpFilePart=0x0) returned 0x41 [0068.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0068.986] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p62r5li3xXj_mf.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p62r5li3xxj_mf.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0ffa5a0, ftCreationTime.dwHighDateTime=0x1d4c6f1, ftLastAccessTime.dwLowDateTime=0xf45b3070, ftLastAccessTime.dwHighDateTime=0x1d4d176, ftLastWriteTime.dwLowDateTime=0xfa47a870, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x17c00)) returned 1 [0068.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0068.986] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p62r5li3xXj_mf.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p62r5li3xxj_mf.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p62r5li3xXj_mf.xlsx.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p62r5li3xxj_mf.xlsx.crypted")) returned 1 [0068.987] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pb2 NStFVGwaAZx.mp4", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pb2 NStFVGwaAZx.mp4", lpFilePart=0x0) returned 0x39 [0068.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0068.987] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pb2 NStFVGwaAZx.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pb2 nstfvgwaazx.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0068.988] GetFileType (hFile=0x26c) returned 0x1 [0068.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0068.988] GetFileType (hFile=0x26c) returned 0x1 [0068.988] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x1d02 [0068.988] ReadFile (in: hFile=0x26c, lpBuffer=0x293c8d0, nNumberOfBytesToRead=0x1d02, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x293c8d0*, lpNumberOfBytesRead=0x24ea60*=0x1d02, lpOverlapped=0x0) returned 1 [0068.990] CloseHandle (hObject=0x26c) returned 1 [0069.056] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0069.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0069.057] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0069.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0069.057] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pb2 NStFVGwaAZx.mp4", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pb2 NStFVGwaAZx.mp4", lpFilePart=0x0) returned 0x39 [0069.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0069.057] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pb2 NStFVGwaAZx.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pb2 nstfvgwaazx.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0069.058] GetFileType (hFile=0x26c) returned 0x1 [0069.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0069.058] GetFileType (hFile=0x26c) returned 0x1 [0069.058] WriteFile (in: hFile=0x26c, lpBuffer=0x2794ba0*, nNumberOfBytesToWrite=0x1d10, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x2794ba0*, lpNumberOfBytesWritten=0x24ea54*=0x1d10, lpOverlapped=0x0) returned 1 [0069.060] CloseHandle (hObject=0x26c) returned 1 [0069.072] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pb2 NStFVGwaAZx.mp4", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pb2 NStFVGwaAZx.mp4", lpFilePart=0x0) returned 0x39 [0069.072] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pb2 NStFVGwaAZx.mp4.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pb2 NStFVGwaAZx.mp4.Crypted", lpFilePart=0x0) returned 0x41 [0069.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0069.072] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pb2 NStFVGwaAZx.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pb2 nstfvgwaazx.mp4"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee597350, ftCreationTime.dwHighDateTime=0x1d4c567, ftLastAccessTime.dwLowDateTime=0x5f4dee0, ftLastAccessTime.dwHighDateTime=0x1d4d180, ftLastWriteTime.dwLowDateTime=0xfa538f50, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x1d10)) returned 1 [0069.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0069.073] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pb2 NStFVGwaAZx.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pb2 nstfvgwaazx.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pb2 NStFVGwaAZx.mp4.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pb2 nstfvgwaazx.mp4.crypted")) returned 1 [0069.074] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pqSzgB SaW6XQP.mp3", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pqSzgB SaW6XQP.mp3", lpFilePart=0x0) returned 0x38 [0069.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0069.074] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pqSzgB SaW6XQP.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pqszgb saw6xqp.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0069.076] GetFileType (hFile=0x26c) returned 0x1 [0069.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0069.076] GetFileType (hFile=0x26c) returned 0x1 [0069.076] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x16932 [0069.077] ReadFile (in: hFile=0x26c, lpBuffer=0x3a202a0, nNumberOfBytesToRead=0x16932, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x3a202a0*, lpNumberOfBytesRead=0x24ea60*=0x16932, lpOverlapped=0x0) returned 1 [0069.080] CloseHandle (hObject=0x26c) returned 1 [0069.126] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0069.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0069.126] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0069.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0069.126] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pqSzgB SaW6XQP.mp3", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pqSzgB SaW6XQP.mp3", lpFilePart=0x0) returned 0x38 [0069.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0069.126] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pqSzgB SaW6XQP.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pqszgb saw6xqp.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0069.128] GetFileType (hFile=0x26c) returned 0x1 [0069.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0069.128] GetFileType (hFile=0x26c) returned 0x1 [0069.128] WriteFile (in: hFile=0x26c, lpBuffer=0x37cbf70*, nNumberOfBytesToWrite=0x16940, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x37cbf70*, lpNumberOfBytesWritten=0x24ea54*=0x16940, lpOverlapped=0x0) returned 1 [0069.131] CloseHandle (hObject=0x26c) returned 1 [0069.136] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pqSzgB SaW6XQP.mp3", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pqSzgB SaW6XQP.mp3", lpFilePart=0x0) returned 0x38 [0069.136] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pqSzgB SaW6XQP.mp3.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pqSzgB SaW6XQP.mp3.Crypted", lpFilePart=0x0) returned 0x40 [0069.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0069.137] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pqSzgB SaW6XQP.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pqszgb saw6xqp.mp3"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b13850, ftCreationTime.dwHighDateTime=0x1d4d1f6, ftLastAccessTime.dwLowDateTime=0x418f19a0, ftLastAccessTime.dwHighDateTime=0x1d4d0f1, ftLastWriteTime.dwLowDateTime=0xfa5d14d0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x16940)) returned 1 [0069.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0069.137] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pqSzgB SaW6XQP.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pqszgb saw6xqp.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pqSzgB SaW6XQP.mp3.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pqszgb saw6xqp.mp3.crypted")) returned 1 [0069.138] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReEoWMb1tgQr2M.avi", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReEoWMb1tgQr2M.avi", lpFilePart=0x0) returned 0x38 [0069.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0069.138] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReEoWMb1tgQr2M.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\reeowmb1tgqr2m.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0069.139] GetFileType (hFile=0x26c) returned 0x1 [0069.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0069.139] GetFileType (hFile=0x26c) returned 0x1 [0069.139] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x7923 [0069.139] ReadFile (in: hFile=0x26c, lpBuffer=0x2749f38, nNumberOfBytesToRead=0x7923, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x2749f38*, lpNumberOfBytesRead=0x24ea60*=0x7923, lpOverlapped=0x0) returned 1 [0069.141] CloseHandle (hObject=0x26c) returned 1 [0069.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0069.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0069.196] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0069.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0069.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReEoWMb1tgQr2M.avi", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReEoWMb1tgQr2M.avi", lpFilePart=0x0) returned 0x38 [0069.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0069.197] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReEoWMb1tgQr2M.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\reeowmb1tgqr2m.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0069.198] GetFileType (hFile=0x26c) returned 0x1 [0069.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0069.198] GetFileType (hFile=0x26c) returned 0x1 [0069.198] WriteFile (in: hFile=0x26c, lpBuffer=0x27bcc70*, nNumberOfBytesToWrite=0x7930, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x27bcc70*, lpNumberOfBytesWritten=0x24ea54*=0x7930, lpOverlapped=0x0) returned 1 [0069.200] CloseHandle (hObject=0x26c) returned 1 [0069.206] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReEoWMb1tgQr2M.avi", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReEoWMb1tgQr2M.avi", lpFilePart=0x0) returned 0x38 [0069.206] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReEoWMb1tgQr2M.avi.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReEoWMb1tgQr2M.avi.Crypted", lpFilePart=0x0) returned 0x40 [0069.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0069.206] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReEoWMb1tgQr2M.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\reeowmb1tgqr2m.avi"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedd1b1a0, ftCreationTime.dwHighDateTime=0x1d4ccfa, ftLastAccessTime.dwLowDateTime=0x7ffbc380, ftLastAccessTime.dwHighDateTime=0x1d4d3be, ftLastWriteTime.dwLowDateTime=0xfa68fbb0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x7930)) returned 1 [0069.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0069.206] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReEoWMb1tgQr2M.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\reeowmb1tgqr2m.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ReEoWMb1tgQr2M.avi.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\reeowmb1tgqr2m.avi.crypted")) returned 1 [0069.208] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RLbcXhJHI.bmp", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RLbcXhJHI.bmp", lpFilePart=0x0) returned 0x33 [0069.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0069.208] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RLbcXhJHI.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rlbcxhjhi.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0069.208] GetFileType (hFile=0x26c) returned 0x1 [0069.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0069.208] GetFileType (hFile=0x26c) returned 0x1 [0069.208] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0xb164 [0069.208] ReadFile (in: hFile=0x26c, lpBuffer=0x27c4b08, nNumberOfBytesToRead=0xb164, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x27c4b08*, lpNumberOfBytesRead=0x24ea60*=0xb164, lpOverlapped=0x0) returned 1 [0069.210] CloseHandle (hObject=0x26c) returned 1 [0069.233] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0069.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0069.233] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0069.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0069.233] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RLbcXhJHI.bmp", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RLbcXhJHI.bmp", lpFilePart=0x0) returned 0x33 [0069.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0069.233] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RLbcXhJHI.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rlbcxhjhi.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0069.235] GetFileType (hFile=0x26c) returned 0x1 [0069.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0069.235] GetFileType (hFile=0x26c) returned 0x1 [0069.235] WriteFile (in: hFile=0x26c, lpBuffer=0x2832d54*, nNumberOfBytesToWrite=0xb170, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x2832d54*, lpNumberOfBytesWritten=0x24ea54*=0xb170, lpOverlapped=0x0) returned 1 [0069.237] CloseHandle (hObject=0x26c) returned 1 [0069.248] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RLbcXhJHI.bmp", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RLbcXhJHI.bmp", lpFilePart=0x0) returned 0x33 [0069.248] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RLbcXhJHI.bmp.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RLbcXhJHI.bmp.Crypted", lpFilePart=0x0) returned 0x3b [0069.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0069.249] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RLbcXhJHI.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rlbcxhjhi.bmp"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc40ce7c0, ftCreationTime.dwHighDateTime=0x1d4cc7f, ftLastAccessTime.dwLowDateTime=0x22bd1e90, ftLastAccessTime.dwHighDateTime=0x1d4cd0f, ftLastWriteTime.dwLowDateTime=0xfa6dbe70, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xb170)) returned 1 [0069.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0069.249] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RLbcXhJHI.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rlbcxhjhi.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RLbcXhJHI.bmp.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rlbcxhjhi.bmp.crypted")) returned 1 [0069.250] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SpQ8TM.mp4", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SpQ8TM.mp4", lpFilePart=0x0) returned 0x30 [0069.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0069.250] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SpQ8TM.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\spq8tm.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0069.251] GetFileType (hFile=0x26c) returned 0x1 [0069.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0069.252] GetFileType (hFile=0x26c) returned 0x1 [0069.252] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0xc4d3 [0069.252] ReadFile (in: hFile=0x26c, lpBuffer=0x283e3e8, nNumberOfBytesToRead=0xc4d3, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x283e3e8*, lpNumberOfBytesRead=0x24ea60*=0xc4d3, lpOverlapped=0x0) returned 1 [0069.254] CloseHandle (hObject=0x26c) returned 1 [0069.272] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0069.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0069.273] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0069.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0069.273] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SpQ8TM.mp4", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SpQ8TM.mp4", lpFilePart=0x0) returned 0x30 [0069.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0069.273] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SpQ8TM.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\spq8tm.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0069.274] GetFileType (hFile=0x26c) returned 0x1 [0069.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0069.275] GetFileType (hFile=0x26c) returned 0x1 [0069.275] WriteFile (in: hFile=0x26c, lpBuffer=0x28b0088*, nNumberOfBytesToWrite=0xc4e0, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x28b0088*, lpNumberOfBytesWritten=0x24ea54*=0xc4e0, lpOverlapped=0x0) returned 1 [0069.276] CloseHandle (hObject=0x26c) returned 1 [0069.280] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SpQ8TM.mp4", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SpQ8TM.mp4", lpFilePart=0x0) returned 0x30 [0069.280] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SpQ8TM.mp4.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SpQ8TM.mp4.Crypted", lpFilePart=0x0) returned 0x38 [0069.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0069.282] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SpQ8TM.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\spq8tm.mp4"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b8a4cf0, ftCreationTime.dwHighDateTime=0x1d4caef, ftLastAccessTime.dwLowDateTime=0xc9dd0990, ftLastAccessTime.dwHighDateTime=0x1d4cef6, ftLastWriteTime.dwLowDateTime=0xfa74e290, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xc4e0)) returned 1 [0069.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0069.282] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SpQ8TM.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\spq8tm.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SpQ8TM.mp4.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\spq8tm.mp4.crypted")) returned 1 [0069.283] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vbMHGI79vM_PtDv8.avi", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vbMHGI79vM_PtDv8.avi", lpFilePart=0x0) returned 0x3a [0069.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0069.283] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vbMHGI79vM_PtDv8.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vbmhgi79vm_ptdv8.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0069.285] GetFileType (hFile=0x26c) returned 0x1 [0069.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0069.285] GetFileType (hFile=0x26c) returned 0x1 [0069.285] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0xcf47 [0069.285] ReadFile (in: hFile=0x26c, lpBuffer=0x28bcaa0, nNumberOfBytesToRead=0xcf47, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x28bcaa0*, lpNumberOfBytesRead=0x24ea60*=0xcf47, lpOverlapped=0x0) returned 1 [0069.287] CloseHandle (hObject=0x26c) returned 1 [0069.312] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0069.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0069.312] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0069.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0069.312] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vbMHGI79vM_PtDv8.avi", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vbMHGI79vM_PtDv8.avi", lpFilePart=0x0) returned 0x3a [0069.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0069.313] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vbMHGI79vM_PtDv8.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vbmhgi79vm_ptdv8.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0069.314] GetFileType (hFile=0x26c) returned 0x1 [0069.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0069.314] GetFileType (hFile=0x26c) returned 0x1 [0069.314] WriteFile (in: hFile=0x26c, lpBuffer=0x2930690*, nNumberOfBytesToWrite=0xcf50, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x2930690*, lpNumberOfBytesWritten=0x24ea54*=0xcf50, lpOverlapped=0x0) returned 1 [0069.316] CloseHandle (hObject=0x26c) returned 1 [0069.320] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vbMHGI79vM_PtDv8.avi", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vbMHGI79vM_PtDv8.avi", lpFilePart=0x0) returned 0x3a [0069.320] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vbMHGI79vM_PtDv8.avi.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vbMHGI79vM_PtDv8.avi.Crypted", lpFilePart=0x0) returned 0x42 [0069.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0069.321] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vbMHGI79vM_PtDv8.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vbmhgi79vm_ptdv8.avi"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf539e80, ftCreationTime.dwHighDateTime=0x1d4d111, ftLastAccessTime.dwLowDateTime=0x2e87c7f0, ftLastAccessTime.dwHighDateTime=0x1d4cb36, ftLastWriteTime.dwLowDateTime=0xfa79a550, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xcf50)) returned 1 [0069.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0069.321] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vbMHGI79vM_PtDv8.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vbmhgi79vm_ptdv8.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vbMHGI79vM_PtDv8.avi.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vbmhgi79vm_ptdv8.avi.crypted")) returned 1 [0069.322] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\x4IIvHjetTqBaG.xlsx", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\x4IIvHjetTqBaG.xlsx", lpFilePart=0x0) returned 0x39 [0069.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0069.322] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\x4IIvHjetTqBaG.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\x4iivhjettqbag.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0069.324] GetFileType (hFile=0x26c) returned 0x1 [0069.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0069.324] GetFileType (hFile=0x26c) returned 0x1 [0069.324] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x10ec0 [0069.324] ReadFile (in: hFile=0x26c, lpBuffer=0x293db8c, nNumberOfBytesToRead=0x10ec0, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x293db8c*, lpNumberOfBytesRead=0x24ea60*=0x10ec0, lpOverlapped=0x0) returned 1 [0069.332] CloseHandle (hObject=0x26c) returned 1 [0069.399] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0069.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0069.399] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0069.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0069.400] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\x4IIvHjetTqBaG.xlsx", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\x4IIvHjetTqBaG.xlsx", lpFilePart=0x0) returned 0x39 [0069.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0069.400] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\x4IIvHjetTqBaG.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\x4iivhjettqbag.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0069.402] GetFileType (hFile=0x26c) returned 0x1 [0069.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0069.402] GetFileType (hFile=0x26c) returned 0x1 [0069.402] WriteFile (in: hFile=0x26c, lpBuffer=0x27c8db4*, nNumberOfBytesToWrite=0x10ed0, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x27c8db4*, lpNumberOfBytesWritten=0x24ea54*=0x10ed0, lpOverlapped=0x0) returned 1 [0069.404] CloseHandle (hObject=0x26c) returned 1 [0069.410] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\x4IIvHjetTqBaG.xlsx", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\x4IIvHjetTqBaG.xlsx", lpFilePart=0x0) returned 0x39 [0069.410] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\x4IIvHjetTqBaG.xlsx.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\x4IIvHjetTqBaG.xlsx.Crypted", lpFilePart=0x0) returned 0x41 [0069.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0069.411] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\x4IIvHjetTqBaG.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\x4iivhjettqbag.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12e8e160, ftCreationTime.dwHighDateTime=0x1d4c9e6, ftLastAccessTime.dwLowDateTime=0xf865da00, ftLastAccessTime.dwHighDateTime=0x1d4d007, ftLastWriteTime.dwLowDateTime=0xfa87ed90, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x10ed0)) returned 1 [0069.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0069.411] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\x4IIvHjetTqBaG.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\x4iivhjettqbag.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\x4IIvHjetTqBaG.xlsx.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\x4iivhjettqbag.xlsx.crypted")) returned 1 [0069.412] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Z3XMtXvu.doc", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Z3XMtXvu.doc", lpFilePart=0x0) returned 0x32 [0069.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0069.412] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Z3XMtXvu.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\z3xmtxvu.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0069.412] GetFileType (hFile=0x26c) returned 0x1 [0069.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0069.413] GetFileType (hFile=0x26c) returned 0x1 [0069.413] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0xec96 [0069.413] ReadFile (in: hFile=0x26c, lpBuffer=0x27da1ec, nNumberOfBytesToRead=0xec96, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x27da1ec*, lpNumberOfBytesRead=0x24ea60*=0xec96, lpOverlapped=0x0) returned 1 [0069.415] CloseHandle (hObject=0x26c) returned 1 [0069.435] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0069.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0069.435] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0069.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0069.435] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Z3XMtXvu.doc", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Z3XMtXvu.doc", lpFilePart=0x0) returned 0x32 [0069.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0069.436] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Z3XMtXvu.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\z3xmtxvu.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0069.437] GetFileType (hFile=0x26c) returned 0x1 [0069.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0069.437] GetFileType (hFile=0x26c) returned 0x1 [0069.437] WriteFile (in: hFile=0x26c, lpBuffer=0x2853728*, nNumberOfBytesToWrite=0xeca0, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x2853728*, lpNumberOfBytesWritten=0x24ea54*=0xeca0, lpOverlapped=0x0) returned 1 [0069.442] CloseHandle (hObject=0x26c) returned 1 [0069.443] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Z3XMtXvu.doc", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Z3XMtXvu.doc", lpFilePart=0x0) returned 0x32 [0069.443] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Z3XMtXvu.doc.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Z3XMtXvu.doc.Crypted", lpFilePart=0x0) returned 0x3a [0069.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0069.443] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Z3XMtXvu.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\z3xmtxvu.doc"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5abc7d90, ftCreationTime.dwHighDateTime=0x1d4ce68, ftLastAccessTime.dwLowDateTime=0x74830d0, ftLastAccessTime.dwHighDateTime=0x1d4cb54, ftLastWriteTime.dwLowDateTime=0xfa8cb050, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xeca0)) returned 1 [0069.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0069.444] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Z3XMtXvu.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\z3xmtxvu.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Z3XMtXvu.doc.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\z3xmtxvu.doc.crypted")) returned 1 [0069.444] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zIHHqGfcI.mp3", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zIHHqGfcI.mp3", lpFilePart=0x0) returned 0x33 [0069.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0069.444] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zIHHqGfcI.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zihhqgfci.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0069.445] GetFileType (hFile=0x26c) returned 0x1 [0069.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0069.445] GetFileType (hFile=0x26c) returned 0x1 [0069.445] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x461b [0069.445] ReadFile (in: hFile=0x26c, lpBuffer=0x28628f4, nNumberOfBytesToRead=0x461b, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x28628f4*, lpNumberOfBytesRead=0x24ea60*=0x461b, lpOverlapped=0x0) returned 1 [0069.451] CloseHandle (hObject=0x26c) returned 1 [0069.470] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0069.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0069.470] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0069.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0069.470] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zIHHqGfcI.mp3", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zIHHqGfcI.mp3", lpFilePart=0x0) returned 0x33 [0069.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0069.470] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zIHHqGfcI.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zihhqgfci.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0069.471] GetFileType (hFile=0x26c) returned 0x1 [0069.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0069.471] GetFileType (hFile=0x26c) returned 0x1 [0069.471] WriteFile (in: hFile=0x26c, lpBuffer=0x28c5580*, nNumberOfBytesToWrite=0x4620, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x28c5580*, lpNumberOfBytesWritten=0x24ea54*=0x4620, lpOverlapped=0x0) returned 1 [0069.473] CloseHandle (hObject=0x26c) returned 1 [0069.476] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zIHHqGfcI.mp3", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zIHHqGfcI.mp3", lpFilePart=0x0) returned 0x33 [0069.476] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zIHHqGfcI.mp3.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zIHHqGfcI.mp3.Crypted", lpFilePart=0x0) returned 0x3b [0069.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0069.476] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zIHHqGfcI.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zihhqgfci.mp3"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6139640, ftCreationTime.dwHighDateTime=0x1d4cfec, ftLastAccessTime.dwLowDateTime=0xf5afc3e0, ftLastAccessTime.dwHighDateTime=0x1d4cfc9, ftLastWriteTime.dwLowDateTime=0xfa917310, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x4620)) returned 1 [0069.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0069.477] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zIHHqGfcI.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zihhqgfci.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zIHHqGfcI.mp3.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zihhqgfci.mp3.crypted")) returned 1 [0069.478] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zUV-2s2ldl.rtf", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zUV-2s2ldl.rtf", lpFilePart=0x0) returned 0x34 [0069.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0069.478] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zUV-2s2ldl.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zuv-2s2ldl.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0069.479] GetFileType (hFile=0x26c) returned 0x1 [0069.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0069.479] GetFileType (hFile=0x26c) returned 0x1 [0069.479] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0xa43f [0069.479] ReadFile (in: hFile=0x26c, lpBuffer=0x28ca0d4, nNumberOfBytesToRead=0xa43f, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x28ca0d4*, lpNumberOfBytesRead=0x24ea60*=0xa43f, lpOverlapped=0x0) returned 1 [0069.482] CloseHandle (hObject=0x26c) returned 1 [0069.503] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0069.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0069.503] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0069.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0069.503] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zUV-2s2ldl.rtf", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zUV-2s2ldl.rtf", lpFilePart=0x0) returned 0x34 [0069.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0069.503] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zUV-2s2ldl.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zuv-2s2ldl.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0069.504] GetFileType (hFile=0x26c) returned 0x1 [0069.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0069.504] GetFileType (hFile=0x26c) returned 0x1 [0069.505] WriteFile (in: hFile=0x26c, lpBuffer=0x294a400*, nNumberOfBytesToWrite=0xa440, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x294a400*, lpNumberOfBytesWritten=0x24ea54*=0xa440, lpOverlapped=0x0) returned 1 [0069.506] CloseHandle (hObject=0x26c) returned 1 [0069.507] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zUV-2s2ldl.rtf", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zUV-2s2ldl.rtf", lpFilePart=0x0) returned 0x34 [0069.507] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zUV-2s2ldl.rtf.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zUV-2s2ldl.rtf.Crypted", lpFilePart=0x0) returned 0x3c [0069.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0069.508] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zUV-2s2ldl.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zuv-2s2ldl.rtf"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7868ce30, ftCreationTime.dwHighDateTime=0x1d4c953, ftLastAccessTime.dwLowDateTime=0xf30618c0, ftLastAccessTime.dwHighDateTime=0x1d4d48c, ftLastWriteTime.dwLowDateTime=0xfa9635d0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xa440)) returned 1 [0069.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0069.508] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zUV-2s2ldl.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zuv-2s2ldl.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zUV-2s2ldl.rtf.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zuv-2s2ldl.rtf.crypted")) returned 1 [0069.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0069.508] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n", lpFilePart=0x0) returned 0x38 [0069.509] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\", lpFilePart=0x0) returned 0x39 [0069.509] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca9f78f0, ftCreationTime.dwHighDateTime=0x1d4ccb6, ftLastAccessTime.dwLowDateTime=0xb8c5720, ftLastAccessTime.dwHighDateTime=0x1d4cf5a, ftLastWriteTime.dwLowDateTime=0xb8c5720, ftLastWriteTime.dwHighDateTime=0x1d4cf5a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b168 [0069.510] FindNextFileW (in: hFindFile=0x69b168, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca9f78f0, ftCreationTime.dwHighDateTime=0x1d4ccb6, ftLastAccessTime.dwLowDateTime=0xb8c5720, ftLastAccessTime.dwHighDateTime=0x1d4cf5a, ftLastWriteTime.dwLowDateTime=0xb8c5720, ftLastWriteTime.dwHighDateTime=0x1d4cf5a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.510] FindNextFileW (in: hFindFile=0x69b168, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4967bdf0, ftCreationTime.dwHighDateTime=0x1d4d1ad, ftLastAccessTime.dwLowDateTime=0x17949fd0, ftLastAccessTime.dwHighDateTime=0x1d4cf70, ftLastWriteTime.dwLowDateTime=0x17949fd0, ftLastWriteTime.dwHighDateTime=0x1d4cf70, nFileSizeHigh=0x0, nFileSizeLow=0x700b, dwReserved0=0x0, dwReserved1=0x0, cFileName="2EB4B-2WT0hASHP.wav", cAlternateFileName="2EB4B-~1.WAV")) returned 1 [0069.510] FindNextFileW (in: hFindFile=0x69b168, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bd14630, ftCreationTime.dwHighDateTime=0x1d4cdea, ftLastAccessTime.dwLowDateTime=0x10585cc0, ftLastAccessTime.dwHighDateTime=0x1d4d18c, ftLastWriteTime.dwLowDateTime=0x10585cc0, ftLastWriteTime.dwHighDateTime=0x1d4d18c, nFileSizeHigh=0x0, nFileSizeLow=0xd74a, dwReserved0=0x0, dwReserved1=0x0, cFileName="67dOKAPnjN2x.csv", cAlternateFileName="67DOKA~1.CSV")) returned 1 [0069.511] FindNextFileW (in: hFindFile=0x69b168, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7178a20, ftCreationTime.dwHighDateTime=0x1d4d102, ftLastAccessTime.dwLowDateTime=0xcea19d0, ftLastAccessTime.dwHighDateTime=0x1d4c740, ftLastWriteTime.dwLowDateTime=0xcea19d0, ftLastWriteTime.dwHighDateTime=0x1d4c740, nFileSizeHigh=0x0, nFileSizeLow=0x4165, dwReserved0=0x0, dwReserved1=0x0, cFileName="9qtL_jhF8GzsNbrNKF.swf", cAlternateFileName="9QTL_J~1.SWF")) returned 1 [0069.511] FindNextFileW (in: hFindFile=0x69b168, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x609f8d0, ftCreationTime.dwHighDateTime=0x1d4cac2, ftLastAccessTime.dwLowDateTime=0xb43b6680, ftLastAccessTime.dwHighDateTime=0x1d4d0a5, ftLastWriteTime.dwLowDateTime=0xb43b6680, ftLastWriteTime.dwHighDateTime=0x1d4d0a5, nFileSizeHigh=0x0, nFileSizeLow=0x18c0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="C5vaFHqg.flv", cAlternateFileName="")) returned 1 [0069.511] FindNextFileW (in: hFindFile=0x69b168, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc2e0ac0, ftCreationTime.dwHighDateTime=0x1d4cd0f, ftLastAccessTime.dwLowDateTime=0x178f7540, ftLastAccessTime.dwHighDateTime=0x1d4cfa8, ftLastWriteTime.dwLowDateTime=0x178f7540, ftLastWriteTime.dwHighDateTime=0x1d4cfa8, nFileSizeHigh=0x0, nFileSizeLow=0x14789, dwReserved0=0x0, dwReserved1=0x0, cFileName="dKGpmJ65l.mp4", cAlternateFileName="DKGPMJ~1.MP4")) returned 1 [0069.511] FindNextFileW (in: hFindFile=0x69b168, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec17e320, ftCreationTime.dwHighDateTime=0x1d4d21d, ftLastAccessTime.dwLowDateTime=0x3c34ec30, ftLastAccessTime.dwHighDateTime=0x1d4c658, ftLastWriteTime.dwLowDateTime=0x3c34ec30, ftLastWriteTime.dwHighDateTime=0x1d4c658, nFileSizeHigh=0x0, nFileSizeLow=0x164c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="hz9X2Shn0.mp4", cAlternateFileName="HZ9X2S~1.MP4")) returned 1 [0069.511] FindNextFileW (in: hFindFile=0x69b168, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e0f8930, ftCreationTime.dwHighDateTime=0x1d4c616, ftLastAccessTime.dwLowDateTime=0x345cdf0, ftLastAccessTime.dwHighDateTime=0x1d4d250, ftLastWriteTime.dwLowDateTime=0x345cdf0, ftLastWriteTime.dwHighDateTime=0x1d4d250, nFileSizeHigh=0x0, nFileSizeLow=0x12bfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="IGCbggAf_Nct.mp4", cAlternateFileName="IGCBGG~1.MP4")) returned 1 [0069.511] FindNextFileW (in: hFindFile=0x69b168, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d8bfd30, ftCreationTime.dwHighDateTime=0x1d4d3ff, ftLastAccessTime.dwLowDateTime=0x8921af0, ftLastAccessTime.dwHighDateTime=0x1d4c63b, ftLastWriteTime.dwLowDateTime=0x8921af0, ftLastWriteTime.dwHighDateTime=0x1d4c63b, nFileSizeHigh=0x0, nFileSizeLow=0xd4ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="k1aNSWAPplNTI7.m4a", cAlternateFileName="K1ANSW~1.M4A")) returned 1 [0069.512] FindNextFileW (in: hFindFile=0x69b168, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a4dc8a0, ftCreationTime.dwHighDateTime=0x1d4cade, ftLastAccessTime.dwLowDateTime=0x190eeed0, ftLastAccessTime.dwHighDateTime=0x1d4d315, ftLastWriteTime.dwLowDateTime=0x190eeed0, ftLastWriteTime.dwHighDateTime=0x1d4d315, nFileSizeHigh=0x0, nFileSizeLow=0x12dc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="nt6RHYmsSeDAl2yNB9X.flv", cAlternateFileName="NT6RHY~1.FLV")) returned 1 [0069.512] FindNextFileW (in: hFindFile=0x69b168, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e8c180, ftCreationTime.dwHighDateTime=0x1d4c5cd, ftLastAccessTime.dwLowDateTime=0xef440570, ftLastAccessTime.dwHighDateTime=0x1d4d2d0, ftLastWriteTime.dwLowDateTime=0xef440570, ftLastWriteTime.dwHighDateTime=0x1d4d2d0, nFileSizeHigh=0x0, nFileSizeLow=0x3e81, dwReserved0=0x0, dwReserved1=0x0, cFileName="TrFOau0_R6INSQTQhu.wav", cAlternateFileName="TRFOAU~1.WAV")) returned 1 [0069.512] FindNextFileW (in: hFindFile=0x69b168, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8945e30, ftCreationTime.dwHighDateTime=0x1d4d37c, ftLastAccessTime.dwLowDateTime=0xea312350, ftLastAccessTime.dwHighDateTime=0x1d4cb2e, ftLastWriteTime.dwLowDateTime=0xea312350, ftLastWriteTime.dwHighDateTime=0x1d4cb2e, nFileSizeHigh=0x0, nFileSizeLow=0x189c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UjQDqOcmc-0Sq.jpg", cAlternateFileName="UJQDQO~1.JPG")) returned 1 [0069.512] FindNextFileW (in: hFindFile=0x69b168, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x717c53d0, ftCreationTime.dwHighDateTime=0x1d4d088, ftLastAccessTime.dwLowDateTime=0x52035bb0, ftLastAccessTime.dwHighDateTime=0x1d4d0ca, ftLastWriteTime.dwLowDateTime=0x52035bb0, ftLastWriteTime.dwHighDateTime=0x1d4d0ca, nFileSizeHigh=0x0, nFileSizeLow=0xd125, dwReserved0=0x0, dwReserved1=0x0, cFileName="vCupig8i.wav", cAlternateFileName="")) returned 1 [0069.512] FindNextFileW (in: hFindFile=0x69b168, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c725650, ftCreationTime.dwHighDateTime=0x1d4cb05, ftLastAccessTime.dwLowDateTime=0x51ec6e20, ftLastAccessTime.dwHighDateTime=0x1d4d384, ftLastWriteTime.dwLowDateTime=0x51ec6e20, ftLastWriteTime.dwHighDateTime=0x1d4d384, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="vnCWUYv9oTJ.pps", cAlternateFileName="VNCWUY~1.PPS")) returned 1 [0069.512] FindNextFileW (in: hFindFile=0x69b168, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0069.512] FindClose (in: hFindFile=0x69b168 | out: hFindFile=0x69b168) returned 1 [0069.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea54) returned 1 [0069.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea60) returned 1 [0069.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0069.513] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n", lpFilePart=0x0) returned 0x38 [0069.513] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\", lpFilePart=0x0) returned 0x39 [0069.513] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca9f78f0, ftCreationTime.dwHighDateTime=0x1d4ccb6, ftLastAccessTime.dwLowDateTime=0xb8c5720, ftLastAccessTime.dwHighDateTime=0x1d4cf5a, ftLastWriteTime.dwLowDateTime=0xb8c5720, ftLastWriteTime.dwHighDateTime=0x1d4cf5a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b168 [0069.513] FindNextFileW (in: hFindFile=0x69b168, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca9f78f0, ftCreationTime.dwHighDateTime=0x1d4ccb6, ftLastAccessTime.dwLowDateTime=0xb8c5720, ftLastAccessTime.dwHighDateTime=0x1d4cf5a, ftLastWriteTime.dwLowDateTime=0xb8c5720, ftLastWriteTime.dwHighDateTime=0x1d4cf5a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.514] FindNextFileW (in: hFindFile=0x69b168, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4967bdf0, ftCreationTime.dwHighDateTime=0x1d4d1ad, ftLastAccessTime.dwLowDateTime=0x17949fd0, ftLastAccessTime.dwHighDateTime=0x1d4cf70, ftLastWriteTime.dwLowDateTime=0x17949fd0, ftLastWriteTime.dwHighDateTime=0x1d4cf70, nFileSizeHigh=0x0, nFileSizeLow=0x700b, dwReserved0=0x0, dwReserved1=0x0, cFileName="2EB4B-2WT0hASHP.wav", cAlternateFileName="2EB4B-~1.WAV")) returned 1 [0069.514] FindNextFileW (in: hFindFile=0x69b168, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bd14630, ftCreationTime.dwHighDateTime=0x1d4cdea, ftLastAccessTime.dwLowDateTime=0x10585cc0, ftLastAccessTime.dwHighDateTime=0x1d4d18c, ftLastWriteTime.dwLowDateTime=0x10585cc0, ftLastWriteTime.dwHighDateTime=0x1d4d18c, nFileSizeHigh=0x0, nFileSizeLow=0xd74a, dwReserved0=0x0, dwReserved1=0x0, cFileName="67dOKAPnjN2x.csv", cAlternateFileName="67DOKA~1.CSV")) returned 1 [0069.514] FindNextFileW (in: hFindFile=0x69b168, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7178a20, ftCreationTime.dwHighDateTime=0x1d4d102, ftLastAccessTime.dwLowDateTime=0xcea19d0, ftLastAccessTime.dwHighDateTime=0x1d4c740, ftLastWriteTime.dwLowDateTime=0xcea19d0, ftLastWriteTime.dwHighDateTime=0x1d4c740, nFileSizeHigh=0x0, nFileSizeLow=0x4165, dwReserved0=0x0, dwReserved1=0x0, cFileName="9qtL_jhF8GzsNbrNKF.swf", cAlternateFileName="9QTL_J~1.SWF")) returned 1 [0069.514] FindNextFileW (in: hFindFile=0x69b168, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x609f8d0, ftCreationTime.dwHighDateTime=0x1d4cac2, ftLastAccessTime.dwLowDateTime=0xb43b6680, ftLastAccessTime.dwHighDateTime=0x1d4d0a5, ftLastWriteTime.dwLowDateTime=0xb43b6680, ftLastWriteTime.dwHighDateTime=0x1d4d0a5, nFileSizeHigh=0x0, nFileSizeLow=0x18c0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="C5vaFHqg.flv", cAlternateFileName="")) returned 1 [0069.514] FindNextFileW (in: hFindFile=0x69b168, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc2e0ac0, ftCreationTime.dwHighDateTime=0x1d4cd0f, ftLastAccessTime.dwLowDateTime=0x178f7540, ftLastAccessTime.dwHighDateTime=0x1d4cfa8, ftLastWriteTime.dwLowDateTime=0x178f7540, ftLastWriteTime.dwHighDateTime=0x1d4cfa8, nFileSizeHigh=0x0, nFileSizeLow=0x14789, dwReserved0=0x0, dwReserved1=0x0, cFileName="dKGpmJ65l.mp4", cAlternateFileName="DKGPMJ~1.MP4")) returned 1 [0069.515] FindNextFileW (in: hFindFile=0x69b168, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec17e320, ftCreationTime.dwHighDateTime=0x1d4d21d, ftLastAccessTime.dwLowDateTime=0x3c34ec30, ftLastAccessTime.dwHighDateTime=0x1d4c658, ftLastWriteTime.dwLowDateTime=0x3c34ec30, ftLastWriteTime.dwHighDateTime=0x1d4c658, nFileSizeHigh=0x0, nFileSizeLow=0x164c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="hz9X2Shn0.mp4", cAlternateFileName="HZ9X2S~1.MP4")) returned 1 [0069.515] FindNextFileW (in: hFindFile=0x69b168, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e0f8930, ftCreationTime.dwHighDateTime=0x1d4c616, ftLastAccessTime.dwLowDateTime=0x345cdf0, ftLastAccessTime.dwHighDateTime=0x1d4d250, ftLastWriteTime.dwLowDateTime=0x345cdf0, ftLastWriteTime.dwHighDateTime=0x1d4d250, nFileSizeHigh=0x0, nFileSizeLow=0x12bfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="IGCbggAf_Nct.mp4", cAlternateFileName="IGCBGG~1.MP4")) returned 1 [0069.515] FindNextFileW (in: hFindFile=0x69b168, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d8bfd30, ftCreationTime.dwHighDateTime=0x1d4d3ff, ftLastAccessTime.dwLowDateTime=0x8921af0, ftLastAccessTime.dwHighDateTime=0x1d4c63b, ftLastWriteTime.dwLowDateTime=0x8921af0, ftLastWriteTime.dwHighDateTime=0x1d4c63b, nFileSizeHigh=0x0, nFileSizeLow=0xd4ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="k1aNSWAPplNTI7.m4a", cAlternateFileName="K1ANSW~1.M4A")) returned 1 [0069.515] FindNextFileW (in: hFindFile=0x69b168, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a4dc8a0, ftCreationTime.dwHighDateTime=0x1d4cade, ftLastAccessTime.dwLowDateTime=0x190eeed0, ftLastAccessTime.dwHighDateTime=0x1d4d315, ftLastWriteTime.dwLowDateTime=0x190eeed0, ftLastWriteTime.dwHighDateTime=0x1d4d315, nFileSizeHigh=0x0, nFileSizeLow=0x12dc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="nt6RHYmsSeDAl2yNB9X.flv", cAlternateFileName="NT6RHY~1.FLV")) returned 1 [0069.515] FindNextFileW (in: hFindFile=0x69b168, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e8c180, ftCreationTime.dwHighDateTime=0x1d4c5cd, ftLastAccessTime.dwLowDateTime=0xef440570, ftLastAccessTime.dwHighDateTime=0x1d4d2d0, ftLastWriteTime.dwLowDateTime=0xef440570, ftLastWriteTime.dwHighDateTime=0x1d4d2d0, nFileSizeHigh=0x0, nFileSizeLow=0x3e81, dwReserved0=0x0, dwReserved1=0x0, cFileName="TrFOau0_R6INSQTQhu.wav", cAlternateFileName="TRFOAU~1.WAV")) returned 1 [0069.515] FindNextFileW (in: hFindFile=0x69b168, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8945e30, ftCreationTime.dwHighDateTime=0x1d4d37c, ftLastAccessTime.dwLowDateTime=0xea312350, ftLastAccessTime.dwHighDateTime=0x1d4cb2e, ftLastWriteTime.dwLowDateTime=0xea312350, ftLastWriteTime.dwHighDateTime=0x1d4cb2e, nFileSizeHigh=0x0, nFileSizeLow=0x189c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UjQDqOcmc-0Sq.jpg", cAlternateFileName="UJQDQO~1.JPG")) returned 1 [0069.516] FindNextFileW (in: hFindFile=0x69b168, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x717c53d0, ftCreationTime.dwHighDateTime=0x1d4d088, ftLastAccessTime.dwLowDateTime=0x52035bb0, ftLastAccessTime.dwHighDateTime=0x1d4d0ca, ftLastWriteTime.dwLowDateTime=0x52035bb0, ftLastWriteTime.dwHighDateTime=0x1d4d0ca, nFileSizeHigh=0x0, nFileSizeLow=0xd125, dwReserved0=0x0, dwReserved1=0x0, cFileName="vCupig8i.wav", cAlternateFileName="")) returned 1 [0069.516] FindNextFileW (in: hFindFile=0x69b168, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c725650, ftCreationTime.dwHighDateTime=0x1d4cb05, ftLastAccessTime.dwLowDateTime=0x51ec6e20, ftLastAccessTime.dwHighDateTime=0x1d4d384, ftLastWriteTime.dwLowDateTime=0x51ec6e20, ftLastWriteTime.dwHighDateTime=0x1d4d384, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="vnCWUYv9oTJ.pps", cAlternateFileName="VNCWUY~1.PPS")) returned 1 [0069.516] FindNextFileW (in: hFindFile=0x69b168, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c725650, ftCreationTime.dwHighDateTime=0x1d4cb05, ftLastAccessTime.dwLowDateTime=0x51ec6e20, ftLastAccessTime.dwHighDateTime=0x1d4d384, ftLastWriteTime.dwLowDateTime=0x51ec6e20, ftLastWriteTime.dwHighDateTime=0x1d4d384, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="vnCWUYv9oTJ.pps", cAlternateFileName="VNCWUY~1.PPS")) returned 0 [0069.516] FindClose (in: hFindFile=0x69b168 | out: hFindFile=0x69b168) returned 1 [0069.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea54) returned 1 [0069.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea60) returned 1 [0069.516] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\67dOKAPnjN2x.csv", nBufferLength=0x105, lpBuffer=0x24e444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\67dOKAPnjN2x.csv", lpFilePart=0x0) returned 0x49 [0069.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0069.517] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\67dOKAPnjN2x.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rlfrgatixavohsfl9n\\67dokapnjn2x.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0069.518] GetFileType (hFile=0x26c) returned 0x1 [0069.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e934) returned 1 [0069.518] GetFileType (hFile=0x26c) returned 0x1 [0069.518] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24ea40 | out: lpFileSizeHigh=0x24ea40*=0x0) returned 0xd74a [0069.518] ReadFile (in: hFile=0x26c, lpBuffer=0x29590d4, nNumberOfBytesToRead=0xd74a, lpNumberOfBytesRead=0x24e9ec, lpOverlapped=0x0 | out: lpBuffer=0x29590d4*, lpNumberOfBytesRead=0x24e9ec*=0xd74a, lpOverlapped=0x0) returned 1 [0069.520] CloseHandle (hObject=0x26c) returned 1 [0069.571] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e558, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0069.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9b8) returned 1 [0069.571] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24ea34 | out: lpFileInformation=0x24ea34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0069.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9b4) returned 1 [0069.571] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\67dOKAPnjN2x.csv", nBufferLength=0x105, lpBuffer=0x24e430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\67dOKAPnjN2x.csv", lpFilePart=0x0) returned 0x49 [0069.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e924) returned 1 [0069.572] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\67dOKAPnjN2x.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rlfrgatixavohsfl9n\\67dokapnjn2x.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0069.573] GetFileType (hFile=0x26c) returned 0x1 [0069.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e920) returned 1 [0069.573] GetFileType (hFile=0x26c) returned 0x1 [0069.573] WriteFile (in: hFile=0x26c, lpBuffer=0x27cf6f8*, nNumberOfBytesToWrite=0xd750, lpNumberOfBytesWritten=0x24e9e0, lpOverlapped=0x0 | out: lpBuffer=0x27cf6f8*, lpNumberOfBytesWritten=0x24e9e0*=0xd750, lpOverlapped=0x0) returned 1 [0069.577] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\67dOKAPnjN2x.csv", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\67dOKAPnjN2x.csv", lpFilePart=0x0) returned 0x49 [0069.577] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\67dOKAPnjN2x.csv.Crypted", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\67dOKAPnjN2x.csv.Crypted", lpFilePart=0x0) returned 0x51 [0069.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9c4) returned 1 [0069.577] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\67dOKAPnjN2x.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rlfrgatixavohsfl9n\\67dokapnjn2x.csv"), fInfoLevelId=0x0, lpFileInformation=0x24ea40 | out: lpFileInformation=0x24ea40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bd14630, ftCreationTime.dwHighDateTime=0x1d4cdea, ftLastAccessTime.dwLowDateTime=0x10585cc0, ftLastAccessTime.dwHighDateTime=0x1d4d18c, ftLastWriteTime.dwLowDateTime=0xfaa21cb0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xd750)) returned 1 [0069.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9c0) returned 1 [0069.577] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\67dOKAPnjN2x.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rlfrgatixavohsfl9n\\67dokapnjn2x.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\67dOKAPnjN2x.csv.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rlfrgatixavohsfl9n\\67dokapnjn2x.csv.crypted")) returned 1 [0069.578] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\dKGpmJ65l.mp4", nBufferLength=0x105, lpBuffer=0x24e444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\dKGpmJ65l.mp4", lpFilePart=0x0) returned 0x46 [0069.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0069.578] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\dKGpmJ65l.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rlfrgatixavohsfl9n\\dkgpmj65l.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0069.578] GetFileType (hFile=0x26c) returned 0x1 [0069.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e934) returned 1 [0069.579] GetFileType (hFile=0x26c) returned 0x1 [0069.579] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24ea40 | out: lpFileSizeHigh=0x24ea40*=0x0) returned 0x14789 [0069.579] ReadFile (in: hFile=0x26c, lpBuffer=0x27dd484, nNumberOfBytesToRead=0x14789, lpNumberOfBytesRead=0x24e9ec, lpOverlapped=0x0 | out: lpBuffer=0x27dd484*, lpNumberOfBytesRead=0x24e9ec*=0x14789, lpOverlapped=0x0) returned 1 [0069.621] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e558, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0069.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9b8) returned 1 [0069.621] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24ea34 | out: lpFileInformation=0x24ea34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0069.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9b4) returned 1 [0069.621] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\dKGpmJ65l.mp4", nBufferLength=0x105, lpBuffer=0x24e430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\dKGpmJ65l.mp4", lpFilePart=0x0) returned 0x46 [0069.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e924) returned 1 [0069.621] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\dKGpmJ65l.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rlfrgatixavohsfl9n\\dkgpmj65l.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0069.623] GetFileType (hFile=0x26c) returned 0x1 [0069.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e920) returned 1 [0069.623] GetFileType (hFile=0x26c) returned 0x1 [0069.623] WriteFile (in: hFile=0x26c, lpBuffer=0x2867a90*, nNumberOfBytesToWrite=0x14790, lpNumberOfBytesWritten=0x24e9e0, lpOverlapped=0x0 | out: lpBuffer=0x2867a90*, lpNumberOfBytesWritten=0x24e9e0*=0x14790, lpOverlapped=0x0) returned 1 [0069.625] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\dKGpmJ65l.mp4", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\dKGpmJ65l.mp4", lpFilePart=0x0) returned 0x46 [0069.625] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\dKGpmJ65l.mp4.Crypted", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\dKGpmJ65l.mp4.Crypted", lpFilePart=0x0) returned 0x4e [0069.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9c4) returned 1 [0069.626] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\dKGpmJ65l.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rlfrgatixavohsfl9n\\dkgpmj65l.mp4"), fInfoLevelId=0x0, lpFileInformation=0x24ea40 | out: lpFileInformation=0x24ea40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc2e0ac0, ftCreationTime.dwHighDateTime=0x1d4cd0f, ftLastAccessTime.dwLowDateTime=0x178f7540, ftLastAccessTime.dwHighDateTime=0x1d4cfa8, ftLastWriteTime.dwLowDateTime=0xfaa940d0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x14790)) returned 1 [0069.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9c0) returned 1 [0069.626] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\dKGpmJ65l.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rlfrgatixavohsfl9n\\dkgpmj65l.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\dKGpmJ65l.mp4.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rlfrgatixavohsfl9n\\dkgpmj65l.mp4.crypted")) returned 1 [0069.626] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\hz9X2Shn0.mp4", nBufferLength=0x105, lpBuffer=0x24e444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\hz9X2Shn0.mp4", lpFilePart=0x0) returned 0x46 [0069.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0069.626] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\hz9X2Shn0.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rlfrgatixavohsfl9n\\hz9x2shn0.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0069.633] GetFileType (hFile=0x26c) returned 0x1 [0069.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e934) returned 1 [0069.633] GetFileType (hFile=0x26c) returned 0x1 [0069.633] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24ea40 | out: lpFileSizeHigh=0x24ea40*=0x0) returned 0x164c4 [0069.634] ReadFile (in: hFile=0x26c, lpBuffer=0x38ae8b0, nNumberOfBytesToRead=0x164c4, lpNumberOfBytesRead=0x24e9ec, lpOverlapped=0x0 | out: lpBuffer=0x38ae8b0*, lpNumberOfBytesRead=0x24e9ec*=0x164c4, lpOverlapped=0x0) returned 1 [0069.662] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e558, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0069.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9b8) returned 1 [0069.662] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24ea34 | out: lpFileInformation=0x24ea34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0069.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9b4) returned 1 [0069.663] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\hz9X2Shn0.mp4", nBufferLength=0x105, lpBuffer=0x24e430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\hz9X2Shn0.mp4", lpFilePart=0x0) returned 0x46 [0069.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e924) returned 1 [0069.663] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\hz9X2Shn0.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rlfrgatixavohsfl9n\\hz9x2shn0.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0069.664] GetFileType (hFile=0x26c) returned 0x1 [0069.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e920) returned 1 [0069.664] GetFileType (hFile=0x26c) returned 0x1 [0069.664] WriteFile (in: hFile=0x26c, lpBuffer=0x391e0f0*, nNumberOfBytesToWrite=0x164d0, lpNumberOfBytesWritten=0x24e9e0, lpOverlapped=0x0 | out: lpBuffer=0x391e0f0*, lpNumberOfBytesWritten=0x24e9e0*=0x164d0, lpOverlapped=0x0) returned 1 [0069.667] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\hz9X2Shn0.mp4", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\hz9X2Shn0.mp4", lpFilePart=0x0) returned 0x46 [0069.667] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\hz9X2Shn0.mp4.Crypted", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\hz9X2Shn0.mp4.Crypted", lpFilePart=0x0) returned 0x4e [0069.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9c4) returned 1 [0069.667] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\hz9X2Shn0.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rlfrgatixavohsfl9n\\hz9x2shn0.mp4"), fInfoLevelId=0x0, lpFileInformation=0x24ea40 | out: lpFileInformation=0x24ea40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec17e320, ftCreationTime.dwHighDateTime=0x1d4d21d, ftLastAccessTime.dwLowDateTime=0x3c34ec30, ftLastAccessTime.dwHighDateTime=0x1d4c658, ftLastWriteTime.dwLowDateTime=0xfaae0390, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x164d0)) returned 1 [0069.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9c0) returned 1 [0069.667] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\hz9X2Shn0.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rlfrgatixavohsfl9n\\hz9x2shn0.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\hz9X2Shn0.mp4.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rlfrgatixavohsfl9n\\hz9x2shn0.mp4.crypted")) returned 1 [0069.688] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\IGCbggAf_Nct.mp4", nBufferLength=0x105, lpBuffer=0x24e444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\IGCbggAf_Nct.mp4", lpFilePart=0x0) returned 0x49 [0069.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0069.688] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\IGCbggAf_Nct.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rlfrgatixavohsfl9n\\igcbggaf_nct.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0069.689] GetFileType (hFile=0x26c) returned 0x1 [0069.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e934) returned 1 [0069.689] GetFileType (hFile=0x26c) returned 0x1 [0069.689] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24ea40 | out: lpFileSizeHigh=0x24ea40*=0x0) returned 0x12bfc [0069.689] ReadFile (in: hFile=0x26c, lpBuffer=0x28c9c0c, nNumberOfBytesToRead=0x12bfc, lpNumberOfBytesRead=0x24e9ec, lpOverlapped=0x0 | out: lpBuffer=0x28c9c0c*, lpNumberOfBytesRead=0x24e9ec*=0x12bfc, lpOverlapped=0x0) returned 1 [0069.722] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e558, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0069.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9b8) returned 1 [0069.722] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24ea34 | out: lpFileInformation=0x24ea34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0069.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9b4) returned 1 [0069.722] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\IGCbggAf_Nct.mp4", nBufferLength=0x105, lpBuffer=0x24e430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\IGCbggAf_Nct.mp4", lpFilePart=0x0) returned 0x49 [0069.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e924) returned 1 [0069.722] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\IGCbggAf_Nct.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rlfrgatixavohsfl9n\\igcbggaf_nct.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0069.724] GetFileType (hFile=0x26c) returned 0x1 [0069.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e920) returned 1 [0069.724] GetFileType (hFile=0x26c) returned 0x1 [0069.724] WriteFile (in: hFile=0x26c, lpBuffer=0x294ee08*, nNumberOfBytesToWrite=0x12c00, lpNumberOfBytesWritten=0x24e9e0, lpOverlapped=0x0 | out: lpBuffer=0x294ee08*, lpNumberOfBytesWritten=0x24e9e0*=0x12c00, lpOverlapped=0x0) returned 1 [0069.726] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\IGCbggAf_Nct.mp4", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\IGCbggAf_Nct.mp4", lpFilePart=0x0) returned 0x49 [0069.726] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\IGCbggAf_Nct.mp4.Crypted", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\IGCbggAf_Nct.mp4.Crypted", lpFilePart=0x0) returned 0x51 [0069.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9c4) returned 1 [0069.726] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\IGCbggAf_Nct.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rlfrgatixavohsfl9n\\igcbggaf_nct.mp4"), fInfoLevelId=0x0, lpFileInformation=0x24ea40 | out: lpFileInformation=0x24ea40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e0f8930, ftCreationTime.dwHighDateTime=0x1d4c616, ftLastAccessTime.dwLowDateTime=0x345cdf0, ftLastAccessTime.dwHighDateTime=0x1d4d250, ftLastWriteTime.dwLowDateTime=0xfab78910, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x12c00)) returned 1 [0069.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9c0) returned 1 [0069.726] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\IGCbggAf_Nct.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rlfrgatixavohsfl9n\\igcbggaf_nct.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\IGCbggAf_Nct.mp4.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rlfrgatixavohsfl9n\\igcbggaf_nct.mp4.crypted")) returned 1 [0069.732] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\UjQDqOcmc-0Sq.jpg", nBufferLength=0x105, lpBuffer=0x24e444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\UjQDqOcmc-0Sq.jpg", lpFilePart=0x0) returned 0x4a [0069.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0069.732] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\UjQDqOcmc-0Sq.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rlfrgatixavohsfl9n\\ujqdqocmc-0sq.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0069.733] GetFileType (hFile=0x26c) returned 0x1 [0069.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e934) returned 1 [0069.733] GetFileType (hFile=0x26c) returned 0x1 [0069.733] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24ea40 | out: lpFileSizeHigh=0x24ea40*=0x0) returned 0x189c0 [0069.733] ReadFile (in: hFile=0x26c, lpBuffer=0x3959de0, nNumberOfBytesToRead=0x189c0, lpNumberOfBytesRead=0x24e9ec, lpOverlapped=0x0 | out: lpBuffer=0x3959de0*, lpNumberOfBytesRead=0x24e9ec*=0x189c0, lpOverlapped=0x0) returned 1 [0069.819] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e558, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0069.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9b8) returned 1 [0069.820] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24ea34 | out: lpFileInformation=0x24ea34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0069.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9b4) returned 1 [0069.820] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\UjQDqOcmc-0Sq.jpg", nBufferLength=0x105, lpBuffer=0x24e430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\UjQDqOcmc-0Sq.jpg", lpFilePart=0x0) returned 0x4a [0069.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e924) returned 1 [0069.820] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\UjQDqOcmc-0Sq.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rlfrgatixavohsfl9n\\ujqdqocmc-0sq.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0069.830] GetFileType (hFile=0x26c) returned 0x1 [0069.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e920) returned 1 [0069.830] GetFileType (hFile=0x26c) returned 0x1 [0069.830] WriteFile (in: hFile=0x26c, lpBuffer=0x39d4f20*, nNumberOfBytesToWrite=0x189d0, lpNumberOfBytesWritten=0x24e9e0, lpOverlapped=0x0 | out: lpBuffer=0x39d4f20*, lpNumberOfBytesWritten=0x24e9e0*=0x189d0, lpOverlapped=0x0) returned 1 [0069.833] CloseHandle (hObject=0x26c) returned 1 [0069.837] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\UjQDqOcmc-0Sq.jpg", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\UjQDqOcmc-0Sq.jpg", lpFilePart=0x0) returned 0x4a [0069.837] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\UjQDqOcmc-0Sq.jpg.Crypted", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\UjQDqOcmc-0Sq.jpg.Crypted", lpFilePart=0x0) returned 0x52 [0069.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9c4) returned 1 [0069.837] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\UjQDqOcmc-0Sq.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rlfrgatixavohsfl9n\\ujqdqocmc-0sq.jpg"), fInfoLevelId=0x0, lpFileInformation=0x24ea40 | out: lpFileInformation=0x24ea40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8945e30, ftCreationTime.dwHighDateTime=0x1d4d37c, ftLastAccessTime.dwLowDateTime=0xea312350, ftLastAccessTime.dwHighDateTime=0x1d4cb2e, ftLastWriteTime.dwLowDateTime=0xfac832b0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x189d0)) returned 1 [0069.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9c0) returned 1 [0069.837] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\UjQDqOcmc-0Sq.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rlfrgatixavohsfl9n\\ujqdqocmc-0sq.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\UjQDqOcmc-0Sq.jpg.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rlfrgatixavohsfl9n\\ujqdqocmc-0sq.jpg.crypted")) returned 1 [0069.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eb08) returned 1 [0069.838] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x24e610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0069.838] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", nBufferLength=0x105, lpBuffer=0x24e5e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpFilePart=0x0) returned 0x28 [0069.839] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*", lpFindFileData=0x24e830 | out: lpFindFileData=0x24e830*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdd8e6ac0, ftLastAccessTime.dwHighDateTime=0x1d50efb, ftLastWriteTime.dwLowDateTime=0xdd8e6ac0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69aea8 [0069.839] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdd8e6ac0, ftLastAccessTime.dwHighDateTime=0x1d50efb, ftLastWriteTime.dwLowDateTime=0xdd8e6ac0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.839] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8731830, ftCreationTime.dwHighDateTime=0x1d4fcf0, ftLastAccessTime.dwLowDateTime=0x2290b120, ftLastAccessTime.dwHighDateTime=0x1d48e76, ftLastWriteTime.dwLowDateTime=0x2290b120, ftLastWriteTime.dwHighDateTime=0x1d48e76, nFileSizeHigh=0x0, nFileSizeLow=0x4495, dwReserved0=0x0, dwReserved1=0x0, cFileName="-ZL_F 2Qp2B.docx", cAlternateFileName="-ZL_F2~1.DOC")) returned 1 [0069.839] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0069.839] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5cf2060, ftCreationTime.dwHighDateTime=0x1d4d1f3, ftLastAccessTime.dwLowDateTime=0xc2f09fd0, ftLastAccessTime.dwHighDateTime=0x1d4d2b5, ftLastWriteTime.dwLowDateTime=0xc2f09fd0, ftLastWriteTime.dwHighDateTime=0x1d4d2b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fAjq", cAlternateFileName="")) returned 1 [0069.840] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca800af0, ftCreationTime.dwHighDateTime=0x1d4d0a4, ftLastAccessTime.dwLowDateTime=0xeb486840, ftLastAccessTime.dwHighDateTime=0x1d4c8d4, ftLastWriteTime.dwLowDateTime=0xeb486840, ftLastWriteTime.dwHighDateTime=0x1d4c8d4, nFileSizeHigh=0x0, nFileSizeLow=0x9e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="fqRU.pptx", cAlternateFileName="FQRU~1.PPT")) returned 1 [0069.840] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6e89390, ftCreationTime.dwHighDateTime=0x1d4c817, ftLastAccessTime.dwLowDateTime=0x54282f70, ftLastAccessTime.dwHighDateTime=0x1d4d6c8, ftLastWriteTime.dwLowDateTime=0x54282f70, ftLastWriteTime.dwHighDateTime=0x1d4d6c8, nFileSizeHigh=0x0, nFileSizeLow=0x18750, dwReserved0=0x0, dwReserved1=0x0, cFileName="GyFPLKBVA.docx", cAlternateFileName="GYFPLK~1.DOC")) returned 1 [0069.840] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0f7c9f0, ftCreationTime.dwHighDateTime=0x1d4d0a1, ftLastAccessTime.dwLowDateTime=0x809faf70, ftLastAccessTime.dwHighDateTime=0x1d48500, ftLastWriteTime.dwLowDateTime=0x809faf70, ftLastWriteTime.dwHighDateTime=0x1d48500, nFileSizeHigh=0x0, nFileSizeLow=0x1946, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kj0A9eECW.xlsx", cAlternateFileName="KJ0A9E~1.XLS")) returned 1 [0069.840] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4667a390, ftCreationTime.dwHighDateTime=0x1d4cbea, ftLastAccessTime.dwLowDateTime=0x39d7c60, ftLastAccessTime.dwHighDateTime=0x1d4c582, ftLastWriteTime.dwLowDateTime=0x39d7c60, ftLastWriteTime.dwHighDateTime=0x1d4c582, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mbMr8eJ4", cAlternateFileName="")) returned 1 [0069.840] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a066810, ftCreationTime.dwHighDateTime=0x1d4d10e, ftLastAccessTime.dwLowDateTime=0x20d702a0, ftLastAccessTime.dwHighDateTime=0x1d4d424, ftLastWriteTime.dwLowDateTime=0x20d702a0, ftLastWriteTime.dwHighDateTime=0x1d4d424, nFileSizeHigh=0x0, nFileSizeLow=0x10e33, dwReserved0=0x0, dwReserved1=0x0, cFileName="MioLFofhbzARVQtIk2.odp", cAlternateFileName="MIOLFO~1.ODP")) returned 1 [0069.841] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0069.841] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0069.841] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0069.841] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0069.842] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0d2e9f0, ftCreationTime.dwHighDateTime=0x1d4c49f, ftLastAccessTime.dwLowDateTime=0x2f86b820, ftLastAccessTime.dwHighDateTime=0x1d48f2f, ftLastWriteTime.dwLowDateTime=0x2f86b820, ftLastWriteTime.dwHighDateTime=0x1d48f2f, nFileSizeHigh=0x0, nFileSizeLow=0x114c9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nORqjVp10- zPmrNTLH.docx", cAlternateFileName="NORQJV~1.DOC")) returned 1 [0069.842] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55da820, ftCreationTime.dwHighDateTime=0x1d4ca52, ftLastAccessTime.dwLowDateTime=0x1d89d560, ftLastAccessTime.dwHighDateTime=0x1d4c89d, ftLastWriteTime.dwLowDateTime=0x1d89d560, ftLastWriteTime.dwHighDateTime=0x1d4c89d, nFileSizeHigh=0x0, nFileSizeLow=0x1ca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OH8Im GVPCn.xlsx", cAlternateFileName="OH8IMG~1.XLS")) returned 1 [0069.842] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0069.842] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0f60c0, ftCreationTime.dwHighDateTime=0x1d4cd54, ftLastAccessTime.dwLowDateTime=0x3f1f7400, ftLastAccessTime.dwHighDateTime=0x1d4c9b0, ftLastWriteTime.dwLowDateTime=0x3f1f7400, ftLastWriteTime.dwHighDateTime=0x1d4c9b0, nFileSizeHigh=0x0, nFileSizeLow=0x17ad6, dwReserved0=0x0, dwReserved1=0x0, cFileName="p5I0xWJ9.rtf", cAlternateFileName="")) returned 1 [0069.842] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30ccb520, ftCreationTime.dwHighDateTime=0x1d4ca55, ftLastAccessTime.dwLowDateTime=0x43873310, ftLastAccessTime.dwHighDateTime=0x1d4cfd3, ftLastWriteTime.dwLowDateTime=0x43873310, ftLastWriteTime.dwHighDateTime=0x1d4cfd3, nFileSizeHigh=0x0, nFileSizeLow=0xc829, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q1vCBs.csv", cAlternateFileName="")) returned 1 [0069.843] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1cd3020, ftCreationTime.dwHighDateTime=0x1d4a551, ftLastAccessTime.dwLowDateTime=0x13ef2890, ftLastAccessTime.dwHighDateTime=0x1d4c84b, ftLastWriteTime.dwLowDateTime=0x13ef2890, ftLastWriteTime.dwHighDateTime=0x1d4c84b, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qjUx.xlsx", cAlternateFileName="QJUX~1.XLS")) returned 1 [0069.843] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1502750, ftCreationTime.dwHighDateTime=0x1d49120, ftLastAccessTime.dwLowDateTime=0x245240f0, ftLastAccessTime.dwHighDateTime=0x1d4f384, ftLastWriteTime.dwLowDateTime=0x245240f0, ftLastWriteTime.dwHighDateTime=0x1d4f384, nFileSizeHigh=0x0, nFileSizeLow=0x17119, dwReserved0=0x0, dwReserved1=0x0, cFileName="RbwRlf.pptx", cAlternateFileName="RBWRLF~1.PPT")) returned 1 [0069.843] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2604780, ftCreationTime.dwHighDateTime=0x1d4beaf, ftLastAccessTime.dwLowDateTime=0xa2a69e20, ftLastAccessTime.dwHighDateTime=0x1d50cb5, ftLastWriteTime.dwLowDateTime=0xa2a69e20, ftLastWriteTime.dwHighDateTime=0x1d50cb5, nFileSizeHigh=0x0, nFileSizeLow=0x4896, dwReserved0=0x0, dwReserved1=0x0, cFileName="rO6BuAGLVoGGiJ.xlsx", cAlternateFileName="RO6BUA~1.XLS")) returned 1 [0069.843] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x187f1ec0, ftCreationTime.dwHighDateTime=0x1d50495, ftLastAccessTime.dwLowDateTime=0x8741c3a0, ftLastAccessTime.dwHighDateTime=0x1d4b650, ftLastWriteTime.dwLowDateTime=0x8741c3a0, ftLastWriteTime.dwHighDateTime=0x1d4b650, nFileSizeHigh=0x0, nFileSizeLow=0x3df9, dwReserved0=0x0, dwReserved1=0x0, cFileName="SqSkG5ZXvBuLN b8e88.docx", cAlternateFileName="SQSKG5~1.DOC")) returned 1 [0069.843] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa14313e0, ftCreationTime.dwHighDateTime=0x1d4d288, ftLastAccessTime.dwLowDateTime=0xcab1edc0, ftLastAccessTime.dwHighDateTime=0x1d4d380, ftLastWriteTime.dwLowDateTime=0xcab1edc0, ftLastWriteTime.dwHighDateTime=0x1d4d380, nFileSizeHigh=0x0, nFileSizeLow=0x6495, dwReserved0=0x0, dwReserved1=0x0, cFileName="UbpJy.xlsx", cAlternateFileName="UBPJY~1.XLS")) returned 1 [0069.843] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae070280, ftCreationTime.dwHighDateTime=0x1d4fe2f, ftLastAccessTime.dwLowDateTime=0x90fecb00, ftLastAccessTime.dwHighDateTime=0x1d4e601, ftLastWriteTime.dwLowDateTime=0x90fecb00, ftLastWriteTime.dwHighDateTime=0x1d4e601, nFileSizeHigh=0x0, nFileSizeLow=0x14eb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="V8sSY7 Q9.pptx", cAlternateFileName="V8SSY7~1.PPT")) returned 1 [0069.844] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf65cc90, ftCreationTime.dwHighDateTime=0x1d4d0ac, ftLastAccessTime.dwLowDateTime=0xdb83eea0, ftLastAccessTime.dwHighDateTime=0x1d4c881, ftLastWriteTime.dwLowDateTime=0xdb83eea0, ftLastWriteTime.dwHighDateTime=0x1d4c881, nFileSizeHigh=0x0, nFileSizeLow=0x199a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WAwuOs2pkIS4tYd88H.odt", cAlternateFileName="WAWUOS~1.ODT")) returned 1 [0069.844] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa743e9d0, ftCreationTime.dwHighDateTime=0x1d500c9, ftLastAccessTime.dwLowDateTime=0xcef0a4e0, ftLastAccessTime.dwHighDateTime=0x1d4dfe1, ftLastWriteTime.dwLowDateTime=0xcef0a4e0, ftLastWriteTime.dwHighDateTime=0x1d4dfe1, nFileSizeHigh=0x0, nFileSizeLow=0x63aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWWIhSj2QeI.pptx", cAlternateFileName="WWWIHS~1.PPT")) returned 1 [0069.844] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b5ee50, ftCreationTime.dwHighDateTime=0x1d4c0c0, ftLastAccessTime.dwLowDateTime=0xaada3e50, ftLastAccessTime.dwHighDateTime=0x1d4c852, ftLastWriteTime.dwLowDateTime=0xaada3e50, ftLastWriteTime.dwHighDateTime=0x1d4c852, nFileSizeHigh=0x0, nFileSizeLow=0x109bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="XOsh9q LlR_2C.xlsx", cAlternateFileName="XOSH9Q~1.XLS")) returned 1 [0069.844] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22198d80, ftCreationTime.dwHighDateTime=0x1d4e145, ftLastAccessTime.dwLowDateTime=0xdfbc1d10, ftLastAccessTime.dwHighDateTime=0x1d4cfb3, ftLastWriteTime.dwLowDateTime=0xdfbc1d10, ftLastWriteTime.dwHighDateTime=0x1d4cfb3, nFileSizeHigh=0x0, nFileSizeLow=0x16023, dwReserved0=0x0, dwReserved1=0x0, cFileName="YRTx_GskUlqeQb1a.docx", cAlternateFileName="YRTX_G~1.DOC")) returned 1 [0069.844] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc66f8140, ftCreationTime.dwHighDateTime=0x1d4c88c, ftLastAccessTime.dwLowDateTime=0x1473e9a0, ftLastAccessTime.dwHighDateTime=0x1d4d367, ftLastWriteTime.dwLowDateTime=0x1473e9a0, ftLastWriteTime.dwHighDateTime=0x1d4d367, nFileSizeHigh=0x0, nFileSizeLow=0xf9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="zx0yzk.xlsx", cAlternateFileName="ZX0YZK~1.XLS")) returned 1 [0069.844] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f9eca20, ftCreationTime.dwHighDateTime=0x1d50456, ftLastAccessTime.dwLowDateTime=0xcf931850, ftLastAccessTime.dwHighDateTime=0x1d4d83f, ftLastWriteTime.dwLowDateTime=0xcf931850, ftLastWriteTime.dwHighDateTime=0x1d4d83f, nFileSizeHigh=0x0, nFileSizeLow=0xc025, dwReserved0=0x0, dwReserved1=0x0, cFileName="_M-3gGfn7.pptx", cAlternateFileName="_M-3GG~1.PPT")) returned 1 [0069.845] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0069.845] FindClose (in: hFindFile=0x69aea8 | out: hFindFile=0x69aea8) returned 1 [0069.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eac8) returned 1 [0069.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ead4) returned 1 [0069.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eb08) returned 1 [0069.845] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x24e610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0069.845] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", nBufferLength=0x105, lpBuffer=0x24e5e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpFilePart=0x0) returned 0x28 [0069.845] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*", lpFindFileData=0x24e830 | out: lpFindFileData=0x24e830*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdd8e6ac0, ftLastAccessTime.dwHighDateTime=0x1d50efb, ftLastWriteTime.dwLowDateTime=0xdd8e6ac0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69aea8 [0069.846] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdd8e6ac0, ftLastAccessTime.dwHighDateTime=0x1d50efb, ftLastWriteTime.dwLowDateTime=0xdd8e6ac0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.846] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8731830, ftCreationTime.dwHighDateTime=0x1d4fcf0, ftLastAccessTime.dwLowDateTime=0x2290b120, ftLastAccessTime.dwHighDateTime=0x1d48e76, ftLastWriteTime.dwLowDateTime=0x2290b120, ftLastWriteTime.dwHighDateTime=0x1d48e76, nFileSizeHigh=0x0, nFileSizeLow=0x4495, dwReserved0=0x0, dwReserved1=0x0, cFileName="-ZL_F 2Qp2B.docx", cAlternateFileName="-ZL_F2~1.DOC")) returned 1 [0069.846] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0069.846] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5cf2060, ftCreationTime.dwHighDateTime=0x1d4d1f3, ftLastAccessTime.dwLowDateTime=0xc2f09fd0, ftLastAccessTime.dwHighDateTime=0x1d4d2b5, ftLastWriteTime.dwLowDateTime=0xc2f09fd0, ftLastWriteTime.dwHighDateTime=0x1d4d2b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fAjq", cAlternateFileName="")) returned 1 [0069.846] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca800af0, ftCreationTime.dwHighDateTime=0x1d4d0a4, ftLastAccessTime.dwLowDateTime=0xeb486840, ftLastAccessTime.dwHighDateTime=0x1d4c8d4, ftLastWriteTime.dwLowDateTime=0xeb486840, ftLastWriteTime.dwHighDateTime=0x1d4c8d4, nFileSizeHigh=0x0, nFileSizeLow=0x9e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="fqRU.pptx", cAlternateFileName="FQRU~1.PPT")) returned 1 [0069.847] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6e89390, ftCreationTime.dwHighDateTime=0x1d4c817, ftLastAccessTime.dwLowDateTime=0x54282f70, ftLastAccessTime.dwHighDateTime=0x1d4d6c8, ftLastWriteTime.dwLowDateTime=0x54282f70, ftLastWriteTime.dwHighDateTime=0x1d4d6c8, nFileSizeHigh=0x0, nFileSizeLow=0x18750, dwReserved0=0x0, dwReserved1=0x0, cFileName="GyFPLKBVA.docx", cAlternateFileName="GYFPLK~1.DOC")) returned 1 [0069.847] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0f7c9f0, ftCreationTime.dwHighDateTime=0x1d4d0a1, ftLastAccessTime.dwLowDateTime=0x809faf70, ftLastAccessTime.dwHighDateTime=0x1d48500, ftLastWriteTime.dwLowDateTime=0x809faf70, ftLastWriteTime.dwHighDateTime=0x1d48500, nFileSizeHigh=0x0, nFileSizeLow=0x1946, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kj0A9eECW.xlsx", cAlternateFileName="KJ0A9E~1.XLS")) returned 1 [0069.847] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4667a390, ftCreationTime.dwHighDateTime=0x1d4cbea, ftLastAccessTime.dwLowDateTime=0x39d7c60, ftLastAccessTime.dwHighDateTime=0x1d4c582, ftLastWriteTime.dwLowDateTime=0x39d7c60, ftLastWriteTime.dwHighDateTime=0x1d4c582, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mbMr8eJ4", cAlternateFileName="")) returned 1 [0069.847] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a066810, ftCreationTime.dwHighDateTime=0x1d4d10e, ftLastAccessTime.dwLowDateTime=0x20d702a0, ftLastAccessTime.dwHighDateTime=0x1d4d424, ftLastWriteTime.dwLowDateTime=0x20d702a0, ftLastWriteTime.dwHighDateTime=0x1d4d424, nFileSizeHigh=0x0, nFileSizeLow=0x10e33, dwReserved0=0x0, dwReserved1=0x0, cFileName="MioLFofhbzARVQtIk2.odp", cAlternateFileName="MIOLFO~1.ODP")) returned 1 [0069.847] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0069.848] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0069.848] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0069.848] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0069.848] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0d2e9f0, ftCreationTime.dwHighDateTime=0x1d4c49f, ftLastAccessTime.dwLowDateTime=0x2f86b820, ftLastAccessTime.dwHighDateTime=0x1d48f2f, ftLastWriteTime.dwLowDateTime=0x2f86b820, ftLastWriteTime.dwHighDateTime=0x1d48f2f, nFileSizeHigh=0x0, nFileSizeLow=0x114c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="nORqjVp10- zPmrNTLH.docx", cAlternateFileName="NORQJV~1.DOC")) returned 1 [0069.848] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55da820, ftCreationTime.dwHighDateTime=0x1d4ca52, ftLastAccessTime.dwLowDateTime=0x1d89d560, ftLastAccessTime.dwHighDateTime=0x1d4c89d, ftLastWriteTime.dwLowDateTime=0x1d89d560, ftLastWriteTime.dwHighDateTime=0x1d4c89d, nFileSizeHigh=0x0, nFileSizeLow=0x1ca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OH8Im GVPCn.xlsx", cAlternateFileName="OH8IMG~1.XLS")) returned 1 [0069.849] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0069.849] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0f60c0, ftCreationTime.dwHighDateTime=0x1d4cd54, ftLastAccessTime.dwLowDateTime=0x3f1f7400, ftLastAccessTime.dwHighDateTime=0x1d4c9b0, ftLastWriteTime.dwLowDateTime=0x3f1f7400, ftLastWriteTime.dwHighDateTime=0x1d4c9b0, nFileSizeHigh=0x0, nFileSizeLow=0x17ad6, dwReserved0=0x0, dwReserved1=0x0, cFileName="p5I0xWJ9.rtf", cAlternateFileName="")) returned 1 [0069.849] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30ccb520, ftCreationTime.dwHighDateTime=0x1d4ca55, ftLastAccessTime.dwLowDateTime=0x43873310, ftLastAccessTime.dwHighDateTime=0x1d4cfd3, ftLastWriteTime.dwLowDateTime=0x43873310, ftLastWriteTime.dwHighDateTime=0x1d4cfd3, nFileSizeHigh=0x0, nFileSizeLow=0xc829, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q1vCBs.csv", cAlternateFileName="")) returned 1 [0069.849] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1cd3020, ftCreationTime.dwHighDateTime=0x1d4a551, ftLastAccessTime.dwLowDateTime=0x13ef2890, ftLastAccessTime.dwHighDateTime=0x1d4c84b, ftLastWriteTime.dwLowDateTime=0x13ef2890, ftLastWriteTime.dwHighDateTime=0x1d4c84b, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qjUx.xlsx", cAlternateFileName="QJUX~1.XLS")) returned 1 [0069.849] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1502750, ftCreationTime.dwHighDateTime=0x1d49120, ftLastAccessTime.dwLowDateTime=0x245240f0, ftLastAccessTime.dwHighDateTime=0x1d4f384, ftLastWriteTime.dwLowDateTime=0x245240f0, ftLastWriteTime.dwHighDateTime=0x1d4f384, nFileSizeHigh=0x0, nFileSizeLow=0x17119, dwReserved0=0x0, dwReserved1=0x0, cFileName="RbwRlf.pptx", cAlternateFileName="RBWRLF~1.PPT")) returned 1 [0069.850] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2604780, ftCreationTime.dwHighDateTime=0x1d4beaf, ftLastAccessTime.dwLowDateTime=0xa2a69e20, ftLastAccessTime.dwHighDateTime=0x1d50cb5, ftLastWriteTime.dwLowDateTime=0xa2a69e20, ftLastWriteTime.dwHighDateTime=0x1d50cb5, nFileSizeHigh=0x0, nFileSizeLow=0x4896, dwReserved0=0x0, dwReserved1=0x0, cFileName="rO6BuAGLVoGGiJ.xlsx", cAlternateFileName="RO6BUA~1.XLS")) returned 1 [0069.850] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x187f1ec0, ftCreationTime.dwHighDateTime=0x1d50495, ftLastAccessTime.dwLowDateTime=0x8741c3a0, ftLastAccessTime.dwHighDateTime=0x1d4b650, ftLastWriteTime.dwLowDateTime=0x8741c3a0, ftLastWriteTime.dwHighDateTime=0x1d4b650, nFileSizeHigh=0x0, nFileSizeLow=0x3df9, dwReserved0=0x0, dwReserved1=0x0, cFileName="SqSkG5ZXvBuLN b8e88.docx", cAlternateFileName="SQSKG5~1.DOC")) returned 1 [0069.850] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa14313e0, ftCreationTime.dwHighDateTime=0x1d4d288, ftLastAccessTime.dwLowDateTime=0xcab1edc0, ftLastAccessTime.dwHighDateTime=0x1d4d380, ftLastWriteTime.dwLowDateTime=0xcab1edc0, ftLastWriteTime.dwHighDateTime=0x1d4d380, nFileSizeHigh=0x0, nFileSizeLow=0x6495, dwReserved0=0x0, dwReserved1=0x0, cFileName="UbpJy.xlsx", cAlternateFileName="UBPJY~1.XLS")) returned 1 [0069.850] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae070280, ftCreationTime.dwHighDateTime=0x1d4fe2f, ftLastAccessTime.dwLowDateTime=0x90fecb00, ftLastAccessTime.dwHighDateTime=0x1d4e601, ftLastWriteTime.dwLowDateTime=0x90fecb00, ftLastWriteTime.dwHighDateTime=0x1d4e601, nFileSizeHigh=0x0, nFileSizeLow=0x14eb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="V8sSY7 Q9.pptx", cAlternateFileName="V8SSY7~1.PPT")) returned 1 [0069.850] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf65cc90, ftCreationTime.dwHighDateTime=0x1d4d0ac, ftLastAccessTime.dwLowDateTime=0xdb83eea0, ftLastAccessTime.dwHighDateTime=0x1d4c881, ftLastWriteTime.dwLowDateTime=0xdb83eea0, ftLastWriteTime.dwHighDateTime=0x1d4c881, nFileSizeHigh=0x0, nFileSizeLow=0x199a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WAwuOs2pkIS4tYd88H.odt", cAlternateFileName="WAWUOS~1.ODT")) returned 1 [0069.851] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa743e9d0, ftCreationTime.dwHighDateTime=0x1d500c9, ftLastAccessTime.dwLowDateTime=0xcef0a4e0, ftLastAccessTime.dwHighDateTime=0x1d4dfe1, ftLastWriteTime.dwLowDateTime=0xcef0a4e0, ftLastWriteTime.dwHighDateTime=0x1d4dfe1, nFileSizeHigh=0x0, nFileSizeLow=0x63aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWWIhSj2QeI.pptx", cAlternateFileName="WWWIHS~1.PPT")) returned 1 [0069.851] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b5ee50, ftCreationTime.dwHighDateTime=0x1d4c0c0, ftLastAccessTime.dwLowDateTime=0xaada3e50, ftLastAccessTime.dwHighDateTime=0x1d4c852, ftLastWriteTime.dwLowDateTime=0xaada3e50, ftLastWriteTime.dwHighDateTime=0x1d4c852, nFileSizeHigh=0x0, nFileSizeLow=0x109bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="XOsh9q LlR_2C.xlsx", cAlternateFileName="XOSH9Q~1.XLS")) returned 1 [0069.851] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22198d80, ftCreationTime.dwHighDateTime=0x1d4e145, ftLastAccessTime.dwLowDateTime=0xdfbc1d10, ftLastAccessTime.dwHighDateTime=0x1d4cfb3, ftLastWriteTime.dwLowDateTime=0xdfbc1d10, ftLastWriteTime.dwHighDateTime=0x1d4cfb3, nFileSizeHigh=0x0, nFileSizeLow=0x16023, dwReserved0=0x0, dwReserved1=0x0, cFileName="YRTx_GskUlqeQb1a.docx", cAlternateFileName="YRTX_G~1.DOC")) returned 1 [0069.851] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc66f8140, ftCreationTime.dwHighDateTime=0x1d4c88c, ftLastAccessTime.dwLowDateTime=0x1473e9a0, ftLastAccessTime.dwHighDateTime=0x1d4d367, ftLastWriteTime.dwLowDateTime=0x1473e9a0, ftLastWriteTime.dwHighDateTime=0x1d4d367, nFileSizeHigh=0x0, nFileSizeLow=0xf9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="zx0yzk.xlsx", cAlternateFileName="ZX0YZK~1.XLS")) returned 1 [0069.852] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f9eca20, ftCreationTime.dwHighDateTime=0x1d50456, ftLastAccessTime.dwLowDateTime=0xcf931850, ftLastAccessTime.dwHighDateTime=0x1d4d83f, ftLastWriteTime.dwLowDateTime=0xcf931850, ftLastWriteTime.dwHighDateTime=0x1d4d83f, nFileSizeHigh=0x0, nFileSizeLow=0xc025, dwReserved0=0x0, dwReserved1=0x0, cFileName="_M-3gGfn7.pptx", cAlternateFileName="_M-3GG~1.PPT")) returned 1 [0069.852] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f9eca20, ftCreationTime.dwHighDateTime=0x1d50456, ftLastAccessTime.dwLowDateTime=0xcf931850, ftLastAccessTime.dwHighDateTime=0x1d4d83f, ftLastWriteTime.dwLowDateTime=0xcf931850, ftLastWriteTime.dwHighDateTime=0x1d4d83f, nFileSizeHigh=0x0, nFileSizeLow=0xc025, dwReserved0=0x0, dwReserved1=0x0, cFileName="_M-3gGfn7.pptx", cAlternateFileName="_M-3GG~1.PPT")) returned 0 [0069.852] FindClose (in: hFindFile=0x69aea8 | out: hFindFile=0x69aea8) returned 1 [0069.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eac8) returned 1 [0069.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ead4) returned 1 [0069.852] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-ZL_F 2Qp2B.docx", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-ZL_F 2Qp2B.docx", lpFilePart=0x0) returned 0x38 [0069.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0069.852] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-ZL_F 2Qp2B.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-zl_f 2qp2b.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0069.862] GetFileType (hFile=0x26c) returned 0x1 [0069.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0069.862] GetFileType (hFile=0x26c) returned 0x1 [0069.862] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x4495 [0069.862] ReadFile (in: hFile=0x26c, lpBuffer=0x27b6098, nNumberOfBytesToRead=0x4495, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x27b6098*, lpNumberOfBytesRead=0x24ea60*=0x4495, lpOverlapped=0x0) returned 1 [0069.864] CloseHandle (hObject=0x26c) returned 1 [0069.907] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0069.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0069.908] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0069.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0069.908] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-ZL_F 2Qp2B.docx", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-ZL_F 2Qp2B.docx", lpFilePart=0x0) returned 0x38 [0069.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0069.908] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-ZL_F 2Qp2B.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-zl_f 2qp2b.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0069.909] GetFileType (hFile=0x26c) returned 0x1 [0069.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0069.909] GetFileType (hFile=0x26c) returned 0x1 [0069.909] WriteFile (in: hFile=0x26c, lpBuffer=0x2818700*, nNumberOfBytesToWrite=0x44a0, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x2818700*, lpNumberOfBytesWritten=0x24ea54*=0x44a0, lpOverlapped=0x0) returned 1 [0069.911] CloseHandle (hObject=0x26c) returned 1 [0069.918] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-ZL_F 2Qp2B.docx", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-ZL_F 2Qp2B.docx", lpFilePart=0x0) returned 0x38 [0069.918] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-ZL_F 2Qp2B.docx.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-ZL_F 2Qp2B.docx.Crypted", lpFilePart=0x0) returned 0x40 [0069.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0069.918] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-ZL_F 2Qp2B.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-zl_f 2qp2b.docx"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8731830, ftCreationTime.dwHighDateTime=0x1d4fcf0, ftLastAccessTime.dwLowDateTime=0x2290b120, ftLastAccessTime.dwHighDateTime=0x1d48e76, ftLastWriteTime.dwLowDateTime=0xfad41990, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x44a0)) returned 1 [0069.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0069.918] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-ZL_F 2Qp2B.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-zl_f 2qp2b.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-ZL_F 2Qp2B.docx.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-zl_f 2qp2b.docx.crypted")) returned 1 [0070.411] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fqRU.pptx", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fqRU.pptx", lpFilePart=0x0) returned 0x31 [0070.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0070.411] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fqRU.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fqru.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0070.471] GetFileType (hFile=0x26c) returned 0x1 [0070.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0070.471] GetFileType (hFile=0x26c) returned 0x1 [0070.471] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x9e6 [0070.471] ReadFile (in: hFile=0x26c, lpBuffer=0x281db04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x281db04*, lpNumberOfBytesRead=0x24ea60*=0x9e6, lpOverlapped=0x0) returned 1 [0070.473] CloseHandle (hObject=0x26c) returned 1 [0070.492] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0070.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0070.492] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0070.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0070.492] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fqRU.pptx", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fqRU.pptx", lpFilePart=0x0) returned 0x31 [0070.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0070.492] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fqRU.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fqru.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0070.493] GetFileType (hFile=0x26c) returned 0x1 [0070.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0070.493] GetFileType (hFile=0x26c) returned 0x1 [0070.493] WriteFile (in: hFile=0x26c, lpBuffer=0x286ed3c*, nNumberOfBytesToWrite=0x9f0, lpNumberOfBytesWritten=0x24ea28, lpOverlapped=0x0 | out: lpBuffer=0x286ed3c*, lpNumberOfBytesWritten=0x24ea28*=0x9f0, lpOverlapped=0x0) returned 1 [0070.494] CloseHandle (hObject=0x26c) returned 1 [0070.500] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fqRU.pptx", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fqRU.pptx", lpFilePart=0x0) returned 0x31 [0070.500] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fqRU.pptx.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fqRU.pptx.Crypted", lpFilePart=0x0) returned 0x39 [0070.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0070.500] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fqRU.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fqru.pptx"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca800af0, ftCreationTime.dwHighDateTime=0x1d4d0a4, ftLastAccessTime.dwLowDateTime=0xeb486840, ftLastAccessTime.dwHighDateTime=0x1d4c8d4, ftLastWriteTime.dwLowDateTime=0xfb2c2c70, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x9f0)) returned 1 [0070.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0070.500] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fqRU.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fqru.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fqRU.pptx.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fqru.pptx.crypted")) returned 1 [0070.501] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GyFPLKBVA.docx", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GyFPLKBVA.docx", lpFilePart=0x0) returned 0x36 [0070.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0070.501] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GyFPLKBVA.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gyfplkbva.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0070.502] GetFileType (hFile=0x26c) returned 0x1 [0070.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0070.502] GetFileType (hFile=0x26c) returned 0x1 [0070.502] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x18750 [0070.502] ReadFile (in: hFile=0x26c, lpBuffer=0x39ed910, nNumberOfBytesToRead=0x18750, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x39ed910*, lpNumberOfBytesRead=0x24ea60*=0x18750, lpOverlapped=0x0) returned 1 [0070.559] CloseHandle (hObject=0x26c) returned 1 [0070.586] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0070.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0070.586] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0070.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0070.586] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GyFPLKBVA.docx", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GyFPLKBVA.docx", lpFilePart=0x0) returned 0x36 [0070.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0070.587] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GyFPLKBVA.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gyfplkbva.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0070.588] GetFileType (hFile=0x26c) returned 0x1 [0070.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0070.588] GetFileType (hFile=0x26c) returned 0x1 [0070.589] WriteFile (in: hFile=0x26c, lpBuffer=0x3a80220*, nNumberOfBytesToWrite=0x18760, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x3a80220*, lpNumberOfBytesWritten=0x24ea54*=0x18760, lpOverlapped=0x0) returned 1 [0070.591] CloseHandle (hObject=0x26c) returned 1 [0070.600] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GyFPLKBVA.docx", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GyFPLKBVA.docx", lpFilePart=0x0) returned 0x36 [0070.600] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GyFPLKBVA.docx.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GyFPLKBVA.docx.Crypted", lpFilePart=0x0) returned 0x3e [0070.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0070.600] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GyFPLKBVA.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gyfplkbva.docx"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6e89390, ftCreationTime.dwHighDateTime=0x1d4c817, ftLastAccessTime.dwLowDateTime=0x54282f70, ftLastAccessTime.dwHighDateTime=0x1d4d6c8, ftLastWriteTime.dwLowDateTime=0xfb3cd610, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x18760)) returned 1 [0070.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0070.601] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GyFPLKBVA.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gyfplkbva.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GyFPLKBVA.docx.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gyfplkbva.docx.crypted")) returned 1 [0070.602] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Kj0A9eECW.xlsx", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Kj0A9eECW.xlsx", lpFilePart=0x0) returned 0x36 [0070.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0070.602] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Kj0A9eECW.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kj0a9eecw.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0070.602] GetFileType (hFile=0x26c) returned 0x1 [0070.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0070.602] GetFileType (hFile=0x26c) returned 0x1 [0070.602] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x1946 [0070.603] ReadFile (in: hFile=0x26c, lpBuffer=0x28bd32c, nNumberOfBytesToRead=0x1946, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x28bd32c*, lpNumberOfBytesRead=0x24ea60*=0x1946, lpOverlapped=0x0) returned 1 [0070.616] CloseHandle (hObject=0x26c) returned 1 [0070.638] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0070.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0070.638] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0070.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0070.639] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Kj0A9eECW.xlsx", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Kj0A9eECW.xlsx", lpFilePart=0x0) returned 0x36 [0070.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0070.639] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Kj0A9eECW.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kj0a9eecw.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0070.640] GetFileType (hFile=0x26c) returned 0x1 [0070.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0070.640] GetFileType (hFile=0x26c) returned 0x1 [0070.640] WriteFile (in: hFile=0x26c, lpBuffer=0x2911fa8*, nNumberOfBytesToWrite=0x1950, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x2911fa8*, lpNumberOfBytesWritten=0x24ea54*=0x1950, lpOverlapped=0x0) returned 1 [0070.641] CloseHandle (hObject=0x26c) returned 1 [0070.644] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Kj0A9eECW.xlsx", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Kj0A9eECW.xlsx", lpFilePart=0x0) returned 0x36 [0070.644] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Kj0A9eECW.xlsx.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Kj0A9eECW.xlsx.Crypted", lpFilePart=0x0) returned 0x3e [0070.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0070.644] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Kj0A9eECW.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kj0a9eecw.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0f7c9f0, ftCreationTime.dwHighDateTime=0x1d4d0a1, ftLastAccessTime.dwLowDateTime=0x809faf70, ftLastAccessTime.dwHighDateTime=0x1d48500, ftLastWriteTime.dwLowDateTime=0xfb43fa30, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x1950)) returned 1 [0070.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0070.645] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Kj0A9eECW.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kj0a9eecw.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Kj0A9eECW.xlsx.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kj0a9eecw.xlsx.crypted")) returned 1 [0070.645] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nORqjVp10- zPmrNTLH.docx", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nORqjVp10- zPmrNTLH.docx", lpFilePart=0x0) returned 0x40 [0070.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0070.645] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nORqjVp10- zPmrNTLH.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\norqjvp10- zpmrntlh.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0070.646] GetFileType (hFile=0x26c) returned 0x1 [0070.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0070.646] GetFileType (hFile=0x26c) returned 0x1 [0070.646] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x114c9 [0070.646] ReadFile (in: hFile=0x26c, lpBuffer=0x2913e94, nNumberOfBytesToRead=0x114c9, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x2913e94*, lpNumberOfBytesRead=0x24ea60*=0x114c9, lpOverlapped=0x0) returned 1 [0070.652] CloseHandle (hObject=0x26c) returned 1 [0070.724] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0070.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0070.724] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0070.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0070.725] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nORqjVp10- zPmrNTLH.docx", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nORqjVp10- zPmrNTLH.docx", lpFilePart=0x0) returned 0x40 [0070.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0070.725] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nORqjVp10- zPmrNTLH.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\norqjvp10- zpmrntlh.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0070.726] GetFileType (hFile=0x26c) returned 0x1 [0070.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0070.726] GetFileType (hFile=0x26c) returned 0x1 [0070.726] WriteFile (in: hFile=0x26c, lpBuffer=0x27859d8*, nNumberOfBytesToWrite=0x114d0, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x27859d8*, lpNumberOfBytesWritten=0x24ea54*=0x114d0, lpOverlapped=0x0) returned 1 [0070.727] CloseHandle (hObject=0x26c) returned 1 [0070.729] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nORqjVp10- zPmrNTLH.docx", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nORqjVp10- zPmrNTLH.docx", lpFilePart=0x0) returned 0x40 [0070.729] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nORqjVp10- zPmrNTLH.docx.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nORqjVp10- zPmrNTLH.docx.Crypted", lpFilePart=0x0) returned 0x48 [0070.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0070.729] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nORqjVp10- zPmrNTLH.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\norqjvp10- zpmrntlh.docx"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0d2e9f0, ftCreationTime.dwHighDateTime=0x1d4c49f, ftLastAccessTime.dwLowDateTime=0x2f86b820, ftLastAccessTime.dwHighDateTime=0x1d48f2f, ftLastWriteTime.dwLowDateTime=0xfb4fe110, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x114d0)) returned 1 [0070.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0070.730] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nORqjVp10- zPmrNTLH.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\norqjvp10- zpmrntlh.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nORqjVp10- zPmrNTLH.docx.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\norqjvp10- zpmrntlh.docx.crypted")) returned 1 [0070.744] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OH8Im GVPCn.xlsx", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OH8Im GVPCn.xlsx", lpFilePart=0x0) returned 0x38 [0070.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0070.744] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OH8Im GVPCn.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh8im gvpcn.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0070.744] GetFileType (hFile=0x26c) returned 0x1 [0070.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0070.744] GetFileType (hFile=0x26c) returned 0x1 [0070.744] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x1ca8 [0070.744] ReadFile (in: hFile=0x26c, lpBuffer=0x2797470, nNumberOfBytesToRead=0x1ca8, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x2797470*, lpNumberOfBytesRead=0x24ea60*=0x1ca8, lpOverlapped=0x0) returned 1 [0070.746] CloseHandle (hObject=0x26c) returned 1 [0070.767] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0070.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0070.768] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0070.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0070.768] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OH8Im GVPCn.xlsx", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OH8Im GVPCn.xlsx", lpFilePart=0x0) returned 0x38 [0070.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0070.768] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OH8Im GVPCn.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh8im gvpcn.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0070.769] GetFileType (hFile=0x26c) returned 0x1 [0070.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0070.770] GetFileType (hFile=0x26c) returned 0x1 [0070.770] WriteFile (in: hFile=0x26c, lpBuffer=0x27ed324*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x27ed324*, lpNumberOfBytesWritten=0x24ea54*=0x1cb0, lpOverlapped=0x0) returned 1 [0070.771] CloseHandle (hObject=0x26c) returned 1 [0070.779] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OH8Im GVPCn.xlsx", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OH8Im GVPCn.xlsx", lpFilePart=0x0) returned 0x38 [0070.779] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OH8Im GVPCn.xlsx.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OH8Im GVPCn.xlsx.Crypted", lpFilePart=0x0) returned 0x40 [0070.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0070.779] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OH8Im GVPCn.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh8im gvpcn.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55da820, ftCreationTime.dwHighDateTime=0x1d4ca52, ftLastAccessTime.dwLowDateTime=0x1d89d560, ftLastAccessTime.dwHighDateTime=0x1d4c89d, ftLastWriteTime.dwLowDateTime=0xfb570530, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x1cb0)) returned 1 [0070.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0070.779] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OH8Im GVPCn.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh8im gvpcn.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OH8Im GVPCn.xlsx.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh8im gvpcn.xlsx.crypted")) returned 1 [0070.780] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p5I0xWJ9.rtf", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p5I0xWJ9.rtf", lpFilePart=0x0) returned 0x34 [0070.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0070.780] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p5I0xWJ9.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p5i0xwj9.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0070.780] GetFileType (hFile=0x26c) returned 0x1 [0070.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0070.782] GetFileType (hFile=0x26c) returned 0x1 [0070.782] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x17ad6 [0070.783] ReadFile (in: hFile=0x26c, lpBuffer=0x37943f0, nNumberOfBytesToRead=0x17ad6, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x37943f0*, lpNumberOfBytesRead=0x24ea60*=0x17ad6, lpOverlapped=0x0) returned 1 [0070.785] CloseHandle (hObject=0x26c) returned 1 [0070.814] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0070.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0070.814] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0070.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0070.814] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p5I0xWJ9.rtf", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p5I0xWJ9.rtf", lpFilePart=0x0) returned 0x34 [0070.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0070.814] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p5I0xWJ9.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p5i0xwj9.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0070.816] GetFileType (hFile=0x26c) returned 0x1 [0070.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0070.816] GetFileType (hFile=0x26c) returned 0x1 [0070.816] WriteFile (in: hFile=0x26c, lpBuffer=0x380aa88*, nNumberOfBytesToWrite=0x17ae0, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x380aa88*, lpNumberOfBytesWritten=0x24ea54*=0x17ae0, lpOverlapped=0x0) returned 1 [0070.819] CloseHandle (hObject=0x26c) returned 1 [0070.846] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p5I0xWJ9.rtf", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p5I0xWJ9.rtf", lpFilePart=0x0) returned 0x34 [0070.846] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p5I0xWJ9.rtf.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p5I0xWJ9.rtf.Crypted", lpFilePart=0x0) returned 0x3c [0070.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0070.846] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p5I0xWJ9.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p5i0xwj9.rtf"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0f60c0, ftCreationTime.dwHighDateTime=0x1d4cd54, ftLastAccessTime.dwLowDateTime=0x3f1f7400, ftLastAccessTime.dwHighDateTime=0x1d4c9b0, ftLastWriteTime.dwLowDateTime=0xfb62ec10, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x17ae0)) returned 1 [0070.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0070.846] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p5I0xWJ9.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p5i0xwj9.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p5I0xWJ9.rtf.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p5i0xwj9.rtf.crypted")) returned 1 [0070.847] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Q1vCBs.csv", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Q1vCBs.csv", lpFilePart=0x0) returned 0x32 [0070.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0070.847] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Q1vCBs.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\q1vcbs.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0070.847] GetFileType (hFile=0x26c) returned 0x1 [0070.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0070.847] GetFileType (hFile=0x26c) returned 0x1 [0070.847] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0xc829 [0070.848] ReadFile (in: hFile=0x26c, lpBuffer=0x283c86c, nNumberOfBytesToRead=0xc829, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x283c86c*, lpNumberOfBytesRead=0x24ea60*=0xc829, lpOverlapped=0x0) returned 1 [0070.849] CloseHandle (hObject=0x26c) returned 1 [0070.873] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0070.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0070.876] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0070.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0070.877] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Q1vCBs.csv", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Q1vCBs.csv", lpFilePart=0x0) returned 0x32 [0070.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0070.877] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Q1vCBs.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\q1vcbs.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0070.878] GetFileType (hFile=0x26c) returned 0x1 [0070.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0070.878] GetFileType (hFile=0x26c) returned 0x1 [0070.878] WriteFile (in: hFile=0x26c, lpBuffer=0x28aeefc*, nNumberOfBytesToWrite=0xc830, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x28aeefc*, lpNumberOfBytesWritten=0x24ea54*=0xc830, lpOverlapped=0x0) returned 1 [0070.880] CloseHandle (hObject=0x26c) returned 1 [0070.890] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Q1vCBs.csv", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Q1vCBs.csv", lpFilePart=0x0) returned 0x32 [0070.890] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Q1vCBs.csv.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Q1vCBs.csv.Crypted", lpFilePart=0x0) returned 0x3a [0070.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0070.891] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Q1vCBs.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\q1vcbs.csv"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30ccb520, ftCreationTime.dwHighDateTime=0x1d4ca55, ftLastAccessTime.dwLowDateTime=0x43873310, ftLastAccessTime.dwHighDateTime=0x1d4cfd3, ftLastWriteTime.dwLowDateTime=0xfb6a1030, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xc830)) returned 1 [0070.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0070.891] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Q1vCBs.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\q1vcbs.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Q1vCBs.csv.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\q1vcbs.csv.crypted")) returned 1 [0070.907] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qjUx.xlsx", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qjUx.xlsx", lpFilePart=0x0) returned 0x31 [0070.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0070.908] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qjUx.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qjux.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0070.909] GetFileType (hFile=0x26c) returned 0x1 [0070.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0070.909] GetFileType (hFile=0x26c) returned 0x1 [0070.909] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0xb3a0 [0070.910] ReadFile (in: hFile=0x26c, lpBuffer=0x28bbc48, nNumberOfBytesToRead=0xb3a0, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x28bbc48*, lpNumberOfBytesRead=0x24ea60*=0xb3a0, lpOverlapped=0x0) returned 1 [0070.911] CloseHandle (hObject=0x26c) returned 1 [0070.945] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0070.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0070.945] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0070.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0070.945] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qjUx.xlsx", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qjUx.xlsx", lpFilePart=0x0) returned 0x31 [0070.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0070.946] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qjUx.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qjux.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0070.947] GetFileType (hFile=0x26c) returned 0x1 [0070.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0070.947] GetFileType (hFile=0x26c) returned 0x1 [0070.947] WriteFile (in: hFile=0x26c, lpBuffer=0x292a554*, nNumberOfBytesToWrite=0xb3b0, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x292a554*, lpNumberOfBytesWritten=0x24ea54*=0xb3b0, lpOverlapped=0x0) returned 1 [0070.949] CloseHandle (hObject=0x26c) returned 1 [0070.954] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qjUx.xlsx", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qjUx.xlsx", lpFilePart=0x0) returned 0x31 [0070.954] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qjUx.xlsx.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qjUx.xlsx.Crypted", lpFilePart=0x0) returned 0x39 [0070.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0070.954] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qjUx.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qjux.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1cd3020, ftCreationTime.dwHighDateTime=0x1d4a551, ftLastAccessTime.dwLowDateTime=0x13ef2890, ftLastAccessTime.dwHighDateTime=0x1d4c84b, ftLastWriteTime.dwLowDateTime=0xfb7395b0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xb3b0)) returned 1 [0070.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0070.955] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qjUx.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qjux.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qjUx.xlsx.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qjux.xlsx.crypted")) returned 1 [0070.955] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RbwRlf.pptx", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RbwRlf.pptx", lpFilePart=0x0) returned 0x33 [0070.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0070.956] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RbwRlf.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rbwrlf.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0071.024] GetFileType (hFile=0x26c) returned 0x1 [0071.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0071.024] GetFileType (hFile=0x26c) returned 0x1 [0071.024] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x17119 [0071.025] ReadFile (in: hFile=0x26c, lpBuffer=0x3851d48, nNumberOfBytesToRead=0x17119, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x3851d48*, lpNumberOfBytesRead=0x24ea60*=0x17119, lpOverlapped=0x0) returned 1 [0071.034] CloseHandle (hObject=0x26c) returned 1 [0071.102] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0071.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0071.102] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0071.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0071.102] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RbwRlf.pptx", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RbwRlf.pptx", lpFilePart=0x0) returned 0x33 [0071.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0071.102] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RbwRlf.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rbwrlf.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0071.104] GetFileType (hFile=0x26c) returned 0x1 [0071.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0071.104] GetFileType (hFile=0x26c) returned 0x1 [0071.104] WriteFile (in: hFile=0x26c, lpBuffer=0x38c5320*, nNumberOfBytesToWrite=0x17120, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x38c5320*, lpNumberOfBytesWritten=0x24ea54*=0x17120, lpOverlapped=0x0) returned 1 [0071.106] CloseHandle (hObject=0x26c) returned 1 [0071.113] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RbwRlf.pptx", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RbwRlf.pptx", lpFilePart=0x0) returned 0x33 [0071.113] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RbwRlf.pptx.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RbwRlf.pptx.Crypted", lpFilePart=0x0) returned 0x3b [0071.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0071.113] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RbwRlf.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rbwrlf.pptx"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1502750, ftCreationTime.dwHighDateTime=0x1d49120, ftLastAccessTime.dwLowDateTime=0x245240f0, ftLastAccessTime.dwHighDateTime=0x1d4f384, ftLastWriteTime.dwLowDateTime=0xfb890210, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x17120)) returned 1 [0071.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0071.114] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RbwRlf.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rbwrlf.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RbwRlf.pptx.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rbwrlf.pptx.crypted")) returned 1 [0071.116] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rO6BuAGLVoGGiJ.xlsx", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rO6BuAGLVoGGiJ.xlsx", lpFilePart=0x0) returned 0x3b [0071.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0071.116] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rO6BuAGLVoGGiJ.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ro6buaglvoggij.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0071.118] GetFileType (hFile=0x26c) returned 0x1 [0071.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0071.118] GetFileType (hFile=0x26c) returned 0x1 [0071.118] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x4896 [0071.119] ReadFile (in: hFile=0x26c, lpBuffer=0x27837b8, nNumberOfBytesToRead=0x4896, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x27837b8*, lpNumberOfBytesRead=0x24ea60*=0x4896, lpOverlapped=0x0) returned 1 [0071.120] CloseHandle (hObject=0x26c) returned 1 [0071.142] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0071.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0071.142] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0071.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0071.143] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rO6BuAGLVoGGiJ.xlsx", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rO6BuAGLVoGGiJ.xlsx", lpFilePart=0x0) returned 0x3b [0071.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0071.143] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rO6BuAGLVoGGiJ.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ro6buaglvoggij.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0071.144] GetFileType (hFile=0x26c) returned 0x1 [0071.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0071.144] GetFileType (hFile=0x26c) returned 0x1 [0071.144] WriteFile (in: hFile=0x26c, lpBuffer=0x27e7220*, nNumberOfBytesToWrite=0x48a0, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x27e7220*, lpNumberOfBytesWritten=0x24ea54*=0x48a0, lpOverlapped=0x0) returned 1 [0071.146] CloseHandle (hObject=0x26c) returned 1 [0071.164] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rO6BuAGLVoGGiJ.xlsx", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rO6BuAGLVoGGiJ.xlsx", lpFilePart=0x0) returned 0x3b [0071.164] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rO6BuAGLVoGGiJ.xlsx.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rO6BuAGLVoGGiJ.xlsx.Crypted", lpFilePart=0x0) returned 0x43 [0071.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0071.164] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rO6BuAGLVoGGiJ.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ro6buaglvoggij.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2604780, ftCreationTime.dwHighDateTime=0x1d4beaf, ftLastAccessTime.dwLowDateTime=0xa2a69e20, ftLastAccessTime.dwHighDateTime=0x1d50cb5, ftLastWriteTime.dwLowDateTime=0xfb902630, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x48a0)) returned 1 [0071.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0071.165] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rO6BuAGLVoGGiJ.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ro6buaglvoggij.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rO6BuAGLVoGGiJ.xlsx.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ro6buaglvoggij.xlsx.crypted")) returned 1 [0071.165] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SqSkG5ZXvBuLN b8e88.docx", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SqSkG5ZXvBuLN b8e88.docx", lpFilePart=0x0) returned 0x40 [0071.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0071.166] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SqSkG5ZXvBuLN b8e88.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\sqskg5zxvbuln b8e88.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0071.170] GetFileType (hFile=0x26c) returned 0x1 [0071.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0071.170] GetFileType (hFile=0x26c) returned 0x1 [0071.170] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x3df9 [0071.170] ReadFile (in: hFile=0x26c, lpBuffer=0x27ec06c, nNumberOfBytesToRead=0x3df9, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x27ec06c*, lpNumberOfBytesRead=0x24ea60*=0x3df9, lpOverlapped=0x0) returned 1 [0071.172] CloseHandle (hObject=0x26c) returned 1 [0071.191] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0071.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0071.191] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0071.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0071.192] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SqSkG5ZXvBuLN b8e88.docx", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SqSkG5ZXvBuLN b8e88.docx", lpFilePart=0x0) returned 0x40 [0071.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0071.193] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SqSkG5ZXvBuLN b8e88.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\sqskg5zxvbuln b8e88.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0071.194] GetFileType (hFile=0x26c) returned 0x1 [0071.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0071.194] GetFileType (hFile=0x26c) returned 0x1 [0071.194] WriteFile (in: hFile=0x26c, lpBuffer=0x284c458*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x284c458*, lpNumberOfBytesWritten=0x24ea54*=0x3e00, lpOverlapped=0x0) returned 1 [0071.195] CloseHandle (hObject=0x26c) returned 1 [0071.200] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SqSkG5ZXvBuLN b8e88.docx", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SqSkG5ZXvBuLN b8e88.docx", lpFilePart=0x0) returned 0x40 [0071.200] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SqSkG5ZXvBuLN b8e88.docx.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SqSkG5ZXvBuLN b8e88.docx.Crypted", lpFilePart=0x0) returned 0x48 [0071.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0071.200] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SqSkG5ZXvBuLN b8e88.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\sqskg5zxvbuln b8e88.docx"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x187f1ec0, ftCreationTime.dwHighDateTime=0x1d50495, ftLastAccessTime.dwLowDateTime=0x8741c3a0, ftLastAccessTime.dwHighDateTime=0x1d4b650, ftLastWriteTime.dwLowDateTime=0xfb974a50, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x3e00)) returned 1 [0071.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0071.200] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SqSkG5ZXvBuLN b8e88.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\sqskg5zxvbuln b8e88.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SqSkG5ZXvBuLN b8e88.docx.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\sqskg5zxvbuln b8e88.docx.crypted")) returned 1 [0071.201] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UbpJy.xlsx", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UbpJy.xlsx", lpFilePart=0x0) returned 0x32 [0071.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0071.201] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UbpJy.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ubpjy.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0071.202] GetFileType (hFile=0x26c) returned 0x1 [0071.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0071.202] GetFileType (hFile=0x26c) returned 0x1 [0071.202] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x6495 [0071.202] ReadFile (in: hFile=0x26c, lpBuffer=0x2850808, nNumberOfBytesToRead=0x6495, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x2850808*, lpNumberOfBytesRead=0x24ea60*=0x6495, lpOverlapped=0x0) returned 1 [0071.238] CloseHandle (hObject=0x26c) returned 1 [0071.259] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0071.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0071.260] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0071.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0071.260] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UbpJy.xlsx", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UbpJy.xlsx", lpFilePart=0x0) returned 0x32 [0071.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0071.260] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UbpJy.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ubpjy.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0071.262] GetFileType (hFile=0x26c) returned 0x1 [0071.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0071.262] GetFileType (hFile=0x26c) returned 0x1 [0071.262] WriteFile (in: hFile=0x26c, lpBuffer=0x28bcd14*, nNumberOfBytesToWrite=0x64a0, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x28bcd14*, lpNumberOfBytesWritten=0x24ea54*=0x64a0, lpOverlapped=0x0) returned 1 [0071.263] CloseHandle (hObject=0x26c) returned 1 [0071.264] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UbpJy.xlsx", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UbpJy.xlsx", lpFilePart=0x0) returned 0x32 [0071.264] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UbpJy.xlsx.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UbpJy.xlsx.Crypted", lpFilePart=0x0) returned 0x3a [0071.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0071.264] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UbpJy.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ubpjy.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa14313e0, ftCreationTime.dwHighDateTime=0x1d4d288, ftLastAccessTime.dwLowDateTime=0xcab1edc0, ftLastAccessTime.dwHighDateTime=0x1d4d380, ftLastWriteTime.dwLowDateTime=0xfba0cfd0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x64a0)) returned 1 [0071.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0071.264] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UbpJy.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ubpjy.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UbpJy.xlsx.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ubpjy.xlsx.crypted")) returned 1 [0071.265] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\V8sSY7 Q9.pptx", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\V8sSY7 Q9.pptx", lpFilePart=0x0) returned 0x36 [0071.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0071.265] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\V8sSY7 Q9.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\v8ssy7 q9.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0071.270] GetFileType (hFile=0x26c) returned 0x1 [0071.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0071.270] GetFileType (hFile=0x26c) returned 0x1 [0071.270] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x14eb2 [0071.271] ReadFile (in: hFile=0x26c, lpBuffer=0x38dc460, nNumberOfBytesToRead=0x14eb2, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x38dc460*, lpNumberOfBytesRead=0x24ea60*=0x14eb2, lpOverlapped=0x0) returned 1 [0071.272] CloseHandle (hObject=0x26c) returned 1 [0071.335] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0071.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0071.335] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0071.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0071.335] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\V8sSY7 Q9.pptx", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\V8sSY7 Q9.pptx", lpFilePart=0x0) returned 0x36 [0071.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0071.335] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\V8sSY7 Q9.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\v8ssy7 q9.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0071.337] GetFileType (hFile=0x26c) returned 0x1 [0071.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0071.337] GetFileType (hFile=0x26c) returned 0x1 [0071.337] WriteFile (in: hFile=0x26c, lpBuffer=0x3944e50*, nNumberOfBytesToWrite=0x14ec0, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x3944e50*, lpNumberOfBytesWritten=0x24ea54*=0x14ec0, lpOverlapped=0x0) returned 1 [0071.339] CloseHandle (hObject=0x26c) returned 1 [0071.345] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\V8sSY7 Q9.pptx", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\V8sSY7 Q9.pptx", lpFilePart=0x0) returned 0x36 [0071.345] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\V8sSY7 Q9.pptx.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\V8sSY7 Q9.pptx.Crypted", lpFilePart=0x0) returned 0x3e [0071.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0071.345] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\V8sSY7 Q9.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\v8ssy7 q9.pptx"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae070280, ftCreationTime.dwHighDateTime=0x1d4fe2f, ftLastAccessTime.dwLowDateTime=0x90fecb00, ftLastAccessTime.dwHighDateTime=0x1d4e601, ftLastWriteTime.dwLowDateTime=0xfbacb6b0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x14ec0)) returned 1 [0071.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0071.345] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\V8sSY7 Q9.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\v8ssy7 q9.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\V8sSY7 Q9.pptx.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\v8ssy7 q9.pptx.crypted")) returned 1 [0071.346] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WAwuOs2pkIS4tYd88H.odt", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WAwuOs2pkIS4tYd88H.odt", lpFilePart=0x0) returned 0x3e [0071.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0071.346] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WAwuOs2pkIS4tYd88H.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wawuos2pkis4tyd88h.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0071.347] GetFileType (hFile=0x26c) returned 0x1 [0071.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0071.347] GetFileType (hFile=0x26c) returned 0x1 [0071.347] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x199a [0071.347] ReadFile (in: hFile=0x26c, lpBuffer=0x2910a60, nNumberOfBytesToRead=0x199a, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x2910a60*, lpNumberOfBytesRead=0x24ea60*=0x199a, lpOverlapped=0x0) returned 1 [0071.351] CloseHandle (hObject=0x26c) returned 1 [0071.426] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0071.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0071.426] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0071.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0071.426] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WAwuOs2pkIS4tYd88H.odt", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WAwuOs2pkIS4tYd88H.odt", lpFilePart=0x0) returned 0x3e [0071.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0071.426] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WAwuOs2pkIS4tYd88H.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wawuos2pkis4tyd88h.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0071.427] GetFileType (hFile=0x26c) returned 0x1 [0071.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0071.428] GetFileType (hFile=0x26c) returned 0x1 [0071.428] WriteFile (in: hFile=0x26c, lpBuffer=0x27678c4*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x27678c4*, lpNumberOfBytesWritten=0x24ea54*=0x19a0, lpOverlapped=0x0) returned 1 [0071.429] CloseHandle (hObject=0x26c) returned 1 [0071.432] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WAwuOs2pkIS4tYd88H.odt", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WAwuOs2pkIS4tYd88H.odt", lpFilePart=0x0) returned 0x3e [0071.432] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WAwuOs2pkIS4tYd88H.odt.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WAwuOs2pkIS4tYd88H.odt.Crypted", lpFilePart=0x0) returned 0x46 [0071.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0071.432] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WAwuOs2pkIS4tYd88H.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wawuos2pkis4tyd88h.odt"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf65cc90, ftCreationTime.dwHighDateTime=0x1d4d0ac, ftLastAccessTime.dwLowDateTime=0xdb83eea0, ftLastAccessTime.dwHighDateTime=0x1d4c881, ftLastWriteTime.dwLowDateTime=0xfbb89d90, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x19a0)) returned 1 [0071.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0071.432] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WAwuOs2pkIS4tYd88H.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wawuos2pkis4tyd88h.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WAwuOs2pkIS4tYd88H.odt.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wawuos2pkis4tyd88h.odt.crypted")) returned 1 [0071.433] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WWWIhSj2QeI.pptx", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WWWIhSj2QeI.pptx", lpFilePart=0x0) returned 0x38 [0071.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0071.434] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WWWIhSj2QeI.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wwwihsj2qei.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0071.434] GetFileType (hFile=0x26c) returned 0x1 [0071.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0071.434] GetFileType (hFile=0x26c) returned 0x1 [0071.434] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x63aa [0071.434] ReadFile (in: hFile=0x26c, lpBuffer=0x2769818, nNumberOfBytesToRead=0x63aa, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x2769818*, lpNumberOfBytesRead=0x24ea60*=0x63aa, lpOverlapped=0x0) returned 1 [0071.458] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0071.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0071.458] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0071.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0071.458] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WWWIhSj2QeI.pptx", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WWWIhSj2QeI.pptx", lpFilePart=0x0) returned 0x38 [0071.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0071.458] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WWWIhSj2QeI.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wwwihsj2qei.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0071.460] GetFileType (hFile=0x26c) returned 0x1 [0071.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0071.460] GetFileType (hFile=0x26c) returned 0x1 [0071.460] WriteFile (in: hFile=0x26c, lpBuffer=0x27d59d0*, nNumberOfBytesToWrite=0x63b0, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x27d59d0*, lpNumberOfBytesWritten=0x24ea54*=0x63b0, lpOverlapped=0x0) returned 1 [0071.462] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WWWIhSj2QeI.pptx", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WWWIhSj2QeI.pptx", lpFilePart=0x0) returned 0x38 [0071.462] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WWWIhSj2QeI.pptx.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WWWIhSj2QeI.pptx.Crypted", lpFilePart=0x0) returned 0x40 [0071.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0071.462] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WWWIhSj2QeI.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wwwihsj2qei.pptx"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa743e9d0, ftCreationTime.dwHighDateTime=0x1d500c9, ftLastAccessTime.dwLowDateTime=0xcef0a4e0, ftLastAccessTime.dwHighDateTime=0x1d4dfe1, ftLastWriteTime.dwLowDateTime=0xfbbd6050, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x63b0)) returned 1 [0071.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0071.462] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WWWIhSj2QeI.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wwwihsj2qei.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WWWIhSj2QeI.pptx.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wwwihsj2qei.pptx.crypted")) returned 1 [0071.472] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XOsh9q LlR_2C.xlsx", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XOsh9q LlR_2C.xlsx", lpFilePart=0x0) returned 0x3a [0071.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0071.472] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XOsh9q LlR_2C.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xosh9q llr_2c.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0071.473] GetFileType (hFile=0x26c) returned 0x1 [0071.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0071.473] GetFileType (hFile=0x26c) returned 0x1 [0071.473] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x109bb [0071.473] ReadFile (in: hFile=0x26c, lpBuffer=0x27dc300, nNumberOfBytesToRead=0x109bb, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x27dc300*, lpNumberOfBytesRead=0x24ea60*=0x109bb, lpOverlapped=0x0) returned 1 [0071.555] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0071.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0071.556] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0071.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0071.556] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XOsh9q LlR_2C.xlsx", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XOsh9q LlR_2C.xlsx", lpFilePart=0x0) returned 0x3a [0071.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0071.556] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XOsh9q LlR_2C.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xosh9q llr_2c.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0071.557] GetFileType (hFile=0x26c) returned 0x1 [0071.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0071.557] GetFileType (hFile=0x26c) returned 0x1 [0071.557] WriteFile (in: hFile=0x26c, lpBuffer=0x285ae40*, nNumberOfBytesToWrite=0x109c0, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x285ae40*, lpNumberOfBytesWritten=0x24ea54*=0x109c0, lpOverlapped=0x0) returned 1 [0071.560] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XOsh9q LlR_2C.xlsx", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XOsh9q LlR_2C.xlsx", lpFilePart=0x0) returned 0x3a [0071.560] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XOsh9q LlR_2C.xlsx.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XOsh9q LlR_2C.xlsx.Crypted", lpFilePart=0x0) returned 0x42 [0071.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0071.560] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XOsh9q LlR_2C.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xosh9q llr_2c.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b5ee50, ftCreationTime.dwHighDateTime=0x1d4c0c0, ftLastAccessTime.dwLowDateTime=0xaada3e50, ftLastAccessTime.dwHighDateTime=0x1d4c852, ftLastWriteTime.dwLowDateTime=0xfbce09f0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x109c0)) returned 1 [0071.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0071.560] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XOsh9q LlR_2C.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xosh9q llr_2c.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XOsh9q LlR_2C.xlsx.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xosh9q llr_2c.xlsx.crypted")) returned 1 [0071.564] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YRTx_GskUlqeQb1a.docx", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YRTx_GskUlqeQb1a.docx", lpFilePart=0x0) returned 0x3d [0071.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0071.564] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YRTx_GskUlqeQb1a.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yrtx_gskulqeqb1a.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0071.565] GetFileType (hFile=0x26c) returned 0x1 [0071.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0071.565] GetFileType (hFile=0x26c) returned 0x1 [0071.565] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x16023 [0071.565] ReadFile (in: hFile=0x26c, lpBuffer=0x397b0b0, nNumberOfBytesToRead=0x16023, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x397b0b0*, lpNumberOfBytesRead=0x24ea60*=0x16023, lpOverlapped=0x0) returned 1 [0071.632] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0071.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0071.633] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0071.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0071.633] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YRTx_GskUlqeQb1a.docx", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YRTx_GskUlqeQb1a.docx", lpFilePart=0x0) returned 0x3d [0071.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0071.633] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YRTx_GskUlqeQb1a.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yrtx_gskulqeqb1a.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0071.634] GetFileType (hFile=0x26c) returned 0x1 [0071.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0071.635] GetFileType (hFile=0x26c) returned 0x1 [0071.635] WriteFile (in: hFile=0x26c, lpBuffer=0x39e91d0*, nNumberOfBytesToWrite=0x16030, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x39e91d0*, lpNumberOfBytesWritten=0x24ea54*=0x16030, lpOverlapped=0x0) returned 1 [0071.637] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YRTx_GskUlqeQb1a.docx", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YRTx_GskUlqeQb1a.docx", lpFilePart=0x0) returned 0x3d [0071.637] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YRTx_GskUlqeQb1a.docx.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YRTx_GskUlqeQb1a.docx.Crypted", lpFilePart=0x0) returned 0x45 [0071.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0071.638] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YRTx_GskUlqeQb1a.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yrtx_gskulqeqb1a.docx"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22198d80, ftCreationTime.dwHighDateTime=0x1d4e145, ftLastAccessTime.dwLowDateTime=0xdfbc1d10, ftLastAccessTime.dwHighDateTime=0x1d4cfb3, ftLastWriteTime.dwLowDateTime=0xfbd9f0d0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x16030)) returned 1 [0071.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0071.638] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YRTx_GskUlqeQb1a.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yrtx_gskulqeqb1a.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YRTx_GskUlqeQb1a.docx.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yrtx_gskulqeqb1a.docx.crypted")) returned 1 [0071.648] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zx0yzk.xlsx", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zx0yzk.xlsx", lpFilePart=0x0) returned 0x33 [0071.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0071.648] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zx0yzk.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zx0yzk.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0071.649] GetFileType (hFile=0x26c) returned 0x1 [0071.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0071.649] GetFileType (hFile=0x26c) returned 0x1 [0071.649] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0xf9de [0071.649] ReadFile (in: hFile=0x26c, lpBuffer=0x28b9120, nNumberOfBytesToRead=0xf9de, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x28b9120*, lpNumberOfBytesRead=0x24ea60*=0xf9de, lpOverlapped=0x0) returned 1 [0071.675] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0071.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0071.675] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0071.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0071.675] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zx0yzk.xlsx", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zx0yzk.xlsx", lpFilePart=0x0) returned 0x33 [0071.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0071.675] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zx0yzk.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zx0yzk.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0071.677] GetFileType (hFile=0x26c) returned 0x1 [0071.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0071.677] GetFileType (hFile=0x26c) returned 0x1 [0071.677] WriteFile (in: hFile=0x26c, lpBuffer=0x2934cc0*, nNumberOfBytesToWrite=0xf9e0, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x2934cc0*, lpNumberOfBytesWritten=0x24ea54*=0xf9e0, lpOverlapped=0x0) returned 1 [0071.679] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zx0yzk.xlsx", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zx0yzk.xlsx", lpFilePart=0x0) returned 0x33 [0071.679] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zx0yzk.xlsx.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zx0yzk.xlsx.Crypted", lpFilePart=0x0) returned 0x3b [0071.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0071.679] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zx0yzk.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zx0yzk.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc66f8140, ftCreationTime.dwHighDateTime=0x1d4c88c, ftLastAccessTime.dwLowDateTime=0x1473e9a0, ftLastAccessTime.dwHighDateTime=0x1d4d367, ftLastWriteTime.dwLowDateTime=0xfbdeb390, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xf9e0)) returned 1 [0071.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0071.680] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zx0yzk.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zx0yzk.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zx0yzk.xlsx.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zx0yzk.xlsx.crypted")) returned 1 [0071.692] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_M-3gGfn7.pptx", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_M-3gGfn7.pptx", lpFilePart=0x0) returned 0x36 [0071.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0071.692] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_M-3gGfn7.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_m-3ggfn7.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0071.693] GetFileType (hFile=0x26c) returned 0x1 [0071.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0071.693] GetFileType (hFile=0x26c) returned 0x1 [0071.693] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0xc025 [0071.693] ReadFile (in: hFile=0x26c, lpBuffer=0x2944bd4, nNumberOfBytesToRead=0xc025, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x2944bd4*, lpNumberOfBytesRead=0x24ea60*=0xc025, lpOverlapped=0x0) returned 1 [0071.752] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0071.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0071.752] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0071.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0071.752] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_M-3gGfn7.pptx", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_M-3gGfn7.pptx", lpFilePart=0x0) returned 0x36 [0071.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0071.752] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_M-3gGfn7.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_m-3ggfn7.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0071.754] GetFileType (hFile=0x26c) returned 0x1 [0071.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0071.754] GetFileType (hFile=0x26c) returned 0x1 [0071.754] WriteFile (in: hFile=0x26c, lpBuffer=0x27c5444*, nNumberOfBytesToWrite=0xc030, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x27c5444*, lpNumberOfBytesWritten=0x24ea54*=0xc030, lpOverlapped=0x0) returned 1 [0071.755] CloseHandle (hObject=0x26c) returned 1 [0071.757] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_M-3gGfn7.pptx", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_M-3gGfn7.pptx", lpFilePart=0x0) returned 0x36 [0071.757] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_M-3gGfn7.pptx.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_M-3gGfn7.pptx.Crypted", lpFilePart=0x0) returned 0x3e [0071.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0071.757] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_M-3gGfn7.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_m-3ggfn7.pptx"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f9eca20, ftCreationTime.dwHighDateTime=0x1d50456, ftLastAccessTime.dwLowDateTime=0xcf931850, ftLastAccessTime.dwHighDateTime=0x1d4d83f, ftLastWriteTime.dwLowDateTime=0xfbea9a70, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xc030)) returned 1 [0071.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0071.757] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_M-3gGfn7.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_m-3ggfn7.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_M-3gGfn7.pptx.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_m-3ggfn7.pptx.crypted")) returned 1 [0071.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0071.758] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq", lpFilePart=0x0) returned 0x2c [0071.758] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\", lpFilePart=0x0) returned 0x2d [0071.758] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5cf2060, ftCreationTime.dwHighDateTime=0x1d4d1f3, ftLastAccessTime.dwLowDateTime=0xc2f09fd0, ftLastAccessTime.dwHighDateTime=0x1d4d2b5, ftLastWriteTime.dwLowDateTime=0xc2f09fd0, ftLastWriteTime.dwHighDateTime=0x1d4d2b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69aea8 [0071.759] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5cf2060, ftCreationTime.dwHighDateTime=0x1d4d1f3, ftLastAccessTime.dwLowDateTime=0xc2f09fd0, ftLastAccessTime.dwHighDateTime=0x1d4d2b5, ftLastWriteTime.dwLowDateTime=0xc2f09fd0, ftLastWriteTime.dwHighDateTime=0x1d4d2b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.759] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3e3d50, ftCreationTime.dwHighDateTime=0x1d4cbe8, ftLastAccessTime.dwLowDateTime=0x3b9e1a50, ftLastAccessTime.dwHighDateTime=0x1d4cb01, ftLastWriteTime.dwLowDateTime=0x3b9e1a50, ftLastWriteTime.dwHighDateTime=0x1d4cb01, nFileSizeHigh=0x0, nFileSizeLow=0x6a25, dwReserved0=0x0, dwReserved1=0x0, cFileName="4P6oAf T212zbLZE.ots", cAlternateFileName="4P6OAF~1.OTS")) returned 1 [0071.759] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f10af20, ftCreationTime.dwHighDateTime=0x1d4c97d, ftLastAccessTime.dwLowDateTime=0x822232d0, ftLastAccessTime.dwHighDateTime=0x1d4d246, ftLastWriteTime.dwLowDateTime=0x822232d0, ftLastWriteTime.dwHighDateTime=0x1d4d246, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAERJpw1vIOjf3pudY", cAlternateFileName="MAERJP~1")) returned 1 [0071.759] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f10af20, ftCreationTime.dwHighDateTime=0x1d4c97d, ftLastAccessTime.dwLowDateTime=0x822232d0, ftLastAccessTime.dwHighDateTime=0x1d4d246, ftLastWriteTime.dwLowDateTime=0x822232d0, ftLastWriteTime.dwHighDateTime=0x1d4d246, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAERJpw1vIOjf3pudY", cAlternateFileName="MAERJP~1")) returned 0 [0071.760] FindClose (in: hFindFile=0x69aea8 | out: hFindFile=0x69aea8) returned 1 [0071.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea54) returned 1 [0071.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea60) returned 1 [0071.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0071.760] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq", lpFilePart=0x0) returned 0x2c [0071.760] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\", lpFilePart=0x0) returned 0x2d [0071.760] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5cf2060, ftCreationTime.dwHighDateTime=0x1d4d1f3, ftLastAccessTime.dwLowDateTime=0xc2f09fd0, ftLastAccessTime.dwHighDateTime=0x1d4d2b5, ftLastWriteTime.dwLowDateTime=0xc2f09fd0, ftLastWriteTime.dwHighDateTime=0x1d4d2b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69aea8 [0071.760] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5cf2060, ftCreationTime.dwHighDateTime=0x1d4d1f3, ftLastAccessTime.dwLowDateTime=0xc2f09fd0, ftLastAccessTime.dwHighDateTime=0x1d4d2b5, ftLastWriteTime.dwLowDateTime=0xc2f09fd0, ftLastWriteTime.dwHighDateTime=0x1d4d2b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.760] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3e3d50, ftCreationTime.dwHighDateTime=0x1d4cbe8, ftLastAccessTime.dwLowDateTime=0x3b9e1a50, ftLastAccessTime.dwHighDateTime=0x1d4cb01, ftLastWriteTime.dwLowDateTime=0x3b9e1a50, ftLastWriteTime.dwHighDateTime=0x1d4cb01, nFileSizeHigh=0x0, nFileSizeLow=0x6a25, dwReserved0=0x0, dwReserved1=0x0, cFileName="4P6oAf T212zbLZE.ots", cAlternateFileName="4P6OAF~1.OTS")) returned 1 [0071.761] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f10af20, ftCreationTime.dwHighDateTime=0x1d4c97d, ftLastAccessTime.dwLowDateTime=0x822232d0, ftLastAccessTime.dwHighDateTime=0x1d4d246, ftLastWriteTime.dwLowDateTime=0x822232d0, ftLastWriteTime.dwHighDateTime=0x1d4d246, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAERJpw1vIOjf3pudY", cAlternateFileName="MAERJP~1")) returned 1 [0071.761] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0071.761] FindClose (in: hFindFile=0x69aea8 | out: hFindFile=0x69aea8) returned 1 [0071.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea54) returned 1 [0071.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea60) returned 1 [0071.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea20) returned 1 [0071.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY", nBufferLength=0x105, lpBuffer=0x24e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY", lpFilePart=0x0) returned 0x3f [0071.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\", nBufferLength=0x105, lpBuffer=0x24e4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\", lpFilePart=0x0) returned 0x40 [0071.761] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\*", lpFindFileData=0x24e748 | out: lpFindFileData=0x24e748*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f10af20, ftCreationTime.dwHighDateTime=0x1d4c97d, ftLastAccessTime.dwLowDateTime=0x822232d0, ftLastAccessTime.dwHighDateTime=0x1d4d246, ftLastWriteTime.dwLowDateTime=0x822232d0, ftLastWriteTime.dwHighDateTime=0x1d4d246, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69aea8 [0071.761] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f10af20, ftCreationTime.dwHighDateTime=0x1d4c97d, ftLastAccessTime.dwLowDateTime=0x822232d0, ftLastAccessTime.dwHighDateTime=0x1d4d246, ftLastWriteTime.dwLowDateTime=0x822232d0, ftLastWriteTime.dwHighDateTime=0x1d4d246, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.762] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9a2000, ftCreationTime.dwHighDateTime=0x1d4cc39, ftLastAccessTime.dwLowDateTime=0xd7cc4ed0, ftLastAccessTime.dwHighDateTime=0x1d4d18a, ftLastWriteTime.dwLowDateTime=0xd7cc4ed0, ftLastWriteTime.dwHighDateTime=0x1d4d18a, nFileSizeHigh=0x0, nFileSizeLow=0xae26, dwReserved0=0x0, dwReserved1=0x0, cFileName="-K8yLT.ods", cAlternateFileName="")) returned 1 [0071.762] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad784070, ftCreationTime.dwHighDateTime=0x1d4d384, ftLastAccessTime.dwLowDateTime=0xc0881150, ftLastAccessTime.dwHighDateTime=0x1d4d162, ftLastWriteTime.dwLowDateTime=0xc0881150, ftLastWriteTime.dwHighDateTime=0x1d4d162, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7r9OW54Bxj7Cg3vKvWi", cAlternateFileName="7R9OW5~1")) returned 1 [0071.762] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a12d4b0, ftCreationTime.dwHighDateTime=0x1d4cb76, ftLastAccessTime.dwLowDateTime=0x150d5ab0, ftLastAccessTime.dwHighDateTime=0x1d4cf5a, ftLastWriteTime.dwLowDateTime=0x150d5ab0, ftLastWriteTime.dwHighDateTime=0x1d4cf5a, nFileSizeHigh=0x0, nFileSizeLow=0x14aac, dwReserved0=0x0, dwReserved1=0x0, cFileName="GXHSgsPw1ysk.odp", cAlternateFileName="GXHSGS~1.ODP")) returned 1 [0071.762] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e140d60, ftCreationTime.dwHighDateTime=0x1d4d3e2, ftLastAccessTime.dwLowDateTime=0x40a24ba0, ftLastAccessTime.dwHighDateTime=0x1d4cbee, ftLastWriteTime.dwLowDateTime=0x40a24ba0, ftLastWriteTime.dwHighDateTime=0x1d4cbee, nFileSizeHigh=0x0, nFileSizeLow=0x238d, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXEo91H22nZj8.xlsx", cAlternateFileName="IXEO91~1.XLS")) returned 1 [0071.762] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e7b5480, ftCreationTime.dwHighDateTime=0x1d4ccac, ftLastAccessTime.dwLowDateTime=0x532aab30, ftLastAccessTime.dwHighDateTime=0x1d4ce39, ftLastWriteTime.dwLowDateTime=0x532aab30, ftLastWriteTime.dwHighDateTime=0x1d4ce39, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OaGDPLeRZhdJESWk5fp", cAlternateFileName="OAGDPL~1")) returned 1 [0071.762] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4be7bc0, ftCreationTime.dwHighDateTime=0x1d4d19a, ftLastAccessTime.dwLowDateTime=0x6cabc2b0, ftLastAccessTime.dwHighDateTime=0x1d4c966, ftLastWriteTime.dwLowDateTime=0x6cabc2b0, ftLastWriteTime.dwHighDateTime=0x1d4c966, nFileSizeHigh=0x0, nFileSizeLow=0x17cd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pF6f5nFBHpTPHJP8.odt", cAlternateFileName="PF6F5N~1.ODT")) returned 1 [0071.763] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74ef5ad0, ftCreationTime.dwHighDateTime=0x1d4d407, ftLastAccessTime.dwLowDateTime=0x41efe930, ftLastAccessTime.dwHighDateTime=0x1d4d360, ftLastWriteTime.dwLowDateTime=0x41efe930, ftLastWriteTime.dwHighDateTime=0x1d4d360, nFileSizeHigh=0x0, nFileSizeLow=0x1310a, dwReserved0=0x0, dwReserved1=0x0, cFileName="r-D58R.rtf", cAlternateFileName="")) returned 1 [0071.763] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc819de50, ftCreationTime.dwHighDateTime=0x1d4d3ef, ftLastAccessTime.dwLowDateTime=0xc885540, ftLastAccessTime.dwHighDateTime=0x1d4cce7, ftLastWriteTime.dwLowDateTime=0xc885540, ftLastWriteTime.dwHighDateTime=0x1d4cce7, nFileSizeHigh=0x0, nFileSizeLow=0x16986, dwReserved0=0x0, dwReserved1=0x0, cFileName="YasD-Ql4DTqeEbS_x4R.pdf", cAlternateFileName="YASD-Q~1.PDF")) returned 1 [0071.763] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0071.763] FindClose (in: hFindFile=0x69aea8 | out: hFindFile=0x69aea8) returned 1 [0071.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9e0) returned 1 [0071.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9ec) returned 1 [0071.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea20) returned 1 [0071.763] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY", nBufferLength=0x105, lpBuffer=0x24e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY", lpFilePart=0x0) returned 0x3f [0071.763] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\", nBufferLength=0x105, lpBuffer=0x24e4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\", lpFilePart=0x0) returned 0x40 [0071.763] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\*", lpFindFileData=0x24e748 | out: lpFindFileData=0x24e748*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f10af20, ftCreationTime.dwHighDateTime=0x1d4c97d, ftLastAccessTime.dwLowDateTime=0x822232d0, ftLastAccessTime.dwHighDateTime=0x1d4d246, ftLastWriteTime.dwLowDateTime=0x822232d0, ftLastWriteTime.dwHighDateTime=0x1d4d246, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69aea8 [0071.764] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f10af20, ftCreationTime.dwHighDateTime=0x1d4c97d, ftLastAccessTime.dwLowDateTime=0x822232d0, ftLastAccessTime.dwHighDateTime=0x1d4d246, ftLastWriteTime.dwLowDateTime=0x822232d0, ftLastWriteTime.dwHighDateTime=0x1d4d246, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.764] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9a2000, ftCreationTime.dwHighDateTime=0x1d4cc39, ftLastAccessTime.dwLowDateTime=0xd7cc4ed0, ftLastAccessTime.dwHighDateTime=0x1d4d18a, ftLastWriteTime.dwLowDateTime=0xd7cc4ed0, ftLastWriteTime.dwHighDateTime=0x1d4d18a, nFileSizeHigh=0x0, nFileSizeLow=0xae26, dwReserved0=0x0, dwReserved1=0x0, cFileName="-K8yLT.ods", cAlternateFileName="")) returned 1 [0071.764] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad784070, ftCreationTime.dwHighDateTime=0x1d4d384, ftLastAccessTime.dwLowDateTime=0xc0881150, ftLastAccessTime.dwHighDateTime=0x1d4d162, ftLastWriteTime.dwLowDateTime=0xc0881150, ftLastWriteTime.dwHighDateTime=0x1d4d162, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7r9OW54Bxj7Cg3vKvWi", cAlternateFileName="7R9OW5~1")) returned 1 [0071.764] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a12d4b0, ftCreationTime.dwHighDateTime=0x1d4cb76, ftLastAccessTime.dwLowDateTime=0x150d5ab0, ftLastAccessTime.dwHighDateTime=0x1d4cf5a, ftLastWriteTime.dwLowDateTime=0x150d5ab0, ftLastWriteTime.dwHighDateTime=0x1d4cf5a, nFileSizeHigh=0x0, nFileSizeLow=0x14aac, dwReserved0=0x0, dwReserved1=0x0, cFileName="GXHSgsPw1ysk.odp", cAlternateFileName="GXHSGS~1.ODP")) returned 1 [0071.764] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e140d60, ftCreationTime.dwHighDateTime=0x1d4d3e2, ftLastAccessTime.dwLowDateTime=0x40a24ba0, ftLastAccessTime.dwHighDateTime=0x1d4cbee, ftLastWriteTime.dwLowDateTime=0x40a24ba0, ftLastWriteTime.dwHighDateTime=0x1d4cbee, nFileSizeHigh=0x0, nFileSizeLow=0x238d, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXEo91H22nZj8.xlsx", cAlternateFileName="IXEO91~1.XLS")) returned 1 [0071.764] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e7b5480, ftCreationTime.dwHighDateTime=0x1d4ccac, ftLastAccessTime.dwLowDateTime=0x532aab30, ftLastAccessTime.dwHighDateTime=0x1d4ce39, ftLastWriteTime.dwLowDateTime=0x532aab30, ftLastWriteTime.dwHighDateTime=0x1d4ce39, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OaGDPLeRZhdJESWk5fp", cAlternateFileName="OAGDPL~1")) returned 1 [0071.765] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4be7bc0, ftCreationTime.dwHighDateTime=0x1d4d19a, ftLastAccessTime.dwLowDateTime=0x6cabc2b0, ftLastAccessTime.dwHighDateTime=0x1d4c966, ftLastWriteTime.dwLowDateTime=0x6cabc2b0, ftLastWriteTime.dwHighDateTime=0x1d4c966, nFileSizeHigh=0x0, nFileSizeLow=0x17cd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pF6f5nFBHpTPHJP8.odt", cAlternateFileName="PF6F5N~1.ODT")) returned 1 [0071.765] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74ef5ad0, ftCreationTime.dwHighDateTime=0x1d4d407, ftLastAccessTime.dwLowDateTime=0x41efe930, ftLastAccessTime.dwHighDateTime=0x1d4d360, ftLastWriteTime.dwLowDateTime=0x41efe930, ftLastWriteTime.dwHighDateTime=0x1d4d360, nFileSizeHigh=0x0, nFileSizeLow=0x1310a, dwReserved0=0x0, dwReserved1=0x0, cFileName="r-D58R.rtf", cAlternateFileName="")) returned 1 [0071.765] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc819de50, ftCreationTime.dwHighDateTime=0x1d4d3ef, ftLastAccessTime.dwLowDateTime=0xc885540, ftLastAccessTime.dwHighDateTime=0x1d4cce7, ftLastWriteTime.dwLowDateTime=0xc885540, ftLastWriteTime.dwHighDateTime=0x1d4cce7, nFileSizeHigh=0x0, nFileSizeLow=0x16986, dwReserved0=0x0, dwReserved1=0x0, cFileName="YasD-Ql4DTqeEbS_x4R.pdf", cAlternateFileName="YASD-Q~1.PDF")) returned 1 [0071.765] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc819de50, ftCreationTime.dwHighDateTime=0x1d4d3ef, ftLastAccessTime.dwLowDateTime=0xc885540, ftLastAccessTime.dwHighDateTime=0x1d4cce7, ftLastWriteTime.dwLowDateTime=0xc885540, ftLastWriteTime.dwHighDateTime=0x1d4cce7, nFileSizeHigh=0x0, nFileSizeLow=0x16986, dwReserved0=0x0, dwReserved1=0x0, cFileName="YasD-Ql4DTqeEbS_x4R.pdf", cAlternateFileName="YASD-Q~1.PDF")) returned 0 [0071.765] FindClose (in: hFindFile=0x69aea8 | out: hFindFile=0x69aea8) returned 1 [0071.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9e0) returned 1 [0071.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9ec) returned 1 [0071.766] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\IXEo91H22nZj8.xlsx", nBufferLength=0x105, lpBuffer=0x24e3d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\IXEo91H22nZj8.xlsx", lpFilePart=0x0) returned 0x52 [0071.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8c4) returned 1 [0071.766] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\IXEo91H22nZj8.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\ixeo91h22nzj8.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0071.767] GetFileType (hFile=0x26c) returned 0x1 [0071.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8c0) returned 1 [0071.767] GetFileType (hFile=0x26c) returned 0x1 [0071.767] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24e9cc | out: lpFileSizeHigh=0x24e9cc*=0x0) returned 0x238d [0071.767] ReadFile (in: hFile=0x26c, lpBuffer=0x27d662c, nNumberOfBytesToRead=0x238d, lpNumberOfBytesRead=0x24e978, lpOverlapped=0x0 | out: lpBuffer=0x27d662c*, lpNumberOfBytesRead=0x24e978*=0x238d, lpOverlapped=0x0) returned 1 [0071.768] CloseHandle (hObject=0x26c) returned 1 [0071.789] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e4e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0071.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e944) returned 1 [0071.789] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24e9c0 | out: lpFileInformation=0x24e9c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0071.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e940) returned 1 [0071.790] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\IXEo91H22nZj8.xlsx", nBufferLength=0x105, lpBuffer=0x24e3bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\IXEo91H22nZj8.xlsx", lpFilePart=0x0) returned 0x52 [0071.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8b0) returned 1 [0071.790] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\IXEo91H22nZj8.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\ixeo91h22nzj8.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0071.791] GetFileType (hFile=0x26c) returned 0x1 [0071.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8ac) returned 1 [0071.791] GetFileType (hFile=0x26c) returned 0x1 [0071.791] WriteFile (in: hFile=0x26c, lpBuffer=0x282e744*, nNumberOfBytesToWrite=0x2390, lpNumberOfBytesWritten=0x24e96c, lpOverlapped=0x0 | out: lpBuffer=0x282e744*, lpNumberOfBytesWritten=0x24e96c*=0x2390, lpOverlapped=0x0) returned 1 [0071.792] CloseHandle (hObject=0x26c) returned 1 [0071.793] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\IXEo91H22nZj8.xlsx", nBufferLength=0x105, lpBuffer=0x24e4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\IXEo91H22nZj8.xlsx", lpFilePart=0x0) returned 0x52 [0071.793] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\IXEo91H22nZj8.xlsx.Crypted", nBufferLength=0x105, lpBuffer=0x24e4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\IXEo91H22nZj8.xlsx.Crypted", lpFilePart=0x0) returned 0x5a [0071.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e950) returned 1 [0071.793] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\IXEo91H22nZj8.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\ixeo91h22nzj8.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x24e9cc | out: lpFileInformation=0x24e9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e140d60, ftCreationTime.dwHighDateTime=0x1d4d3e2, ftLastAccessTime.dwLowDateTime=0x40a24ba0, ftLastAccessTime.dwHighDateTime=0x1d4cbee, ftLastWriteTime.dwLowDateTime=0xfbf1be90, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x2390)) returned 1 [0071.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e94c) returned 1 [0071.794] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\IXEo91H22nZj8.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\ixeo91h22nzj8.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\IXEo91H22nZj8.xlsx.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\ixeo91h22nzj8.xlsx.crypted")) returned 1 [0071.794] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\pF6f5nFBHpTPHJP8.odt", nBufferLength=0x105, lpBuffer=0x24e3d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\pF6f5nFBHpTPHJP8.odt", lpFilePart=0x0) returned 0x54 [0071.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8c4) returned 1 [0071.794] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\pF6f5nFBHpTPHJP8.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\pf6f5nfbhptphjp8.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0071.795] GetFileType (hFile=0x26c) returned 0x1 [0071.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8c0) returned 1 [0071.796] GetFileType (hFile=0x26c) returned 0x1 [0071.796] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24e9cc | out: lpFileSizeHigh=0x24e9cc*=0x0) returned 0x17cd8 [0071.796] ReadFile (in: hFile=0x26c, lpBuffer=0x3a36640, nNumberOfBytesToRead=0x17cd8, lpNumberOfBytesRead=0x24e978, lpOverlapped=0x0 | out: lpBuffer=0x3a36640*, lpNumberOfBytesRead=0x24e978*=0x17cd8, lpOverlapped=0x0) returned 1 [0071.801] CloseHandle (hObject=0x26c) returned 1 [0071.833] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e4e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0071.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e944) returned 1 [0071.833] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24e9c0 | out: lpFileInformation=0x24e9c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0071.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e940) returned 1 [0071.833] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\pF6f5nFBHpTPHJP8.odt", nBufferLength=0x105, lpBuffer=0x24e3bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\pF6f5nFBHpTPHJP8.odt", lpFilePart=0x0) returned 0x54 [0071.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8b0) returned 1 [0071.833] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\pF6f5nFBHpTPHJP8.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\pf6f5nfbhptphjp8.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0071.835] GetFileType (hFile=0x26c) returned 0x1 [0071.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8ac) returned 1 [0071.835] GetFileType (hFile=0x26c) returned 0x1 [0071.835] WriteFile (in: hFile=0x26c, lpBuffer=0x37a1410*, nNumberOfBytesToWrite=0x17ce0, lpNumberOfBytesWritten=0x24e96c, lpOverlapped=0x0 | out: lpBuffer=0x37a1410*, lpNumberOfBytesWritten=0x24e96c*=0x17ce0, lpOverlapped=0x0) returned 1 [0071.838] CloseHandle (hObject=0x26c) returned 1 [0071.840] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\pF6f5nFBHpTPHJP8.odt", nBufferLength=0x105, lpBuffer=0x24e4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\pF6f5nFBHpTPHJP8.odt", lpFilePart=0x0) returned 0x54 [0071.840] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\pF6f5nFBHpTPHJP8.odt.Crypted", nBufferLength=0x105, lpBuffer=0x24e4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\pF6f5nFBHpTPHJP8.odt.Crypted", lpFilePart=0x0) returned 0x5c [0071.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e950) returned 1 [0071.840] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\pF6f5nFBHpTPHJP8.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\pf6f5nfbhptphjp8.odt"), fInfoLevelId=0x0, lpFileInformation=0x24e9cc | out: lpFileInformation=0x24e9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4be7bc0, ftCreationTime.dwHighDateTime=0x1d4d19a, ftLastAccessTime.dwLowDateTime=0x6cabc2b0, ftLastAccessTime.dwHighDateTime=0x1d4c966, ftLastWriteTime.dwLowDateTime=0xfbf8e2b0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x17ce0)) returned 1 [0071.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e94c) returned 1 [0071.840] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\pF6f5nFBHpTPHJP8.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\pf6f5nfbhptphjp8.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\pF6f5nFBHpTPHJP8.odt.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\pf6f5nfbhptphjp8.odt.crypted")) returned 1 [0071.841] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\r-D58R.rtf", nBufferLength=0x105, lpBuffer=0x24e3d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\r-D58R.rtf", lpFilePart=0x0) returned 0x4a [0071.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8c4) returned 1 [0071.841] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\r-D58R.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\r-d58r.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0071.843] GetFileType (hFile=0x26c) returned 0x1 [0071.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8c0) returned 1 [0071.843] GetFileType (hFile=0x26c) returned 0x1 [0071.843] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24e9cc | out: lpFileSizeHigh=0x24e9cc*=0x0) returned 0x1310a [0071.843] ReadFile (in: hFile=0x26c, lpBuffer=0x274a93c, nNumberOfBytesToRead=0x1310a, lpNumberOfBytesRead=0x24e978, lpOverlapped=0x0 | out: lpBuffer=0x274a93c*, lpNumberOfBytesRead=0x24e978*=0x1310a, lpOverlapped=0x0) returned 1 [0071.845] CloseHandle (hObject=0x26c) returned 1 [0071.902] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e4e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0071.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e944) returned 1 [0071.902] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24e9c0 | out: lpFileInformation=0x24e9c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0071.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e940) returned 1 [0071.903] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\r-D58R.rtf", nBufferLength=0x105, lpBuffer=0x24e3bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\r-D58R.rtf", lpFilePart=0x0) returned 0x4a [0071.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8b0) returned 1 [0071.903] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\r-D58R.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\r-d58r.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0071.904] GetFileType (hFile=0x26c) returned 0x1 [0071.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8ac) returned 1 [0071.904] GetFileType (hFile=0x26c) returned 0x1 [0071.904] WriteFile (in: hFile=0x26c, lpBuffer=0x27d0bc8*, nNumberOfBytesToWrite=0x13110, lpNumberOfBytesWritten=0x24e96c, lpOverlapped=0x0 | out: lpBuffer=0x27d0bc8*, lpNumberOfBytesWritten=0x24e96c*=0x13110, lpOverlapped=0x0) returned 1 [0071.906] CloseHandle (hObject=0x26c) returned 1 [0071.909] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\r-D58R.rtf", nBufferLength=0x105, lpBuffer=0x24e4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\r-D58R.rtf", lpFilePart=0x0) returned 0x4a [0071.909] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\r-D58R.rtf.Crypted", nBufferLength=0x105, lpBuffer=0x24e4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\r-D58R.rtf.Crypted", lpFilePart=0x0) returned 0x52 [0071.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e950) returned 1 [0071.909] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\r-D58R.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\r-d58r.rtf"), fInfoLevelId=0x0, lpFileInformation=0x24e9cc | out: lpFileInformation=0x24e9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74ef5ad0, ftCreationTime.dwHighDateTime=0x1d4d407, ftLastAccessTime.dwLowDateTime=0x41efe930, ftLastAccessTime.dwHighDateTime=0x1d4d360, ftLastWriteTime.dwLowDateTime=0xfc026830, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x13110)) returned 1 [0071.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e94c) returned 1 [0071.909] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\r-D58R.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\r-d58r.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\r-D58R.rtf.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\r-d58r.rtf.crypted")) returned 1 [0071.910] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\YasD-Ql4DTqeEbS_x4R.pdf", nBufferLength=0x105, lpBuffer=0x24e3d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\YasD-Ql4DTqeEbS_x4R.pdf", lpFilePart=0x0) returned 0x57 [0071.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8c4) returned 1 [0071.910] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\YasD-Ql4DTqeEbS_x4R.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\yasd-ql4dtqeebs_x4r.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0071.920] GetFileType (hFile=0x26c) returned 0x1 [0071.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8c0) returned 1 [0071.920] GetFileType (hFile=0x26c) returned 0x1 [0071.920] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24e9cc | out: lpFileSizeHigh=0x24e9cc*=0x0) returned 0x16986 [0071.920] ReadFile (in: hFile=0x26c, lpBuffer=0x3a4e338, nNumberOfBytesToRead=0x16986, lpNumberOfBytesRead=0x24e978, lpOverlapped=0x0 | out: lpBuffer=0x3a4e338*, lpNumberOfBytesRead=0x24e978*=0x16986, lpOverlapped=0x0) returned 1 [0071.922] CloseHandle (hObject=0x26c) returned 1 [0071.946] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e4e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0071.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e944) returned 1 [0071.946] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24e9c0 | out: lpFileInformation=0x24e9c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0071.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e940) returned 1 [0071.946] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\YasD-Ql4DTqeEbS_x4R.pdf", nBufferLength=0x105, lpBuffer=0x24e3bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\YasD-Ql4DTqeEbS_x4R.pdf", lpFilePart=0x0) returned 0x57 [0071.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8b0) returned 1 [0071.946] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\YasD-Ql4DTqeEbS_x4R.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\yasd-ql4dtqeebs_x4r.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0071.949] GetFileType (hFile=0x26c) returned 0x1 [0071.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8ac) returned 1 [0071.949] GetFileType (hFile=0x26c) returned 0x1 [0071.949] WriteFile (in: hFile=0x26c, lpBuffer=0x3839990*, nNumberOfBytesToWrite=0x16990, lpNumberOfBytesWritten=0x24e96c, lpOverlapped=0x0 | out: lpBuffer=0x3839990*, lpNumberOfBytesWritten=0x24e96c*=0x16990, lpOverlapped=0x0) returned 1 [0071.951] CloseHandle (hObject=0x26c) returned 1 [0071.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\YasD-Ql4DTqeEbS_x4R.pdf", nBufferLength=0x105, lpBuffer=0x24e4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\YasD-Ql4DTqeEbS_x4R.pdf", lpFilePart=0x0) returned 0x57 [0071.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\YasD-Ql4DTqeEbS_x4R.pdf.Crypted", nBufferLength=0x105, lpBuffer=0x24e4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\YasD-Ql4DTqeEbS_x4R.pdf.Crypted", lpFilePart=0x0) returned 0x5f [0071.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e950) returned 1 [0071.953] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\YasD-Ql4DTqeEbS_x4R.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\yasd-ql4dtqeebs_x4r.pdf"), fInfoLevelId=0x0, lpFileInformation=0x24e9cc | out: lpFileInformation=0x24e9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc819de50, ftCreationTime.dwHighDateTime=0x1d4d3ef, ftLastAccessTime.dwLowDateTime=0xc885540, ftLastAccessTime.dwHighDateTime=0x1d4cce7, ftLastWriteTime.dwLowDateTime=0xfc098c50, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x16990)) returned 1 [0071.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e94c) returned 1 [0071.954] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\YasD-Ql4DTqeEbS_x4R.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\yasd-ql4dtqeebs_x4r.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\YasD-Ql4DTqeEbS_x4R.pdf.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\yasd-ql4dtqeebs_x4r.pdf.crypted")) returned 1 [0071.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0071.954] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi", nBufferLength=0x105, lpBuffer=0x24e4b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi", lpFilePart=0x0) returned 0x53 [0071.954] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\", nBufferLength=0x105, lpBuffer=0x24e488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\", lpFilePart=0x0) returned 0x54 [0071.954] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\*", lpFindFileData=0x24e6d4 | out: lpFindFileData=0x24e6d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad784070, ftCreationTime.dwHighDateTime=0x1d4d384, ftLastAccessTime.dwLowDateTime=0xc0881150, ftLastAccessTime.dwHighDateTime=0x1d4d162, ftLastWriteTime.dwLowDateTime=0xc0881150, ftLastWriteTime.dwHighDateTime=0x1d4d162, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b128 [0071.955] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad784070, ftCreationTime.dwHighDateTime=0x1d4d384, ftLastAccessTime.dwLowDateTime=0xc0881150, ftLastAccessTime.dwHighDateTime=0x1d4d162, ftLastWriteTime.dwLowDateTime=0xc0881150, ftLastWriteTime.dwHighDateTime=0x1d4d162, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.955] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70dd8c90, ftCreationTime.dwHighDateTime=0x1d4cfa8, ftLastAccessTime.dwLowDateTime=0xd0572360, ftLastAccessTime.dwHighDateTime=0x1d4d1e3, ftLastWriteTime.dwLowDateTime=0xd0572360, ftLastWriteTime.dwHighDateTime=0x1d4d1e3, nFileSizeHigh=0x0, nFileSizeLow=0x1758d, dwReserved0=0x0, dwReserved1=0x0, cFileName="7 Im9rgNYyJl.odp", cAlternateFileName="7IM9RG~1.ODP")) returned 1 [0071.955] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe017d60, ftCreationTime.dwHighDateTime=0x1d4c5b8, ftLastAccessTime.dwLowDateTime=0x8fe59720, ftLastAccessTime.dwHighDateTime=0x1d4c997, ftLastWriteTime.dwLowDateTime=0x8fe59720, ftLastWriteTime.dwHighDateTime=0x1d4c997, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bnoPaHMEJ", cAlternateFileName="BNOPAH~1")) returned 1 [0071.955] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cac07f0, ftCreationTime.dwHighDateTime=0x1d4c5d0, ftLastAccessTime.dwLowDateTime=0x1b9b5850, ftLastAccessTime.dwHighDateTime=0x1d4c6db, ftLastWriteTime.dwLowDateTime=0x1b9b5850, ftLastWriteTime.dwHighDateTime=0x1d4c6db, nFileSizeHigh=0x0, nFileSizeLow=0x15108, dwReserved0=0x0, dwReserved1=0x0, cFileName="egT9FkoOL9KcGhH8_M.csv", cAlternateFileName="EGT9FK~1.CSV")) returned 1 [0071.955] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b9e2710, ftCreationTime.dwHighDateTime=0x1d4cd82, ftLastAccessTime.dwLowDateTime=0xbb7ba920, ftLastAccessTime.dwHighDateTime=0x1d4d3d7, ftLastWriteTime.dwLowDateTime=0xbb7ba920, ftLastWriteTime.dwHighDateTime=0x1d4d3d7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NxBS-Yk4vaIA7F8OLY", cAlternateFileName="NXBS-Y~1")) returned 1 [0071.956] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x109d5310, ftCreationTime.dwHighDateTime=0x1d4cbfc, ftLastAccessTime.dwLowDateTime=0x6aaa34e0, ftLastAccessTime.dwHighDateTime=0x1d4d08e, ftLastWriteTime.dwLowDateTime=0x6aaa34e0, ftLastWriteTime.dwHighDateTime=0x1d4d08e, nFileSizeHigh=0x0, nFileSizeLow=0x15ef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="q4wKX.doc", cAlternateFileName="")) returned 1 [0071.956] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cede330, ftCreationTime.dwHighDateTime=0x1d4d460, ftLastAccessTime.dwLowDateTime=0x19ecd10, ftLastAccessTime.dwHighDateTime=0x1d4d2f2, ftLastWriteTime.dwLowDateTime=0x19ecd10, ftLastWriteTime.dwHighDateTime=0x1d4d2f2, nFileSizeHigh=0x0, nFileSizeLow=0x10302, dwReserved0=0x0, dwReserved1=0x0, cFileName="yq2RkH3GEKoo96A.odt", cAlternateFileName="YQ2RKH~1.ODT")) returned 1 [0071.956] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x275503c0, ftCreationTime.dwHighDateTime=0x1d4ca7e, ftLastAccessTime.dwLowDateTime=0x221a2590, ftLastAccessTime.dwHighDateTime=0x1d4cb53, ftLastWriteTime.dwLowDateTime=0x221a2590, ftLastWriteTime.dwHighDateTime=0x1d4cb53, nFileSizeHigh=0x0, nFileSizeLow=0x18623, dwReserved0=0x0, dwReserved1=0x0, cFileName="_eZ1XcjFQ0_fsr.odp", cAlternateFileName="_EZ1XC~1.ODP")) returned 1 [0071.956] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b8c5e50, ftCreationTime.dwHighDateTime=0x1d4c595, ftLastAccessTime.dwLowDateTime=0xb4d80410, ftLastAccessTime.dwHighDateTime=0x1d4cf86, ftLastWriteTime.dwLowDateTime=0xb4d80410, ftLastWriteTime.dwHighDateTime=0x1d4cf86, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_raEKX4psyDwqXm", cAlternateFileName="_RAEKX~1")) returned 1 [0071.956] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b8c5e50, ftCreationTime.dwHighDateTime=0x1d4c595, ftLastAccessTime.dwLowDateTime=0xb4d80410, ftLastAccessTime.dwHighDateTime=0x1d4cf86, ftLastWriteTime.dwLowDateTime=0xb4d80410, ftLastWriteTime.dwHighDateTime=0x1d4cf86, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_raEKX4psyDwqXm", cAlternateFileName="_RAEKX~1")) returned 0 [0071.956] FindClose (in: hFindFile=0x69b128 | out: hFindFile=0x69b128) returned 1 [0071.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e96c) returned 1 [0071.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e978) returned 1 [0071.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0071.957] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi", nBufferLength=0x105, lpBuffer=0x24e4b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi", lpFilePart=0x0) returned 0x53 [0071.957] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\", nBufferLength=0x105, lpBuffer=0x24e488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\", lpFilePart=0x0) returned 0x54 [0071.957] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\*", lpFindFileData=0x24e6d4 | out: lpFindFileData=0x24e6d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad784070, ftCreationTime.dwHighDateTime=0x1d4d384, ftLastAccessTime.dwLowDateTime=0xc0881150, ftLastAccessTime.dwHighDateTime=0x1d4d162, ftLastWriteTime.dwLowDateTime=0xc0881150, ftLastWriteTime.dwHighDateTime=0x1d4d162, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b128 [0071.957] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad784070, ftCreationTime.dwHighDateTime=0x1d4d384, ftLastAccessTime.dwLowDateTime=0xc0881150, ftLastAccessTime.dwHighDateTime=0x1d4d162, ftLastWriteTime.dwLowDateTime=0xc0881150, ftLastWriteTime.dwHighDateTime=0x1d4d162, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.957] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70dd8c90, ftCreationTime.dwHighDateTime=0x1d4cfa8, ftLastAccessTime.dwLowDateTime=0xd0572360, ftLastAccessTime.dwHighDateTime=0x1d4d1e3, ftLastWriteTime.dwLowDateTime=0xd0572360, ftLastWriteTime.dwHighDateTime=0x1d4d1e3, nFileSizeHigh=0x0, nFileSizeLow=0x1758d, dwReserved0=0x0, dwReserved1=0x0, cFileName="7 Im9rgNYyJl.odp", cAlternateFileName="7IM9RG~1.ODP")) returned 1 [0071.958] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe017d60, ftCreationTime.dwHighDateTime=0x1d4c5b8, ftLastAccessTime.dwLowDateTime=0x8fe59720, ftLastAccessTime.dwHighDateTime=0x1d4c997, ftLastWriteTime.dwLowDateTime=0x8fe59720, ftLastWriteTime.dwHighDateTime=0x1d4c997, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bnoPaHMEJ", cAlternateFileName="BNOPAH~1")) returned 1 [0071.958] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cac07f0, ftCreationTime.dwHighDateTime=0x1d4c5d0, ftLastAccessTime.dwLowDateTime=0x1b9b5850, ftLastAccessTime.dwHighDateTime=0x1d4c6db, ftLastWriteTime.dwLowDateTime=0x1b9b5850, ftLastWriteTime.dwHighDateTime=0x1d4c6db, nFileSizeHigh=0x0, nFileSizeLow=0x15108, dwReserved0=0x0, dwReserved1=0x0, cFileName="egT9FkoOL9KcGhH8_M.csv", cAlternateFileName="EGT9FK~1.CSV")) returned 1 [0071.958] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b9e2710, ftCreationTime.dwHighDateTime=0x1d4cd82, ftLastAccessTime.dwLowDateTime=0xbb7ba920, ftLastAccessTime.dwHighDateTime=0x1d4d3d7, ftLastWriteTime.dwLowDateTime=0xbb7ba920, ftLastWriteTime.dwHighDateTime=0x1d4d3d7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NxBS-Yk4vaIA7F8OLY", cAlternateFileName="NXBS-Y~1")) returned 1 [0071.958] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x109d5310, ftCreationTime.dwHighDateTime=0x1d4cbfc, ftLastAccessTime.dwLowDateTime=0x6aaa34e0, ftLastAccessTime.dwHighDateTime=0x1d4d08e, ftLastWriteTime.dwLowDateTime=0x6aaa34e0, ftLastWriteTime.dwHighDateTime=0x1d4d08e, nFileSizeHigh=0x0, nFileSizeLow=0x15ef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="q4wKX.doc", cAlternateFileName="")) returned 1 [0071.958] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cede330, ftCreationTime.dwHighDateTime=0x1d4d460, ftLastAccessTime.dwLowDateTime=0x19ecd10, ftLastAccessTime.dwHighDateTime=0x1d4d2f2, ftLastWriteTime.dwLowDateTime=0x19ecd10, ftLastWriteTime.dwHighDateTime=0x1d4d2f2, nFileSizeHigh=0x0, nFileSizeLow=0x10302, dwReserved0=0x0, dwReserved1=0x0, cFileName="yq2RkH3GEKoo96A.odt", cAlternateFileName="YQ2RKH~1.ODT")) returned 1 [0071.958] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x275503c0, ftCreationTime.dwHighDateTime=0x1d4ca7e, ftLastAccessTime.dwLowDateTime=0x221a2590, ftLastAccessTime.dwHighDateTime=0x1d4cb53, ftLastWriteTime.dwLowDateTime=0x221a2590, ftLastWriteTime.dwHighDateTime=0x1d4cb53, nFileSizeHigh=0x0, nFileSizeLow=0x18623, dwReserved0=0x0, dwReserved1=0x0, cFileName="_eZ1XcjFQ0_fsr.odp", cAlternateFileName="_EZ1XC~1.ODP")) returned 1 [0071.959] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b8c5e50, ftCreationTime.dwHighDateTime=0x1d4c595, ftLastAccessTime.dwLowDateTime=0xb4d80410, ftLastAccessTime.dwHighDateTime=0x1d4cf86, ftLastWriteTime.dwLowDateTime=0xb4d80410, ftLastWriteTime.dwHighDateTime=0x1d4cf86, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_raEKX4psyDwqXm", cAlternateFileName="_RAEKX~1")) returned 1 [0071.959] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0071.959] FindClose (in: hFindFile=0x69b128 | out: hFindFile=0x69b128) returned 1 [0071.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e96c) returned 1 [0071.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e978) returned 1 [0071.959] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\egT9FkoOL9KcGhH8_M.csv", nBufferLength=0x105, lpBuffer=0x24e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\egT9FkoOL9KcGhH8_M.csv", lpFilePart=0x0) returned 0x6a [0071.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e850) returned 1 [0071.959] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\egT9FkoOL9KcGhH8_M.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\egt9fkool9kcghh8_m.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0071.960] GetFileType (hFile=0x26c) returned 0x1 [0071.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e84c) returned 1 [0071.960] GetFileType (hFile=0x26c) returned 0x1 [0071.960] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24e958 | out: lpFileSizeHigh=0x24e958*=0x0) returned 0x15108 [0071.960] ReadFile (in: hFile=0x26c, lpBuffer=0x3850340, nNumberOfBytesToRead=0x15108, lpNumberOfBytesRead=0x24e904, lpOverlapped=0x0 | out: lpBuffer=0x3850340*, lpNumberOfBytesRead=0x24e904*=0x15108, lpOverlapped=0x0) returned 1 [0071.962] CloseHandle (hObject=0x26c) returned 1 [0072.029] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0072.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8d0) returned 1 [0072.029] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24e94c | out: lpFileInformation=0x24e94c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0072.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8cc) returned 1 [0072.029] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\egT9FkoOL9KcGhH8_M.csv", nBufferLength=0x105, lpBuffer=0x24e348, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\egT9FkoOL9KcGhH8_M.csv", lpFilePart=0x0) returned 0x6a [0072.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e83c) returned 1 [0072.029] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\egT9FkoOL9KcGhH8_M.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\egt9fkool9kcghh8_m.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0072.031] GetFileType (hFile=0x26c) returned 0x1 [0072.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e838) returned 1 [0072.031] GetFileType (hFile=0x26c) returned 0x1 [0072.031] WriteFile (in: hFile=0x26c, lpBuffer=0x38b98c8*, nNumberOfBytesToWrite=0x15110, lpNumberOfBytesWritten=0x24e8f8, lpOverlapped=0x0 | out: lpBuffer=0x38b98c8*, lpNumberOfBytesWritten=0x24e8f8*=0x15110, lpOverlapped=0x0) returned 1 [0072.033] CloseHandle (hObject=0x26c) returned 1 [0072.036] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\egT9FkoOL9KcGhH8_M.csv", nBufferLength=0x105, lpBuffer=0x24e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\egT9FkoOL9KcGhH8_M.csv", lpFilePart=0x0) returned 0x6a [0072.036] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\egT9FkoOL9KcGhH8_M.csv.Crypted", nBufferLength=0x105, lpBuffer=0x24e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\egT9FkoOL9KcGhH8_M.csv.Crypted", lpFilePart=0x0) returned 0x72 [0072.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8dc) returned 1 [0072.036] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\egT9FkoOL9KcGhH8_M.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\egt9fkool9kcghh8_m.csv"), fInfoLevelId=0x0, lpFileInformation=0x24e958 | out: lpFileInformation=0x24e958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cac07f0, ftCreationTime.dwHighDateTime=0x1d4c5d0, ftLastAccessTime.dwLowDateTime=0x1b9b5850, ftLastAccessTime.dwHighDateTime=0x1d4c6db, ftLastWriteTime.dwLowDateTime=0xfc157330, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x15110)) returned 1 [0072.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8d8) returned 1 [0072.036] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\egT9FkoOL9KcGhH8_M.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\egt9fkool9kcghh8_m.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\egT9FkoOL9KcGhH8_M.csv.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\egt9fkool9kcghh8_m.csv.crypted")) returned 1 [0072.037] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\q4wKX.doc", nBufferLength=0x105, lpBuffer=0x24e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\q4wKX.doc", lpFilePart=0x0) returned 0x5d [0072.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e850) returned 1 [0072.037] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\q4wKX.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\q4wkx.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0072.037] GetFileType (hFile=0x26c) returned 0x1 [0072.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e84c) returned 1 [0072.037] GetFileType (hFile=0x26c) returned 0x1 [0072.037] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24e958 | out: lpFileSizeHigh=0x24e958*=0x0) returned 0x15ef8 [0072.037] ReadFile (in: hFile=0x26c, lpBuffer=0x38ce9f8, nNumberOfBytesToRead=0x15ef8, lpNumberOfBytesRead=0x24e904, lpOverlapped=0x0 | out: lpBuffer=0x38ce9f8*, lpNumberOfBytesRead=0x24e904*=0x15ef8, lpOverlapped=0x0) returned 1 [0072.039] CloseHandle (hObject=0x26c) returned 1 [0072.062] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0072.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8d0) returned 1 [0072.063] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24e94c | out: lpFileInformation=0x24e94c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0072.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8cc) returned 1 [0072.063] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\q4wKX.doc", nBufferLength=0x105, lpBuffer=0x24e348, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\q4wKX.doc", lpFilePart=0x0) returned 0x5d [0072.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e83c) returned 1 [0072.063] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\q4wKX.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\q4wkx.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0072.064] GetFileType (hFile=0x26c) returned 0x1 [0072.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e838) returned 1 [0072.065] GetFileType (hFile=0x26c) returned 0x1 [0072.065] WriteFile (in: hFile=0x26c, lpBuffer=0x393c530*, nNumberOfBytesToWrite=0x15f00, lpNumberOfBytesWritten=0x24e8f8, lpOverlapped=0x0 | out: lpBuffer=0x393c530*, lpNumberOfBytesWritten=0x24e8f8*=0x15f00, lpOverlapped=0x0) returned 1 [0072.067] CloseHandle (hObject=0x26c) returned 1 [0072.068] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\q4wKX.doc", nBufferLength=0x105, lpBuffer=0x24e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\q4wKX.doc", lpFilePart=0x0) returned 0x5d [0072.068] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\q4wKX.doc.Crypted", nBufferLength=0x105, lpBuffer=0x24e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\q4wKX.doc.Crypted", lpFilePart=0x0) returned 0x65 [0072.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8dc) returned 1 [0072.069] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\q4wKX.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\q4wkx.doc"), fInfoLevelId=0x0, lpFileInformation=0x24e958 | out: lpFileInformation=0x24e958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x109d5310, ftCreationTime.dwHighDateTime=0x1d4cbfc, ftLastAccessTime.dwLowDateTime=0x6aaa34e0, ftLastAccessTime.dwHighDateTime=0x1d4d08e, ftLastWriteTime.dwLowDateTime=0xfc1a35f0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x15f00)) returned 1 [0072.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8d8) returned 1 [0072.069] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\q4wKX.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\q4wkx.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\q4wKX.doc.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\q4wkx.doc.crypted")) returned 1 [0072.069] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\yq2RkH3GEKoo96A.odt", nBufferLength=0x105, lpBuffer=0x24e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\yq2RkH3GEKoo96A.odt", lpFilePart=0x0) returned 0x67 [0072.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e850) returned 1 [0072.070] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\yq2RkH3GEKoo96A.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\yq2rkh3gekoo96a.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0072.070] GetFileType (hFile=0x26c) returned 0x1 [0072.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e84c) returned 1 [0072.070] GetFileType (hFile=0x26c) returned 0x1 [0072.070] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24e958 | out: lpFileSizeHigh=0x24e958*=0x0) returned 0x10302 [0072.070] ReadFile (in: hFile=0x26c, lpBuffer=0x28cfe9c, nNumberOfBytesToRead=0x10302, lpNumberOfBytesRead=0x24e904, lpOverlapped=0x0 | out: lpBuffer=0x28cfe9c*, lpNumberOfBytesRead=0x24e904*=0x10302, lpOverlapped=0x0) returned 1 [0072.072] CloseHandle (hObject=0x26c) returned 1 [0072.097] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0072.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8d0) returned 1 [0072.097] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24e94c | out: lpFileInformation=0x24e94c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0072.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8cc) returned 1 [0072.097] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\yq2RkH3GEKoo96A.odt", nBufferLength=0x105, lpBuffer=0x24e348, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\yq2RkH3GEKoo96A.odt", lpFilePart=0x0) returned 0x67 [0072.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e83c) returned 1 [0072.097] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\yq2RkH3GEKoo96A.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\yq2rkh3gekoo96a.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0072.099] GetFileType (hFile=0x26c) returned 0x1 [0072.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e838) returned 1 [0072.099] GetFileType (hFile=0x26c) returned 0x1 [0072.099] WriteFile (in: hFile=0x26c, lpBuffer=0x275b79c*, nNumberOfBytesToWrite=0x10310, lpNumberOfBytesWritten=0x24e8f8, lpOverlapped=0x0 | out: lpBuffer=0x275b79c*, lpNumberOfBytesWritten=0x24e8f8*=0x10310, lpOverlapped=0x0) returned 1 [0072.100] CloseHandle (hObject=0x26c) returned 1 [0072.540] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\yq2RkH3GEKoo96A.odt", nBufferLength=0x105, lpBuffer=0x24e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\yq2RkH3GEKoo96A.odt", lpFilePart=0x0) returned 0x67 [0072.540] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\yq2RkH3GEKoo96A.odt.Crypted", nBufferLength=0x105, lpBuffer=0x24e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\yq2RkH3GEKoo96A.odt.Crypted", lpFilePart=0x0) returned 0x6f [0072.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8dc) returned 1 [0072.540] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\yq2RkH3GEKoo96A.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\yq2rkh3gekoo96a.odt"), fInfoLevelId=0x0, lpFileInformation=0x24e958 | out: lpFileInformation=0x24e958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cede330, ftCreationTime.dwHighDateTime=0x1d4d460, ftLastAccessTime.dwLowDateTime=0x19ecd10, ftLastAccessTime.dwHighDateTime=0x1d4d2f2, ftLastWriteTime.dwLowDateTime=0xfc23bb70, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x10310)) returned 1 [0072.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8d8) returned 1 [0072.540] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\yq2RkH3GEKoo96A.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\yq2rkh3gekoo96a.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\yq2RkH3GEKoo96A.odt.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\yq2rkh3gekoo96a.odt.crypted")) returned 1 [0072.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0072.541] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\bnoPaHMEJ", nBufferLength=0x105, lpBuffer=0x24e440, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\bnoPaHMEJ", lpFilePart=0x0) returned 0x5d [0072.541] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\bnoPaHMEJ\\", nBufferLength=0x105, lpBuffer=0x24e414, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\bnoPaHMEJ\\", lpFilePart=0x0) returned 0x5e [0072.541] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\bnoPaHMEJ\\*", lpFindFileData=0x24e660 | out: lpFindFileData=0x24e660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe017d60, ftCreationTime.dwHighDateTime=0x1d4c5b8, ftLastAccessTime.dwLowDateTime=0x8fe59720, ftLastAccessTime.dwHighDateTime=0x1d4c997, ftLastWriteTime.dwLowDateTime=0x8fe59720, ftLastWriteTime.dwHighDateTime=0x1d4c997, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b128 [0072.541] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe017d60, ftCreationTime.dwHighDateTime=0x1d4c5b8, ftLastAccessTime.dwLowDateTime=0x8fe59720, ftLastAccessTime.dwHighDateTime=0x1d4c997, ftLastWriteTime.dwLowDateTime=0x8fe59720, ftLastWriteTime.dwHighDateTime=0x1d4c997, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.541] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe017d60, ftCreationTime.dwHighDateTime=0x1d4c5b8, ftLastAccessTime.dwLowDateTime=0x8fe59720, ftLastAccessTime.dwHighDateTime=0x1d4c997, ftLastWriteTime.dwLowDateTime=0x8fe59720, ftLastWriteTime.dwHighDateTime=0x1d4c997, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0072.541] FindClose (in: hFindFile=0x69b128 | out: hFindFile=0x69b128) returned 1 [0072.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8f8) returned 1 [0072.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e904) returned 1 [0072.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0072.542] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\bnoPaHMEJ", nBufferLength=0x105, lpBuffer=0x24e440, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\bnoPaHMEJ", lpFilePart=0x0) returned 0x5d [0072.542] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\bnoPaHMEJ\\", nBufferLength=0x105, lpBuffer=0x24e414, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\bnoPaHMEJ\\", lpFilePart=0x0) returned 0x5e [0072.542] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\bnoPaHMEJ\\*", lpFindFileData=0x24e660 | out: lpFindFileData=0x24e660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe017d60, ftCreationTime.dwHighDateTime=0x1d4c5b8, ftLastAccessTime.dwLowDateTime=0x8fe59720, ftLastAccessTime.dwHighDateTime=0x1d4c997, ftLastWriteTime.dwLowDateTime=0x8fe59720, ftLastWriteTime.dwHighDateTime=0x1d4c997, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b128 [0072.542] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe017d60, ftCreationTime.dwHighDateTime=0x1d4c5b8, ftLastAccessTime.dwLowDateTime=0x8fe59720, ftLastAccessTime.dwHighDateTime=0x1d4c997, ftLastWriteTime.dwLowDateTime=0x8fe59720, ftLastWriteTime.dwHighDateTime=0x1d4c997, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.542] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe017d60, ftCreationTime.dwHighDateTime=0x1d4c5b8, ftLastAccessTime.dwLowDateTime=0x8fe59720, ftLastAccessTime.dwHighDateTime=0x1d4c997, ftLastWriteTime.dwLowDateTime=0x8fe59720, ftLastWriteTime.dwHighDateTime=0x1d4c997, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0072.542] FindClose (in: hFindFile=0x69b128 | out: hFindFile=0x69b128) returned 1 [0072.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8f8) returned 1 [0072.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e904) returned 1 [0072.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0072.542] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY", nBufferLength=0x105, lpBuffer=0x24e440, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY", lpFilePart=0x0) returned 0x66 [0072.542] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\", nBufferLength=0x105, lpBuffer=0x24e414, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\", lpFilePart=0x0) returned 0x67 [0072.543] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\*", lpFindFileData=0x24e660 | out: lpFindFileData=0x24e660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b9e2710, ftCreationTime.dwHighDateTime=0x1d4cd82, ftLastAccessTime.dwLowDateTime=0xbb7ba920, ftLastAccessTime.dwHighDateTime=0x1d4d3d7, ftLastWriteTime.dwLowDateTime=0xbb7ba920, ftLastWriteTime.dwHighDateTime=0x1d4d3d7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b128 [0072.543] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b9e2710, ftCreationTime.dwHighDateTime=0x1d4cd82, ftLastAccessTime.dwLowDateTime=0xbb7ba920, ftLastAccessTime.dwHighDateTime=0x1d4d3d7, ftLastWriteTime.dwLowDateTime=0xbb7ba920, ftLastWriteTime.dwHighDateTime=0x1d4d3d7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.543] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6440df90, ftCreationTime.dwHighDateTime=0x1d4d4d6, ftLastAccessTime.dwLowDateTime=0xafc4dc30, ftLastAccessTime.dwHighDateTime=0x1d4c565, ftLastWriteTime.dwLowDateTime=0xafc4dc30, ftLastWriteTime.dwHighDateTime=0x1d4c565, nFileSizeHigh=0x0, nFileSizeLow=0x17f0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrVZ.rtf", cAlternateFileName="")) returned 1 [0072.543] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88a776d0, ftCreationTime.dwHighDateTime=0x1d4c5f6, ftLastAccessTime.dwLowDateTime=0x2aa47c50, ftLastAccessTime.dwHighDateTime=0x1d4d3d3, ftLastWriteTime.dwLowDateTime=0x2aa47c50, ftLastWriteTime.dwHighDateTime=0x1d4d3d3, nFileSizeHigh=0x0, nFileSizeLow=0x6f85, dwReserved0=0x0, dwReserved1=0x0, cFileName="ovdNY.pdf", cAlternateFileName="")) returned 1 [0072.543] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15724eb0, ftCreationTime.dwHighDateTime=0x1d4d226, ftLastAccessTime.dwLowDateTime=0x695462e0, ftLastAccessTime.dwHighDateTime=0x1d4d341, ftLastWriteTime.dwLowDateTime=0x695462e0, ftLastWriteTime.dwHighDateTime=0x1d4d341, nFileSizeHigh=0x0, nFileSizeLow=0x18e6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pl3osqnrWiDw.doc", cAlternateFileName="PL3OSQ~1.DOC")) returned 1 [0072.543] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa26df270, ftCreationTime.dwHighDateTime=0x1d4cf1e, ftLastAccessTime.dwLowDateTime=0xfabfb6f0, ftLastAccessTime.dwHighDateTime=0x1d4ca11, ftLastWriteTime.dwLowDateTime=0xfabfb6f0, ftLastWriteTime.dwHighDateTime=0x1d4ca11, nFileSizeHigh=0x0, nFileSizeLow=0x14497, dwReserved0=0x0, dwReserved1=0x0, cFileName="raxbhRv_M.ots", cAlternateFileName="RAXBHR~1.OTS")) returned 1 [0072.543] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0072.543] FindClose (in: hFindFile=0x69b128 | out: hFindFile=0x69b128) returned 1 [0072.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8f8) returned 1 [0072.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e904) returned 1 [0072.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0072.544] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY", nBufferLength=0x105, lpBuffer=0x24e440, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY", lpFilePart=0x0) returned 0x66 [0072.544] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\", nBufferLength=0x105, lpBuffer=0x24e414, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\", lpFilePart=0x0) returned 0x67 [0072.544] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\*", lpFindFileData=0x24e660 | out: lpFindFileData=0x24e660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b9e2710, ftCreationTime.dwHighDateTime=0x1d4cd82, ftLastAccessTime.dwLowDateTime=0xbb7ba920, ftLastAccessTime.dwHighDateTime=0x1d4d3d7, ftLastWriteTime.dwLowDateTime=0xbb7ba920, ftLastWriteTime.dwHighDateTime=0x1d4d3d7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b128 [0072.544] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b9e2710, ftCreationTime.dwHighDateTime=0x1d4cd82, ftLastAccessTime.dwLowDateTime=0xbb7ba920, ftLastAccessTime.dwHighDateTime=0x1d4d3d7, ftLastWriteTime.dwLowDateTime=0xbb7ba920, ftLastWriteTime.dwHighDateTime=0x1d4d3d7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.544] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6440df90, ftCreationTime.dwHighDateTime=0x1d4d4d6, ftLastAccessTime.dwLowDateTime=0xafc4dc30, ftLastAccessTime.dwHighDateTime=0x1d4c565, ftLastWriteTime.dwLowDateTime=0xafc4dc30, ftLastWriteTime.dwHighDateTime=0x1d4c565, nFileSizeHigh=0x0, nFileSizeLow=0x17f0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrVZ.rtf", cAlternateFileName="")) returned 1 [0072.544] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88a776d0, ftCreationTime.dwHighDateTime=0x1d4c5f6, ftLastAccessTime.dwLowDateTime=0x2aa47c50, ftLastAccessTime.dwHighDateTime=0x1d4d3d3, ftLastWriteTime.dwLowDateTime=0x2aa47c50, ftLastWriteTime.dwHighDateTime=0x1d4d3d3, nFileSizeHigh=0x0, nFileSizeLow=0x6f85, dwReserved0=0x0, dwReserved1=0x0, cFileName="ovdNY.pdf", cAlternateFileName="")) returned 1 [0072.544] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15724eb0, ftCreationTime.dwHighDateTime=0x1d4d226, ftLastAccessTime.dwLowDateTime=0x695462e0, ftLastAccessTime.dwHighDateTime=0x1d4d341, ftLastWriteTime.dwLowDateTime=0x695462e0, ftLastWriteTime.dwHighDateTime=0x1d4d341, nFileSizeHigh=0x0, nFileSizeLow=0x18e6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pl3osqnrWiDw.doc", cAlternateFileName="PL3OSQ~1.DOC")) returned 1 [0072.544] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa26df270, ftCreationTime.dwHighDateTime=0x1d4cf1e, ftLastAccessTime.dwLowDateTime=0xfabfb6f0, ftLastAccessTime.dwHighDateTime=0x1d4ca11, ftLastWriteTime.dwLowDateTime=0xfabfb6f0, ftLastWriteTime.dwHighDateTime=0x1d4ca11, nFileSizeHigh=0x0, nFileSizeLow=0x14497, dwReserved0=0x0, dwReserved1=0x0, cFileName="raxbhRv_M.ots", cAlternateFileName="RAXBHR~1.OTS")) returned 1 [0072.545] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa26df270, ftCreationTime.dwHighDateTime=0x1d4cf1e, ftLastAccessTime.dwLowDateTime=0xfabfb6f0, ftLastAccessTime.dwHighDateTime=0x1d4ca11, ftLastWriteTime.dwLowDateTime=0xfabfb6f0, ftLastWriteTime.dwHighDateTime=0x1d4ca11, nFileSizeHigh=0x0, nFileSizeLow=0x14497, dwReserved0=0x0, dwReserved1=0x0, cFileName="raxbhRv_M.ots", cAlternateFileName="RAXBHR~1.OTS")) returned 0 [0072.545] FindClose (in: hFindFile=0x69b128 | out: hFindFile=0x69b128) returned 1 [0072.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8f8) returned 1 [0072.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e904) returned 1 [0072.545] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\FrVZ.rtf", nBufferLength=0x105, lpBuffer=0x24e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\FrVZ.rtf", lpFilePart=0x0) returned 0x6f [0072.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e7dc) returned 1 [0072.545] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\FrVZ.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\nxbs-yk4vaia7f8oly\\frvz.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0072.545] GetFileType (hFile=0x26c) returned 0x1 [0072.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e7d8) returned 1 [0072.545] GetFileType (hFile=0x26c) returned 0x1 [0072.545] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24e8e4 | out: lpFileSizeHigh=0x24e8e4*=0x0) returned 0x17f0a [0072.546] ReadFile (in: hFile=0x26c, lpBuffer=0x3972a70, nNumberOfBytesToRead=0x17f0a, lpNumberOfBytesRead=0x24e890, lpOverlapped=0x0 | out: lpBuffer=0x3972a70*, lpNumberOfBytesRead=0x24e890*=0x17f0a, lpOverlapped=0x0) returned 1 [0072.547] CloseHandle (hObject=0x26c) returned 1 [0072.601] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e3fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0072.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e85c) returned 1 [0072.601] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24e8d8 | out: lpFileInformation=0x24e8d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0072.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e858) returned 1 [0072.601] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\FrVZ.rtf", nBufferLength=0x105, lpBuffer=0x24e2d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\FrVZ.rtf", lpFilePart=0x0) returned 0x6f [0072.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e7c8) returned 1 [0072.601] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\FrVZ.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\nxbs-yk4vaia7f8oly\\frvz.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0072.603] GetFileType (hFile=0x26c) returned 0x1 [0072.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e7c4) returned 1 [0072.603] GetFileType (hFile=0x26c) returned 0x1 [0072.603] WriteFile (in: hFile=0x26c, lpBuffer=0x39ea5f8*, nNumberOfBytesToWrite=0x17f10, lpNumberOfBytesWritten=0x24e884, lpOverlapped=0x0 | out: lpBuffer=0x39ea5f8*, lpNumberOfBytesWritten=0x24e884*=0x17f10, lpOverlapped=0x0) returned 1 [0072.605] CloseHandle (hObject=0x26c) returned 1 [0072.608] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\FrVZ.rtf", nBufferLength=0x105, lpBuffer=0x24e408, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\FrVZ.rtf", lpFilePart=0x0) returned 0x6f [0072.608] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\FrVZ.rtf.Crypted", nBufferLength=0x105, lpBuffer=0x24e408, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\FrVZ.rtf.Crypted", lpFilePart=0x0) returned 0x77 [0072.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e868) returned 1 [0072.608] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\FrVZ.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\nxbs-yk4vaia7f8oly\\frvz.rtf"), fInfoLevelId=0x0, lpFileInformation=0x24e8e4 | out: lpFileInformation=0x24e8e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6440df90, ftCreationTime.dwHighDateTime=0x1d4d4d6, ftLastAccessTime.dwLowDateTime=0xafc4dc30, ftLastAccessTime.dwHighDateTime=0x1d4c565, ftLastWriteTime.dwLowDateTime=0xfc2d40f0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x17f10)) returned 1 [0072.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e864) returned 1 [0072.608] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\FrVZ.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\nxbs-yk4vaia7f8oly\\frvz.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\FrVZ.rtf.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\nxbs-yk4vaia7f8oly\\frvz.rtf.crypted")) returned 1 [0072.609] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\ovdNY.pdf", nBufferLength=0x105, lpBuffer=0x24e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\ovdNY.pdf", lpFilePart=0x0) returned 0x70 [0072.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e7dc) returned 1 [0072.609] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\ovdNY.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\nxbs-yk4vaia7f8oly\\ovdny.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0072.610] GetFileType (hFile=0x26c) returned 0x1 [0072.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e7d8) returned 1 [0072.610] GetFileType (hFile=0x26c) returned 0x1 [0072.610] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24e8e4 | out: lpFileSizeHigh=0x24e8e4*=0x0) returned 0x6f85 [0072.610] ReadFile (in: hFile=0x26c, lpBuffer=0x27be3a0, nNumberOfBytesToRead=0x6f85, lpNumberOfBytesRead=0x24e890, lpOverlapped=0x0 | out: lpBuffer=0x27be3a0*, lpNumberOfBytesRead=0x24e890*=0x6f85, lpOverlapped=0x0) returned 1 [0072.611] CloseHandle (hObject=0x26c) returned 1 [0072.632] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e3fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0072.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e85c) returned 1 [0072.632] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24e8d8 | out: lpFileInformation=0x24e8d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0072.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e858) returned 1 [0072.632] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\ovdNY.pdf", nBufferLength=0x105, lpBuffer=0x24e2d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\ovdNY.pdf", lpFilePart=0x0) returned 0x70 [0072.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e7c8) returned 1 [0072.632] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\ovdNY.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\nxbs-yk4vaia7f8oly\\ovdny.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0072.635] GetFileType (hFile=0x26c) returned 0x1 [0072.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e7c4) returned 1 [0072.635] GetFileType (hFile=0x26c) returned 0x1 [0072.635] WriteFile (in: hFile=0x26c, lpBuffer=0x282df5c*, nNumberOfBytesToWrite=0x6f90, lpNumberOfBytesWritten=0x24e884, lpOverlapped=0x0 | out: lpBuffer=0x282df5c*, lpNumberOfBytesWritten=0x24e884*=0x6f90, lpOverlapped=0x0) returned 1 [0072.636] CloseHandle (hObject=0x26c) returned 1 [0072.640] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\ovdNY.pdf", nBufferLength=0x105, lpBuffer=0x24e408, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\ovdNY.pdf", lpFilePart=0x0) returned 0x70 [0072.640] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\ovdNY.pdf.Crypted", nBufferLength=0x105, lpBuffer=0x24e408, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\ovdNY.pdf.Crypted", lpFilePart=0x0) returned 0x78 [0072.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e868) returned 1 [0072.640] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\ovdNY.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\nxbs-yk4vaia7f8oly\\ovdny.pdf"), fInfoLevelId=0x0, lpFileInformation=0x24e8e4 | out: lpFileInformation=0x24e8e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88a776d0, ftCreationTime.dwHighDateTime=0x1d4c5f6, ftLastAccessTime.dwLowDateTime=0x2aa47c50, ftLastAccessTime.dwHighDateTime=0x1d4d3d3, ftLastWriteTime.dwLowDateTime=0xfc3203b0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x6f90)) returned 1 [0072.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e864) returned 1 [0072.640] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\ovdNY.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\nxbs-yk4vaia7f8oly\\ovdny.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\ovdNY.pdf.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\nxbs-yk4vaia7f8oly\\ovdny.pdf.crypted")) returned 1 [0072.641] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\Pl3osqnrWiDw.doc", nBufferLength=0x105, lpBuffer=0x24e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\Pl3osqnrWiDw.doc", lpFilePart=0x0) returned 0x77 [0072.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e7dc) returned 1 [0072.641] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\Pl3osqnrWiDw.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\nxbs-yk4vaia7f8oly\\pl3osqnrwidw.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0072.641] GetFileType (hFile=0x26c) returned 0x1 [0072.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e7d8) returned 1 [0072.641] GetFileType (hFile=0x26c) returned 0x1 [0072.642] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24e8e4 | out: lpFileSizeHigh=0x24e8e4*=0x0) returned 0x18e6e [0072.642] ReadFile (in: hFile=0x26c, lpBuffer=0x3a02528, nNumberOfBytesToRead=0x18e6e, lpNumberOfBytesRead=0x24e890, lpOverlapped=0x0 | out: lpBuffer=0x3a02528*, lpNumberOfBytesRead=0x24e890*=0x18e6e, lpOverlapped=0x0) returned 1 [0072.672] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e3fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0072.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e85c) returned 1 [0072.673] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24e8d8 | out: lpFileInformation=0x24e8d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0072.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e858) returned 1 [0072.673] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\Pl3osqnrWiDw.doc", nBufferLength=0x105, lpBuffer=0x24e2d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\Pl3osqnrWiDw.doc", lpFilePart=0x0) returned 0x77 [0072.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e7c8) returned 1 [0072.673] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\Pl3osqnrWiDw.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\nxbs-yk4vaia7f8oly\\pl3osqnrwidw.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0072.678] GetFileType (hFile=0x26c) returned 0x1 [0072.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e7c4) returned 1 [0072.678] GetFileType (hFile=0x26c) returned 0x1 [0072.678] WriteFile (in: hFile=0x26c, lpBuffer=0x3a1b3b8*, nNumberOfBytesToWrite=0x18e70, lpNumberOfBytesWritten=0x24e884, lpOverlapped=0x0 | out: lpBuffer=0x3a1b3b8*, lpNumberOfBytesWritten=0x24e884*=0x18e70, lpOverlapped=0x0) returned 1 [0072.681] CloseHandle (hObject=0x26c) returned 1 [0072.684] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\Pl3osqnrWiDw.doc", nBufferLength=0x105, lpBuffer=0x24e408, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\Pl3osqnrWiDw.doc", lpFilePart=0x0) returned 0x77 [0072.684] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\Pl3osqnrWiDw.doc.Crypted", nBufferLength=0x105, lpBuffer=0x24e408, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\Pl3osqnrWiDw.doc.Crypted", lpFilePart=0x0) returned 0x7f [0072.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e868) returned 1 [0072.684] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\Pl3osqnrWiDw.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\nxbs-yk4vaia7f8oly\\pl3osqnrwidw.doc"), fInfoLevelId=0x0, lpFileInformation=0x24e8e4 | out: lpFileInformation=0x24e8e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15724eb0, ftCreationTime.dwHighDateTime=0x1d4d226, ftLastAccessTime.dwLowDateTime=0x695462e0, ftLastAccessTime.dwHighDateTime=0x1d4d341, ftLastWriteTime.dwLowDateTime=0xfc3927d0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x18e70)) returned 1 [0072.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e864) returned 1 [0072.684] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\Pl3osqnrWiDw.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\nxbs-yk4vaia7f8oly\\pl3osqnrwidw.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\NxBS-Yk4vaIA7F8OLY\\Pl3osqnrWiDw.doc.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\nxbs-yk4vaia7f8oly\\pl3osqnrwidw.doc.crypted")) returned 1 [0072.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0072.685] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm", nBufferLength=0x105, lpBuffer=0x24e440, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm", lpFilePart=0x0) returned 0x63 [0072.685] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm\\", nBufferLength=0x105, lpBuffer=0x24e414, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm\\", lpFilePart=0x0) returned 0x64 [0072.685] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm\\*", lpFindFileData=0x24e660 | out: lpFindFileData=0x24e660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b8c5e50, ftCreationTime.dwHighDateTime=0x1d4c595, ftLastAccessTime.dwLowDateTime=0xb4d80410, ftLastAccessTime.dwHighDateTime=0x1d4cf86, ftLastWriteTime.dwLowDateTime=0xb4d80410, ftLastWriteTime.dwHighDateTime=0x1d4cf86, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69ade8 [0072.686] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b8c5e50, ftCreationTime.dwHighDateTime=0x1d4c595, ftLastAccessTime.dwLowDateTime=0xb4d80410, ftLastAccessTime.dwHighDateTime=0x1d4cf86, ftLastWriteTime.dwLowDateTime=0xb4d80410, ftLastWriteTime.dwHighDateTime=0x1d4cf86, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.687] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9043520, ftCreationTime.dwHighDateTime=0x1d4c86d, ftLastAccessTime.dwLowDateTime=0xc63d7700, ftLastAccessTime.dwHighDateTime=0x1d4ca48, ftLastWriteTime.dwLowDateTime=0xc63d7700, ftLastWriteTime.dwHighDateTime=0x1d4ca48, nFileSizeHigh=0x0, nFileSizeLow=0x14b7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="6R9M5TSg.ods", cAlternateFileName="")) returned 1 [0072.687] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadab58a0, ftCreationTime.dwHighDateTime=0x1d4d327, ftLastAccessTime.dwLowDateTime=0x661c4bb0, ftLastAccessTime.dwHighDateTime=0x1d4ce46, ftLastWriteTime.dwLowDateTime=0x661c4bb0, ftLastWriteTime.dwHighDateTime=0x1d4ce46, nFileSizeHigh=0x0, nFileSizeLow=0x12df3, dwReserved0=0x0, dwReserved1=0x0, cFileName="8rifTB-DF.pps", cAlternateFileName="8RIFTB~1.PPS")) returned 1 [0072.687] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4b4ba0, ftCreationTime.dwHighDateTime=0x1d4d09e, ftLastAccessTime.dwLowDateTime=0x8ff0dc0, ftLastAccessTime.dwHighDateTime=0x1d4d024, ftLastWriteTime.dwLowDateTime=0x8ff0dc0, ftLastWriteTime.dwHighDateTime=0x1d4d024, nFileSizeHigh=0x0, nFileSizeLow=0x5327, dwReserved0=0x0, dwReserved1=0x0, cFileName="b1AiNK_C2.pps", cAlternateFileName="B1AINK~1.PPS")) returned 1 [0072.687] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ceeab00, ftCreationTime.dwHighDateTime=0x1d4c69a, ftLastAccessTime.dwLowDateTime=0xfbb4700, ftLastAccessTime.dwHighDateTime=0x1d4d2cc, ftLastWriteTime.dwLowDateTime=0xfbb4700, ftLastWriteTime.dwHighDateTime=0x1d4d2cc, nFileSizeHigh=0x0, nFileSizeLow=0x510d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HBaoiNYL.ppt", cAlternateFileName="")) returned 1 [0072.687] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf29b940, ftCreationTime.dwHighDateTime=0x1d4d33d, ftLastAccessTime.dwLowDateTime=0xfab70760, ftLastAccessTime.dwHighDateTime=0x1d4ced2, ftLastWriteTime.dwLowDateTime=0xfab70760, ftLastWriteTime.dwHighDateTime=0x1d4ced2, nFileSizeHigh=0x0, nFileSizeLow=0x17b8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pr8jDyh.pptx", cAlternateFileName="PR8JDY~1.PPT")) returned 1 [0072.687] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0072.687] FindClose (in: hFindFile=0x69ade8 | out: hFindFile=0x69ade8) returned 1 [0072.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8f8) returned 1 [0072.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e904) returned 1 [0072.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0072.688] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm", nBufferLength=0x105, lpBuffer=0x24e440, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm", lpFilePart=0x0) returned 0x63 [0072.688] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm\\", nBufferLength=0x105, lpBuffer=0x24e414, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm\\", lpFilePart=0x0) returned 0x64 [0072.688] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm\\*", lpFindFileData=0x24e660 | out: lpFindFileData=0x24e660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b8c5e50, ftCreationTime.dwHighDateTime=0x1d4c595, ftLastAccessTime.dwLowDateTime=0xb4d80410, ftLastAccessTime.dwHighDateTime=0x1d4cf86, ftLastWriteTime.dwLowDateTime=0xb4d80410, ftLastWriteTime.dwHighDateTime=0x1d4cf86, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69ade8 [0072.688] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b8c5e50, ftCreationTime.dwHighDateTime=0x1d4c595, ftLastAccessTime.dwLowDateTime=0xb4d80410, ftLastAccessTime.dwHighDateTime=0x1d4cf86, ftLastWriteTime.dwLowDateTime=0xb4d80410, ftLastWriteTime.dwHighDateTime=0x1d4cf86, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.688] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9043520, ftCreationTime.dwHighDateTime=0x1d4c86d, ftLastAccessTime.dwLowDateTime=0xc63d7700, ftLastAccessTime.dwHighDateTime=0x1d4ca48, ftLastWriteTime.dwLowDateTime=0xc63d7700, ftLastWriteTime.dwHighDateTime=0x1d4ca48, nFileSizeHigh=0x0, nFileSizeLow=0x14b7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="6R9M5TSg.ods", cAlternateFileName="")) returned 1 [0072.688] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadab58a0, ftCreationTime.dwHighDateTime=0x1d4d327, ftLastAccessTime.dwLowDateTime=0x661c4bb0, ftLastAccessTime.dwHighDateTime=0x1d4ce46, ftLastWriteTime.dwLowDateTime=0x661c4bb0, ftLastWriteTime.dwHighDateTime=0x1d4ce46, nFileSizeHigh=0x0, nFileSizeLow=0x12df3, dwReserved0=0x0, dwReserved1=0x0, cFileName="8rifTB-DF.pps", cAlternateFileName="8RIFTB~1.PPS")) returned 1 [0072.689] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4b4ba0, ftCreationTime.dwHighDateTime=0x1d4d09e, ftLastAccessTime.dwLowDateTime=0x8ff0dc0, ftLastAccessTime.dwHighDateTime=0x1d4d024, ftLastWriteTime.dwLowDateTime=0x8ff0dc0, ftLastWriteTime.dwHighDateTime=0x1d4d024, nFileSizeHigh=0x0, nFileSizeLow=0x5327, dwReserved0=0x0, dwReserved1=0x0, cFileName="b1AiNK_C2.pps", cAlternateFileName="B1AINK~1.PPS")) returned 1 [0072.689] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ceeab00, ftCreationTime.dwHighDateTime=0x1d4c69a, ftLastAccessTime.dwLowDateTime=0xfbb4700, ftLastAccessTime.dwHighDateTime=0x1d4d2cc, ftLastWriteTime.dwLowDateTime=0xfbb4700, ftLastWriteTime.dwHighDateTime=0x1d4d2cc, nFileSizeHigh=0x0, nFileSizeLow=0x510d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HBaoiNYL.ppt", cAlternateFileName="")) returned 1 [0072.689] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf29b940, ftCreationTime.dwHighDateTime=0x1d4d33d, ftLastAccessTime.dwLowDateTime=0xfab70760, ftLastAccessTime.dwHighDateTime=0x1d4ced2, ftLastWriteTime.dwLowDateTime=0xfab70760, ftLastWriteTime.dwHighDateTime=0x1d4ced2, nFileSizeHigh=0x0, nFileSizeLow=0x17b8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pr8jDyh.pptx", cAlternateFileName="PR8JDY~1.PPT")) returned 1 [0072.689] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf29b940, ftCreationTime.dwHighDateTime=0x1d4d33d, ftLastAccessTime.dwLowDateTime=0xfab70760, ftLastAccessTime.dwHighDateTime=0x1d4ced2, ftLastWriteTime.dwLowDateTime=0xfab70760, ftLastWriteTime.dwHighDateTime=0x1d4ced2, nFileSizeHigh=0x0, nFileSizeLow=0x17b8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pr8jDyh.pptx", cAlternateFileName="PR8JDY~1.PPT")) returned 0 [0072.689] FindClose (in: hFindFile=0x69ade8 | out: hFindFile=0x69ade8) returned 1 [0072.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8f8) returned 1 [0072.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e904) returned 1 [0072.689] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm\\HBaoiNYL.ppt", nBufferLength=0x105, lpBuffer=0x24e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm\\HBaoiNYL.ppt", lpFilePart=0x0) returned 0x70 [0072.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e7dc) returned 1 [0072.690] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm\\HBaoiNYL.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\_raekx4psydwqxm\\hbaoinyl.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0072.690] GetFileType (hFile=0x26c) returned 0x1 [0072.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e7d8) returned 1 [0072.690] GetFileType (hFile=0x26c) returned 0x1 [0072.690] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24e8e4 | out: lpFileSizeHigh=0x24e8e4*=0x0) returned 0x510d [0072.690] ReadFile (in: hFile=0x26c, lpBuffer=0x274ebc0, nNumberOfBytesToRead=0x510d, lpNumberOfBytesRead=0x24e890, lpOverlapped=0x0 | out: lpBuffer=0x274ebc0*, lpNumberOfBytesRead=0x24e890*=0x510d, lpOverlapped=0x0) returned 1 [0072.692] CloseHandle (hObject=0x26c) returned 1 [0072.743] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e3fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0072.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e85c) returned 1 [0072.743] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24e8d8 | out: lpFileInformation=0x24e8d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0072.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e858) returned 1 [0072.743] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm\\HBaoiNYL.ppt", nBufferLength=0x105, lpBuffer=0x24e2d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm\\HBaoiNYL.ppt", lpFilePart=0x0) returned 0x70 [0072.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e7c8) returned 1 [0072.743] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm\\HBaoiNYL.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\_raekx4psydwqxm\\hbaoinyl.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0072.745] GetFileType (hFile=0x26c) returned 0x1 [0072.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e7c4) returned 1 [0072.745] GetFileType (hFile=0x26c) returned 0x1 [0072.745] WriteFile (in: hFile=0x26c, lpBuffer=0x27b5058*, nNumberOfBytesToWrite=0x5110, lpNumberOfBytesWritten=0x24e884, lpOverlapped=0x0 | out: lpBuffer=0x27b5058*, lpNumberOfBytesWritten=0x24e884*=0x5110, lpOverlapped=0x0) returned 1 [0072.746] CloseHandle (hObject=0x26c) returned 1 [0072.747] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm\\HBaoiNYL.ppt", nBufferLength=0x105, lpBuffer=0x24e408, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm\\HBaoiNYL.ppt", lpFilePart=0x0) returned 0x70 [0072.747] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm\\HBaoiNYL.ppt.Crypted", nBufferLength=0x105, lpBuffer=0x24e408, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm\\HBaoiNYL.ppt.Crypted", lpFilePart=0x0) returned 0x78 [0072.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e868) returned 1 [0072.747] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm\\HBaoiNYL.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\_raekx4psydwqxm\\hbaoinyl.ppt"), fInfoLevelId=0x0, lpFileInformation=0x24e8e4 | out: lpFileInformation=0x24e8e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ceeab00, ftCreationTime.dwHighDateTime=0x1d4c69a, ftLastAccessTime.dwLowDateTime=0xfbb4700, ftLastAccessTime.dwHighDateTime=0x1d4d2cc, ftLastWriteTime.dwLowDateTime=0xfc42ad50, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x5110)) returned 1 [0072.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e864) returned 1 [0072.748] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm\\HBaoiNYL.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\_raekx4psydwqxm\\hbaoinyl.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm\\HBaoiNYL.ppt.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\_raekx4psydwqxm\\hbaoinyl.ppt.crypted")) returned 1 [0072.748] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm\\pr8jDyh.pptx", nBufferLength=0x105, lpBuffer=0x24e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm\\pr8jDyh.pptx", lpFilePart=0x0) returned 0x70 [0072.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e7dc) returned 1 [0072.748] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm\\pr8jDyh.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\_raekx4psydwqxm\\pr8jdyh.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0072.749] GetFileType (hFile=0x26c) returned 0x1 [0072.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e7d8) returned 1 [0072.749] GetFileType (hFile=0x26c) returned 0x1 [0072.749] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24e8e4 | out: lpFileSizeHigh=0x24e8e4*=0x0) returned 0x17b8a [0072.749] ReadFile (in: hFile=0x26c, lpBuffer=0x3a34248, nNumberOfBytesToRead=0x17b8a, lpNumberOfBytesRead=0x24e890, lpOverlapped=0x0 | out: lpBuffer=0x3a34248*, lpNumberOfBytesRead=0x24e890*=0x17b8a, lpOverlapped=0x0) returned 1 [0072.751] CloseHandle (hObject=0x26c) returned 1 [0072.774] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e3fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0072.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e85c) returned 1 [0072.774] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24e8d8 | out: lpFileInformation=0x24e8d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0072.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e858) returned 1 [0072.775] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm\\pr8jDyh.pptx", nBufferLength=0x105, lpBuffer=0x24e2d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm\\pr8jDyh.pptx", lpFilePart=0x0) returned 0x70 [0072.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e7c8) returned 1 [0072.775] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm\\pr8jDyh.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\_raekx4psydwqxm\\pr8jdyh.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0072.776] GetFileType (hFile=0x26c) returned 0x1 [0072.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e7c4) returned 1 [0072.777] GetFileType (hFile=0x26c) returned 0x1 [0072.777] WriteFile (in: hFile=0x26c, lpBuffer=0x3a7b530*, nNumberOfBytesToWrite=0x17b90, lpNumberOfBytesWritten=0x24e884, lpOverlapped=0x0 | out: lpBuffer=0x3a7b530*, lpNumberOfBytesWritten=0x24e884*=0x17b90, lpOverlapped=0x0) returned 1 [0072.779] CloseHandle (hObject=0x26c) returned 1 [0072.784] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm\\pr8jDyh.pptx", nBufferLength=0x105, lpBuffer=0x24e408, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm\\pr8jDyh.pptx", lpFilePart=0x0) returned 0x70 [0072.784] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm\\pr8jDyh.pptx.Crypted", nBufferLength=0x105, lpBuffer=0x24e408, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm\\pr8jDyh.pptx.Crypted", lpFilePart=0x0) returned 0x78 [0072.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e868) returned 1 [0072.784] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm\\pr8jDyh.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\_raekx4psydwqxm\\pr8jdyh.pptx"), fInfoLevelId=0x0, lpFileInformation=0x24e8e4 | out: lpFileInformation=0x24e8e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf29b940, ftCreationTime.dwHighDateTime=0x1d4d33d, ftLastAccessTime.dwLowDateTime=0xfab70760, ftLastAccessTime.dwHighDateTime=0x1d4ced2, ftLastWriteTime.dwLowDateTime=0xfc477010, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x17b90)) returned 1 [0072.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e864) returned 1 [0072.784] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm\\pr8jDyh.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\_raekx4psydwqxm\\pr8jdyh.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\7r9OW54Bxj7Cg3vKvWi\\_raEKX4psyDwqXm\\pr8jDyh.pptx.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\7r9ow54bxj7cg3vkvwi\\_raekx4psydwqxm\\pr8jdyh.pptx.crypted")) returned 1 [0072.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0072.785] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp", nBufferLength=0x105, lpBuffer=0x24e4b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp", lpFilePart=0x0) returned 0x53 [0072.785] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\", nBufferLength=0x105, lpBuffer=0x24e488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\", lpFilePart=0x0) returned 0x54 [0072.785] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\*", lpFindFileData=0x24e6d4 | out: lpFindFileData=0x24e6d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e7b5480, ftCreationTime.dwHighDateTime=0x1d4ccac, ftLastAccessTime.dwLowDateTime=0x532aab30, ftLastAccessTime.dwHighDateTime=0x1d4ce39, ftLastWriteTime.dwLowDateTime=0x532aab30, ftLastWriteTime.dwHighDateTime=0x1d4ce39, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69aea8 [0072.785] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e7b5480, ftCreationTime.dwHighDateTime=0x1d4ccac, ftLastAccessTime.dwLowDateTime=0x532aab30, ftLastAccessTime.dwHighDateTime=0x1d4ce39, ftLastWriteTime.dwLowDateTime=0x532aab30, ftLastWriteTime.dwHighDateTime=0x1d4ce39, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.786] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa371c2e0, ftCreationTime.dwHighDateTime=0x1d4cf97, ftLastAccessTime.dwLowDateTime=0x4b00ac00, ftLastAccessTime.dwHighDateTime=0x1d4cd50, ftLastWriteTime.dwLowDateTime=0x4b00ac00, ftLastWriteTime.dwHighDateTime=0x1d4cd50, nFileSizeHigh=0x0, nFileSizeLow=0x17322, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gu zJdi-EC53s_N6C_.pps", cAlternateFileName="GUZJDI~1.PPS")) returned 1 [0072.786] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac8dfab0, ftCreationTime.dwHighDateTime=0x1d4c803, ftLastAccessTime.dwLowDateTime=0xc4151950, ftLastAccessTime.dwHighDateTime=0x1d4c5d5, ftLastWriteTime.dwLowDateTime=0xc4151950, ftLastWriteTime.dwHighDateTime=0x1d4c5d5, nFileSizeHigh=0x0, nFileSizeLow=0x13bee, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ic9J qi.ppt", cAlternateFileName="IC9JQI~1.PPT")) returned 1 [0072.786] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee2c4e20, ftCreationTime.dwHighDateTime=0x1d4d4e4, ftLastAccessTime.dwLowDateTime=0xf31e6e00, ftLastAccessTime.dwHighDateTime=0x1d4c89f, ftLastWriteTime.dwLowDateTime=0xf31e6e00, ftLastWriteTime.dwHighDateTime=0x1d4c89f, nFileSizeHigh=0x0, nFileSizeLow=0x1025b, dwReserved0=0x0, dwReserved1=0x0, cFileName="jgBKoRK.odt", cAlternateFileName="")) returned 1 [0072.786] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce6cf590, ftCreationTime.dwHighDateTime=0x1d4ce80, ftLastAccessTime.dwLowDateTime=0x9fd8d250, ftLastAccessTime.dwHighDateTime=0x1d4c8c0, ftLastWriteTime.dwLowDateTime=0x9fd8d250, ftLastWriteTime.dwHighDateTime=0x1d4c8c0, nFileSizeHigh=0x0, nFileSizeLow=0x9236, dwReserved0=0x0, dwReserved1=0x0, cFileName="L0UKWYw0F.docx", cAlternateFileName="L0UKWY~1.DOC")) returned 1 [0072.786] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72332ab0, ftCreationTime.dwHighDateTime=0x1d4cda9, ftLastAccessTime.dwLowDateTime=0x9e66d9c0, ftLastAccessTime.dwHighDateTime=0x1d4cf79, ftLastWriteTime.dwLowDateTime=0x9e66d9c0, ftLastWriteTime.dwHighDateTime=0x1d4cf79, nFileSizeHigh=0x0, nFileSizeLow=0x156d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="q0HuyyNcAfSgy3g.rtf", cAlternateFileName="Q0HUYY~1.RTF")) returned 1 [0072.786] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8dbc8e0, ftCreationTime.dwHighDateTime=0x1d4c90c, ftLastAccessTime.dwLowDateTime=0xc36a8d40, ftLastAccessTime.dwHighDateTime=0x1d4d3d2, ftLastWriteTime.dwLowDateTime=0xc36a8d40, ftLastWriteTime.dwHighDateTime=0x1d4d3d2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UA2y2aBJr OGAqM7", cAlternateFileName="UA2Y2A~1")) returned 1 [0072.786] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8dbc8e0, ftCreationTime.dwHighDateTime=0x1d4c90c, ftLastAccessTime.dwLowDateTime=0xc36a8d40, ftLastAccessTime.dwHighDateTime=0x1d4d3d2, ftLastWriteTime.dwLowDateTime=0xc36a8d40, ftLastWriteTime.dwHighDateTime=0x1d4d3d2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UA2y2aBJr OGAqM7", cAlternateFileName="UA2Y2A~1")) returned 0 [0072.787] FindClose (in: hFindFile=0x69aea8 | out: hFindFile=0x69aea8) returned 1 [0072.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e96c) returned 1 [0072.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e978) returned 1 [0072.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0072.787] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp", nBufferLength=0x105, lpBuffer=0x24e4b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp", lpFilePart=0x0) returned 0x53 [0072.787] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\", nBufferLength=0x105, lpBuffer=0x24e488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\", lpFilePart=0x0) returned 0x54 [0072.787] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\*", lpFindFileData=0x24e6d4 | out: lpFindFileData=0x24e6d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e7b5480, ftCreationTime.dwHighDateTime=0x1d4ccac, ftLastAccessTime.dwLowDateTime=0x532aab30, ftLastAccessTime.dwHighDateTime=0x1d4ce39, ftLastWriteTime.dwLowDateTime=0x532aab30, ftLastWriteTime.dwHighDateTime=0x1d4ce39, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69aea8 [0072.787] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e7b5480, ftCreationTime.dwHighDateTime=0x1d4ccac, ftLastAccessTime.dwLowDateTime=0x532aab30, ftLastAccessTime.dwHighDateTime=0x1d4ce39, ftLastWriteTime.dwLowDateTime=0x532aab30, ftLastWriteTime.dwHighDateTime=0x1d4ce39, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.787] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa371c2e0, ftCreationTime.dwHighDateTime=0x1d4cf97, ftLastAccessTime.dwLowDateTime=0x4b00ac00, ftLastAccessTime.dwHighDateTime=0x1d4cd50, ftLastWriteTime.dwLowDateTime=0x4b00ac00, ftLastWriteTime.dwHighDateTime=0x1d4cd50, nFileSizeHigh=0x0, nFileSizeLow=0x17322, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gu zJdi-EC53s_N6C_.pps", cAlternateFileName="GUZJDI~1.PPS")) returned 1 [0072.787] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac8dfab0, ftCreationTime.dwHighDateTime=0x1d4c803, ftLastAccessTime.dwLowDateTime=0xc4151950, ftLastAccessTime.dwHighDateTime=0x1d4c5d5, ftLastWriteTime.dwLowDateTime=0xc4151950, ftLastWriteTime.dwHighDateTime=0x1d4c5d5, nFileSizeHigh=0x0, nFileSizeLow=0x13bee, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ic9J qi.ppt", cAlternateFileName="IC9JQI~1.PPT")) returned 1 [0072.788] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee2c4e20, ftCreationTime.dwHighDateTime=0x1d4d4e4, ftLastAccessTime.dwLowDateTime=0xf31e6e00, ftLastAccessTime.dwHighDateTime=0x1d4c89f, ftLastWriteTime.dwLowDateTime=0xf31e6e00, ftLastWriteTime.dwHighDateTime=0x1d4c89f, nFileSizeHigh=0x0, nFileSizeLow=0x1025b, dwReserved0=0x0, dwReserved1=0x0, cFileName="jgBKoRK.odt", cAlternateFileName="")) returned 1 [0072.788] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce6cf590, ftCreationTime.dwHighDateTime=0x1d4ce80, ftLastAccessTime.dwLowDateTime=0x9fd8d250, ftLastAccessTime.dwHighDateTime=0x1d4c8c0, ftLastWriteTime.dwLowDateTime=0x9fd8d250, ftLastWriteTime.dwHighDateTime=0x1d4c8c0, nFileSizeHigh=0x0, nFileSizeLow=0x9236, dwReserved0=0x0, dwReserved1=0x0, cFileName="L0UKWYw0F.docx", cAlternateFileName="L0UKWY~1.DOC")) returned 1 [0072.788] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72332ab0, ftCreationTime.dwHighDateTime=0x1d4cda9, ftLastAccessTime.dwLowDateTime=0x9e66d9c0, ftLastAccessTime.dwHighDateTime=0x1d4cf79, ftLastWriteTime.dwLowDateTime=0x9e66d9c0, ftLastWriteTime.dwHighDateTime=0x1d4cf79, nFileSizeHigh=0x0, nFileSizeLow=0x156d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="q0HuyyNcAfSgy3g.rtf", cAlternateFileName="Q0HUYY~1.RTF")) returned 1 [0072.788] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8dbc8e0, ftCreationTime.dwHighDateTime=0x1d4c90c, ftLastAccessTime.dwLowDateTime=0xc36a8d40, ftLastAccessTime.dwHighDateTime=0x1d4d3d2, ftLastWriteTime.dwLowDateTime=0xc36a8d40, ftLastWriteTime.dwHighDateTime=0x1d4d3d2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UA2y2aBJr OGAqM7", cAlternateFileName="UA2Y2A~1")) returned 1 [0072.788] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0072.788] FindClose (in: hFindFile=0x69aea8 | out: hFindFile=0x69aea8) returned 1 [0072.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e96c) returned 1 [0072.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e978) returned 1 [0072.789] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\Ic9J qi.ppt", nBufferLength=0x105, lpBuffer=0x24e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\Ic9J qi.ppt", lpFilePart=0x0) returned 0x5f [0072.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e850) returned 1 [0072.789] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\Ic9J qi.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\oagdplerzhdjeswk5fp\\ic9j qi.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0072.789] GetFileType (hFile=0x26c) returned 0x1 [0072.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e84c) returned 1 [0072.789] GetFileType (hFile=0x26c) returned 0x1 [0072.789] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24e958 | out: lpFileSizeHigh=0x24e958*=0x0) returned 0x13bee [0072.790] ReadFile (in: hFile=0x26c, lpBuffer=0x280b220, nNumberOfBytesToRead=0x13bee, lpNumberOfBytesRead=0x24e904, lpOverlapped=0x0 | out: lpBuffer=0x280b220*, lpNumberOfBytesRead=0x24e904*=0x13bee, lpOverlapped=0x0) returned 1 [0072.791] CloseHandle (hObject=0x26c) returned 1 [0072.811] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0072.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8d0) returned 1 [0072.811] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24e94c | out: lpFileInformation=0x24e94c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0072.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8cc) returned 1 [0072.811] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\Ic9J qi.ppt", nBufferLength=0x105, lpBuffer=0x24e348, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\Ic9J qi.ppt", lpFilePart=0x0) returned 0x5f [0072.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e83c) returned 1 [0072.812] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\Ic9J qi.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\oagdplerzhdjeswk5fp\\ic9j qi.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0072.813] GetFileType (hFile=0x26c) returned 0x1 [0072.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e838) returned 1 [0072.813] GetFileType (hFile=0x26c) returned 0x1 [0072.813] WriteFile (in: hFile=0x26c, lpBuffer=0x28933f0*, nNumberOfBytesToWrite=0x13bf0, lpNumberOfBytesWritten=0x24e8f8, lpOverlapped=0x0 | out: lpBuffer=0x28933f0*, lpNumberOfBytesWritten=0x24e8f8*=0x13bf0, lpOverlapped=0x0) returned 1 [0072.815] CloseHandle (hObject=0x26c) returned 1 [0072.820] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\Ic9J qi.ppt", nBufferLength=0x105, lpBuffer=0x24e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\Ic9J qi.ppt", lpFilePart=0x0) returned 0x5f [0072.820] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\Ic9J qi.ppt.Crypted", nBufferLength=0x105, lpBuffer=0x24e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\Ic9J qi.ppt.Crypted", lpFilePart=0x0) returned 0x67 [0072.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8dc) returned 1 [0072.823] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\Ic9J qi.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\oagdplerzhdjeswk5fp\\ic9j qi.ppt"), fInfoLevelId=0x0, lpFileInformation=0x24e958 | out: lpFileInformation=0x24e958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac8dfab0, ftCreationTime.dwHighDateTime=0x1d4c803, ftLastAccessTime.dwLowDateTime=0xc4151950, ftLastAccessTime.dwHighDateTime=0x1d4c5d5, ftLastWriteTime.dwLowDateTime=0xfc4c32d0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x13bf0)) returned 1 [0072.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8d8) returned 1 [0072.823] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\Ic9J qi.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\oagdplerzhdjeswk5fp\\ic9j qi.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\Ic9J qi.ppt.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\oagdplerzhdjeswk5fp\\ic9j qi.ppt.crypted")) returned 1 [0072.824] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\jgBKoRK.odt", nBufferLength=0x105, lpBuffer=0x24e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\jgBKoRK.odt", lpFilePart=0x0) returned 0x5f [0072.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e850) returned 1 [0072.824] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\jgBKoRK.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\oagdplerzhdjeswk5fp\\jgbkork.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0072.824] GetFileType (hFile=0x26c) returned 0x1 [0072.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e84c) returned 1 [0072.824] GetFileType (hFile=0x26c) returned 0x1 [0072.824] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24e958 | out: lpFileSizeHigh=0x24e958*=0x0) returned 0x1025b [0072.824] ReadFile (in: hFile=0x26c, lpBuffer=0x28a76bc, nNumberOfBytesToRead=0x1025b, lpNumberOfBytesRead=0x24e904, lpOverlapped=0x0 | out: lpBuffer=0x28a76bc*, lpNumberOfBytesRead=0x24e904*=0x1025b, lpOverlapped=0x0) returned 1 [0072.841] CloseHandle (hObject=0x26c) returned 1 [0072.862] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0072.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8d0) returned 1 [0072.862] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24e94c | out: lpFileInformation=0x24e94c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0072.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8cc) returned 1 [0072.863] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\jgBKoRK.odt", nBufferLength=0x105, lpBuffer=0x24e348, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\jgBKoRK.odt", lpFilePart=0x0) returned 0x5f [0072.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e83c) returned 1 [0072.863] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\jgBKoRK.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\oagdplerzhdjeswk5fp\\jgbkork.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0072.864] GetFileType (hFile=0x26c) returned 0x1 [0072.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e838) returned 1 [0072.864] GetFileType (hFile=0x26c) returned 0x1 [0072.864] WriteFile (in: hFile=0x26c, lpBuffer=0x2924bdc*, nNumberOfBytesToWrite=0x10260, lpNumberOfBytesWritten=0x24e8f8, lpOverlapped=0x0 | out: lpBuffer=0x2924bdc*, lpNumberOfBytesWritten=0x24e8f8*=0x10260, lpOverlapped=0x0) returned 1 [0072.866] CloseHandle (hObject=0x26c) returned 1 [0072.869] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\jgBKoRK.odt", nBufferLength=0x105, lpBuffer=0x24e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\jgBKoRK.odt", lpFilePart=0x0) returned 0x5f [0072.869] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\jgBKoRK.odt.Crypted", nBufferLength=0x105, lpBuffer=0x24e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\jgBKoRK.odt.Crypted", lpFilePart=0x0) returned 0x67 [0072.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8dc) returned 1 [0072.869] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\jgBKoRK.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\oagdplerzhdjeswk5fp\\jgbkork.odt"), fInfoLevelId=0x0, lpFileInformation=0x24e958 | out: lpFileInformation=0x24e958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee2c4e20, ftCreationTime.dwHighDateTime=0x1d4d4e4, ftLastAccessTime.dwLowDateTime=0xf31e6e00, ftLastAccessTime.dwHighDateTime=0x1d4c89f, ftLastWriteTime.dwLowDateTime=0xfc55b850, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x10260)) returned 1 [0072.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8d8) returned 1 [0072.869] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\jgBKoRK.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\oagdplerzhdjeswk5fp\\jgbkork.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\jgBKoRK.odt.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\oagdplerzhdjeswk5fp\\jgbkork.odt.crypted")) returned 1 [0072.870] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\L0UKWYw0F.docx", nBufferLength=0x105, lpBuffer=0x24e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\L0UKWYw0F.docx", lpFilePart=0x0) returned 0x62 [0072.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e850) returned 1 [0072.870] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\L0UKWYw0F.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\oagdplerzhdjeswk5fp\\l0ukwyw0f.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0072.870] GetFileType (hFile=0x26c) returned 0x1 [0072.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e84c) returned 1 [0072.870] GetFileType (hFile=0x26c) returned 0x1 [0072.870] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24e958 | out: lpFileSizeHigh=0x24e958*=0x0) returned 0x9236 [0072.870] ReadFile (in: hFile=0x26c, lpBuffer=0x2935528, nNumberOfBytesToRead=0x9236, lpNumberOfBytesRead=0x24e904, lpOverlapped=0x0 | out: lpBuffer=0x2935528*, lpNumberOfBytesRead=0x24e904*=0x9236, lpOverlapped=0x0) returned 1 [0072.872] CloseHandle (hObject=0x26c) returned 1 [0072.910] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0072.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8d0) returned 1 [0072.910] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24e94c | out: lpFileInformation=0x24e94c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0072.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8cc) returned 1 [0072.910] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\L0UKWYw0F.docx", nBufferLength=0x105, lpBuffer=0x24e348, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\L0UKWYw0F.docx", lpFilePart=0x0) returned 0x62 [0072.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e83c) returned 1 [0072.910] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\L0UKWYw0F.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\oagdplerzhdjeswk5fp\\l0ukwyw0f.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0072.911] GetFileType (hFile=0x26c) returned 0x1 [0072.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e838) returned 1 [0072.911] GetFileType (hFile=0x26c) returned 0x1 [0072.911] WriteFile (in: hFile=0x26c, lpBuffer=0x27b9d04*, nNumberOfBytesToWrite=0x9240, lpNumberOfBytesWritten=0x24e8f8, lpOverlapped=0x0 | out: lpBuffer=0x27b9d04*, lpNumberOfBytesWritten=0x24e8f8*=0x9240, lpOverlapped=0x0) returned 1 [0072.915] CloseHandle (hObject=0x26c) returned 1 [0072.916] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\L0UKWYw0F.docx", nBufferLength=0x105, lpBuffer=0x24e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\L0UKWYw0F.docx", lpFilePart=0x0) returned 0x62 [0072.916] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\L0UKWYw0F.docx.Crypted", nBufferLength=0x105, lpBuffer=0x24e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\L0UKWYw0F.docx.Crypted", lpFilePart=0x0) returned 0x6a [0072.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8dc) returned 1 [0072.916] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\L0UKWYw0F.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\oagdplerzhdjeswk5fp\\l0ukwyw0f.docx"), fInfoLevelId=0x0, lpFileInformation=0x24e958 | out: lpFileInformation=0x24e958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce6cf590, ftCreationTime.dwHighDateTime=0x1d4ce80, ftLastAccessTime.dwLowDateTime=0x9fd8d250, ftLastAccessTime.dwHighDateTime=0x1d4c8c0, ftLastWriteTime.dwLowDateTime=0xfc5cdc70, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x9240)) returned 1 [0072.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8d8) returned 1 [0072.916] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\L0UKWYw0F.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\oagdplerzhdjeswk5fp\\l0ukwyw0f.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\L0UKWYw0F.docx.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\oagdplerzhdjeswk5fp\\l0ukwyw0f.docx.crypted")) returned 1 [0072.916] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\q0HuyyNcAfSgy3g.rtf", nBufferLength=0x105, lpBuffer=0x24e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\q0HuyyNcAfSgy3g.rtf", lpFilePart=0x0) returned 0x67 [0072.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e850) returned 1 [0072.916] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\q0HuyyNcAfSgy3g.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\oagdplerzhdjeswk5fp\\q0huyyncafsgy3g.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0072.917] GetFileType (hFile=0x26c) returned 0x1 [0072.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e84c) returned 1 [0072.917] GetFileType (hFile=0x26c) returned 0x1 [0072.917] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24e958 | out: lpFileSizeHigh=0x24e958*=0x0) returned 0x156d4 [0072.917] ReadFile (in: hFile=0x26c, lpBuffer=0x37e8e10, nNumberOfBytesToRead=0x156d4, lpNumberOfBytesRead=0x24e904, lpOverlapped=0x0 | out: lpBuffer=0x37e8e10*, lpNumberOfBytesRead=0x24e904*=0x156d4, lpOverlapped=0x0) returned 1 [0072.923] CloseHandle (hObject=0x26c) returned 1 [0072.939] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0072.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8d0) returned 1 [0072.939] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24e94c | out: lpFileInformation=0x24e94c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0072.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8cc) returned 1 [0072.939] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\q0HuyyNcAfSgy3g.rtf", nBufferLength=0x105, lpBuffer=0x24e348, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\q0HuyyNcAfSgy3g.rtf", lpFilePart=0x0) returned 0x67 [0072.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e83c) returned 1 [0072.939] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\q0HuyyNcAfSgy3g.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\oagdplerzhdjeswk5fp\\q0huyyncafsgy3g.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0072.940] GetFileType (hFile=0x26c) returned 0x1 [0072.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e838) returned 1 [0072.940] GetFileType (hFile=0x26c) returned 0x1 [0072.940] WriteFile (in: hFile=0x26c, lpBuffer=0x38540a0*, nNumberOfBytesToWrite=0x156e0, lpNumberOfBytesWritten=0x24e8f8, lpOverlapped=0x0 | out: lpBuffer=0x38540a0*, lpNumberOfBytesWritten=0x24e8f8*=0x156e0, lpOverlapped=0x0) returned 1 [0072.942] CloseHandle (hObject=0x26c) returned 1 [0072.943] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\q0HuyyNcAfSgy3g.rtf", nBufferLength=0x105, lpBuffer=0x24e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\q0HuyyNcAfSgy3g.rtf", lpFilePart=0x0) returned 0x67 [0072.944] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\q0HuyyNcAfSgy3g.rtf.Crypted", nBufferLength=0x105, lpBuffer=0x24e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\q0HuyyNcAfSgy3g.rtf.Crypted", lpFilePart=0x0) returned 0x6f [0072.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8dc) returned 1 [0072.944] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\q0HuyyNcAfSgy3g.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\oagdplerzhdjeswk5fp\\q0huyyncafsgy3g.rtf"), fInfoLevelId=0x0, lpFileInformation=0x24e958 | out: lpFileInformation=0x24e958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72332ab0, ftCreationTime.dwHighDateTime=0x1d4cda9, ftLastAccessTime.dwLowDateTime=0x9e66d9c0, ftLastAccessTime.dwHighDateTime=0x1d4cf79, ftLastWriteTime.dwLowDateTime=0xfc5f3dd0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x156e0)) returned 1 [0072.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8d8) returned 1 [0072.944] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\q0HuyyNcAfSgy3g.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\oagdplerzhdjeswk5fp\\q0huyyncafsgy3g.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\q0HuyyNcAfSgy3g.rtf.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\oagdplerzhdjeswk5fp\\q0huyyncafsgy3g.rtf.crypted")) returned 1 [0072.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0072.945] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7", nBufferLength=0x105, lpBuffer=0x24e440, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7", lpFilePart=0x0) returned 0x64 [0072.945] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7\\", nBufferLength=0x105, lpBuffer=0x24e414, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7\\", lpFilePart=0x0) returned 0x65 [0072.945] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7\\*", lpFindFileData=0x24e660 | out: lpFindFileData=0x24e660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8dbc8e0, ftCreationTime.dwHighDateTime=0x1d4c90c, ftLastAccessTime.dwLowDateTime=0xc36a8d40, ftLastAccessTime.dwHighDateTime=0x1d4d3d2, ftLastWriteTime.dwLowDateTime=0xc36a8d40, ftLastWriteTime.dwHighDateTime=0x1d4d3d2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69aea8 [0072.945] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8dbc8e0, ftCreationTime.dwHighDateTime=0x1d4c90c, ftLastAccessTime.dwLowDateTime=0xc36a8d40, ftLastAccessTime.dwHighDateTime=0x1d4d3d2, ftLastWriteTime.dwLowDateTime=0xc36a8d40, ftLastWriteTime.dwHighDateTime=0x1d4d3d2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.945] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b7f1a10, ftCreationTime.dwHighDateTime=0x1d4ce08, ftLastAccessTime.dwLowDateTime=0x1552e450, ftLastAccessTime.dwHighDateTime=0x1d4cbda, ftLastWriteTime.dwLowDateTime=0x1552e450, ftLastWriteTime.dwHighDateTime=0x1d4cbda, nFileSizeHigh=0x0, nFileSizeLow=0x6d2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="nIDj7xwfo.xlsx", cAlternateFileName="NIDJ7X~1.XLS")) returned 1 [0072.945] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c39a60, ftCreationTime.dwHighDateTime=0x1d4d526, ftLastAccessTime.dwLowDateTime=0x5e040440, ftLastAccessTime.dwHighDateTime=0x1d4d346, ftLastWriteTime.dwLowDateTime=0x5e040440, ftLastWriteTime.dwHighDateTime=0x1d4d346, nFileSizeHigh=0x0, nFileSizeLow=0x42eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="U7-JUQms0.xls", cAlternateFileName="U7-JUQ~1.XLS")) returned 1 [0072.945] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x575acab0, ftCreationTime.dwHighDateTime=0x1d4c6c2, ftLastAccessTime.dwLowDateTime=0x865d1100, ftLastAccessTime.dwHighDateTime=0x1d4d00f, ftLastWriteTime.dwLowDateTime=0x865d1100, ftLastWriteTime.dwHighDateTime=0x1d4d00f, nFileSizeHigh=0x0, nFileSizeLow=0x449e, dwReserved0=0x0, dwReserved1=0x0, cFileName="X6v8u.pps", cAlternateFileName="")) returned 1 [0072.946] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0072.946] FindClose (in: hFindFile=0x69aea8 | out: hFindFile=0x69aea8) returned 1 [0072.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8f8) returned 1 [0072.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e904) returned 1 [0072.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0072.946] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7", nBufferLength=0x105, lpBuffer=0x24e440, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7", lpFilePart=0x0) returned 0x64 [0072.946] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7\\", nBufferLength=0x105, lpBuffer=0x24e414, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7\\", lpFilePart=0x0) returned 0x65 [0072.946] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7\\*", lpFindFileData=0x24e660 | out: lpFindFileData=0x24e660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8dbc8e0, ftCreationTime.dwHighDateTime=0x1d4c90c, ftLastAccessTime.dwLowDateTime=0xc36a8d40, ftLastAccessTime.dwHighDateTime=0x1d4d3d2, ftLastWriteTime.dwLowDateTime=0xc36a8d40, ftLastWriteTime.dwHighDateTime=0x1d4d3d2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69aea8 [0072.946] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8dbc8e0, ftCreationTime.dwHighDateTime=0x1d4c90c, ftLastAccessTime.dwLowDateTime=0xc36a8d40, ftLastAccessTime.dwHighDateTime=0x1d4d3d2, ftLastWriteTime.dwLowDateTime=0xc36a8d40, ftLastWriteTime.dwHighDateTime=0x1d4d3d2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.947] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b7f1a10, ftCreationTime.dwHighDateTime=0x1d4ce08, ftLastAccessTime.dwLowDateTime=0x1552e450, ftLastAccessTime.dwHighDateTime=0x1d4cbda, ftLastWriteTime.dwLowDateTime=0x1552e450, ftLastWriteTime.dwHighDateTime=0x1d4cbda, nFileSizeHigh=0x0, nFileSizeLow=0x6d2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="nIDj7xwfo.xlsx", cAlternateFileName="NIDJ7X~1.XLS")) returned 1 [0072.947] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c39a60, ftCreationTime.dwHighDateTime=0x1d4d526, ftLastAccessTime.dwLowDateTime=0x5e040440, ftLastAccessTime.dwHighDateTime=0x1d4d346, ftLastWriteTime.dwLowDateTime=0x5e040440, ftLastWriteTime.dwHighDateTime=0x1d4d346, nFileSizeHigh=0x0, nFileSizeLow=0x42eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="U7-JUQms0.xls", cAlternateFileName="U7-JUQ~1.XLS")) returned 1 [0072.947] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x575acab0, ftCreationTime.dwHighDateTime=0x1d4c6c2, ftLastAccessTime.dwLowDateTime=0x865d1100, ftLastAccessTime.dwHighDateTime=0x1d4d00f, ftLastWriteTime.dwLowDateTime=0x865d1100, ftLastWriteTime.dwHighDateTime=0x1d4d00f, nFileSizeHigh=0x0, nFileSizeLow=0x449e, dwReserved0=0x0, dwReserved1=0x0, cFileName="X6v8u.pps", cAlternateFileName="")) returned 1 [0072.947] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e670 | out: lpFindFileData=0x24e670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x575acab0, ftCreationTime.dwHighDateTime=0x1d4c6c2, ftLastAccessTime.dwLowDateTime=0x865d1100, ftLastAccessTime.dwHighDateTime=0x1d4d00f, ftLastWriteTime.dwLowDateTime=0x865d1100, ftLastWriteTime.dwHighDateTime=0x1d4d00f, nFileSizeHigh=0x0, nFileSizeLow=0x449e, dwReserved0=0x0, dwReserved1=0x0, cFileName="X6v8u.pps", cAlternateFileName="")) returned 0 [0072.947] FindClose (in: hFindFile=0x69aea8 | out: hFindFile=0x69aea8) returned 1 [0072.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8f8) returned 1 [0072.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e904) returned 1 [0072.947] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7\\nIDj7xwfo.xlsx", nBufferLength=0x105, lpBuffer=0x24e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7\\nIDj7xwfo.xlsx", lpFilePart=0x0) returned 0x73 [0072.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e7dc) returned 1 [0072.947] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7\\nIDj7xwfo.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\oagdplerzhdjeswk5fp\\ua2y2abjr ogaqm7\\nidj7xwfo.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0072.948] GetFileType (hFile=0x26c) returned 0x1 [0072.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e7d8) returned 1 [0072.948] GetFileType (hFile=0x26c) returned 0x1 [0072.948] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24e8e4 | out: lpFileSizeHigh=0x24e8e4*=0x0) returned 0x6d2c [0072.948] ReadFile (in: hFile=0x26c, lpBuffer=0x28137b4, nNumberOfBytesToRead=0x6d2c, lpNumberOfBytesRead=0x24e890, lpOverlapped=0x0 | out: lpBuffer=0x28137b4*, lpNumberOfBytesRead=0x24e890*=0x6d2c, lpOverlapped=0x0) returned 1 [0072.949] CloseHandle (hObject=0x26c) returned 1 [0072.968] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e3fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0072.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e85c) returned 1 [0072.968] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24e8d8 | out: lpFileInformation=0x24e8d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0072.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e858) returned 1 [0072.968] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7\\nIDj7xwfo.xlsx", nBufferLength=0x105, lpBuffer=0x24e2d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7\\nIDj7xwfo.xlsx", lpFilePart=0x0) returned 0x73 [0072.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e7c8) returned 1 [0072.968] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7\\nIDj7xwfo.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\oagdplerzhdjeswk5fp\\ua2y2abjr ogaqm7\\nidj7xwfo.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0072.969] GetFileType (hFile=0x26c) returned 0x1 [0072.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e7c4) returned 1 [0072.969] GetFileType (hFile=0x26c) returned 0x1 [0072.969] WriteFile (in: hFile=0x26c, lpBuffer=0x288278c*, nNumberOfBytesToWrite=0x6d30, lpNumberOfBytesWritten=0x24e884, lpOverlapped=0x0 | out: lpBuffer=0x288278c*, lpNumberOfBytesWritten=0x24e884*=0x6d30, lpOverlapped=0x0) returned 1 [0072.971] CloseHandle (hObject=0x26c) returned 1 [0072.972] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7\\nIDj7xwfo.xlsx", nBufferLength=0x105, lpBuffer=0x24e408, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7\\nIDj7xwfo.xlsx", lpFilePart=0x0) returned 0x73 [0072.972] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7\\nIDj7xwfo.xlsx.Crypted", nBufferLength=0x105, lpBuffer=0x24e408, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7\\nIDj7xwfo.xlsx.Crypted", lpFilePart=0x0) returned 0x7b [0072.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e868) returned 1 [0072.972] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7\\nIDj7xwfo.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\oagdplerzhdjeswk5fp\\ua2y2abjr ogaqm7\\nidj7xwfo.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x24e8e4 | out: lpFileInformation=0x24e8e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b7f1a10, ftCreationTime.dwHighDateTime=0x1d4ce08, ftLastAccessTime.dwLowDateTime=0x1552e450, ftLastAccessTime.dwHighDateTime=0x1d4cbda, ftLastWriteTime.dwLowDateTime=0xfc640090, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x6d30)) returned 1 [0072.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e864) returned 1 [0072.972] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7\\nIDj7xwfo.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\oagdplerzhdjeswk5fp\\ua2y2abjr ogaqm7\\nidj7xwfo.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7\\nIDj7xwfo.xlsx.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\oagdplerzhdjeswk5fp\\ua2y2abjr ogaqm7\\nidj7xwfo.xlsx.crypted")) returned 1 [0072.973] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7\\U7-JUQms0.xls", nBufferLength=0x105, lpBuffer=0x24e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7\\U7-JUQms0.xls", lpFilePart=0x0) returned 0x72 [0072.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e7dc) returned 1 [0072.973] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7\\U7-JUQms0.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\oagdplerzhdjeswk5fp\\ua2y2abjr ogaqm7\\u7-juqms0.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0072.973] GetFileType (hFile=0x26c) returned 0x1 [0072.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e7d8) returned 1 [0072.973] GetFileType (hFile=0x26c) returned 0x1 [0072.973] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24e8e4 | out: lpFileSizeHigh=0x24e8e4*=0x0) returned 0x42eb [0072.973] ReadFile (in: hFile=0x26c, lpBuffer=0x2889c6c, nNumberOfBytesToRead=0x42eb, lpNumberOfBytesRead=0x24e890, lpOverlapped=0x0 | out: lpBuffer=0x2889c6c*, lpNumberOfBytesRead=0x24e890*=0x42eb, lpOverlapped=0x0) returned 1 [0072.993] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e3fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0072.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e85c) returned 1 [0072.994] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24e8d8 | out: lpFileInformation=0x24e8d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0072.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e858) returned 1 [0072.994] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7\\U7-JUQms0.xls", nBufferLength=0x105, lpBuffer=0x24e2d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7\\U7-JUQms0.xls", lpFilePart=0x0) returned 0x72 [0072.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e7c8) returned 1 [0072.994] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7\\U7-JUQms0.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\oagdplerzhdjeswk5fp\\ua2y2abjr ogaqm7\\u7-juqms0.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0072.995] GetFileType (hFile=0x26c) returned 0x1 [0072.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e7c4) returned 1 [0072.995] GetFileType (hFile=0x26c) returned 0x1 [0072.995] WriteFile (in: hFile=0x26c, lpBuffer=0x28eb908*, nNumberOfBytesToWrite=0x42f0, lpNumberOfBytesWritten=0x24e884, lpOverlapped=0x0 | out: lpBuffer=0x28eb908*, lpNumberOfBytesWritten=0x24e884*=0x42f0, lpOverlapped=0x0) returned 1 [0072.997] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7\\U7-JUQms0.xls", nBufferLength=0x105, lpBuffer=0x24e408, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7\\U7-JUQms0.xls", lpFilePart=0x0) returned 0x72 [0072.997] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7\\U7-JUQms0.xls.Crypted", nBufferLength=0x105, lpBuffer=0x24e408, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7\\U7-JUQms0.xls.Crypted", lpFilePart=0x0) returned 0x7a [0072.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e868) returned 1 [0072.997] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7\\U7-JUQms0.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\oagdplerzhdjeswk5fp\\ua2y2abjr ogaqm7\\u7-juqms0.xls"), fInfoLevelId=0x0, lpFileInformation=0x24e8e4 | out: lpFileInformation=0x24e8e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c39a60, ftCreationTime.dwHighDateTime=0x1d4d526, ftLastAccessTime.dwLowDateTime=0x5e040440, ftLastAccessTime.dwHighDateTime=0x1d4d346, ftLastWriteTime.dwLowDateTime=0xfc68c350, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x42f0)) returned 1 [0072.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e864) returned 1 [0072.997] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7\\U7-JUQms0.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\oagdplerzhdjeswk5fp\\ua2y2abjr ogaqm7\\u7-juqms0.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fAjq\\MAERJpw1vIOjf3pudY\\OaGDPLeRZhdJESWk5fp\\UA2y2aBJr OGAqM7\\U7-JUQms0.xls.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fajq\\maerjpw1viojf3pudy\\oagdplerzhdjeswk5fp\\ua2y2abjr ogaqm7\\u7-juqms0.xls.crypted")) returned 1 [0072.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0072.997] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4", lpFilePart=0x0) returned 0x30 [0072.997] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\", lpFilePart=0x0) returned 0x31 [0072.998] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4667a390, ftCreationTime.dwHighDateTime=0x1d4cbea, ftLastAccessTime.dwLowDateTime=0x39d7c60, ftLastAccessTime.dwHighDateTime=0x1d4c582, ftLastWriteTime.dwLowDateTime=0x39d7c60, ftLastWriteTime.dwHighDateTime=0x1d4c582, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69ade8 [0072.998] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4667a390, ftCreationTime.dwHighDateTime=0x1d4cbea, ftLastAccessTime.dwLowDateTime=0x39d7c60, ftLastAccessTime.dwHighDateTime=0x1d4c582, ftLastWriteTime.dwLowDateTime=0x39d7c60, ftLastWriteTime.dwHighDateTime=0x1d4c582, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.998] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x256d1ee0, ftCreationTime.dwHighDateTime=0x1d4d35b, ftLastAccessTime.dwLowDateTime=0x2a752c70, ftLastAccessTime.dwHighDateTime=0x1d4cdd4, ftLastWriteTime.dwLowDateTime=0x2a752c70, ftLastWriteTime.dwHighDateTime=0x1d4cdd4, nFileSizeHigh=0x0, nFileSizeLow=0x12c4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DpRxX.pdf", cAlternateFileName="")) returned 1 [0072.998] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c40a140, ftCreationTime.dwHighDateTime=0x1d4d526, ftLastAccessTime.dwLowDateTime=0xf1502aa0, ftLastAccessTime.dwHighDateTime=0x1d4cf16, ftLastWriteTime.dwLowDateTime=0xf1502aa0, ftLastWriteTime.dwHighDateTime=0x1d4cf16, nFileSizeHigh=0x0, nFileSizeLow=0x116e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS oQ7nF8n-IXQy1NYN.csv", cAlternateFileName="RSOQ7N~1.CSV")) returned 1 [0072.998] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce9d0bf0, ftCreationTime.dwHighDateTime=0x1d4cd30, ftLastAccessTime.dwLowDateTime=0xa5e2a230, ftLastAccessTime.dwHighDateTime=0x1d4c5db, ftLastWriteTime.dwLowDateTime=0xa5e2a230, ftLastWriteTime.dwHighDateTime=0x1d4c5db, nFileSizeHigh=0x0, nFileSizeLow=0x4b35, dwReserved0=0x0, dwReserved1=0x0, cFileName="xjsP4Bo8_.pps", cAlternateFileName="XJSP4B~1.PPS")) returned 1 [0072.998] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59639110, ftCreationTime.dwHighDateTime=0x1d4d4ba, ftLastAccessTime.dwLowDateTime=0x6f7c6070, ftLastAccessTime.dwHighDateTime=0x1d4cceb, ftLastWriteTime.dwLowDateTime=0x6f7c6070, ftLastWriteTime.dwHighDateTime=0x1d4cceb, nFileSizeHigh=0x0, nFileSizeLow=0x14e90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y8cmm8CitI.csv", cAlternateFileName="Y8CMM8~1.CSV")) returned 1 [0072.999] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0072.999] FindClose (in: hFindFile=0x69ade8 | out: hFindFile=0x69ade8) returned 1 [0072.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea54) returned 1 [0072.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea60) returned 1 [0072.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0072.999] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4", lpFilePart=0x0) returned 0x30 [0072.999] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\", lpFilePart=0x0) returned 0x31 [0072.999] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4667a390, ftCreationTime.dwHighDateTime=0x1d4cbea, ftLastAccessTime.dwLowDateTime=0x39d7c60, ftLastAccessTime.dwHighDateTime=0x1d4c582, ftLastWriteTime.dwLowDateTime=0x39d7c60, ftLastWriteTime.dwHighDateTime=0x1d4c582, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69ade8 [0072.999] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4667a390, ftCreationTime.dwHighDateTime=0x1d4cbea, ftLastAccessTime.dwLowDateTime=0x39d7c60, ftLastAccessTime.dwHighDateTime=0x1d4c582, ftLastWriteTime.dwLowDateTime=0x39d7c60, ftLastWriteTime.dwHighDateTime=0x1d4c582, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.999] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x256d1ee0, ftCreationTime.dwHighDateTime=0x1d4d35b, ftLastAccessTime.dwLowDateTime=0x2a752c70, ftLastAccessTime.dwHighDateTime=0x1d4cdd4, ftLastWriteTime.dwLowDateTime=0x2a752c70, ftLastWriteTime.dwHighDateTime=0x1d4cdd4, nFileSizeHigh=0x0, nFileSizeLow=0x12c4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DpRxX.pdf", cAlternateFileName="")) returned 1 [0072.999] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c40a140, ftCreationTime.dwHighDateTime=0x1d4d526, ftLastAccessTime.dwLowDateTime=0xf1502aa0, ftLastAccessTime.dwHighDateTime=0x1d4cf16, ftLastWriteTime.dwLowDateTime=0xf1502aa0, ftLastWriteTime.dwHighDateTime=0x1d4cf16, nFileSizeHigh=0x0, nFileSizeLow=0x116e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="RS oQ7nF8n-IXQy1NYN.csv", cAlternateFileName="RSOQ7N~1.CSV")) returned 1 [0073.000] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce9d0bf0, ftCreationTime.dwHighDateTime=0x1d4cd30, ftLastAccessTime.dwLowDateTime=0xa5e2a230, ftLastAccessTime.dwHighDateTime=0x1d4c5db, ftLastWriteTime.dwLowDateTime=0xa5e2a230, ftLastWriteTime.dwHighDateTime=0x1d4c5db, nFileSizeHigh=0x0, nFileSizeLow=0x4b35, dwReserved0=0x0, dwReserved1=0x0, cFileName="xjsP4Bo8_.pps", cAlternateFileName="XJSP4B~1.PPS")) returned 1 [0073.000] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59639110, ftCreationTime.dwHighDateTime=0x1d4d4ba, ftLastAccessTime.dwLowDateTime=0x6f7c6070, ftLastAccessTime.dwHighDateTime=0x1d4cceb, ftLastWriteTime.dwLowDateTime=0x6f7c6070, ftLastWriteTime.dwHighDateTime=0x1d4cceb, nFileSizeHigh=0x0, nFileSizeLow=0x14e90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y8cmm8CitI.csv", cAlternateFileName="Y8CMM8~1.CSV")) returned 1 [0073.000] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59639110, ftCreationTime.dwHighDateTime=0x1d4d4ba, ftLastAccessTime.dwLowDateTime=0x6f7c6070, ftLastAccessTime.dwHighDateTime=0x1d4cceb, ftLastWriteTime.dwLowDateTime=0x6f7c6070, ftLastWriteTime.dwHighDateTime=0x1d4cceb, nFileSizeHigh=0x0, nFileSizeLow=0x14e90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y8cmm8CitI.csv", cAlternateFileName="Y8CMM8~1.CSV")) returned 0 [0073.000] FindClose (in: hFindFile=0x69ade8 | out: hFindFile=0x69ade8) returned 1 [0073.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea54) returned 1 [0073.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea60) returned 1 [0073.000] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\DpRxX.pdf", nBufferLength=0x105, lpBuffer=0x24e444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\DpRxX.pdf", lpFilePart=0x0) returned 0x3a [0073.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0073.000] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\DpRxX.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmr8ej4\\dprxx.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0073.001] GetFileType (hFile=0x26c) returned 0x1 [0073.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e934) returned 1 [0073.001] GetFileType (hFile=0x26c) returned 0x1 [0073.001] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24ea40 | out: lpFileSizeHigh=0x24ea40*=0x0) returned 0x12c4f [0073.001] ReadFile (in: hFile=0x26c, lpBuffer=0x28f2254, nNumberOfBytesToRead=0x12c4f, lpNumberOfBytesRead=0x24e9ec, lpOverlapped=0x0 | out: lpBuffer=0x28f2254*, lpNumberOfBytesRead=0x24e9ec*=0x12c4f, lpOverlapped=0x0) returned 1 [0073.025] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e558, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0073.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9b8) returned 1 [0073.025] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24ea34 | out: lpFileInformation=0x24ea34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0073.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9b4) returned 1 [0073.025] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\DpRxX.pdf", nBufferLength=0x105, lpBuffer=0x24e430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\DpRxX.pdf", lpFilePart=0x0) returned 0x3a [0073.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e924) returned 1 [0073.025] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\DpRxX.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmr8ej4\\dprxx.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0073.027] GetFileType (hFile=0x26c) returned 0x1 [0073.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e920) returned 1 [0073.027] GetFileType (hFile=0x26c) returned 0x1 [0073.027] WriteFile (in: hFile=0x26c, lpBuffer=0x27a0598*, nNumberOfBytesToWrite=0x12c50, lpNumberOfBytesWritten=0x24e9e0, lpOverlapped=0x0 | out: lpBuffer=0x27a0598*, lpNumberOfBytesWritten=0x24e9e0*=0x12c50, lpOverlapped=0x0) returned 1 [0073.029] CloseHandle (hObject=0x26c) returned 1 [0073.030] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\DpRxX.pdf", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\DpRxX.pdf", lpFilePart=0x0) returned 0x3a [0073.030] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\DpRxX.pdf.Crypted", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\DpRxX.pdf.Crypted", lpFilePart=0x0) returned 0x42 [0073.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9c4) returned 1 [0073.030] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\DpRxX.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmr8ej4\\dprxx.pdf"), fInfoLevelId=0x0, lpFileInformation=0x24ea40 | out: lpFileInformation=0x24ea40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x256d1ee0, ftCreationTime.dwHighDateTime=0x1d4d35b, ftLastAccessTime.dwLowDateTime=0x2a752c70, ftLastAccessTime.dwHighDateTime=0x1d4cdd4, ftLastWriteTime.dwLowDateTime=0xfc6d8610, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x12c50)) returned 1 [0073.030] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9c0) returned 1 [0073.030] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\DpRxX.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmr8ej4\\dprxx.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\DpRxX.pdf.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmr8ej4\\dprxx.pdf.crypted")) returned 1 [0073.031] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\RS oQ7nF8n-IXQy1NYN.csv", nBufferLength=0x105, lpBuffer=0x24e444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\RS oQ7nF8n-IXQy1NYN.csv", lpFilePart=0x0) returned 0x48 [0073.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0073.031] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\RS oQ7nF8n-IXQy1NYN.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmr8ej4\\rs oq7nf8n-ixqy1nyn.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0073.031] GetFileType (hFile=0x26c) returned 0x1 [0073.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e934) returned 1 [0073.031] GetFileType (hFile=0x26c) returned 0x1 [0073.031] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24ea40 | out: lpFileSizeHigh=0x24ea40*=0x0) returned 0x116e6 [0073.031] ReadFile (in: hFile=0x26c, lpBuffer=0x27b378c, nNumberOfBytesToRead=0x116e6, lpNumberOfBytesRead=0x24e9ec, lpOverlapped=0x0 | out: lpBuffer=0x27b378c*, lpNumberOfBytesRead=0x24e9ec*=0x116e6, lpOverlapped=0x0) returned 1 [0073.033] CloseHandle (hObject=0x26c) returned 1 [0073.081] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e558, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0073.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9b8) returned 1 [0073.081] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24ea34 | out: lpFileInformation=0x24ea34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0073.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9b4) returned 1 [0073.081] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\RS oQ7nF8n-IXQy1NYN.csv", nBufferLength=0x105, lpBuffer=0x24e430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\RS oQ7nF8n-IXQy1NYN.csv", lpFilePart=0x0) returned 0x48 [0073.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e924) returned 1 [0073.082] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\RS oQ7nF8n-IXQy1NYN.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmr8ej4\\rs oq7nf8n-ixqy1nyn.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0073.083] GetFileType (hFile=0x26c) returned 0x1 [0073.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e920) returned 1 [0073.083] GetFileType (hFile=0x26c) returned 0x1 [0073.083] WriteFile (in: hFile=0x26c, lpBuffer=0x2834bb8*, nNumberOfBytesToWrite=0x116f0, lpNumberOfBytesWritten=0x24e9e0, lpOverlapped=0x0 | out: lpBuffer=0x2834bb8*, lpNumberOfBytesWritten=0x24e9e0*=0x116f0, lpOverlapped=0x0) returned 1 [0073.085] CloseHandle (hObject=0x26c) returned 1 [0073.086] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\RS oQ7nF8n-IXQy1NYN.csv", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\RS oQ7nF8n-IXQy1NYN.csv", lpFilePart=0x0) returned 0x48 [0073.086] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\RS oQ7nF8n-IXQy1NYN.csv.Crypted", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\RS oQ7nF8n-IXQy1NYN.csv.Crypted", lpFilePart=0x0) returned 0x50 [0073.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9c4) returned 1 [0073.086] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\RS oQ7nF8n-IXQy1NYN.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmr8ej4\\rs oq7nf8n-ixqy1nyn.csv"), fInfoLevelId=0x0, lpFileInformation=0x24ea40 | out: lpFileInformation=0x24ea40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c40a140, ftCreationTime.dwHighDateTime=0x1d4d526, ftLastAccessTime.dwLowDateTime=0xf1502aa0, ftLastAccessTime.dwHighDateTime=0x1d4cf16, ftLastWriteTime.dwLowDateTime=0xfc770b90, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x116f0)) returned 1 [0073.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9c0) returned 1 [0073.086] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\RS oQ7nF8n-IXQy1NYN.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmr8ej4\\rs oq7nf8n-ixqy1nyn.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\RS oQ7nF8n-IXQy1NYN.csv.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmr8ej4\\rs oq7nf8n-ixqy1nyn.csv.crypted")) returned 1 [0073.087] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\Y8cmm8CitI.csv", nBufferLength=0x105, lpBuffer=0x24e444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\Y8cmm8CitI.csv", lpFilePart=0x0) returned 0x3f [0073.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0073.087] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\Y8cmm8CitI.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmr8ej4\\y8cmm8citi.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0073.087] GetFileType (hFile=0x26c) returned 0x1 [0073.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e934) returned 1 [0073.087] GetFileType (hFile=0x26c) returned 0x1 [0073.087] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24ea40 | out: lpFileSizeHigh=0x24ea40*=0x0) returned 0x14e90 [0073.088] ReadFile (in: hFile=0x26c, lpBuffer=0x38b1e20, nNumberOfBytesToRead=0x14e90, lpNumberOfBytesRead=0x24e9ec, lpOverlapped=0x0 | out: lpBuffer=0x38b1e20*, lpNumberOfBytesRead=0x24e9ec*=0x14e90, lpOverlapped=0x0) returned 1 [0073.089] CloseHandle (hObject=0x26c) returned 1 [0073.109] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e558, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0073.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9b8) returned 1 [0073.109] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24ea34 | out: lpFileInformation=0x24ea34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0073.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9b4) returned 1 [0073.109] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\Y8cmm8CitI.csv", nBufferLength=0x105, lpBuffer=0x24e430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\Y8cmm8CitI.csv", lpFilePart=0x0) returned 0x3f [0073.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e924) returned 1 [0073.109] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\Y8cmm8CitI.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmr8ej4\\y8cmm8citi.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0073.111] GetFileType (hFile=0x26c) returned 0x1 [0073.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e920) returned 1 [0073.111] GetFileType (hFile=0x26c) returned 0x1 [0073.111] WriteFile (in: hFile=0x26c, lpBuffer=0x391a770*, nNumberOfBytesToWrite=0x14ea0, lpNumberOfBytesWritten=0x24e9e0, lpOverlapped=0x0 | out: lpBuffer=0x391a770*, lpNumberOfBytesWritten=0x24e9e0*=0x14ea0, lpOverlapped=0x0) returned 1 [0073.113] CloseHandle (hObject=0x26c) returned 1 [0073.148] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\Y8cmm8CitI.csv", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\Y8cmm8CitI.csv", lpFilePart=0x0) returned 0x3f [0073.148] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\Y8cmm8CitI.csv.Crypted", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\Y8cmm8CitI.csv.Crypted", lpFilePart=0x0) returned 0x47 [0073.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9c4) returned 1 [0073.148] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\Y8cmm8CitI.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmr8ej4\\y8cmm8citi.csv"), fInfoLevelId=0x0, lpFileInformation=0x24ea40 | out: lpFileInformation=0x24ea40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59639110, ftCreationTime.dwHighDateTime=0x1d4d4ba, ftLastAccessTime.dwLowDateTime=0x6f7c6070, ftLastAccessTime.dwHighDateTime=0x1d4cceb, ftLastWriteTime.dwLowDateTime=0xfc7e2fb0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x14ea0)) returned 1 [0073.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9c0) returned 1 [0073.148] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\Y8cmm8CitI.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmr8ej4\\y8cmm8citi.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mbMr8eJ4\\Y8cmm8CitI.csv.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mbmr8ej4\\y8cmm8citi.csv.crypted")) returned 1 [0073.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0073.149] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", lpFilePart=0x0) returned 0x30 [0073.149] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\", lpFilePart=0x0) returned 0x31 [0073.149] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0073.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea58) returned 1 [0073.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0073.610] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", lpFilePart=0x0) returned 0x33 [0073.610] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\", lpFilePart=0x0) returned 0x34 [0073.610] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0073.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea58) returned 1 [0073.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0073.612] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", lpFilePart=0x0) returned 0x31 [0073.612] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\", lpFilePart=0x0) returned 0x32 [0073.612] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69aea8 [0073.695] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.696] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0073.696] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9e9e4460, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9e9e4460, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites.vss", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0073.696] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0073.696] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0 [0073.696] FindClose (in: hFindFile=0x69aea8 | out: hFindFile=0x69aea8) returned 1 [0073.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea54) returned 1 [0073.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea60) returned 1 [0073.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0073.697] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", lpFilePart=0x0) returned 0x31 [0073.697] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\", lpFilePart=0x0) returned 0x32 [0073.697] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69aea8 [0073.697] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.697] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0073.697] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9e9e4460, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9e9e4460, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites.vss", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0073.698] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0073.698] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0073.698] FindClose (in: hFindFile=0x69aea8 | out: hFindFile=0x69aea8) returned 1 [0073.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea54) returned 1 [0073.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea60) returned 1 [0073.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea20) returned 1 [0073.698] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x24e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x3a [0073.698] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\", nBufferLength=0x105, lpBuffer=0x24e4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\", lpFilePart=0x0) returned 0x3b [0073.699] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x24e748 | out: lpFindFileData=0x24e748*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69aea8 [0073.712] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.712] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0073.713] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0073.713] FindClose (in: hFindFile=0x69aea8 | out: hFindFile=0x69aea8) returned 1 [0073.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9e0) returned 1 [0073.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9ec) returned 1 [0073.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea20) returned 1 [0073.713] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x24e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x3a [0073.713] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\", nBufferLength=0x105, lpBuffer=0x24e4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\", lpFilePart=0x0) returned 0x3b [0073.713] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x24e748 | out: lpFindFileData=0x24e748*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69aea8 [0073.714] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.714] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0073.714] FindNextFileW (in: hFindFile=0x69aea8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0073.714] FindClose (in: hFindFile=0x69aea8 | out: hFindFile=0x69aea8) returned 1 [0073.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9e0) returned 1 [0073.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9ec) returned 1 [0073.715] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico", nBufferLength=0x105, lpBuffer=0x24e3d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico", lpFilePart=0x0) returned 0x45 [0073.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8c4) returned 1 [0073.715] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0073.730] GetFileType (hFile=0x26c) returned 0x1 [0073.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8c0) returned 1 [0073.730] GetFileType (hFile=0x26c) returned 0x1 [0073.730] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24e9cc | out: lpFileSizeHigh=0x24e9cc*=0x0) returned 0x74e6 [0073.730] ReadFile (in: hFile=0x26c, lpBuffer=0x2899ed8, nNumberOfBytesToRead=0x74e6, lpNumberOfBytesRead=0x24e978, lpOverlapped=0x0 | out: lpBuffer=0x2899ed8*, lpNumberOfBytesRead=0x24e978*=0x74e6, lpOverlapped=0x0) returned 1 [0073.750] CloseHandle (hObject=0x26c) returned 1 [0073.793] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e4e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0073.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e944) returned 1 [0073.793] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24e9c0 | out: lpFileInformation=0x24e9c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0073.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e940) returned 1 [0073.794] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico", nBufferLength=0x105, lpBuffer=0x24e3bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico", lpFilePart=0x0) returned 0x45 [0073.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8b0) returned 1 [0073.794] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0073.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24d6e8) returned 1 [0073.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0073.795] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", lpFilePart=0x0) returned 0x31 [0073.795] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\", lpFilePart=0x0) returned 0x32 [0073.795] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0073.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea58) returned 1 [0073.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0073.797] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x35 [0073.797] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\", lpFilePart=0x0) returned 0x36 [0073.797] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b228 [0073.798] FindNextFileW (in: hFindFile=0x69b228, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.799] FindNextFileW (in: hFindFile=0x69b228, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 1 [0073.799] FindNextFileW (in: hFindFile=0x69b228, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0073.799] FindClose (in: hFindFile=0x69b228 | out: hFindFile=0x69b228) returned 1 [0073.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea54) returned 1 [0073.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea60) returned 1 [0073.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0073.805] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x35 [0073.805] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\", lpFilePart=0x0) returned 0x36 [0073.806] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b228 [0073.806] FindNextFileW (in: hFindFile=0x69b228, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.806] FindNextFileW (in: hFindFile=0x69b228, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 1 [0073.806] FindNextFileW (in: hFindFile=0x69b228, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 0 [0073.806] FindClose (in: hFindFile=0x69b228 | out: hFindFile=0x69b228) returned 1 [0073.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea54) returned 1 [0073.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea60) returned 1 [0073.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eb08) returned 1 [0073.807] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", nBufferLength=0x105, lpBuffer=0x24e610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", lpFilePart=0x0) returned 0x27 [0073.807] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\", nBufferLength=0x105, lpBuffer=0x24e5e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\", lpFilePart=0x0) returned 0x28 [0073.807] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*", lpFindFileData=0x24e830 | out: lpFindFileData=0x24e830*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b228 [0073.807] FindNextFileW (in: hFindFile=0x69b228, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.807] FindNextFileW (in: hFindFile=0x69b228, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0073.807] FindNextFileW (in: hFindFile=0x69b228, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0073.808] FindClose (in: hFindFile=0x69b228 | out: hFindFile=0x69b228) returned 1 [0073.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eac8) returned 1 [0073.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ead4) returned 1 [0073.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eb08) returned 1 [0073.808] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", nBufferLength=0x105, lpBuffer=0x24e610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", lpFilePart=0x0) returned 0x27 [0073.808] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\", nBufferLength=0x105, lpBuffer=0x24e5e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\", lpFilePart=0x0) returned 0x28 [0073.808] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*", lpFindFileData=0x24e830 | out: lpFindFileData=0x24e830*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b228 [0073.808] FindNextFileW (in: hFindFile=0x69b228, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.808] FindNextFileW (in: hFindFile=0x69b228, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0073.809] FindNextFileW (in: hFindFile=0x69b228, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0073.809] FindClose (in: hFindFile=0x69b228 | out: hFindFile=0x69b228) returned 1 [0073.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eac8) returned 1 [0073.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ead4) returned 1 [0073.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eb08) returned 1 [0073.809] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", nBufferLength=0x105, lpBuffer=0x24e610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", lpFilePart=0x0) returned 0x26 [0073.809] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", nBufferLength=0x105, lpBuffer=0x24e5e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", lpFilePart=0x0) returned 0x27 [0073.809] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", lpFindFileData=0x24e830 | out: lpFindFileData=0x24e830*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xddcc4e80, ftLastAccessTime.dwHighDateTime=0x1d50efb, ftLastWriteTime.dwLowDateTime=0xddcc4e80, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b228 [0073.809] FindNextFileW (in: hFindFile=0x69b228, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xddcc4e80, ftLastAccessTime.dwHighDateTime=0x1d50efb, ftLastWriteTime.dwLowDateTime=0xddcc4e80, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.810] FindNextFileW (in: hFindFile=0x69b228, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0073.810] FindNextFileW (in: hFindFile=0x69b228, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5512f700, ftCreationTime.dwHighDateTime=0x1d4c695, ftLastAccessTime.dwLowDateTime=0x487707c0, ftLastAccessTime.dwHighDateTime=0x1d4d06d, ftLastWriteTime.dwLowDateTime=0x487707c0, ftLastWriteTime.dwHighDateTime=0x1d4d06d, nFileSizeHigh=0x0, nFileSizeLow=0x15d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="EMHGi-zKGwvJcNtVp.bmp", cAlternateFileName="EMHGI-~1.BMP")) returned 1 [0073.810] FindNextFileW (in: hFindFile=0x69b228, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57aef420, ftCreationTime.dwHighDateTime=0x1d4d476, ftLastAccessTime.dwLowDateTime=0x3b525330, ftLastAccessTime.dwHighDateTime=0x1d4c8af, ftLastWriteTime.dwLowDateTime=0x3b525330, ftLastWriteTime.dwHighDateTime=0x1d4c8af, nFileSizeHigh=0x0, nFileSizeLow=0xbb67, dwReserved0=0x0, dwReserved1=0x0, cFileName="FO-jGzIfqX5vu.gif", cAlternateFileName="FO-JGZ~1.GIF")) returned 1 [0073.810] FindNextFileW (in: hFindFile=0x69b228, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74d579f0, ftCreationTime.dwHighDateTime=0x1d4c550, ftLastAccessTime.dwLowDateTime=0x31cd1b30, ftLastAccessTime.dwHighDateTime=0x1d4c902, ftLastWriteTime.dwLowDateTime=0x31cd1b30, ftLastWriteTime.dwHighDateTime=0x1d4c902, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="iM7anJ2M_R", cAlternateFileName="IM7ANJ~1")) returned 1 [0073.810] FindNextFileW (in: hFindFile=0x69b228, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e4013d0, ftCreationTime.dwHighDateTime=0x1d4d461, ftLastAccessTime.dwLowDateTime=0xea0d9060, ftLastAccessTime.dwHighDateTime=0x1d4c639, ftLastWriteTime.dwLowDateTime=0xea0d9060, ftLastWriteTime.dwHighDateTime=0x1d4c639, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MBjYdLX-SVIM8HZg", cAlternateFileName="MBJYDL~1")) returned 1 [0073.810] FindNextFileW (in: hFindFile=0x69b228, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc43add70, ftCreationTime.dwHighDateTime=0x1d4cb3e, ftLastAccessTime.dwLowDateTime=0xea2420c0, ftLastAccessTime.dwHighDateTime=0x1d4ceac, ftLastWriteTime.dwLowDateTime=0xea2420c0, ftLastWriteTime.dwHighDateTime=0x1d4ceac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="O17558GL7LMbWY 5W", cAlternateFileName="O17558~1")) returned 1 [0073.810] FindNextFileW (in: hFindFile=0x69b228, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x682e3780, ftCreationTime.dwHighDateTime=0x1d4d182, ftLastAccessTime.dwLowDateTime=0x6d031160, ftLastAccessTime.dwHighDateTime=0x1d4c9dd, ftLastWriteTime.dwLowDateTime=0x6d031160, ftLastWriteTime.dwHighDateTime=0x1d4c9dd, nFileSizeHigh=0x0, nFileSizeLow=0x35c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PQTj.png", cAlternateFileName="")) returned 1 [0073.811] FindNextFileW (in: hFindFile=0x69b228, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42eaf990, ftCreationTime.dwHighDateTime=0x1d4ce53, ftLastAccessTime.dwLowDateTime=0x12913a90, ftLastAccessTime.dwHighDateTime=0x1d4d3a1, ftLastWriteTime.dwLowDateTime=0x12913a90, ftLastWriteTime.dwHighDateTime=0x1d4d3a1, nFileSizeHigh=0x0, nFileSizeLow=0x10622, dwReserved0=0x0, dwReserved1=0x0, cFileName="r5F2Z.gif", cAlternateFileName="")) returned 1 [0073.811] FindNextFileW (in: hFindFile=0x69b228, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf298d0, ftCreationTime.dwHighDateTime=0x1d4d006, ftLastAccessTime.dwLowDateTime=0xf6b516e0, ftLastAccessTime.dwHighDateTime=0x1d4c76e, ftLastWriteTime.dwLowDateTime=0xf6b516e0, ftLastWriteTime.dwHighDateTime=0x1d4c76e, nFileSizeHigh=0x0, nFileSizeLow=0x1259d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z_rJGh67uG.gif", cAlternateFileName="Z_RJGH~1.GIF")) returned 1 [0073.811] FindNextFileW (in: hFindFile=0x69b228, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0073.811] FindClose (in: hFindFile=0x69b228 | out: hFindFile=0x69b228) returned 1 [0073.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eac8) returned 1 [0073.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ead4) returned 1 [0073.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eb08) returned 1 [0073.811] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", nBufferLength=0x105, lpBuffer=0x24e610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", lpFilePart=0x0) returned 0x26 [0073.811] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", nBufferLength=0x105, lpBuffer=0x24e5e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", lpFilePart=0x0) returned 0x27 [0073.811] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", lpFindFileData=0x24e830 | out: lpFindFileData=0x24e830*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xddcc4e80, ftLastAccessTime.dwHighDateTime=0x1d50efb, ftLastWriteTime.dwLowDateTime=0xddcc4e80, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b228 [0073.811] FindNextFileW (in: hFindFile=0x69b228, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xddcc4e80, ftLastAccessTime.dwHighDateTime=0x1d50efb, ftLastWriteTime.dwLowDateTime=0xddcc4e80, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.812] FindNextFileW (in: hFindFile=0x69b228, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0073.812] FindNextFileW (in: hFindFile=0x69b228, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5512f700, ftCreationTime.dwHighDateTime=0x1d4c695, ftLastAccessTime.dwLowDateTime=0x487707c0, ftLastAccessTime.dwHighDateTime=0x1d4d06d, ftLastWriteTime.dwLowDateTime=0x487707c0, ftLastWriteTime.dwHighDateTime=0x1d4d06d, nFileSizeHigh=0x0, nFileSizeLow=0x15d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="EMHGi-zKGwvJcNtVp.bmp", cAlternateFileName="EMHGI-~1.BMP")) returned 1 [0073.812] FindNextFileW (in: hFindFile=0x69b228, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57aef420, ftCreationTime.dwHighDateTime=0x1d4d476, ftLastAccessTime.dwLowDateTime=0x3b525330, ftLastAccessTime.dwHighDateTime=0x1d4c8af, ftLastWriteTime.dwLowDateTime=0x3b525330, ftLastWriteTime.dwHighDateTime=0x1d4c8af, nFileSizeHigh=0x0, nFileSizeLow=0xbb67, dwReserved0=0x0, dwReserved1=0x0, cFileName="FO-jGzIfqX5vu.gif", cAlternateFileName="FO-JGZ~1.GIF")) returned 1 [0073.812] FindNextFileW (in: hFindFile=0x69b228, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74d579f0, ftCreationTime.dwHighDateTime=0x1d4c550, ftLastAccessTime.dwLowDateTime=0x31cd1b30, ftLastAccessTime.dwHighDateTime=0x1d4c902, ftLastWriteTime.dwLowDateTime=0x31cd1b30, ftLastWriteTime.dwHighDateTime=0x1d4c902, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="iM7anJ2M_R", cAlternateFileName="IM7ANJ~1")) returned 1 [0073.812] FindNextFileW (in: hFindFile=0x69b228, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e4013d0, ftCreationTime.dwHighDateTime=0x1d4d461, ftLastAccessTime.dwLowDateTime=0xea0d9060, ftLastAccessTime.dwHighDateTime=0x1d4c639, ftLastWriteTime.dwLowDateTime=0xea0d9060, ftLastWriteTime.dwHighDateTime=0x1d4c639, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MBjYdLX-SVIM8HZg", cAlternateFileName="MBJYDL~1")) returned 1 [0073.812] FindNextFileW (in: hFindFile=0x69b228, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc43add70, ftCreationTime.dwHighDateTime=0x1d4cb3e, ftLastAccessTime.dwLowDateTime=0xea2420c0, ftLastAccessTime.dwHighDateTime=0x1d4ceac, ftLastWriteTime.dwLowDateTime=0xea2420c0, ftLastWriteTime.dwHighDateTime=0x1d4ceac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="O17558GL7LMbWY 5W", cAlternateFileName="O17558~1")) returned 1 [0073.813] FindNextFileW (in: hFindFile=0x69b228, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x682e3780, ftCreationTime.dwHighDateTime=0x1d4d182, ftLastAccessTime.dwLowDateTime=0x6d031160, ftLastAccessTime.dwHighDateTime=0x1d4c9dd, ftLastWriteTime.dwLowDateTime=0x6d031160, ftLastWriteTime.dwHighDateTime=0x1d4c9dd, nFileSizeHigh=0x0, nFileSizeLow=0x35c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PQTj.png", cAlternateFileName="")) returned 1 [0073.813] FindNextFileW (in: hFindFile=0x69b228, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42eaf990, ftCreationTime.dwHighDateTime=0x1d4ce53, ftLastAccessTime.dwLowDateTime=0x12913a90, ftLastAccessTime.dwHighDateTime=0x1d4d3a1, ftLastWriteTime.dwLowDateTime=0x12913a90, ftLastWriteTime.dwHighDateTime=0x1d4d3a1, nFileSizeHigh=0x0, nFileSizeLow=0x10622, dwReserved0=0x0, dwReserved1=0x0, cFileName="r5F2Z.gif", cAlternateFileName="")) returned 1 [0073.813] FindNextFileW (in: hFindFile=0x69b228, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf298d0, ftCreationTime.dwHighDateTime=0x1d4d006, ftLastAccessTime.dwLowDateTime=0xf6b516e0, ftLastAccessTime.dwHighDateTime=0x1d4c76e, ftLastWriteTime.dwLowDateTime=0xf6b516e0, ftLastWriteTime.dwHighDateTime=0x1d4c76e, nFileSizeHigh=0x0, nFileSizeLow=0x1259d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z_rJGh67uG.gif", cAlternateFileName="Z_RJGH~1.GIF")) returned 1 [0073.813] FindNextFileW (in: hFindFile=0x69b228, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf298d0, ftCreationTime.dwHighDateTime=0x1d4d006, ftLastAccessTime.dwLowDateTime=0xf6b516e0, ftLastAccessTime.dwHighDateTime=0x1d4c76e, ftLastWriteTime.dwLowDateTime=0xf6b516e0, ftLastWriteTime.dwHighDateTime=0x1d4c76e, nFileSizeHigh=0x0, nFileSizeLow=0x1259d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z_rJGh67uG.gif", cAlternateFileName="Z_RJGH~1.GIF")) returned 0 [0073.813] FindClose (in: hFindFile=0x69b228 | out: hFindFile=0x69b228) returned 1 [0073.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eac8) returned 1 [0073.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ead4) returned 1 [0073.814] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EMHGi-zKGwvJcNtVp.bmp", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EMHGi-zKGwvJcNtVp.bmp", lpFilePart=0x0) returned 0x3c [0073.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0073.814] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EMHGi-zKGwvJcNtVp.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\emhgi-zkgwvjcntvp.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0073.814] GetFileType (hFile=0x26c) returned 0x1 [0073.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0073.814] GetFileType (hFile=0x26c) returned 0x1 [0073.814] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x15d86 [0073.814] ReadFile (in: hFile=0x26c, lpBuffer=0x392f630, nNumberOfBytesToRead=0x15d86, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x392f630*, lpNumberOfBytesRead=0x24ea60*=0x15d86, lpOverlapped=0x0) returned 1 [0073.817] CloseHandle (hObject=0x26c) returned 1 [0073.874] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0073.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0073.874] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0073.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0073.874] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EMHGi-zKGwvJcNtVp.bmp", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EMHGi-zKGwvJcNtVp.bmp", lpFilePart=0x0) returned 0x3c [0073.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0073.874] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EMHGi-zKGwvJcNtVp.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\emhgi-zkgwvjcntvp.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0073.876] GetFileType (hFile=0x26c) returned 0x1 [0073.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0073.876] GetFileType (hFile=0x26c) returned 0x1 [0073.876] WriteFile (in: hFile=0x26c, lpBuffer=0x399ca38*, nNumberOfBytesToWrite=0x15d90, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x399ca38*, lpNumberOfBytesWritten=0x24ea54*=0x15d90, lpOverlapped=0x0) returned 1 [0073.878] CloseHandle (hObject=0x26c) returned 1 [0073.882] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EMHGi-zKGwvJcNtVp.bmp", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EMHGi-zKGwvJcNtVp.bmp", lpFilePart=0x0) returned 0x3c [0073.882] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EMHGi-zKGwvJcNtVp.bmp.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EMHGi-zKGwvJcNtVp.bmp.Crypted", lpFilePart=0x0) returned 0x44 [0073.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0073.882] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EMHGi-zKGwvJcNtVp.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\emhgi-zkgwvjcntvp.bmp"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5512f700, ftCreationTime.dwHighDateTime=0x1d4c695, ftLastAccessTime.dwLowDateTime=0x487707c0, ftLastAccessTime.dwHighDateTime=0x1d4d06d, ftLastWriteTime.dwLowDateTime=0xfcee1050, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x15d90)) returned 1 [0073.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0073.882] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EMHGi-zKGwvJcNtVp.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\emhgi-zkgwvjcntvp.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EMHGi-zKGwvJcNtVp.bmp.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\emhgi-zkgwvjcntvp.bmp.crypted")) returned 1 [0073.883] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\PQTj.png", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\PQTj.png", lpFilePart=0x0) returned 0x2f [0073.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0073.883] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\PQTj.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\pqtj.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0073.883] GetFileType (hFile=0x26c) returned 0x1 [0073.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0073.883] GetFileType (hFile=0x26c) returned 0x1 [0073.883] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x35c1 [0073.883] ReadFile (in: hFile=0x26c, lpBuffer=0x296649c, nNumberOfBytesToRead=0x35c1, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x296649c*, lpNumberOfBytesRead=0x24ea60*=0x35c1, lpOverlapped=0x0) returned 1 [0073.885] CloseHandle (hObject=0x26c) returned 1 [0073.910] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0073.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0073.910] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0073.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0073.911] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\PQTj.png", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\PQTj.png", lpFilePart=0x0) returned 0x2f [0073.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0073.911] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\PQTj.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\pqtj.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0073.912] GetFileType (hFile=0x26c) returned 0x1 [0073.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0073.912] GetFileType (hFile=0x26c) returned 0x1 [0073.912] WriteFile (in: hFile=0x26c, lpBuffer=0x29c3f98*, nNumberOfBytesToWrite=0x35d0, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x29c3f98*, lpNumberOfBytesWritten=0x24ea54*=0x35d0, lpOverlapped=0x0) returned 1 [0073.913] CloseHandle (hObject=0x26c) returned 1 [0073.916] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\PQTj.png", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\PQTj.png", lpFilePart=0x0) returned 0x2f [0073.916] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\PQTj.png.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\PQTj.png.Crypted", lpFilePart=0x0) returned 0x37 [0073.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0073.916] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\PQTj.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\pqtj.png"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x682e3780, ftCreationTime.dwHighDateTime=0x1d4d182, ftLastAccessTime.dwLowDateTime=0x6d031160, ftLastAccessTime.dwHighDateTime=0x1d4c9dd, ftLastWriteTime.dwLowDateTime=0xfcf2d310, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x35d0)) returned 1 [0073.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0073.916] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\PQTj.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\pqtj.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\PQTj.png.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\pqtj.png.crypted")) returned 1 [0073.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0073.917] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R", lpFilePart=0x0) returned 0x31 [0073.917] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\", lpFilePart=0x0) returned 0x32 [0073.917] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74d579f0, ftCreationTime.dwHighDateTime=0x1d4c550, ftLastAccessTime.dwLowDateTime=0x31cd1b30, ftLastAccessTime.dwHighDateTime=0x1d4c902, ftLastWriteTime.dwLowDateTime=0x31cd1b30, ftLastWriteTime.dwHighDateTime=0x1d4c902, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b1e8 [0073.917] FindNextFileW (in: hFindFile=0x69b1e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74d579f0, ftCreationTime.dwHighDateTime=0x1d4c550, ftLastAccessTime.dwLowDateTime=0x31cd1b30, ftLastAccessTime.dwHighDateTime=0x1d4c902, ftLastWriteTime.dwLowDateTime=0x31cd1b30, ftLastWriteTime.dwHighDateTime=0x1d4c902, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.918] FindNextFileW (in: hFindFile=0x69b1e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8d50760, ftCreationTime.dwHighDateTime=0x1d4c8e6, ftLastAccessTime.dwLowDateTime=0xe723f400, ftLastAccessTime.dwHighDateTime=0x1d4ce47, ftLastWriteTime.dwLowDateTime=0xe723f400, ftLastWriteTime.dwHighDateTime=0x1d4ce47, nFileSizeHigh=0x0, nFileSizeLow=0x8f6d, dwReserved0=0x0, dwReserved1=0x0, cFileName="3hHxI6kz.jpg", cAlternateFileName="")) returned 1 [0073.918] FindNextFileW (in: hFindFile=0x69b1e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b325dc0, ftCreationTime.dwHighDateTime=0x1d4d3ce, ftLastAccessTime.dwLowDateTime=0x485515e0, ftLastAccessTime.dwHighDateTime=0x1d4c9e0, ftLastWriteTime.dwLowDateTime=0x485515e0, ftLastWriteTime.dwHighDateTime=0x1d4c9e0, nFileSizeHigh=0x0, nFileSizeLow=0x9f3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="aIwtyh2Wi.bmp", cAlternateFileName="AIWTYH~1.BMP")) returned 1 [0073.918] FindNextFileW (in: hFindFile=0x69b1e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10dec6d0, ftCreationTime.dwHighDateTime=0x1d4ca65, ftLastAccessTime.dwLowDateTime=0x2ad72b90, ftLastAccessTime.dwHighDateTime=0x1d4cfe2, ftLastWriteTime.dwLowDateTime=0x2ad72b90, ftLastWriteTime.dwHighDateTime=0x1d4cfe2, nFileSizeHigh=0x0, nFileSizeLow=0xe0b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="HdBy9h_IfQ_NJxxZzV.png", cAlternateFileName="HDBY9H~1.PNG")) returned 1 [0073.918] FindNextFileW (in: hFindFile=0x69b1e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56e552e0, ftCreationTime.dwHighDateTime=0x1d4cee1, ftLastAccessTime.dwLowDateTime=0xc3a8a300, ftLastAccessTime.dwHighDateTime=0x1d4c671, ftLastWriteTime.dwLowDateTime=0xc3a8a300, ftLastWriteTime.dwHighDateTime=0x1d4c671, nFileSizeHigh=0x0, nFileSizeLow=0x181c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SGLvkc2L.png", cAlternateFileName="")) returned 1 [0073.918] FindNextFileW (in: hFindFile=0x69b1e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0073.918] FindClose (in: hFindFile=0x69b1e8 | out: hFindFile=0x69b1e8) returned 1 [0073.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea54) returned 1 [0073.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea60) returned 1 [0073.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0073.919] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R", lpFilePart=0x0) returned 0x31 [0073.919] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\", lpFilePart=0x0) returned 0x32 [0073.919] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74d579f0, ftCreationTime.dwHighDateTime=0x1d4c550, ftLastAccessTime.dwLowDateTime=0x31cd1b30, ftLastAccessTime.dwHighDateTime=0x1d4c902, ftLastWriteTime.dwLowDateTime=0x31cd1b30, ftLastWriteTime.dwHighDateTime=0x1d4c902, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b1e8 [0073.919] FindNextFileW (in: hFindFile=0x69b1e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74d579f0, ftCreationTime.dwHighDateTime=0x1d4c550, ftLastAccessTime.dwLowDateTime=0x31cd1b30, ftLastAccessTime.dwHighDateTime=0x1d4c902, ftLastWriteTime.dwLowDateTime=0x31cd1b30, ftLastWriteTime.dwHighDateTime=0x1d4c902, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.919] FindNextFileW (in: hFindFile=0x69b1e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8d50760, ftCreationTime.dwHighDateTime=0x1d4c8e6, ftLastAccessTime.dwLowDateTime=0xe723f400, ftLastAccessTime.dwHighDateTime=0x1d4ce47, ftLastWriteTime.dwLowDateTime=0xe723f400, ftLastWriteTime.dwHighDateTime=0x1d4ce47, nFileSizeHigh=0x0, nFileSizeLow=0x8f6d, dwReserved0=0x0, dwReserved1=0x0, cFileName="3hHxI6kz.jpg", cAlternateFileName="")) returned 1 [0073.919] FindNextFileW (in: hFindFile=0x69b1e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b325dc0, ftCreationTime.dwHighDateTime=0x1d4d3ce, ftLastAccessTime.dwLowDateTime=0x485515e0, ftLastAccessTime.dwHighDateTime=0x1d4c9e0, ftLastWriteTime.dwLowDateTime=0x485515e0, ftLastWriteTime.dwHighDateTime=0x1d4c9e0, nFileSizeHigh=0x0, nFileSizeLow=0x9f3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="aIwtyh2Wi.bmp", cAlternateFileName="AIWTYH~1.BMP")) returned 1 [0073.920] FindNextFileW (in: hFindFile=0x69b1e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10dec6d0, ftCreationTime.dwHighDateTime=0x1d4ca65, ftLastAccessTime.dwLowDateTime=0x2ad72b90, ftLastAccessTime.dwHighDateTime=0x1d4cfe2, ftLastWriteTime.dwLowDateTime=0x2ad72b90, ftLastWriteTime.dwHighDateTime=0x1d4cfe2, nFileSizeHigh=0x0, nFileSizeLow=0xe0b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="HdBy9h_IfQ_NJxxZzV.png", cAlternateFileName="HDBY9H~1.PNG")) returned 1 [0073.920] FindNextFileW (in: hFindFile=0x69b1e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56e552e0, ftCreationTime.dwHighDateTime=0x1d4cee1, ftLastAccessTime.dwLowDateTime=0xc3a8a300, ftLastAccessTime.dwHighDateTime=0x1d4c671, ftLastWriteTime.dwLowDateTime=0xc3a8a300, ftLastWriteTime.dwHighDateTime=0x1d4c671, nFileSizeHigh=0x0, nFileSizeLow=0x181c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SGLvkc2L.png", cAlternateFileName="")) returned 1 [0073.920] FindNextFileW (in: hFindFile=0x69b1e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56e552e0, ftCreationTime.dwHighDateTime=0x1d4cee1, ftLastAccessTime.dwLowDateTime=0xc3a8a300, ftLastAccessTime.dwHighDateTime=0x1d4c671, ftLastWriteTime.dwLowDateTime=0xc3a8a300, ftLastWriteTime.dwHighDateTime=0x1d4c671, nFileSizeHigh=0x0, nFileSizeLow=0x181c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SGLvkc2L.png", cAlternateFileName="")) returned 0 [0073.920] FindClose (in: hFindFile=0x69b1e8 | out: hFindFile=0x69b1e8) returned 1 [0073.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea54) returned 1 [0073.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea60) returned 1 [0073.920] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\3hHxI6kz.jpg", nBufferLength=0x105, lpBuffer=0x24e444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\3hHxI6kz.jpg", lpFilePart=0x0) returned 0x3e [0073.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0073.920] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\3hHxI6kz.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\im7anj2m_r\\3hhxi6kz.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0073.921] GetFileType (hFile=0x26c) returned 0x1 [0073.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e934) returned 1 [0073.921] GetFileType (hFile=0x26c) returned 0x1 [0073.921] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24ea40 | out: lpFileSizeHigh=0x24ea40*=0x0) returned 0x8f6d [0073.922] ReadFile (in: hFile=0x26c, lpBuffer=0x29c9990, nNumberOfBytesToRead=0x8f6d, lpNumberOfBytesRead=0x24e9ec, lpOverlapped=0x0 | out: lpBuffer=0x29c9990*, lpNumberOfBytesRead=0x24e9ec*=0x8f6d, lpOverlapped=0x0) returned 1 [0073.934] CloseHandle (hObject=0x26c) returned 1 [0073.966] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e558, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0073.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9b8) returned 1 [0073.966] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24ea34 | out: lpFileInformation=0x24ea34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0073.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9b4) returned 1 [0073.966] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\3hHxI6kz.jpg", nBufferLength=0x105, lpBuffer=0x24e430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\3hHxI6kz.jpg", lpFilePart=0x0) returned 0x3e [0073.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e924) returned 1 [0073.966] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\3hHxI6kz.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\im7anj2m_r\\3hhxi6kz.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0073.968] GetFileType (hFile=0x26c) returned 0x1 [0073.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e920) returned 1 [0073.968] GetFileType (hFile=0x26c) returned 0x1 [0073.968] WriteFile (in: hFile=0x26c, lpBuffer=0x2a434ac*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x24e9e0, lpOverlapped=0x0 | out: lpBuffer=0x2a434ac*, lpNumberOfBytesWritten=0x24e9e0*=0x8f70, lpOverlapped=0x0) returned 1 [0073.969] CloseHandle (hObject=0x26c) returned 1 [0073.973] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\3hHxI6kz.jpg", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\3hHxI6kz.jpg", lpFilePart=0x0) returned 0x3e [0073.973] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\3hHxI6kz.jpg.Crypted", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\3hHxI6kz.jpg.Crypted", lpFilePart=0x0) returned 0x46 [0073.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9c4) returned 1 [0073.973] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\3hHxI6kz.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\im7anj2m_r\\3hhxi6kz.jpg"), fInfoLevelId=0x0, lpFileInformation=0x24ea40 | out: lpFileInformation=0x24ea40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8d50760, ftCreationTime.dwHighDateTime=0x1d4c8e6, ftLastAccessTime.dwLowDateTime=0xe723f400, ftLastAccessTime.dwHighDateTime=0x1d4ce47, ftLastWriteTime.dwLowDateTime=0xfcf9f730, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x8f70)) returned 1 [0073.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9c0) returned 1 [0073.973] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\3hHxI6kz.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\im7anj2m_r\\3hhxi6kz.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\3hHxI6kz.jpg.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\im7anj2m_r\\3hhxi6kz.jpg.crypted")) returned 1 [0073.974] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\aIwtyh2Wi.bmp", nBufferLength=0x105, lpBuffer=0x24e444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\aIwtyh2Wi.bmp", lpFilePart=0x0) returned 0x3f [0073.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0073.974] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\aIwtyh2Wi.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\im7anj2m_r\\aiwtyh2wi.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0073.975] GetFileType (hFile=0x26c) returned 0x1 [0073.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e934) returned 1 [0073.975] GetFileType (hFile=0x26c) returned 0x1 [0073.975] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24ea40 | out: lpFileSizeHigh=0x24ea40*=0x0) returned 0x9f3f [0073.976] ReadFile (in: hFile=0x26c, lpBuffer=0x2a4c9c0, nNumberOfBytesToRead=0x9f3f, lpNumberOfBytesRead=0x24e9ec, lpOverlapped=0x0 | out: lpBuffer=0x2a4c9c0*, lpNumberOfBytesRead=0x24e9ec*=0x9f3f, lpOverlapped=0x0) returned 1 [0073.979] CloseHandle (hObject=0x26c) returned 1 [0074.019] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e558, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0074.019] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9b8) returned 1 [0074.019] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24ea34 | out: lpFileInformation=0x24ea34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0074.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9b4) returned 1 [0074.020] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\aIwtyh2Wi.bmp", nBufferLength=0x105, lpBuffer=0x24e430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\aIwtyh2Wi.bmp", lpFilePart=0x0) returned 0x3f [0074.020] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e924) returned 1 [0074.020] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\aIwtyh2Wi.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\im7anj2m_r\\aiwtyh2wi.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.021] GetFileType (hFile=0x26c) returned 0x1 [0074.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e920) returned 1 [0074.021] GetFileType (hFile=0x26c) returned 0x1 [0074.021] WriteFile (in: hFile=0x26c, lpBuffer=0x2acb3ec*, nNumberOfBytesToWrite=0x9f40, lpNumberOfBytesWritten=0x24e9e0, lpOverlapped=0x0 | out: lpBuffer=0x2acb3ec*, lpNumberOfBytesWritten=0x24e9e0*=0x9f40, lpOverlapped=0x0) returned 1 [0074.025] CloseHandle (hObject=0x26c) returned 1 [0074.028] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\aIwtyh2Wi.bmp", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\aIwtyh2Wi.bmp", lpFilePart=0x0) returned 0x3f [0074.028] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\aIwtyh2Wi.bmp.Crypted", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\aIwtyh2Wi.bmp.Crypted", lpFilePart=0x0) returned 0x47 [0074.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9c4) returned 1 [0074.028] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\aIwtyh2Wi.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\im7anj2m_r\\aiwtyh2wi.bmp"), fInfoLevelId=0x0, lpFileInformation=0x24ea40 | out: lpFileInformation=0x24ea40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b325dc0, ftCreationTime.dwHighDateTime=0x1d4d3ce, ftLastAccessTime.dwLowDateTime=0x485515e0, ftLastAccessTime.dwHighDateTime=0x1d4c9e0, ftLastWriteTime.dwLowDateTime=0xfd037cb0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x9f40)) returned 1 [0074.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9c0) returned 1 [0074.029] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\aIwtyh2Wi.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\im7anj2m_r\\aiwtyh2wi.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\aIwtyh2Wi.bmp.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\im7anj2m_r\\aiwtyh2wi.bmp.crypted")) returned 1 [0074.029] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\HdBy9h_IfQ_NJxxZzV.png", nBufferLength=0x105, lpBuffer=0x24e444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\HdBy9h_IfQ_NJxxZzV.png", lpFilePart=0x0) returned 0x48 [0074.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0074.029] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\HdBy9h_IfQ_NJxxZzV.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\im7anj2m_r\\hdby9h_ifq_njxxzzv.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.029] GetFileType (hFile=0x26c) returned 0x1 [0074.030] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e934) returned 1 [0074.030] GetFileType (hFile=0x26c) returned 0x1 [0074.030] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24ea40 | out: lpFileSizeHigh=0x24ea40*=0x0) returned 0xe0b2 [0074.031] ReadFile (in: hFile=0x26c, lpBuffer=0x2ad58f8, nNumberOfBytesToRead=0xe0b2, lpNumberOfBytesRead=0x24e9ec, lpOverlapped=0x0 | out: lpBuffer=0x2ad58f8*, lpNumberOfBytesRead=0x24e9ec*=0xe0b2, lpOverlapped=0x0) returned 1 [0074.066] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e558, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0074.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9b8) returned 1 [0074.066] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24ea34 | out: lpFileInformation=0x24ea34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0074.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9b4) returned 1 [0074.066] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\HdBy9h_IfQ_NJxxZzV.png", nBufferLength=0x105, lpBuffer=0x24e430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\HdBy9h_IfQ_NJxxZzV.png", lpFilePart=0x0) returned 0x48 [0074.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e924) returned 1 [0074.066] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\HdBy9h_IfQ_NJxxZzV.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\im7anj2m_r\\hdby9h_ifq_njxxzzv.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.067] GetFileType (hFile=0x26c) returned 0x1 [0074.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e920) returned 1 [0074.067] GetFileType (hFile=0x26c) returned 0x1 [0074.067] WriteFile (in: hFile=0x26c, lpBuffer=0x2b4c938*, nNumberOfBytesToWrite=0xe0c0, lpNumberOfBytesWritten=0x24e9e0, lpOverlapped=0x0 | out: lpBuffer=0x2b4c938*, lpNumberOfBytesWritten=0x24e9e0*=0xe0c0, lpOverlapped=0x0) returned 1 [0074.075] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\HdBy9h_IfQ_NJxxZzV.png", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\HdBy9h_IfQ_NJxxZzV.png", lpFilePart=0x0) returned 0x48 [0074.075] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\HdBy9h_IfQ_NJxxZzV.png.Crypted", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\HdBy9h_IfQ_NJxxZzV.png.Crypted", lpFilePart=0x0) returned 0x50 [0074.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9c4) returned 1 [0074.075] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\HdBy9h_IfQ_NJxxZzV.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\im7anj2m_r\\hdby9h_ifq_njxxzzv.png"), fInfoLevelId=0x0, lpFileInformation=0x24ea40 | out: lpFileInformation=0x24ea40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10dec6d0, ftCreationTime.dwHighDateTime=0x1d4ca65, ftLastAccessTime.dwLowDateTime=0x2ad72b90, ftLastAccessTime.dwHighDateTime=0x1d4cfe2, ftLastWriteTime.dwLowDateTime=0xfd0aa0d0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xe0c0)) returned 1 [0074.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9c0) returned 1 [0074.076] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\HdBy9h_IfQ_NJxxZzV.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\im7anj2m_r\\hdby9h_ifq_njxxzzv.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\HdBy9h_IfQ_NJxxZzV.png.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\im7anj2m_r\\hdby9h_ifq_njxxzzv.png.crypted")) returned 1 [0074.076] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\SGLvkc2L.png", nBufferLength=0x105, lpBuffer=0x24e444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\SGLvkc2L.png", lpFilePart=0x0) returned 0x3e [0074.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0074.076] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\SGLvkc2L.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\im7anj2m_r\\sglvkc2l.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.076] GetFileType (hFile=0x26c) returned 0x1 [0074.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e934) returned 1 [0074.076] GetFileType (hFile=0x26c) returned 0x1 [0074.076] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24ea40 | out: lpFileSizeHigh=0x24ea40*=0x0) returned 0x181c6 [0074.077] ReadFile (in: hFile=0x26c, lpBuffer=0x39ce968, nNumberOfBytesToRead=0x181c6, lpNumberOfBytesRead=0x24e9ec, lpOverlapped=0x0 | out: lpBuffer=0x39ce968*, lpNumberOfBytesRead=0x24e9ec*=0x181c6, lpOverlapped=0x0) returned 1 [0074.168] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e558, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0074.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9b8) returned 1 [0074.168] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24ea34 | out: lpFileInformation=0x24ea34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0074.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9b4) returned 1 [0074.168] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\SGLvkc2L.png", nBufferLength=0x105, lpBuffer=0x24e430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\SGLvkc2L.png", lpFilePart=0x0) returned 0x3e [0074.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e924) returned 1 [0074.169] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\SGLvkc2L.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\im7anj2m_r\\sglvkc2l.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.170] GetFileType (hFile=0x26c) returned 0x1 [0074.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e920) returned 1 [0074.170] GetFileType (hFile=0x26c) returned 0x1 [0074.170] WriteFile (in: hFile=0x26c, lpBuffer=0x37b9fd0*, nNumberOfBytesToWrite=0x181d0, lpNumberOfBytesWritten=0x24e9e0, lpOverlapped=0x0 | out: lpBuffer=0x37b9fd0*, lpNumberOfBytesWritten=0x24e9e0*=0x181d0, lpOverlapped=0x0) returned 1 [0074.173] CloseHandle (hObject=0x26c) returned 1 [0074.180] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\SGLvkc2L.png", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\SGLvkc2L.png", lpFilePart=0x0) returned 0x3e [0074.181] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\SGLvkc2L.png.Crypted", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\SGLvkc2L.png.Crypted", lpFilePart=0x0) returned 0x46 [0074.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9c4) returned 1 [0074.181] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\SGLvkc2L.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\im7anj2m_r\\sglvkc2l.png"), fInfoLevelId=0x0, lpFileInformation=0x24ea40 | out: lpFileInformation=0x24ea40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56e552e0, ftCreationTime.dwHighDateTime=0x1d4cee1, ftLastAccessTime.dwLowDateTime=0xc3a8a300, ftLastAccessTime.dwHighDateTime=0x1d4c671, ftLastWriteTime.dwLowDateTime=0xfd1b4a70, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x181d0)) returned 1 [0074.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9c0) returned 1 [0074.181] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\SGLvkc2L.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\im7anj2m_r\\sglvkc2l.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\iM7anJ2M_R\\SGLvkc2L.png.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\im7anj2m_r\\sglvkc2l.png.crypted")) returned 1 [0074.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0074.182] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg", lpFilePart=0x0) returned 0x37 [0074.182] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg\\", lpFilePart=0x0) returned 0x38 [0074.182] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e4013d0, ftCreationTime.dwHighDateTime=0x1d4d461, ftLastAccessTime.dwLowDateTime=0xea0d9060, ftLastAccessTime.dwHighDateTime=0x1d4c639, ftLastWriteTime.dwLowDateTime=0xea0d9060, ftLastWriteTime.dwHighDateTime=0x1d4c639, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b0a8 [0074.182] FindNextFileW (in: hFindFile=0x69b0a8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e4013d0, ftCreationTime.dwHighDateTime=0x1d4d461, ftLastAccessTime.dwLowDateTime=0xea0d9060, ftLastAccessTime.dwHighDateTime=0x1d4c639, ftLastWriteTime.dwLowDateTime=0xea0d9060, ftLastWriteTime.dwHighDateTime=0x1d4c639, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.182] FindNextFileW (in: hFindFile=0x69b0a8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78c85620, ftCreationTime.dwHighDateTime=0x1d4c90d, ftLastAccessTime.dwLowDateTime=0x3b1c8920, ftLastAccessTime.dwHighDateTime=0x1d4d413, ftLastWriteTime.dwLowDateTime=0x3b1c8920, ftLastWriteTime.dwHighDateTime=0x1d4d413, nFileSizeHigh=0x0, nFileSizeLow=0xc01a, dwReserved0=0x0, dwReserved1=0x0, cFileName="7Oeho.bmp", cAlternateFileName="")) returned 1 [0074.182] FindNextFileW (in: hFindFile=0x69b0a8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad69ea0, ftCreationTime.dwHighDateTime=0x1d4ca09, ftLastAccessTime.dwLowDateTime=0xfe8b0b80, ftLastAccessTime.dwHighDateTime=0x1d4d5b1, ftLastWriteTime.dwLowDateTime=0xfe8b0b80, ftLastWriteTime.dwHighDateTime=0x1d4d5b1, nFileSizeHigh=0x0, nFileSizeLow=0x9421, dwReserved0=0x0, dwReserved1=0x0, cFileName="c6rtW9L9AXtGCW-m.png", cAlternateFileName="C6RTW9~1.PNG")) returned 1 [0074.182] FindNextFileW (in: hFindFile=0x69b0a8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.183] FindClose (in: hFindFile=0x69b0a8 | out: hFindFile=0x69b0a8) returned 1 [0074.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea54) returned 1 [0074.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea60) returned 1 [0074.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0074.183] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg", lpFilePart=0x0) returned 0x37 [0074.183] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg\\", lpFilePart=0x0) returned 0x38 [0074.183] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e4013d0, ftCreationTime.dwHighDateTime=0x1d4d461, ftLastAccessTime.dwLowDateTime=0xea0d9060, ftLastAccessTime.dwHighDateTime=0x1d4c639, ftLastWriteTime.dwLowDateTime=0xea0d9060, ftLastWriteTime.dwHighDateTime=0x1d4c639, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b0a8 [0074.183] FindNextFileW (in: hFindFile=0x69b0a8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e4013d0, ftCreationTime.dwHighDateTime=0x1d4d461, ftLastAccessTime.dwLowDateTime=0xea0d9060, ftLastAccessTime.dwHighDateTime=0x1d4c639, ftLastWriteTime.dwLowDateTime=0xea0d9060, ftLastWriteTime.dwHighDateTime=0x1d4c639, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.183] FindNextFileW (in: hFindFile=0x69b0a8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78c85620, ftCreationTime.dwHighDateTime=0x1d4c90d, ftLastAccessTime.dwLowDateTime=0x3b1c8920, ftLastAccessTime.dwHighDateTime=0x1d4d413, ftLastWriteTime.dwLowDateTime=0x3b1c8920, ftLastWriteTime.dwHighDateTime=0x1d4d413, nFileSizeHigh=0x0, nFileSizeLow=0xc01a, dwReserved0=0x0, dwReserved1=0x0, cFileName="7Oeho.bmp", cAlternateFileName="")) returned 1 [0074.184] FindNextFileW (in: hFindFile=0x69b0a8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad69ea0, ftCreationTime.dwHighDateTime=0x1d4ca09, ftLastAccessTime.dwLowDateTime=0xfe8b0b80, ftLastAccessTime.dwHighDateTime=0x1d4d5b1, ftLastWriteTime.dwLowDateTime=0xfe8b0b80, ftLastWriteTime.dwHighDateTime=0x1d4d5b1, nFileSizeHigh=0x0, nFileSizeLow=0x9421, dwReserved0=0x0, dwReserved1=0x0, cFileName="c6rtW9L9AXtGCW-m.png", cAlternateFileName="C6RTW9~1.PNG")) returned 1 [0074.184] FindNextFileW (in: hFindFile=0x69b0a8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad69ea0, ftCreationTime.dwHighDateTime=0x1d4ca09, ftLastAccessTime.dwLowDateTime=0xfe8b0b80, ftLastAccessTime.dwHighDateTime=0x1d4d5b1, ftLastWriteTime.dwLowDateTime=0xfe8b0b80, ftLastWriteTime.dwHighDateTime=0x1d4d5b1, nFileSizeHigh=0x0, nFileSizeLow=0x9421, dwReserved0=0x0, dwReserved1=0x0, cFileName="c6rtW9L9AXtGCW-m.png", cAlternateFileName="C6RTW9~1.PNG")) returned 0 [0074.184] FindClose (in: hFindFile=0x69b0a8 | out: hFindFile=0x69b0a8) returned 1 [0074.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea54) returned 1 [0074.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea60) returned 1 [0074.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg\\7Oeho.bmp", nBufferLength=0x105, lpBuffer=0x24e444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg\\7Oeho.bmp", lpFilePart=0x0) returned 0x41 [0074.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0074.184] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg\\7Oeho.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mbjydlx-svim8hzg\\7oeho.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.185] GetFileType (hFile=0x26c) returned 0x1 [0074.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e934) returned 1 [0074.185] GetFileType (hFile=0x26c) returned 0x1 [0074.185] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24ea40 | out: lpFileSizeHigh=0x24ea40*=0x0) returned 0xc01a [0074.185] ReadFile (in: hFile=0x26c, lpBuffer=0x274c004, nNumberOfBytesToRead=0xc01a, lpNumberOfBytesRead=0x24e9ec, lpOverlapped=0x0 | out: lpBuffer=0x274c004*, lpNumberOfBytesRead=0x24e9ec*=0xc01a, lpOverlapped=0x0) returned 1 [0074.195] CloseHandle (hObject=0x26c) returned 1 [0074.274] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e558, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0074.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9b8) returned 1 [0074.274] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24ea34 | out: lpFileInformation=0x24ea34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0074.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9b4) returned 1 [0074.274] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg\\7Oeho.bmp", nBufferLength=0x105, lpBuffer=0x24e430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg\\7Oeho.bmp", lpFilePart=0x0) returned 0x41 [0074.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e924) returned 1 [0074.274] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg\\7Oeho.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mbjydlx-svim8hzg\\7oeho.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.276] GetFileType (hFile=0x26c) returned 0x1 [0074.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e920) returned 1 [0074.276] GetFileType (hFile=0x26c) returned 0x1 [0074.276] WriteFile (in: hFile=0x26c, lpBuffer=0x27bcfc0*, nNumberOfBytesToWrite=0xc020, lpNumberOfBytesWritten=0x24e9e0, lpOverlapped=0x0 | out: lpBuffer=0x27bcfc0*, lpNumberOfBytesWritten=0x24e9e0*=0xc020, lpOverlapped=0x0) returned 1 [0074.278] CloseHandle (hObject=0x26c) returned 1 [0074.279] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg\\7Oeho.bmp", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg\\7Oeho.bmp", lpFilePart=0x0) returned 0x41 [0074.279] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg\\7Oeho.bmp.Crypted", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg\\7Oeho.bmp.Crypted", lpFilePart=0x0) returned 0x49 [0074.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9c4) returned 1 [0074.279] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg\\7Oeho.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mbjydlx-svim8hzg\\7oeho.bmp"), fInfoLevelId=0x0, lpFileInformation=0x24ea40 | out: lpFileInformation=0x24ea40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78c85620, ftCreationTime.dwHighDateTime=0x1d4c90d, ftLastAccessTime.dwLowDateTime=0x3b1c8920, ftLastAccessTime.dwHighDateTime=0x1d4d413, ftLastWriteTime.dwLowDateTime=0xfd2992b0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xc020)) returned 1 [0074.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9c0) returned 1 [0074.279] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg\\7Oeho.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mbjydlx-svim8hzg\\7oeho.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg\\7Oeho.bmp.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mbjydlx-svim8hzg\\7oeho.bmp.crypted")) returned 1 [0074.280] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg\\c6rtW9L9AXtGCW-m.png", nBufferLength=0x105, lpBuffer=0x24e444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg\\c6rtW9L9AXtGCW-m.png", lpFilePart=0x0) returned 0x4c [0074.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0074.280] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg\\c6rtW9L9AXtGCW-m.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mbjydlx-svim8hzg\\c6rtw9l9axtgcw-m.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.280] GetFileType (hFile=0x26c) returned 0x1 [0074.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e934) returned 1 [0074.280] GetFileType (hFile=0x26c) returned 0x1 [0074.280] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24ea40 | out: lpFileSizeHigh=0x24ea40*=0x0) returned 0x9421 [0074.280] ReadFile (in: hFile=0x26c, lpBuffer=0x27c95b8, nNumberOfBytesToRead=0x9421, lpNumberOfBytesRead=0x24e9ec, lpOverlapped=0x0 | out: lpBuffer=0x27c95b8*, lpNumberOfBytesRead=0x24e9ec*=0x9421, lpOverlapped=0x0) returned 1 [0074.282] CloseHandle (hObject=0x26c) returned 1 [0074.312] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e558, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0074.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9b8) returned 1 [0074.312] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24ea34 | out: lpFileInformation=0x24ea34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0074.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9b4) returned 1 [0074.312] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg\\c6rtW9L9AXtGCW-m.png", nBufferLength=0x105, lpBuffer=0x24e430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg\\c6rtW9L9AXtGCW-m.png", lpFilePart=0x0) returned 0x4c [0074.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e924) returned 1 [0074.312] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg\\c6rtW9L9AXtGCW-m.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mbjydlx-svim8hzg\\c6rtw9l9axtgcw-m.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.313] GetFileType (hFile=0x26c) returned 0x1 [0074.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e920) returned 1 [0074.313] GetFileType (hFile=0x26c) returned 0x1 [0074.313] WriteFile (in: hFile=0x26c, lpBuffer=0x2844894*, nNumberOfBytesToWrite=0x9430, lpNumberOfBytesWritten=0x24e9e0, lpOverlapped=0x0 | out: lpBuffer=0x2844894*, lpNumberOfBytesWritten=0x24e9e0*=0x9430, lpOverlapped=0x0) returned 1 [0074.315] CloseHandle (hObject=0x26c) returned 1 [0074.320] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg\\c6rtW9L9AXtGCW-m.png", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg\\c6rtW9L9AXtGCW-m.png", lpFilePart=0x0) returned 0x4c [0074.320] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg\\c6rtW9L9AXtGCW-m.png.Crypted", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg\\c6rtW9L9AXtGCW-m.png.Crypted", lpFilePart=0x0) returned 0x54 [0074.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9c4) returned 1 [0074.320] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg\\c6rtW9L9AXtGCW-m.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mbjydlx-svim8hzg\\c6rtw9l9axtgcw-m.png"), fInfoLevelId=0x0, lpFileInformation=0x24ea40 | out: lpFileInformation=0x24ea40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad69ea0, ftCreationTime.dwHighDateTime=0x1d4ca09, ftLastAccessTime.dwLowDateTime=0xfe8b0b80, ftLastAccessTime.dwHighDateTime=0x1d4d5b1, ftLastWriteTime.dwLowDateTime=0xfd30b6d0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x9430)) returned 1 [0074.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9c0) returned 1 [0074.321] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg\\c6rtW9L9AXtGCW-m.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mbjydlx-svim8hzg\\c6rtw9l9axtgcw-m.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MBjYdLX-SVIM8HZg\\c6rtW9L9AXtGCW-m.png.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mbjydlx-svim8hzg\\c6rtw9l9axtgcw-m.png.crypted")) returned 1 [0074.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0074.321] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W", lpFilePart=0x0) returned 0x38 [0074.321] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\", lpFilePart=0x0) returned 0x39 [0074.322] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc43add70, ftCreationTime.dwHighDateTime=0x1d4cb3e, ftLastAccessTime.dwLowDateTime=0xea2420c0, ftLastAccessTime.dwHighDateTime=0x1d4ceac, ftLastWriteTime.dwLowDateTime=0xea2420c0, ftLastWriteTime.dwHighDateTime=0x1d4ceac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69afa8 [0074.322] FindNextFileW (in: hFindFile=0x69afa8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc43add70, ftCreationTime.dwHighDateTime=0x1d4cb3e, ftLastAccessTime.dwLowDateTime=0xea2420c0, ftLastAccessTime.dwHighDateTime=0x1d4ceac, ftLastWriteTime.dwLowDateTime=0xea2420c0, ftLastWriteTime.dwHighDateTime=0x1d4ceac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.322] FindNextFileW (in: hFindFile=0x69afa8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5e200, ftCreationTime.dwHighDateTime=0x1d4d45d, ftLastAccessTime.dwLowDateTime=0xafa8d680, ftLastAccessTime.dwHighDateTime=0x1d4c988, ftLastWriteTime.dwLowDateTime=0xafa8d680, ftLastWriteTime.dwHighDateTime=0x1d4c988, nFileSizeHigh=0x0, nFileSizeLow=0x18bc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="0BU1rDMele0QJf.jpg", cAlternateFileName="0BU1RD~1.JPG")) returned 1 [0074.322] FindNextFileW (in: hFindFile=0x69afa8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a64e030, ftCreationTime.dwHighDateTime=0x1d4c8c7, ftLastAccessTime.dwLowDateTime=0xf9d0a570, ftLastAccessTime.dwHighDateTime=0x1d4d569, ftLastWriteTime.dwLowDateTime=0xf9d0a570, ftLastWriteTime.dwHighDateTime=0x1d4d569, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="acz2p6nuNVaZxlmzSj", cAlternateFileName="ACZ2P6~1")) returned 1 [0074.322] FindNextFileW (in: hFindFile=0x69afa8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa99ed060, ftCreationTime.dwHighDateTime=0x1d4c59a, ftLastAccessTime.dwLowDateTime=0x2ee0e8a0, ftLastAccessTime.dwHighDateTime=0x1d4c8be, ftLastWriteTime.dwLowDateTime=0x2ee0e8a0, ftLastWriteTime.dwHighDateTime=0x1d4c8be, nFileSizeHigh=0x0, nFileSizeLow=0x17cc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ajb7um.jpg", cAlternateFileName="")) returned 1 [0074.322] FindNextFileW (in: hFindFile=0x69afa8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc3b25b0, ftCreationTime.dwHighDateTime=0x1d4c8fa, ftLastAccessTime.dwLowDateTime=0x6e679930, ftLastAccessTime.dwHighDateTime=0x1d4cda8, ftLastWriteTime.dwLowDateTime=0x6e679930, ftLastWriteTime.dwHighDateTime=0x1d4cda8, nFileSizeHigh=0x0, nFileSizeLow=0x7e14, dwReserved0=0x0, dwReserved1=0x0, cFileName="hnH7xHtplP 0.png", cAlternateFileName="HNH7XH~1.PNG")) returned 1 [0074.323] FindNextFileW (in: hFindFile=0x69afa8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabe1d750, ftCreationTime.dwHighDateTime=0x1d4ce05, ftLastAccessTime.dwLowDateTime=0x45d35e70, ftLastAccessTime.dwHighDateTime=0x1d4cd8d, ftLastWriteTime.dwLowDateTime=0x45d35e70, ftLastWriteTime.dwHighDateTime=0x1d4cd8d, nFileSizeHigh=0x0, nFileSizeLow=0x2f04, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPmF0.jpg", cAlternateFileName="")) returned 1 [0074.323] FindNextFileW (in: hFindFile=0x69afa8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9a0be50, ftCreationTime.dwHighDateTime=0x1d4d379, ftLastAccessTime.dwLowDateTime=0x3a21b490, ftLastAccessTime.dwHighDateTime=0x1d4ca32, ftLastWriteTime.dwLowDateTime=0x3a21b490, ftLastWriteTime.dwHighDateTime=0x1d4ca32, nFileSizeHigh=0x0, nFileSizeLow=0xfcb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sd OA6Dh2tRUbwOV68.gif", cAlternateFileName="SDOA6D~1.GIF")) returned 1 [0074.323] FindNextFileW (in: hFindFile=0x69afa8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4059b300, ftCreationTime.dwHighDateTime=0x1d4c792, ftLastAccessTime.dwLowDateTime=0x7624cde0, ftLastAccessTime.dwHighDateTime=0x1d4d515, ftLastWriteTime.dwLowDateTime=0x7624cde0, ftLastWriteTime.dwHighDateTime=0x1d4d515, nFileSizeHigh=0x0, nFileSizeLow=0x28b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TnTWU_2.png", cAlternateFileName="")) returned 1 [0074.323] FindNextFileW (in: hFindFile=0x69afa8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbda62cc0, ftCreationTime.dwHighDateTime=0x1d4cb30, ftLastAccessTime.dwLowDateTime=0xcc068570, ftLastAccessTime.dwHighDateTime=0x1d4cc26, ftLastWriteTime.dwLowDateTime=0xcc068570, ftLastWriteTime.dwHighDateTime=0x1d4cc26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uEbUE", cAlternateFileName="")) returned 1 [0074.323] FindNextFileW (in: hFindFile=0x69afa8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbda62cc0, ftCreationTime.dwHighDateTime=0x1d4cb30, ftLastAccessTime.dwLowDateTime=0xcc068570, ftLastAccessTime.dwHighDateTime=0x1d4cc26, ftLastWriteTime.dwLowDateTime=0xcc068570, ftLastWriteTime.dwHighDateTime=0x1d4cc26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uEbUE", cAlternateFileName="")) returned 0 [0074.323] FindClose (in: hFindFile=0x69afa8 | out: hFindFile=0x69afa8) returned 1 [0074.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea54) returned 1 [0074.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea60) returned 1 [0074.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0074.324] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W", lpFilePart=0x0) returned 0x38 [0074.324] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\", lpFilePart=0x0) returned 0x39 [0074.324] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc43add70, ftCreationTime.dwHighDateTime=0x1d4cb3e, ftLastAccessTime.dwLowDateTime=0xea2420c0, ftLastAccessTime.dwHighDateTime=0x1d4ceac, ftLastWriteTime.dwLowDateTime=0xea2420c0, ftLastWriteTime.dwHighDateTime=0x1d4ceac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69afa8 [0074.324] FindNextFileW (in: hFindFile=0x69afa8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc43add70, ftCreationTime.dwHighDateTime=0x1d4cb3e, ftLastAccessTime.dwLowDateTime=0xea2420c0, ftLastAccessTime.dwHighDateTime=0x1d4ceac, ftLastWriteTime.dwLowDateTime=0xea2420c0, ftLastWriteTime.dwHighDateTime=0x1d4ceac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.324] FindNextFileW (in: hFindFile=0x69afa8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5e200, ftCreationTime.dwHighDateTime=0x1d4d45d, ftLastAccessTime.dwLowDateTime=0xafa8d680, ftLastAccessTime.dwHighDateTime=0x1d4c988, ftLastWriteTime.dwLowDateTime=0xafa8d680, ftLastWriteTime.dwHighDateTime=0x1d4c988, nFileSizeHigh=0x0, nFileSizeLow=0x18bc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="0BU1rDMele0QJf.jpg", cAlternateFileName="0BU1RD~1.JPG")) returned 1 [0074.324] FindNextFileW (in: hFindFile=0x69afa8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a64e030, ftCreationTime.dwHighDateTime=0x1d4c8c7, ftLastAccessTime.dwLowDateTime=0xf9d0a570, ftLastAccessTime.dwHighDateTime=0x1d4d569, ftLastWriteTime.dwLowDateTime=0xf9d0a570, ftLastWriteTime.dwHighDateTime=0x1d4d569, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="acz2p6nuNVaZxlmzSj", cAlternateFileName="ACZ2P6~1")) returned 1 [0074.325] FindNextFileW (in: hFindFile=0x69afa8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa99ed060, ftCreationTime.dwHighDateTime=0x1d4c59a, ftLastAccessTime.dwLowDateTime=0x2ee0e8a0, ftLastAccessTime.dwHighDateTime=0x1d4c8be, ftLastWriteTime.dwLowDateTime=0x2ee0e8a0, ftLastWriteTime.dwHighDateTime=0x1d4c8be, nFileSizeHigh=0x0, nFileSizeLow=0x17cc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ajb7um.jpg", cAlternateFileName="")) returned 1 [0074.325] FindNextFileW (in: hFindFile=0x69afa8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc3b25b0, ftCreationTime.dwHighDateTime=0x1d4c8fa, ftLastAccessTime.dwLowDateTime=0x6e679930, ftLastAccessTime.dwHighDateTime=0x1d4cda8, ftLastWriteTime.dwLowDateTime=0x6e679930, ftLastWriteTime.dwHighDateTime=0x1d4cda8, nFileSizeHigh=0x0, nFileSizeLow=0x7e14, dwReserved0=0x0, dwReserved1=0x0, cFileName="hnH7xHtplP 0.png", cAlternateFileName="HNH7XH~1.PNG")) returned 1 [0074.325] FindNextFileW (in: hFindFile=0x69afa8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabe1d750, ftCreationTime.dwHighDateTime=0x1d4ce05, ftLastAccessTime.dwLowDateTime=0x45d35e70, ftLastAccessTime.dwHighDateTime=0x1d4cd8d, ftLastWriteTime.dwLowDateTime=0x45d35e70, ftLastWriteTime.dwHighDateTime=0x1d4cd8d, nFileSizeHigh=0x0, nFileSizeLow=0x2f04, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPmF0.jpg", cAlternateFileName="")) returned 1 [0074.325] FindNextFileW (in: hFindFile=0x69afa8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9a0be50, ftCreationTime.dwHighDateTime=0x1d4d379, ftLastAccessTime.dwLowDateTime=0x3a21b490, ftLastAccessTime.dwHighDateTime=0x1d4ca32, ftLastWriteTime.dwLowDateTime=0x3a21b490, ftLastWriteTime.dwHighDateTime=0x1d4ca32, nFileSizeHigh=0x0, nFileSizeLow=0xfcb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sd OA6Dh2tRUbwOV68.gif", cAlternateFileName="SDOA6D~1.GIF")) returned 1 [0074.325] FindNextFileW (in: hFindFile=0x69afa8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4059b300, ftCreationTime.dwHighDateTime=0x1d4c792, ftLastAccessTime.dwLowDateTime=0x7624cde0, ftLastAccessTime.dwHighDateTime=0x1d4d515, ftLastWriteTime.dwLowDateTime=0x7624cde0, ftLastWriteTime.dwHighDateTime=0x1d4d515, nFileSizeHigh=0x0, nFileSizeLow=0x28b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TnTWU_2.png", cAlternateFileName="")) returned 1 [0074.325] FindNextFileW (in: hFindFile=0x69afa8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbda62cc0, ftCreationTime.dwHighDateTime=0x1d4cb30, ftLastAccessTime.dwLowDateTime=0xcc068570, ftLastAccessTime.dwHighDateTime=0x1d4cc26, ftLastWriteTime.dwLowDateTime=0xcc068570, ftLastWriteTime.dwHighDateTime=0x1d4cc26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uEbUE", cAlternateFileName="")) returned 1 [0074.325] FindNextFileW (in: hFindFile=0x69afa8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.326] FindClose (in: hFindFile=0x69afa8 | out: hFindFile=0x69afa8) returned 1 [0074.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea54) returned 1 [0074.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea60) returned 1 [0074.326] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\0BU1rDMele0QJf.jpg", nBufferLength=0x105, lpBuffer=0x24e444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\0BU1rDMele0QJf.jpg", lpFilePart=0x0) returned 0x4b [0074.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0074.326] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\0BU1rDMele0QJf.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\0bu1rdmele0qjf.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.327] GetFileType (hFile=0x26c) returned 0x1 [0074.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e934) returned 1 [0074.327] GetFileType (hFile=0x26c) returned 0x1 [0074.327] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24ea40 | out: lpFileSizeHigh=0x24ea40*=0x0) returned 0x18bc6 [0074.327] ReadFile (in: hFile=0x26c, lpBuffer=0x37ea200, nNumberOfBytesToRead=0x18bc6, lpNumberOfBytesRead=0x24e9ec, lpOverlapped=0x0 | out: lpBuffer=0x37ea200*, lpNumberOfBytesRead=0x24e9ec*=0x18bc6, lpOverlapped=0x0) returned 1 [0074.329] CloseHandle (hObject=0x26c) returned 1 [0074.383] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e558, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0074.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9b8) returned 1 [0074.383] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24ea34 | out: lpFileInformation=0x24ea34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0074.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9b4) returned 1 [0074.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\0BU1rDMele0QJf.jpg", nBufferLength=0x105, lpBuffer=0x24e430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\0BU1rDMele0QJf.jpg", lpFilePart=0x0) returned 0x4b [0074.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e924) returned 1 [0074.384] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\0BU1rDMele0QJf.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\0bu1rdmele0qjf.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.385] GetFileType (hFile=0x26c) returned 0x1 [0074.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e920) returned 1 [0074.385] GetFileType (hFile=0x26c) returned 0x1 [0074.385] WriteFile (in: hFile=0x26c, lpBuffer=0x3865d48*, nNumberOfBytesToWrite=0x18bd0, lpNumberOfBytesWritten=0x24e9e0, lpOverlapped=0x0 | out: lpBuffer=0x3865d48*, lpNumberOfBytesWritten=0x24e9e0*=0x18bd0, lpOverlapped=0x0) returned 1 [0074.388] CloseHandle (hObject=0x26c) returned 1 [0074.389] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\0BU1rDMele0QJf.jpg", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\0BU1rDMele0QJf.jpg", lpFilePart=0x0) returned 0x4b [0074.390] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\0BU1rDMele0QJf.jpg.Crypted", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\0BU1rDMele0QJf.jpg.Crypted", lpFilePart=0x0) returned 0x53 [0074.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9c4) returned 1 [0074.390] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\0BU1rDMele0QJf.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\0bu1rdmele0qjf.jpg"), fInfoLevelId=0x0, lpFileInformation=0x24ea40 | out: lpFileInformation=0x24ea40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5e200, ftCreationTime.dwHighDateTime=0x1d4d45d, ftLastAccessTime.dwLowDateTime=0xafa8d680, ftLastAccessTime.dwHighDateTime=0x1d4c988, ftLastWriteTime.dwLowDateTime=0xfd3a3c50, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x18bd0)) returned 1 [0074.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9c0) returned 1 [0074.390] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\0BU1rDMele0QJf.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\0bu1rdmele0qjf.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\0BU1rDMele0QJf.jpg.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\0bu1rdmele0qjf.jpg.crypted")) returned 1 [0074.391] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\ajb7um.jpg", nBufferLength=0x105, lpBuffer=0x24e444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\ajb7um.jpg", lpFilePart=0x0) returned 0x43 [0074.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0074.391] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\ajb7um.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\ajb7um.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.391] GetFileType (hFile=0x26c) returned 0x1 [0074.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e934) returned 1 [0074.391] GetFileType (hFile=0x26c) returned 0x1 [0074.391] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24ea40 | out: lpFileSizeHigh=0x24ea40*=0x0) returned 0x17cc5 [0074.391] ReadFile (in: hFile=0x26c, lpBuffer=0x387e938, nNumberOfBytesToRead=0x17cc5, lpNumberOfBytesRead=0x24e9ec, lpOverlapped=0x0 | out: lpBuffer=0x387e938*, lpNumberOfBytesRead=0x24e9ec*=0x17cc5, lpOverlapped=0x0) returned 1 [0074.394] CloseHandle (hObject=0x26c) returned 1 [0074.417] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e558, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0074.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9b8) returned 1 [0074.417] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24ea34 | out: lpFileInformation=0x24ea34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0074.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9b4) returned 1 [0074.418] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\ajb7um.jpg", nBufferLength=0x105, lpBuffer=0x24e430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\ajb7um.jpg", lpFilePart=0x0) returned 0x43 [0074.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e924) returned 1 [0074.418] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\ajb7um.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\ajb7um.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.419] GetFileType (hFile=0x26c) returned 0x1 [0074.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e920) returned 1 [0074.419] GetFileType (hFile=0x26c) returned 0x1 [0074.419] WriteFile (in: hFile=0x26c, lpBuffer=0x38f5980*, nNumberOfBytesToWrite=0x17cd0, lpNumberOfBytesWritten=0x24e9e0, lpOverlapped=0x0 | out: lpBuffer=0x38f5980*, lpNumberOfBytesWritten=0x24e9e0*=0x17cd0, lpOverlapped=0x0) returned 1 [0074.421] CloseHandle (hObject=0x26c) returned 1 [0074.424] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\ajb7um.jpg", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\ajb7um.jpg", lpFilePart=0x0) returned 0x43 [0074.424] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\ajb7um.jpg.Crypted", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\ajb7um.jpg.Crypted", lpFilePart=0x0) returned 0x4b [0074.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9c4) returned 1 [0074.424] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\ajb7um.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\ajb7um.jpg"), fInfoLevelId=0x0, lpFileInformation=0x24ea40 | out: lpFileInformation=0x24ea40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa99ed060, ftCreationTime.dwHighDateTime=0x1d4c59a, ftLastAccessTime.dwLowDateTime=0x2ee0e8a0, ftLastAccessTime.dwHighDateTime=0x1d4c8be, ftLastWriteTime.dwLowDateTime=0xfd3eff10, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x17cd0)) returned 1 [0074.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9c0) returned 1 [0074.424] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\ajb7um.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\ajb7um.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\ajb7um.jpg.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\ajb7um.jpg.crypted")) returned 1 [0074.424] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\hnH7xHtplP 0.png", nBufferLength=0x105, lpBuffer=0x24e444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\hnH7xHtplP 0.png", lpFilePart=0x0) returned 0x49 [0074.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0074.424] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\hnH7xHtplP 0.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\hnh7xhtplp 0.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.425] GetFileType (hFile=0x26c) returned 0x1 [0074.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e934) returned 1 [0074.425] GetFileType (hFile=0x26c) returned 0x1 [0074.425] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24ea40 | out: lpFileSizeHigh=0x24ea40*=0x0) returned 0x7e14 [0074.425] ReadFile (in: hFile=0x26c, lpBuffer=0x28eb960, nNumberOfBytesToRead=0x7e14, lpNumberOfBytesRead=0x24e9ec, lpOverlapped=0x0 | out: lpBuffer=0x28eb960*, lpNumberOfBytesRead=0x24e9ec*=0x7e14, lpOverlapped=0x0) returned 1 [0074.426] CloseHandle (hObject=0x26c) returned 1 [0074.455] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e558, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0074.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9b8) returned 1 [0074.455] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24ea34 | out: lpFileInformation=0x24ea34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0074.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9b4) returned 1 [0074.455] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\hnH7xHtplP 0.png", nBufferLength=0x105, lpBuffer=0x24e430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\hnH7xHtplP 0.png", lpFilePart=0x0) returned 0x49 [0074.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e924) returned 1 [0074.455] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\hnH7xHtplP 0.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\hnh7xhtplp 0.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.456] GetFileType (hFile=0x26c) returned 0x1 [0074.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e920) returned 1 [0074.457] GetFileType (hFile=0x26c) returned 0x1 [0074.457] WriteFile (in: hFile=0x26c, lpBuffer=0x295fde8*, nNumberOfBytesToWrite=0x7e20, lpNumberOfBytesWritten=0x24e9e0, lpOverlapped=0x0 | out: lpBuffer=0x295fde8*, lpNumberOfBytesWritten=0x24e9e0*=0x7e20, lpOverlapped=0x0) returned 1 [0074.458] CloseHandle (hObject=0x26c) returned 1 [0074.460] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\hnH7xHtplP 0.png", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\hnH7xHtplP 0.png", lpFilePart=0x0) returned 0x49 [0074.460] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\hnH7xHtplP 0.png.Crypted", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\hnH7xHtplP 0.png.Crypted", lpFilePart=0x0) returned 0x51 [0074.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9c4) returned 1 [0074.460] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\hnH7xHtplP 0.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\hnh7xhtplp 0.png"), fInfoLevelId=0x0, lpFileInformation=0x24ea40 | out: lpFileInformation=0x24ea40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc3b25b0, ftCreationTime.dwHighDateTime=0x1d4c8fa, ftLastAccessTime.dwLowDateTime=0x6e679930, ftLastAccessTime.dwHighDateTime=0x1d4cda8, ftLastWriteTime.dwLowDateTime=0xfd462330, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x7e20)) returned 1 [0074.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9c0) returned 1 [0074.460] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\hnH7xHtplP 0.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\hnh7xhtplp 0.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\hnH7xHtplP 0.png.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\hnh7xhtplp 0.png.crypted")) returned 1 [0074.461] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\IPmF0.jpg", nBufferLength=0x105, lpBuffer=0x24e444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\IPmF0.jpg", lpFilePart=0x0) returned 0x42 [0074.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0074.461] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\IPmF0.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\ipmf0.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.462] GetFileType (hFile=0x26c) returned 0x1 [0074.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e934) returned 1 [0074.462] GetFileType (hFile=0x26c) returned 0x1 [0074.462] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24ea40 | out: lpFileSizeHigh=0x24ea40*=0x0) returned 0x2f04 [0074.462] ReadFile (in: hFile=0x26c, lpBuffer=0x2968204, nNumberOfBytesToRead=0x2f04, lpNumberOfBytesRead=0x24e9ec, lpOverlapped=0x0 | out: lpBuffer=0x2968204*, lpNumberOfBytesRead=0x24e9ec*=0x2f04, lpOverlapped=0x0) returned 1 [0074.463] CloseHandle (hObject=0x26c) returned 1 [0074.517] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e558, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0074.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9b8) returned 1 [0074.517] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24ea34 | out: lpFileInformation=0x24ea34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0074.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9b4) returned 1 [0074.517] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\IPmF0.jpg", nBufferLength=0x105, lpBuffer=0x24e430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\IPmF0.jpg", lpFilePart=0x0) returned 0x42 [0074.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e924) returned 1 [0074.517] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\IPmF0.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\ipmf0.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.518] GetFileType (hFile=0x26c) returned 0x1 [0074.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e920) returned 1 [0074.518] GetFileType (hFile=0x26c) returned 0x1 [0074.518] WriteFile (in: hFile=0x26c, lpBuffer=0x278fc18*, nNumberOfBytesToWrite=0x2f10, lpNumberOfBytesWritten=0x24e9e0, lpOverlapped=0x0 | out: lpBuffer=0x278fc18*, lpNumberOfBytesWritten=0x24e9e0*=0x2f10, lpOverlapped=0x0) returned 1 [0074.519] CloseHandle (hObject=0x26c) returned 1 [0074.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\IPmF0.jpg", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\IPmF0.jpg", lpFilePart=0x0) returned 0x42 [0074.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\IPmF0.jpg.Crypted", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\IPmF0.jpg.Crypted", lpFilePart=0x0) returned 0x4a [0074.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9c4) returned 1 [0074.525] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\IPmF0.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\ipmf0.jpg"), fInfoLevelId=0x0, lpFileInformation=0x24ea40 | out: lpFileInformation=0x24ea40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabe1d750, ftCreationTime.dwHighDateTime=0x1d4ce05, ftLastAccessTime.dwLowDateTime=0x45d35e70, ftLastAccessTime.dwHighDateTime=0x1d4cd8d, ftLastWriteTime.dwLowDateTime=0xfd4fa8b0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x2f10)) returned 1 [0074.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9c0) returned 1 [0074.526] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\IPmF0.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\ipmf0.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\IPmF0.jpg.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\ipmf0.jpg.crypted")) returned 1 [0074.526] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\TnTWU_2.png", nBufferLength=0x105, lpBuffer=0x24e444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\TnTWU_2.png", lpFilePart=0x0) returned 0x44 [0074.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0074.526] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\TnTWU_2.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\tntwu_2.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.527] GetFileType (hFile=0x26c) returned 0x1 [0074.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e934) returned 1 [0074.527] GetFileType (hFile=0x26c) returned 0x1 [0074.527] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24ea40 | out: lpFileSizeHigh=0x24ea40*=0x0) returned 0x28b6 [0074.527] ReadFile (in: hFile=0x26c, lpBuffer=0x2793104, nNumberOfBytesToRead=0x28b6, lpNumberOfBytesRead=0x24e9ec, lpOverlapped=0x0 | out: lpBuffer=0x2793104*, lpNumberOfBytesRead=0x24e9ec*=0x28b6, lpOverlapped=0x0) returned 1 [0074.529] CloseHandle (hObject=0x26c) returned 1 [0074.548] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e558, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0074.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9b8) returned 1 [0074.548] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24ea34 | out: lpFileInformation=0x24ea34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0074.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9b4) returned 1 [0074.549] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\TnTWU_2.png", nBufferLength=0x105, lpBuffer=0x24e430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\TnTWU_2.png", lpFilePart=0x0) returned 0x44 [0074.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e924) returned 1 [0074.549] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\TnTWU_2.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\tntwu_2.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.550] GetFileType (hFile=0x26c) returned 0x1 [0074.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e920) returned 1 [0074.550] GetFileType (hFile=0x26c) returned 0x1 [0074.550] WriteFile (in: hFile=0x26c, lpBuffer=0x27ecc0c*, nNumberOfBytesToWrite=0x28c0, lpNumberOfBytesWritten=0x24e9e0, lpOverlapped=0x0 | out: lpBuffer=0x27ecc0c*, lpNumberOfBytesWritten=0x24e9e0*=0x28c0, lpOverlapped=0x0) returned 1 [0074.551] CloseHandle (hObject=0x26c) returned 1 [0074.553] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\TnTWU_2.png", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\TnTWU_2.png", lpFilePart=0x0) returned 0x44 [0074.553] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\TnTWU_2.png.Crypted", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\TnTWU_2.png.Crypted", lpFilePart=0x0) returned 0x4c [0074.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9c4) returned 1 [0074.554] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\TnTWU_2.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\tntwu_2.png"), fInfoLevelId=0x0, lpFileInformation=0x24ea40 | out: lpFileInformation=0x24ea40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4059b300, ftCreationTime.dwHighDateTime=0x1d4c792, ftLastAccessTime.dwLowDateTime=0x7624cde0, ftLastAccessTime.dwHighDateTime=0x1d4d515, ftLastWriteTime.dwLowDateTime=0xfd546b70, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x28c0)) returned 1 [0074.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9c0) returned 1 [0074.554] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\TnTWU_2.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\tntwu_2.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\TnTWU_2.png.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\tntwu_2.png.crypted")) returned 1 [0074.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea20) returned 1 [0074.554] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj", nBufferLength=0x105, lpBuffer=0x24e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj", lpFilePart=0x0) returned 0x4b [0074.555] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\", nBufferLength=0x105, lpBuffer=0x24e4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\", lpFilePart=0x0) returned 0x4c [0074.555] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\*", lpFindFileData=0x24e748 | out: lpFindFileData=0x24e748*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a64e030, ftCreationTime.dwHighDateTime=0x1d4c8c7, ftLastAccessTime.dwLowDateTime=0xf9d0a570, ftLastAccessTime.dwHighDateTime=0x1d4d569, ftLastWriteTime.dwLowDateTime=0xf9d0a570, ftLastWriteTime.dwHighDateTime=0x1d4d569, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69ade8 [0074.555] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a64e030, ftCreationTime.dwHighDateTime=0x1d4c8c7, ftLastAccessTime.dwLowDateTime=0xf9d0a570, ftLastAccessTime.dwHighDateTime=0x1d4d569, ftLastWriteTime.dwLowDateTime=0xf9d0a570, ftLastWriteTime.dwHighDateTime=0x1d4d569, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.555] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f0c84b0, ftCreationTime.dwHighDateTime=0x1d4d08e, ftLastAccessTime.dwLowDateTime=0x4519db80, ftLastAccessTime.dwHighDateTime=0x1d4ced7, ftLastWriteTime.dwLowDateTime=0x4519db80, ftLastWriteTime.dwHighDateTime=0x1d4ced7, nFileSizeHigh=0x0, nFileSizeLow=0x8328, dwReserved0=0x0, dwReserved1=0x0, cFileName="D4fe6I-tzfjf4Nt.jpg", cAlternateFileName="D4FE6I~1.JPG")) returned 1 [0074.555] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6242070, ftCreationTime.dwHighDateTime=0x1d4d165, ftLastAccessTime.dwLowDateTime=0x39a1500, ftLastAccessTime.dwHighDateTime=0x1d4cae8, ftLastWriteTime.dwLowDateTime=0x39a1500, ftLastWriteTime.dwHighDateTime=0x1d4cae8, nFileSizeHigh=0x0, nFileSizeLow=0x1057c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FL6uOQdf1K9s.gif", cAlternateFileName="FL6UOQ~1.GIF")) returned 1 [0074.556] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9edcc10, ftCreationTime.dwHighDateTime=0x1d4cca4, ftLastAccessTime.dwLowDateTime=0xdce9a400, ftLastAccessTime.dwHighDateTime=0x1d4d354, ftLastWriteTime.dwLowDateTime=0xdce9a400, ftLastWriteTime.dwHighDateTime=0x1d4d354, nFileSizeHigh=0x0, nFileSizeLow=0x679b, dwReserved0=0x0, dwReserved1=0x0, cFileName="iJ5G5S1Gf-jh1N.bmp", cAlternateFileName="IJ5G5S~1.BMP")) returned 1 [0074.556] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ec3a740, ftCreationTime.dwHighDateTime=0x1d4cf75, ftLastAccessTime.dwLowDateTime=0xe7e415e0, ftLastAccessTime.dwHighDateTime=0x1d4cbb9, ftLastWriteTime.dwLowDateTime=0xe7e415e0, ftLastWriteTime.dwHighDateTime=0x1d4cbb9, nFileSizeHigh=0x0, nFileSizeLow=0x13278, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru4ZSs.png", cAlternateFileName="")) returned 1 [0074.556] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.556] FindClose (in: hFindFile=0x69ade8 | out: hFindFile=0x69ade8) returned 1 [0074.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9e0) returned 1 [0074.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9ec) returned 1 [0074.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea20) returned 1 [0074.556] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj", nBufferLength=0x105, lpBuffer=0x24e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj", lpFilePart=0x0) returned 0x4b [0074.556] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\", nBufferLength=0x105, lpBuffer=0x24e4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\", lpFilePart=0x0) returned 0x4c [0074.556] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\*", lpFindFileData=0x24e748 | out: lpFindFileData=0x24e748*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a64e030, ftCreationTime.dwHighDateTime=0x1d4c8c7, ftLastAccessTime.dwLowDateTime=0xf9d0a570, ftLastAccessTime.dwHighDateTime=0x1d4d569, ftLastWriteTime.dwLowDateTime=0xf9d0a570, ftLastWriteTime.dwHighDateTime=0x1d4d569, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69ade8 [0074.557] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a64e030, ftCreationTime.dwHighDateTime=0x1d4c8c7, ftLastAccessTime.dwLowDateTime=0xf9d0a570, ftLastAccessTime.dwHighDateTime=0x1d4d569, ftLastWriteTime.dwLowDateTime=0xf9d0a570, ftLastWriteTime.dwHighDateTime=0x1d4d569, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.557] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f0c84b0, ftCreationTime.dwHighDateTime=0x1d4d08e, ftLastAccessTime.dwLowDateTime=0x4519db80, ftLastAccessTime.dwHighDateTime=0x1d4ced7, ftLastWriteTime.dwLowDateTime=0x4519db80, ftLastWriteTime.dwHighDateTime=0x1d4ced7, nFileSizeHigh=0x0, nFileSizeLow=0x8328, dwReserved0=0x0, dwReserved1=0x0, cFileName="D4fe6I-tzfjf4Nt.jpg", cAlternateFileName="D4FE6I~1.JPG")) returned 1 [0074.557] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6242070, ftCreationTime.dwHighDateTime=0x1d4d165, ftLastAccessTime.dwLowDateTime=0x39a1500, ftLastAccessTime.dwHighDateTime=0x1d4cae8, ftLastWriteTime.dwLowDateTime=0x39a1500, ftLastWriteTime.dwHighDateTime=0x1d4cae8, nFileSizeHigh=0x0, nFileSizeLow=0x1057c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FL6uOQdf1K9s.gif", cAlternateFileName="FL6UOQ~1.GIF")) returned 1 [0074.557] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9edcc10, ftCreationTime.dwHighDateTime=0x1d4cca4, ftLastAccessTime.dwLowDateTime=0xdce9a400, ftLastAccessTime.dwHighDateTime=0x1d4d354, ftLastWriteTime.dwLowDateTime=0xdce9a400, ftLastWriteTime.dwHighDateTime=0x1d4d354, nFileSizeHigh=0x0, nFileSizeLow=0x679b, dwReserved0=0x0, dwReserved1=0x0, cFileName="iJ5G5S1Gf-jh1N.bmp", cAlternateFileName="IJ5G5S~1.BMP")) returned 1 [0074.557] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ec3a740, ftCreationTime.dwHighDateTime=0x1d4cf75, ftLastAccessTime.dwLowDateTime=0xe7e415e0, ftLastAccessTime.dwHighDateTime=0x1d4cbb9, ftLastWriteTime.dwLowDateTime=0xe7e415e0, ftLastWriteTime.dwHighDateTime=0x1d4cbb9, nFileSizeHigh=0x0, nFileSizeLow=0x13278, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru4ZSs.png", cAlternateFileName="")) returned 1 [0074.558] FindNextFileW (in: hFindFile=0x69ade8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ec3a740, ftCreationTime.dwHighDateTime=0x1d4cf75, ftLastAccessTime.dwLowDateTime=0xe7e415e0, ftLastAccessTime.dwHighDateTime=0x1d4cbb9, ftLastWriteTime.dwLowDateTime=0xe7e415e0, ftLastWriteTime.dwHighDateTime=0x1d4cbb9, nFileSizeHigh=0x0, nFileSizeLow=0x13278, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru4ZSs.png", cAlternateFileName="")) returned 0 [0074.558] FindClose (in: hFindFile=0x69ade8 | out: hFindFile=0x69ade8) returned 1 [0074.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9e0) returned 1 [0074.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9ec) returned 1 [0074.558] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\D4fe6I-tzfjf4Nt.jpg", nBufferLength=0x105, lpBuffer=0x24e3d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\D4fe6I-tzfjf4Nt.jpg", lpFilePart=0x0) returned 0x5f [0074.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8c4) returned 1 [0074.558] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\D4fe6I-tzfjf4Nt.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\acz2p6nunvazxlmzsj\\d4fe6i-tzfjf4nt.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.558] GetFileType (hFile=0x26c) returned 0x1 [0074.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8c0) returned 1 [0074.558] GetFileType (hFile=0x26c) returned 0x1 [0074.558] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24e9cc | out: lpFileSizeHigh=0x24e9cc*=0x0) returned 0x8328 [0074.559] ReadFile (in: hFile=0x26c, lpBuffer=0x27f22c8, nNumberOfBytesToRead=0x8328, lpNumberOfBytesRead=0x24e978, lpOverlapped=0x0 | out: lpBuffer=0x27f22c8*, lpNumberOfBytesRead=0x24e978*=0x8328, lpOverlapped=0x0) returned 1 [0074.575] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e4e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0074.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e944) returned 1 [0074.575] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24e9c0 | out: lpFileInformation=0x24e9c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0074.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e940) returned 1 [0074.575] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\D4fe6I-tzfjf4Nt.jpg", nBufferLength=0x105, lpBuffer=0x24e3bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\D4fe6I-tzfjf4Nt.jpg", lpFilePart=0x0) returned 0x5f [0074.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8b0) returned 1 [0074.576] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\D4fe6I-tzfjf4Nt.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\acz2p6nunvazxlmzsj\\d4fe6i-tzfjf4nt.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.577] GetFileType (hFile=0x26c) returned 0x1 [0074.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8ac) returned 1 [0074.577] GetFileType (hFile=0x26c) returned 0x1 [0074.577] WriteFile (in: hFile=0x26c, lpBuffer=0x28680a0*, nNumberOfBytesToWrite=0x8330, lpNumberOfBytesWritten=0x24e96c, lpOverlapped=0x0 | out: lpBuffer=0x28680a0*, lpNumberOfBytesWritten=0x24e96c*=0x8330, lpOverlapped=0x0) returned 1 [0074.579] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\D4fe6I-tzfjf4Nt.jpg", nBufferLength=0x105, lpBuffer=0x24e4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\D4fe6I-tzfjf4Nt.jpg", lpFilePart=0x0) returned 0x5f [0074.579] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\D4fe6I-tzfjf4Nt.jpg.Crypted", nBufferLength=0x105, lpBuffer=0x24e4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\D4fe6I-tzfjf4Nt.jpg.Crypted", lpFilePart=0x0) returned 0x67 [0074.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e950) returned 1 [0074.579] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\D4fe6I-tzfjf4Nt.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\acz2p6nunvazxlmzsj\\d4fe6i-tzfjf4nt.jpg"), fInfoLevelId=0x0, lpFileInformation=0x24e9cc | out: lpFileInformation=0x24e9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f0c84b0, ftCreationTime.dwHighDateTime=0x1d4d08e, ftLastAccessTime.dwLowDateTime=0x4519db80, ftLastAccessTime.dwHighDateTime=0x1d4ced7, ftLastWriteTime.dwLowDateTime=0xfd56ccd0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x8330)) returned 1 [0074.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e94c) returned 1 [0074.579] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\D4fe6I-tzfjf4Nt.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\acz2p6nunvazxlmzsj\\d4fe6i-tzfjf4nt.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\D4fe6I-tzfjf4Nt.jpg.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\acz2p6nunvazxlmzsj\\d4fe6i-tzfjf4nt.jpg.crypted")) returned 1 [0074.580] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\iJ5G5S1Gf-jh1N.bmp", nBufferLength=0x105, lpBuffer=0x24e3d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\iJ5G5S1Gf-jh1N.bmp", lpFilePart=0x0) returned 0x5e [0074.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8c4) returned 1 [0074.580] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\iJ5G5S1Gf-jh1N.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\acz2p6nunvazxlmzsj\\ij5g5s1gf-jh1n.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.580] GetFileType (hFile=0x26c) returned 0x1 [0074.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8c0) returned 1 [0074.580] GetFileType (hFile=0x26c) returned 0x1 [0074.580] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24e9cc | out: lpFileSizeHigh=0x24e9cc*=0x0) returned 0x679b [0074.580] ReadFile (in: hFile=0x26c, lpBuffer=0x2870ae4, nNumberOfBytesToRead=0x679b, lpNumberOfBytesRead=0x24e978, lpOverlapped=0x0 | out: lpBuffer=0x2870ae4*, lpNumberOfBytesRead=0x24e978*=0x679b, lpOverlapped=0x0) returned 1 [0074.603] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e4e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0074.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e944) returned 1 [0074.603] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24e9c0 | out: lpFileInformation=0x24e9c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0074.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e940) returned 1 [0074.603] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\iJ5G5S1Gf-jh1N.bmp", nBufferLength=0x105, lpBuffer=0x24e3bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\iJ5G5S1Gf-jh1N.bmp", lpFilePart=0x0) returned 0x5e [0074.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8b0) returned 1 [0074.603] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\iJ5G5S1Gf-jh1N.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\acz2p6nunvazxlmzsj\\ij5g5s1gf-jh1n.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.604] GetFileType (hFile=0x26c) returned 0x1 [0074.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8ac) returned 1 [0074.604] GetFileType (hFile=0x26c) returned 0x1 [0074.604] WriteFile (in: hFile=0x26c, lpBuffer=0x28ddef0*, nNumberOfBytesToWrite=0x67a0, lpNumberOfBytesWritten=0x24e96c, lpOverlapped=0x0 | out: lpBuffer=0x28ddef0*, lpNumberOfBytesWritten=0x24e96c*=0x67a0, lpOverlapped=0x0) returned 1 [0074.606] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\iJ5G5S1Gf-jh1N.bmp", nBufferLength=0x105, lpBuffer=0x24e4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\iJ5G5S1Gf-jh1N.bmp", lpFilePart=0x0) returned 0x5e [0074.606] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\iJ5G5S1Gf-jh1N.bmp.Crypted", nBufferLength=0x105, lpBuffer=0x24e4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\iJ5G5S1Gf-jh1N.bmp.Crypted", lpFilePart=0x0) returned 0x66 [0074.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e950) returned 1 [0074.606] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\iJ5G5S1Gf-jh1N.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\acz2p6nunvazxlmzsj\\ij5g5s1gf-jh1n.bmp"), fInfoLevelId=0x0, lpFileInformation=0x24e9cc | out: lpFileInformation=0x24e9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9edcc10, ftCreationTime.dwHighDateTime=0x1d4cca4, ftLastAccessTime.dwLowDateTime=0xdce9a400, ftLastAccessTime.dwHighDateTime=0x1d4d354, ftLastWriteTime.dwLowDateTime=0xfd5b8f90, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x67a0)) returned 1 [0074.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e94c) returned 1 [0074.606] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\iJ5G5S1Gf-jh1N.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\acz2p6nunvazxlmzsj\\ij5g5s1gf-jh1n.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\iJ5G5S1Gf-jh1N.bmp.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\acz2p6nunvazxlmzsj\\ij5g5s1gf-jh1n.bmp.crypted")) returned 1 [0074.606] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\ru4ZSs.png", nBufferLength=0x105, lpBuffer=0x24e3d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\ru4ZSs.png", lpFilePart=0x0) returned 0x56 [0074.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8c4) returned 1 [0074.607] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\ru4ZSs.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\acz2p6nunvazxlmzsj\\ru4zss.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.607] GetFileType (hFile=0x26c) returned 0x1 [0074.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8c0) returned 1 [0074.607] GetFileType (hFile=0x26c) returned 0x1 [0074.607] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24e9cc | out: lpFileSizeHigh=0x24e9cc*=0x0) returned 0x13278 [0074.607] ReadFile (in: hFile=0x26c, lpBuffer=0x28e4d6c, nNumberOfBytesToRead=0x13278, lpNumberOfBytesRead=0x24e978, lpOverlapped=0x0 | out: lpBuffer=0x28e4d6c*, lpNumberOfBytesRead=0x24e978*=0x13278, lpOverlapped=0x0) returned 1 [0074.627] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e4e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0074.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e944) returned 1 [0074.627] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24e9c0 | out: lpFileInformation=0x24e9c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0074.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e940) returned 1 [0074.627] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\ru4ZSs.png", nBufferLength=0x105, lpBuffer=0x24e3bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\ru4ZSs.png", lpFilePart=0x0) returned 0x56 [0074.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8b0) returned 1 [0074.627] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\ru4ZSs.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\acz2p6nunvazxlmzsj\\ru4zss.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.628] GetFileType (hFile=0x26c) returned 0x1 [0074.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8ac) returned 1 [0074.628] GetFileType (hFile=0x26c) returned 0x1 [0074.629] WriteFile (in: hFile=0x26c, lpBuffer=0x278dfd8*, nNumberOfBytesToWrite=0x13280, lpNumberOfBytesWritten=0x24e96c, lpOverlapped=0x0 | out: lpBuffer=0x278dfd8*, lpNumberOfBytesWritten=0x24e96c*=0x13280, lpOverlapped=0x0) returned 1 [0074.631] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\ru4ZSs.png", nBufferLength=0x105, lpBuffer=0x24e4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\ru4ZSs.png", lpFilePart=0x0) returned 0x56 [0074.631] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\ru4ZSs.png.Crypted", nBufferLength=0x105, lpBuffer=0x24e4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\ru4ZSs.png.Crypted", lpFilePart=0x0) returned 0x5e [0074.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e950) returned 1 [0074.631] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\ru4ZSs.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\acz2p6nunvazxlmzsj\\ru4zss.png"), fInfoLevelId=0x0, lpFileInformation=0x24e9cc | out: lpFileInformation=0x24e9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ec3a740, ftCreationTime.dwHighDateTime=0x1d4cf75, ftLastAccessTime.dwLowDateTime=0xe7e415e0, ftLastAccessTime.dwHighDateTime=0x1d4cbb9, ftLastWriteTime.dwLowDateTime=0xfd605250, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x13280)) returned 1 [0074.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e94c) returned 1 [0074.631] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\ru4ZSs.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\acz2p6nunvazxlmzsj\\ru4zss.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\acz2p6nuNVaZxlmzSj\\ru4ZSs.png.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\acz2p6nunvazxlmzsj\\ru4zss.png.crypted")) returned 1 [0074.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea20) returned 1 [0074.632] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE", nBufferLength=0x105, lpBuffer=0x24e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE", lpFilePart=0x0) returned 0x3e [0074.632] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\", nBufferLength=0x105, lpBuffer=0x24e4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\", lpFilePart=0x0) returned 0x3f [0074.632] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\*", lpFindFileData=0x24e748 | out: lpFindFileData=0x24e748*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbda62cc0, ftCreationTime.dwHighDateTime=0x1d4cb30, ftLastAccessTime.dwLowDateTime=0xcc068570, ftLastAccessTime.dwHighDateTime=0x1d4cc26, ftLastWriteTime.dwLowDateTime=0xcc068570, ftLastWriteTime.dwHighDateTime=0x1d4cc26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69afa8 [0074.632] FindNextFileW (in: hFindFile=0x69afa8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbda62cc0, ftCreationTime.dwHighDateTime=0x1d4cb30, ftLastAccessTime.dwLowDateTime=0xcc068570, ftLastAccessTime.dwHighDateTime=0x1d4cc26, ftLastWriteTime.dwLowDateTime=0xcc068570, ftLastWriteTime.dwHighDateTime=0x1d4cc26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.632] FindNextFileW (in: hFindFile=0x69afa8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf665bc0, ftCreationTime.dwHighDateTime=0x1d4cf67, ftLastAccessTime.dwLowDateTime=0x12c27320, ftLastAccessTime.dwHighDateTime=0x1d4cd53, ftLastWriteTime.dwLowDateTime=0x12c27320, ftLastWriteTime.dwHighDateTime=0x1d4cd53, nFileSizeHigh=0x0, nFileSizeLow=0xaf48, dwReserved0=0x0, dwReserved1=0x0, cFileName="bpAc-4m8rrHxT.png", cAlternateFileName="BPAC-4~1.PNG")) returned 1 [0074.632] FindNextFileW (in: hFindFile=0x69afa8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x461d9a60, ftCreationTime.dwHighDateTime=0x1d4d47e, ftLastAccessTime.dwLowDateTime=0x491377e0, ftLastAccessTime.dwHighDateTime=0x1d4c7f3, ftLastWriteTime.dwLowDateTime=0x491377e0, ftLastWriteTime.dwHighDateTime=0x1d4c7f3, nFileSizeHigh=0x0, nFileSizeLow=0x7bc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIHk-Os -rLm.bmp", cAlternateFileName="PIHK-O~1.BMP")) returned 1 [0074.632] FindNextFileW (in: hFindFile=0x69afa8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74c5fc80, ftCreationTime.dwHighDateTime=0x1d4c543, ftLastAccessTime.dwLowDateTime=0x49afe20, ftLastAccessTime.dwHighDateTime=0x1d4d447, ftLastWriteTime.dwLowDateTime=0x49afe20, ftLastWriteTime.dwHighDateTime=0x1d4d447, nFileSizeHigh=0x0, nFileSizeLow=0x3a81, dwReserved0=0x0, dwReserved1=0x0, cFileName="uqE-T5phpl.jpg", cAlternateFileName="UQE-T5~1.JPG")) returned 1 [0074.633] FindNextFileW (in: hFindFile=0x69afa8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a8b0310, ftCreationTime.dwHighDateTime=0x1d4c58a, ftLastAccessTime.dwLowDateTime=0x7cdacf10, ftLastAccessTime.dwHighDateTime=0x1d4d13a, ftLastWriteTime.dwLowDateTime=0x7cdacf10, ftLastWriteTime.dwHighDateTime=0x1d4d13a, nFileSizeHigh=0x0, nFileSizeLow=0x16ab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VtReoqcOEPYjXQykd7.png", cAlternateFileName="VTREOQ~1.PNG")) returned 1 [0074.633] FindNextFileW (in: hFindFile=0x69afa8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeddade0, ftCreationTime.dwHighDateTime=0x1d4c8dd, ftLastAccessTime.dwLowDateTime=0x8bae0470, ftLastAccessTime.dwHighDateTime=0x1d4c885, ftLastWriteTime.dwLowDateTime=0x8bae0470, ftLastWriteTime.dwHighDateTime=0x1d4c885, nFileSizeHigh=0x0, nFileSizeLow=0x3f02, dwReserved0=0x0, dwReserved1=0x0, cFileName="WR4rv.bmp", cAlternateFileName="")) returned 1 [0074.633] FindNextFileW (in: hFindFile=0x69afa8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.633] FindClose (in: hFindFile=0x69afa8 | out: hFindFile=0x69afa8) returned 1 [0074.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9e0) returned 1 [0074.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9ec) returned 1 [0074.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea20) returned 1 [0074.633] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE", nBufferLength=0x105, lpBuffer=0x24e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE", lpFilePart=0x0) returned 0x3e [0074.633] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\", nBufferLength=0x105, lpBuffer=0x24e4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\", lpFilePart=0x0) returned 0x3f [0074.633] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\*", lpFindFileData=0x24e748 | out: lpFindFileData=0x24e748*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbda62cc0, ftCreationTime.dwHighDateTime=0x1d4cb30, ftLastAccessTime.dwLowDateTime=0xcc068570, ftLastAccessTime.dwHighDateTime=0x1d4cc26, ftLastWriteTime.dwLowDateTime=0xcc068570, ftLastWriteTime.dwHighDateTime=0x1d4cc26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69afa8 [0074.633] FindNextFileW (in: hFindFile=0x69afa8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbda62cc0, ftCreationTime.dwHighDateTime=0x1d4cb30, ftLastAccessTime.dwLowDateTime=0xcc068570, ftLastAccessTime.dwHighDateTime=0x1d4cc26, ftLastWriteTime.dwLowDateTime=0xcc068570, ftLastWriteTime.dwHighDateTime=0x1d4cc26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.633] FindNextFileW (in: hFindFile=0x69afa8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf665bc0, ftCreationTime.dwHighDateTime=0x1d4cf67, ftLastAccessTime.dwLowDateTime=0x12c27320, ftLastAccessTime.dwHighDateTime=0x1d4cd53, ftLastWriteTime.dwLowDateTime=0x12c27320, ftLastWriteTime.dwHighDateTime=0x1d4cd53, nFileSizeHigh=0x0, nFileSizeLow=0xaf48, dwReserved0=0x0, dwReserved1=0x0, cFileName="bpAc-4m8rrHxT.png", cAlternateFileName="BPAC-4~1.PNG")) returned 1 [0074.634] FindNextFileW (in: hFindFile=0x69afa8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x461d9a60, ftCreationTime.dwHighDateTime=0x1d4d47e, ftLastAccessTime.dwLowDateTime=0x491377e0, ftLastAccessTime.dwHighDateTime=0x1d4c7f3, ftLastWriteTime.dwLowDateTime=0x491377e0, ftLastWriteTime.dwHighDateTime=0x1d4c7f3, nFileSizeHigh=0x0, nFileSizeLow=0x7bc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIHk-Os -rLm.bmp", cAlternateFileName="PIHK-O~1.BMP")) returned 1 [0074.634] FindNextFileW (in: hFindFile=0x69afa8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74c5fc80, ftCreationTime.dwHighDateTime=0x1d4c543, ftLastAccessTime.dwLowDateTime=0x49afe20, ftLastAccessTime.dwHighDateTime=0x1d4d447, ftLastWriteTime.dwLowDateTime=0x49afe20, ftLastWriteTime.dwHighDateTime=0x1d4d447, nFileSizeHigh=0x0, nFileSizeLow=0x3a81, dwReserved0=0x0, dwReserved1=0x0, cFileName="uqE-T5phpl.jpg", cAlternateFileName="UQE-T5~1.JPG")) returned 1 [0074.634] FindNextFileW (in: hFindFile=0x69afa8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a8b0310, ftCreationTime.dwHighDateTime=0x1d4c58a, ftLastAccessTime.dwLowDateTime=0x7cdacf10, ftLastAccessTime.dwHighDateTime=0x1d4d13a, ftLastWriteTime.dwLowDateTime=0x7cdacf10, ftLastWriteTime.dwHighDateTime=0x1d4d13a, nFileSizeHigh=0x0, nFileSizeLow=0x16ab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VtReoqcOEPYjXQykd7.png", cAlternateFileName="VTREOQ~1.PNG")) returned 1 [0074.634] FindNextFileW (in: hFindFile=0x69afa8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeddade0, ftCreationTime.dwHighDateTime=0x1d4c8dd, ftLastAccessTime.dwLowDateTime=0x8bae0470, ftLastAccessTime.dwHighDateTime=0x1d4c885, ftLastWriteTime.dwLowDateTime=0x8bae0470, ftLastWriteTime.dwHighDateTime=0x1d4c885, nFileSizeHigh=0x0, nFileSizeLow=0x3f02, dwReserved0=0x0, dwReserved1=0x0, cFileName="WR4rv.bmp", cAlternateFileName="")) returned 1 [0074.634] FindNextFileW (in: hFindFile=0x69afa8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeddade0, ftCreationTime.dwHighDateTime=0x1d4c8dd, ftLastAccessTime.dwLowDateTime=0x8bae0470, ftLastAccessTime.dwHighDateTime=0x1d4c885, ftLastWriteTime.dwLowDateTime=0x8bae0470, ftLastWriteTime.dwHighDateTime=0x1d4c885, nFileSizeHigh=0x0, nFileSizeLow=0x3f02, dwReserved0=0x0, dwReserved1=0x0, cFileName="WR4rv.bmp", cAlternateFileName="")) returned 0 [0074.634] FindClose (in: hFindFile=0x69afa8 | out: hFindFile=0x69afa8) returned 1 [0074.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9e0) returned 1 [0074.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9ec) returned 1 [0074.634] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\bpAc-4m8rrHxT.png", nBufferLength=0x105, lpBuffer=0x24e3d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\bpAc-4m8rrHxT.png", lpFilePart=0x0) returned 0x50 [0074.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8c4) returned 1 [0074.634] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\bpAc-4m8rrHxT.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\uebue\\bpac-4m8rrhxt.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.635] GetFileType (hFile=0x26c) returned 0x1 [0074.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8c0) returned 1 [0074.635] GetFileType (hFile=0x26c) returned 0x1 [0074.635] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24e9cc | out: lpFileSizeHigh=0x24e9cc*=0x0) returned 0xaf48 [0074.635] ReadFile (in: hFile=0x26c, lpBuffer=0x27a406c, nNumberOfBytesToRead=0xaf48, lpNumberOfBytesRead=0x24e978, lpOverlapped=0x0 | out: lpBuffer=0x27a406c*, lpNumberOfBytesRead=0x24e978*=0xaf48, lpOverlapped=0x0) returned 1 [0074.673] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e4e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0074.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e944) returned 1 [0074.673] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24e9c0 | out: lpFileInformation=0x24e9c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0074.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e940) returned 1 [0074.673] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\bpAc-4m8rrHxT.png", nBufferLength=0x105, lpBuffer=0x24e3bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\bpAc-4m8rrHxT.png", lpFilePart=0x0) returned 0x50 [0074.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8b0) returned 1 [0074.673] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\bpAc-4m8rrHxT.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\uebue\\bpac-4m8rrhxt.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.674] GetFileType (hFile=0x26c) returned 0x1 [0074.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8ac) returned 1 [0074.674] GetFileType (hFile=0x26c) returned 0x1 [0074.674] WriteFile (in: hFile=0x26c, lpBuffer=0x2811db4*, nNumberOfBytesToWrite=0xaf50, lpNumberOfBytesWritten=0x24e96c, lpOverlapped=0x0 | out: lpBuffer=0x2811db4*, lpNumberOfBytesWritten=0x24e96c*=0xaf50, lpOverlapped=0x0) returned 1 [0074.676] CloseHandle (hObject=0x26c) returned 1 [0074.682] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\bpAc-4m8rrHxT.png", nBufferLength=0x105, lpBuffer=0x24e4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\bpAc-4m8rrHxT.png", lpFilePart=0x0) returned 0x50 [0074.682] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\bpAc-4m8rrHxT.png.Crypted", nBufferLength=0x105, lpBuffer=0x24e4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\bpAc-4m8rrHxT.png.Crypted", lpFilePart=0x0) returned 0x58 [0074.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e950) returned 1 [0074.682] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\bpAc-4m8rrHxT.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\uebue\\bpac-4m8rrhxt.png"), fInfoLevelId=0x0, lpFileInformation=0x24e9cc | out: lpFileInformation=0x24e9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf665bc0, ftCreationTime.dwHighDateTime=0x1d4cf67, ftLastAccessTime.dwLowDateTime=0x12c27320, ftLastAccessTime.dwHighDateTime=0x1d4cd53, ftLastWriteTime.dwLowDateTime=0xfd677670, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xaf50)) returned 1 [0074.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e94c) returned 1 [0074.682] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\bpAc-4m8rrHxT.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\uebue\\bpac-4m8rrhxt.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\bpAc-4m8rrHxT.png.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\uebue\\bpac-4m8rrhxt.png.crypted")) returned 1 [0074.683] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\PIHk-Os -rLm.bmp", nBufferLength=0x105, lpBuffer=0x24e3d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\PIHk-Os -rLm.bmp", lpFilePart=0x0) returned 0x4f [0074.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8c4) returned 1 [0074.683] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\PIHk-Os -rLm.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\uebue\\pihk-os -rlm.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.683] GetFileType (hFile=0x26c) returned 0x1 [0074.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8c0) returned 1 [0074.683] GetFileType (hFile=0x26c) returned 0x1 [0074.683] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24e9cc | out: lpFileSizeHigh=0x24e9cc*=0x0) returned 0x7bc7 [0074.683] ReadFile (in: hFile=0x26c, lpBuffer=0x281d368, nNumberOfBytesToRead=0x7bc7, lpNumberOfBytesRead=0x24e978, lpOverlapped=0x0 | out: lpBuffer=0x281d368*, lpNumberOfBytesRead=0x24e978*=0x7bc7, lpOverlapped=0x0) returned 1 [0074.685] CloseHandle (hObject=0x26c) returned 1 [0074.701] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e4e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0074.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e944) returned 1 [0074.701] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24e9c0 | out: lpFileInformation=0x24e9c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0074.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e940) returned 1 [0074.701] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\PIHk-Os -rLm.bmp", nBufferLength=0x105, lpBuffer=0x24e3bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\PIHk-Os -rLm.bmp", lpFilePart=0x0) returned 0x4f [0074.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8b0) returned 1 [0074.701] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\PIHk-Os -rLm.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\uebue\\pihk-os -rlm.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.702] GetFileType (hFile=0x26c) returned 0x1 [0074.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8ac) returned 1 [0074.703] GetFileType (hFile=0x26c) returned 0x1 [0074.703] WriteFile (in: hFile=0x26c, lpBuffer=0x2890c64*, nNumberOfBytesToWrite=0x7bd0, lpNumberOfBytesWritten=0x24e96c, lpOverlapped=0x0 | out: lpBuffer=0x2890c64*, lpNumberOfBytesWritten=0x24e96c*=0x7bd0, lpOverlapped=0x0) returned 1 [0074.704] CloseHandle (hObject=0x26c) returned 1 [0074.709] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\PIHk-Os -rLm.bmp", nBufferLength=0x105, lpBuffer=0x24e4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\PIHk-Os -rLm.bmp", lpFilePart=0x0) returned 0x4f [0074.709] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\PIHk-Os -rLm.bmp.Crypted", nBufferLength=0x105, lpBuffer=0x24e4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\PIHk-Os -rLm.bmp.Crypted", lpFilePart=0x0) returned 0x57 [0074.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e950) returned 1 [0074.709] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\PIHk-Os -rLm.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\uebue\\pihk-os -rlm.bmp"), fInfoLevelId=0x0, lpFileInformation=0x24e9cc | out: lpFileInformation=0x24e9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x461d9a60, ftCreationTime.dwHighDateTime=0x1d4d47e, ftLastAccessTime.dwLowDateTime=0x491377e0, ftLastAccessTime.dwHighDateTime=0x1d4c7f3, ftLastWriteTime.dwLowDateTime=0xfd69d7d0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x7bd0)) returned 1 [0074.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e94c) returned 1 [0074.709] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\PIHk-Os -rLm.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\uebue\\pihk-os -rlm.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\PIHk-Os -rLm.bmp.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\uebue\\pihk-os -rlm.bmp.crypted")) returned 1 [0074.710] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\uqE-T5phpl.jpg", nBufferLength=0x105, lpBuffer=0x24e3d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\uqE-T5phpl.jpg", lpFilePart=0x0) returned 0x4d [0074.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8c4) returned 1 [0074.710] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\uqE-T5phpl.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\uebue\\uqe-t5phpl.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.711] GetFileType (hFile=0x26c) returned 0x1 [0074.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8c0) returned 1 [0074.711] GetFileType (hFile=0x26c) returned 0x1 [0074.711] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24e9cc | out: lpFileSizeHigh=0x24e9cc*=0x0) returned 0x3a81 [0074.711] ReadFile (in: hFile=0x26c, lpBuffer=0x2898e80, nNumberOfBytesToRead=0x3a81, lpNumberOfBytesRead=0x24e978, lpOverlapped=0x0 | out: lpBuffer=0x2898e80*, lpNumberOfBytesRead=0x24e978*=0x3a81, lpOverlapped=0x0) returned 1 [0074.714] CloseHandle (hObject=0x26c) returned 1 [0074.734] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e4e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0074.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e944) returned 1 [0074.734] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24e9c0 | out: lpFileInformation=0x24e9c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0074.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e940) returned 1 [0074.734] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\uqE-T5phpl.jpg", nBufferLength=0x105, lpBuffer=0x24e3bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\uqE-T5phpl.jpg", lpFilePart=0x0) returned 0x4d [0074.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8b0) returned 1 [0074.734] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\uqE-T5phpl.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\uebue\\uqe-t5phpl.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.735] GetFileType (hFile=0x26c) returned 0x1 [0074.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8ac) returned 1 [0074.735] GetFileType (hFile=0x26c) returned 0x1 [0074.735] WriteFile (in: hFile=0x26c, lpBuffer=0x28f813c*, nNumberOfBytesToWrite=0x3a90, lpNumberOfBytesWritten=0x24e96c, lpOverlapped=0x0 | out: lpBuffer=0x28f813c*, lpNumberOfBytesWritten=0x24e96c*=0x3a90, lpOverlapped=0x0) returned 1 [0074.736] CloseHandle (hObject=0x26c) returned 1 [0074.740] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\uqE-T5phpl.jpg", nBufferLength=0x105, lpBuffer=0x24e4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\uqE-T5phpl.jpg", lpFilePart=0x0) returned 0x4d [0074.740] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\uqE-T5phpl.jpg.Crypted", nBufferLength=0x105, lpBuffer=0x24e4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\uqE-T5phpl.jpg.Crypted", lpFilePart=0x0) returned 0x55 [0074.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e950) returned 1 [0074.740] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\uqE-T5phpl.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\uebue\\uqe-t5phpl.jpg"), fInfoLevelId=0x0, lpFileInformation=0x24e9cc | out: lpFileInformation=0x24e9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74c5fc80, ftCreationTime.dwHighDateTime=0x1d4c543, ftLastAccessTime.dwLowDateTime=0x49afe20, ftLastAccessTime.dwHighDateTime=0x1d4d447, ftLastWriteTime.dwLowDateTime=0xfd70fbf0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x3a90)) returned 1 [0074.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e94c) returned 1 [0074.740] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\uqE-T5phpl.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\uebue\\uqe-t5phpl.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\uqE-T5phpl.jpg.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\uebue\\uqe-t5phpl.jpg.crypted")) returned 1 [0074.745] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\VtReoqcOEPYjXQykd7.png", nBufferLength=0x105, lpBuffer=0x24e3d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\VtReoqcOEPYjXQykd7.png", lpFilePart=0x0) returned 0x55 [0074.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8c4) returned 1 [0074.745] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\VtReoqcOEPYjXQykd7.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\uebue\\vtreoqcoepyjxqykd7.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.745] GetFileType (hFile=0x26c) returned 0x1 [0074.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8c0) returned 1 [0074.745] GetFileType (hFile=0x26c) returned 0x1 [0074.745] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24e9cc | out: lpFileSizeHigh=0x24e9cc*=0x0) returned 0x16ab0 [0074.745] ReadFile (in: hFile=0x26c, lpBuffer=0x3949a10, nNumberOfBytesToRead=0x16ab0, lpNumberOfBytesRead=0x24e978, lpOverlapped=0x0 | out: lpBuffer=0x3949a10*, lpNumberOfBytesRead=0x24e978*=0x16ab0, lpOverlapped=0x0) returned 1 [0074.747] CloseHandle (hObject=0x26c) returned 1 [0074.769] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e4e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0074.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e944) returned 1 [0074.769] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24e9c0 | out: lpFileInformation=0x24e9c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0074.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e940) returned 1 [0074.770] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\VtReoqcOEPYjXQykd7.png", nBufferLength=0x105, lpBuffer=0x24e3bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\VtReoqcOEPYjXQykd7.png", lpFilePart=0x0) returned 0x55 [0074.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8b0) returned 1 [0074.770] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\VtReoqcOEPYjXQykd7.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\uebue\\vtreoqcoepyjxqykd7.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.772] GetFileType (hFile=0x26c) returned 0x1 [0074.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8ac) returned 1 [0074.772] GetFileType (hFile=0x26c) returned 0x1 [0074.772] WriteFile (in: hFile=0x26c, lpBuffer=0x39fed30*, nNumberOfBytesToWrite=0x16ac0, lpNumberOfBytesWritten=0x24e96c, lpOverlapped=0x0 | out: lpBuffer=0x39fed30*, lpNumberOfBytesWritten=0x24e96c*=0x16ac0, lpOverlapped=0x0) returned 1 [0074.774] CloseHandle (hObject=0x26c) returned 1 [0074.777] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\VtReoqcOEPYjXQykd7.png", nBufferLength=0x105, lpBuffer=0x24e4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\VtReoqcOEPYjXQykd7.png", lpFilePart=0x0) returned 0x55 [0074.778] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\VtReoqcOEPYjXQykd7.png.Crypted", nBufferLength=0x105, lpBuffer=0x24e4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\VtReoqcOEPYjXQykd7.png.Crypted", lpFilePart=0x0) returned 0x5d [0074.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e950) returned 1 [0074.778] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\VtReoqcOEPYjXQykd7.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\uebue\\vtreoqcoepyjxqykd7.png"), fInfoLevelId=0x0, lpFileInformation=0x24e9cc | out: lpFileInformation=0x24e9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a8b0310, ftCreationTime.dwHighDateTime=0x1d4c58a, ftLastAccessTime.dwLowDateTime=0x7cdacf10, ftLastAccessTime.dwHighDateTime=0x1d4d13a, ftLastWriteTime.dwLowDateTime=0xfd75beb0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x16ac0)) returned 1 [0074.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e94c) returned 1 [0074.778] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\VtReoqcOEPYjXQykd7.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\uebue\\vtreoqcoepyjxqykd7.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\VtReoqcOEPYjXQykd7.png.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\uebue\\vtreoqcoepyjxqykd7.png.crypted")) returned 1 [0074.779] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\WR4rv.bmp", nBufferLength=0x105, lpBuffer=0x24e3d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\WR4rv.bmp", lpFilePart=0x0) returned 0x48 [0074.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8c4) returned 1 [0074.779] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\WR4rv.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\uebue\\wr4rv.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.779] GetFileType (hFile=0x26c) returned 0x1 [0074.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8c0) returned 1 [0074.779] GetFileType (hFile=0x26c) returned 0x1 [0074.779] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24e9cc | out: lpFileSizeHigh=0x24e9cc*=0x0) returned 0x3f02 [0074.779] ReadFile (in: hFile=0x26c, lpBuffer=0x2949694, nNumberOfBytesToRead=0x3f02, lpNumberOfBytesRead=0x24e978, lpOverlapped=0x0 | out: lpBuffer=0x2949694*, lpNumberOfBytesRead=0x24e978*=0x3f02, lpOverlapped=0x0) returned 1 [0074.781] CloseHandle (hObject=0x26c) returned 1 [0074.803] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e4e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0074.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e944) returned 1 [0074.804] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24e9c0 | out: lpFileInformation=0x24e9c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0074.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e940) returned 1 [0074.804] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\WR4rv.bmp", nBufferLength=0x105, lpBuffer=0x24e3bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\WR4rv.bmp", lpFilePart=0x0) returned 0x48 [0074.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8b0) returned 1 [0074.804] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\WR4rv.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\uebue\\wr4rv.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.805] GetFileType (hFile=0x26c) returned 0x1 [0074.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8ac) returned 1 [0074.805] GetFileType (hFile=0x26c) returned 0x1 [0074.805] WriteFile (in: hFile=0x26c, lpBuffer=0x29a9fd0*, nNumberOfBytesToWrite=0x3f10, lpNumberOfBytesWritten=0x24e96c, lpOverlapped=0x0 | out: lpBuffer=0x29a9fd0*, lpNumberOfBytesWritten=0x24e96c*=0x3f10, lpOverlapped=0x0) returned 1 [0074.806] CloseHandle (hObject=0x26c) returned 1 [0074.812] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\WR4rv.bmp", nBufferLength=0x105, lpBuffer=0x24e4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\WR4rv.bmp", lpFilePart=0x0) returned 0x48 [0074.812] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\WR4rv.bmp.Crypted", nBufferLength=0x105, lpBuffer=0x24e4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\WR4rv.bmp.Crypted", lpFilePart=0x0) returned 0x50 [0074.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e950) returned 1 [0074.812] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\WR4rv.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\uebue\\wr4rv.bmp"), fInfoLevelId=0x0, lpFileInformation=0x24e9cc | out: lpFileInformation=0x24e9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeddade0, ftCreationTime.dwHighDateTime=0x1d4c8dd, ftLastAccessTime.dwLowDateTime=0x8bae0470, ftLastAccessTime.dwHighDateTime=0x1d4c885, ftLastWriteTime.dwLowDateTime=0xfd7a8170, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x3f10)) returned 1 [0074.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e94c) returned 1 [0074.813] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\WR4rv.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\uebue\\wr4rv.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\O17558GL7LMbWY 5W\\uEbUE\\WR4rv.bmp.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\o17558gl7lmbwy 5w\\uebue\\wr4rv.bmp.crypted")) returned 1 [0074.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eb08) returned 1 [0074.813] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music", nBufferLength=0x105, lpBuffer=0x24e610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music", lpFilePart=0x0) returned 0x23 [0074.813] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", nBufferLength=0x105, lpBuffer=0x24e5e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", lpFilePart=0x0) returned 0x24 [0074.814] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*", lpFindFileData=0x24e830 | out: lpFindFileData=0x24e830*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xddbe0640, ftLastAccessTime.dwHighDateTime=0x1d50efb, ftLastWriteTime.dwLowDateTime=0xddbe0640, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b128 [0074.814] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xddbe0640, ftLastAccessTime.dwHighDateTime=0x1d50efb, ftLastWriteTime.dwLowDateTime=0xddbe0640, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.814] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc42fa920, ftCreationTime.dwHighDateTime=0x1d4c8e9, ftLastAccessTime.dwLowDateTime=0x137bb820, ftLastAccessTime.dwHighDateTime=0x1d4c90d, ftLastWriteTime.dwLowDateTime=0x137bb820, ftLastWriteTime.dwHighDateTime=0x1d4c90d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3ZQEAOMA_Fbl9VpLCy75", cAlternateFileName="3ZQEAO~1")) returned 1 [0074.814] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a4a5740, ftCreationTime.dwHighDateTime=0x1d4d56d, ftLastAccessTime.dwLowDateTime=0x739b4010, ftLastAccessTime.dwHighDateTime=0x1d4cf73, ftLastWriteTime.dwLowDateTime=0x739b4010, ftLastWriteTime.dwHighDateTime=0x1d4cf73, nFileSizeHigh=0x0, nFileSizeLow=0x9750, dwReserved0=0x0, dwReserved1=0x0, cFileName="90TYbCo8quX6MyRS cwv.wav", cAlternateFileName="90TYBC~1.WAV")) returned 1 [0074.814] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0074.815] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1724170, ftCreationTime.dwHighDateTime=0x1d4cfee, ftLastAccessTime.dwLowDateTime=0xe5f01d50, ftLastAccessTime.dwHighDateTime=0x1d4d1c8, ftLastWriteTime.dwLowDateTime=0xe5f01d50, ftLastWriteTime.dwHighDateTime=0x1d4d1c8, nFileSizeHigh=0x0, nFileSizeLow=0x6b28, dwReserved0=0x0, dwReserved1=0x0, cFileName="hnuPMuWsx0X.wav", cAlternateFileName="HNUPMU~1.WAV")) returned 1 [0074.815] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda293120, ftCreationTime.dwHighDateTime=0x1d4d428, ftLastAccessTime.dwLowDateTime=0x34c77a60, ftLastAccessTime.dwHighDateTime=0x1d4d0a0, ftLastWriteTime.dwLowDateTime=0x34c77a60, ftLastWriteTime.dwHighDateTime=0x1d4d0a0, nFileSizeHigh=0x0, nFileSizeLow=0x922f, dwReserved0=0x0, dwReserved1=0x0, cFileName="IINuWhTz_E3jzShfn.wav", cAlternateFileName="IINUWH~1.WAV")) returned 1 [0074.815] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0f900, ftCreationTime.dwHighDateTime=0x1d4c7a0, ftLastAccessTime.dwLowDateTime=0x3bb7d190, ftLastAccessTime.dwHighDateTime=0x1d4c5d7, ftLastWriteTime.dwLowDateTime=0x3bb7d190, ftLastWriteTime.dwHighDateTime=0x1d4c5d7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lFh_0-8r_AOzRmJc", cAlternateFileName="LFH_0-~1")) returned 1 [0074.815] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb7250, ftCreationTime.dwHighDateTime=0x1d4cf55, ftLastAccessTime.dwLowDateTime=0x30477c80, ftLastAccessTime.dwHighDateTime=0x1d4c8c9, ftLastWriteTime.dwLowDateTime=0x30477c80, ftLastWriteTime.dwHighDateTime=0x1d4c8c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="va44UjDRb", cAlternateFileName="VA44UJ~1")) returned 1 [0074.815] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1db3820, ftCreationTime.dwHighDateTime=0x1d4d416, ftLastAccessTime.dwLowDateTime=0x319615a0, ftLastAccessTime.dwHighDateTime=0x1d4d216, ftLastWriteTime.dwLowDateTime=0x319615a0, ftLastWriteTime.dwHighDateTime=0x1d4d216, nFileSizeHigh=0x0, nFileSizeLow=0x87f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="zyppu6WfedEkY.wav", cAlternateFileName="ZYPPU6~1.WAV")) returned 1 [0074.816] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.816] FindClose (in: hFindFile=0x69b128 | out: hFindFile=0x69b128) returned 1 [0074.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eac8) returned 1 [0074.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ead4) returned 1 [0074.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eb08) returned 1 [0074.816] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music", nBufferLength=0x105, lpBuffer=0x24e610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music", lpFilePart=0x0) returned 0x23 [0074.816] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", nBufferLength=0x105, lpBuffer=0x24e5e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", lpFilePart=0x0) returned 0x24 [0074.816] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*", lpFindFileData=0x24e830 | out: lpFindFileData=0x24e830*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xddbe0640, ftLastAccessTime.dwHighDateTime=0x1d50efb, ftLastWriteTime.dwLowDateTime=0xddbe0640, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b128 [0074.817] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xddbe0640, ftLastAccessTime.dwHighDateTime=0x1d50efb, ftLastWriteTime.dwLowDateTime=0xddbe0640, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.817] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc42fa920, ftCreationTime.dwHighDateTime=0x1d4c8e9, ftLastAccessTime.dwLowDateTime=0x137bb820, ftLastAccessTime.dwHighDateTime=0x1d4c90d, ftLastWriteTime.dwLowDateTime=0x137bb820, ftLastWriteTime.dwHighDateTime=0x1d4c90d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3ZQEAOMA_Fbl9VpLCy75", cAlternateFileName="3ZQEAO~1")) returned 1 [0074.817] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a4a5740, ftCreationTime.dwHighDateTime=0x1d4d56d, ftLastAccessTime.dwLowDateTime=0x739b4010, ftLastAccessTime.dwHighDateTime=0x1d4cf73, ftLastWriteTime.dwLowDateTime=0x739b4010, ftLastWriteTime.dwHighDateTime=0x1d4cf73, nFileSizeHigh=0x0, nFileSizeLow=0x9750, dwReserved0=0x0, dwReserved1=0x0, cFileName="90TYbCo8quX6MyRS cwv.wav", cAlternateFileName="90TYBC~1.WAV")) returned 1 [0074.817] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0074.817] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1724170, ftCreationTime.dwHighDateTime=0x1d4cfee, ftLastAccessTime.dwLowDateTime=0xe5f01d50, ftLastAccessTime.dwHighDateTime=0x1d4d1c8, ftLastWriteTime.dwLowDateTime=0xe5f01d50, ftLastWriteTime.dwHighDateTime=0x1d4d1c8, nFileSizeHigh=0x0, nFileSizeLow=0x6b28, dwReserved0=0x0, dwReserved1=0x0, cFileName="hnuPMuWsx0X.wav", cAlternateFileName="HNUPMU~1.WAV")) returned 1 [0074.818] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda293120, ftCreationTime.dwHighDateTime=0x1d4d428, ftLastAccessTime.dwLowDateTime=0x34c77a60, ftLastAccessTime.dwHighDateTime=0x1d4d0a0, ftLastWriteTime.dwLowDateTime=0x34c77a60, ftLastWriteTime.dwHighDateTime=0x1d4d0a0, nFileSizeHigh=0x0, nFileSizeLow=0x922f, dwReserved0=0x0, dwReserved1=0x0, cFileName="IINuWhTz_E3jzShfn.wav", cAlternateFileName="IINUWH~1.WAV")) returned 1 [0074.818] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0f900, ftCreationTime.dwHighDateTime=0x1d4c7a0, ftLastAccessTime.dwLowDateTime=0x3bb7d190, ftLastAccessTime.dwHighDateTime=0x1d4c5d7, ftLastWriteTime.dwLowDateTime=0x3bb7d190, ftLastWriteTime.dwHighDateTime=0x1d4c5d7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lFh_0-8r_AOzRmJc", cAlternateFileName="LFH_0-~1")) returned 1 [0074.818] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb7250, ftCreationTime.dwHighDateTime=0x1d4cf55, ftLastAccessTime.dwLowDateTime=0x30477c80, ftLastAccessTime.dwHighDateTime=0x1d4c8c9, ftLastWriteTime.dwLowDateTime=0x30477c80, ftLastWriteTime.dwHighDateTime=0x1d4c8c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="va44UjDRb", cAlternateFileName="VA44UJ~1")) returned 1 [0074.818] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1db3820, ftCreationTime.dwHighDateTime=0x1d4d416, ftLastAccessTime.dwLowDateTime=0x319615a0, ftLastAccessTime.dwHighDateTime=0x1d4d216, ftLastWriteTime.dwLowDateTime=0x319615a0, ftLastWriteTime.dwHighDateTime=0x1d4d216, nFileSizeHigh=0x0, nFileSizeLow=0x87f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="zyppu6WfedEkY.wav", cAlternateFileName="ZYPPU6~1.WAV")) returned 1 [0074.818] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1db3820, ftCreationTime.dwHighDateTime=0x1d4d416, ftLastAccessTime.dwLowDateTime=0x319615a0, ftLastAccessTime.dwHighDateTime=0x1d4d216, ftLastWriteTime.dwLowDateTime=0x319615a0, ftLastWriteTime.dwHighDateTime=0x1d4d216, nFileSizeHigh=0x0, nFileSizeLow=0x87f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="zyppu6WfedEkY.wav", cAlternateFileName="ZYPPU6~1.WAV")) returned 0 [0074.819] FindClose (in: hFindFile=0x69b128 | out: hFindFile=0x69b128) returned 1 [0074.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eac8) returned 1 [0074.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ead4) returned 1 [0074.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0074.819] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75", lpFilePart=0x0) returned 0x38 [0074.819] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75\\", lpFilePart=0x0) returned 0x39 [0074.819] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc42fa920, ftCreationTime.dwHighDateTime=0x1d4c8e9, ftLastAccessTime.dwLowDateTime=0x137bb820, ftLastAccessTime.dwHighDateTime=0x1d4c90d, ftLastWriteTime.dwLowDateTime=0x137bb820, ftLastWriteTime.dwHighDateTime=0x1d4c90d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b128 [0074.819] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc42fa920, ftCreationTime.dwHighDateTime=0x1d4c8e9, ftLastAccessTime.dwLowDateTime=0x137bb820, ftLastAccessTime.dwHighDateTime=0x1d4c90d, ftLastWriteTime.dwLowDateTime=0x137bb820, ftLastWriteTime.dwHighDateTime=0x1d4c90d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.819] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfffe1b00, ftCreationTime.dwHighDateTime=0x1d4c8a1, ftLastAccessTime.dwLowDateTime=0xd0342a90, ftLastAccessTime.dwHighDateTime=0x1d4d0fd, ftLastWriteTime.dwLowDateTime=0xd0342a90, ftLastWriteTime.dwHighDateTime=0x1d4d0fd, nFileSizeHigh=0x0, nFileSizeLow=0x1c81, dwReserved0=0x0, dwReserved1=0x0, cFileName="248xU1e.mp3", cAlternateFileName="")) returned 1 [0074.820] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fdc3c00, ftCreationTime.dwHighDateTime=0x1d4cf76, ftLastAccessTime.dwLowDateTime=0x38cb3050, ftLastAccessTime.dwHighDateTime=0x1d4c8f5, ftLastWriteTime.dwLowDateTime=0x38cb3050, ftLastWriteTime.dwHighDateTime=0x1d4c8f5, nFileSizeHigh=0x0, nFileSizeLow=0xbb5, dwReserved0=0x0, dwReserved1=0x0, cFileName="5FzQJGf4gu3y2tWJS.m4a", cAlternateFileName="5FZQJG~1.M4A")) returned 1 [0074.820] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc6d6c30, ftCreationTime.dwHighDateTime=0x1d4ce1d, ftLastAccessTime.dwLowDateTime=0xa8b32d90, ftLastAccessTime.dwHighDateTime=0x1d4d3a0, ftLastWriteTime.dwLowDateTime=0xa8b32d90, ftLastWriteTime.dwHighDateTime=0x1d4d3a0, nFileSizeHigh=0x0, nFileSizeLow=0x16be8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dg3LAsvegzM13.mp3", cAlternateFileName="DG3LAS~1.MP3")) returned 1 [0074.820] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe926ea50, ftCreationTime.dwHighDateTime=0x1d4c9f1, ftLastAccessTime.dwLowDateTime=0xd895bc30, ftLastAccessTime.dwHighDateTime=0x1d4d080, ftLastWriteTime.dwLowDateTime=0xd895bc30, ftLastWriteTime.dwHighDateTime=0x1d4d080, nFileSizeHigh=0x0, nFileSizeLow=0x9b83, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPttZz7eiNiamsX.m4a", cAlternateFileName="FPTTZZ~1.M4A")) returned 1 [0074.820] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdd72680, ftCreationTime.dwHighDateTime=0x1d4d48d, ftLastAccessTime.dwLowDateTime=0x95ee3760, ftLastAccessTime.dwHighDateTime=0x1d4cf2a, ftLastWriteTime.dwLowDateTime=0x95ee3760, ftLastWriteTime.dwHighDateTime=0x1d4cf2a, nFileSizeHigh=0x0, nFileSizeLow=0x10984, dwReserved0=0x0, dwReserved1=0x0, cFileName="kJpp06ewvMfEDa7-4.m4a", cAlternateFileName="KJPP06~1.M4A")) returned 1 [0074.820] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.820] FindClose (in: hFindFile=0x69b128 | out: hFindFile=0x69b128) returned 1 [0074.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea54) returned 1 [0074.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea60) returned 1 [0074.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0074.821] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75", lpFilePart=0x0) returned 0x38 [0074.821] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75\\", lpFilePart=0x0) returned 0x39 [0074.821] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc42fa920, ftCreationTime.dwHighDateTime=0x1d4c8e9, ftLastAccessTime.dwLowDateTime=0x137bb820, ftLastAccessTime.dwHighDateTime=0x1d4c90d, ftLastWriteTime.dwLowDateTime=0x137bb820, ftLastWriteTime.dwHighDateTime=0x1d4c90d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b128 [0074.821] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc42fa920, ftCreationTime.dwHighDateTime=0x1d4c8e9, ftLastAccessTime.dwLowDateTime=0x137bb820, ftLastAccessTime.dwHighDateTime=0x1d4c90d, ftLastWriteTime.dwLowDateTime=0x137bb820, ftLastWriteTime.dwHighDateTime=0x1d4c90d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.821] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfffe1b00, ftCreationTime.dwHighDateTime=0x1d4c8a1, ftLastAccessTime.dwLowDateTime=0xd0342a90, ftLastAccessTime.dwHighDateTime=0x1d4d0fd, ftLastWriteTime.dwLowDateTime=0xd0342a90, ftLastWriteTime.dwHighDateTime=0x1d4d0fd, nFileSizeHigh=0x0, nFileSizeLow=0x1c81, dwReserved0=0x0, dwReserved1=0x0, cFileName="248xU1e.mp3", cAlternateFileName="")) returned 1 [0074.821] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fdc3c00, ftCreationTime.dwHighDateTime=0x1d4cf76, ftLastAccessTime.dwLowDateTime=0x38cb3050, ftLastAccessTime.dwHighDateTime=0x1d4c8f5, ftLastWriteTime.dwLowDateTime=0x38cb3050, ftLastWriteTime.dwHighDateTime=0x1d4c8f5, nFileSizeHigh=0x0, nFileSizeLow=0xbb5, dwReserved0=0x0, dwReserved1=0x0, cFileName="5FzQJGf4gu3y2tWJS.m4a", cAlternateFileName="5FZQJG~1.M4A")) returned 1 [0074.822] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc6d6c30, ftCreationTime.dwHighDateTime=0x1d4ce1d, ftLastAccessTime.dwLowDateTime=0xa8b32d90, ftLastAccessTime.dwHighDateTime=0x1d4d3a0, ftLastWriteTime.dwLowDateTime=0xa8b32d90, ftLastWriteTime.dwHighDateTime=0x1d4d3a0, nFileSizeHigh=0x0, nFileSizeLow=0x16be8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dg3LAsvegzM13.mp3", cAlternateFileName="DG3LAS~1.MP3")) returned 1 [0074.822] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe926ea50, ftCreationTime.dwHighDateTime=0x1d4c9f1, ftLastAccessTime.dwLowDateTime=0xd895bc30, ftLastAccessTime.dwHighDateTime=0x1d4d080, ftLastWriteTime.dwLowDateTime=0xd895bc30, ftLastWriteTime.dwHighDateTime=0x1d4d080, nFileSizeHigh=0x0, nFileSizeLow=0x9b83, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPttZz7eiNiamsX.m4a", cAlternateFileName="FPTTZZ~1.M4A")) returned 1 [0074.822] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdd72680, ftCreationTime.dwHighDateTime=0x1d4d48d, ftLastAccessTime.dwLowDateTime=0x95ee3760, ftLastAccessTime.dwHighDateTime=0x1d4cf2a, ftLastWriteTime.dwLowDateTime=0x95ee3760, ftLastWriteTime.dwHighDateTime=0x1d4cf2a, nFileSizeHigh=0x0, nFileSizeLow=0x10984, dwReserved0=0x0, dwReserved1=0x0, cFileName="kJpp06ewvMfEDa7-4.m4a", cAlternateFileName="KJPP06~1.M4A")) returned 1 [0074.822] FindNextFileW (in: hFindFile=0x69b128, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdd72680, ftCreationTime.dwHighDateTime=0x1d4d48d, ftLastAccessTime.dwLowDateTime=0x95ee3760, ftLastAccessTime.dwHighDateTime=0x1d4cf2a, ftLastWriteTime.dwLowDateTime=0x95ee3760, ftLastWriteTime.dwHighDateTime=0x1d4cf2a, nFileSizeHigh=0x0, nFileSizeLow=0x10984, dwReserved0=0x0, dwReserved1=0x0, cFileName="kJpp06ewvMfEDa7-4.m4a", cAlternateFileName="KJPP06~1.M4A")) returned 0 [0074.822] FindClose (in: hFindFile=0x69b128 | out: hFindFile=0x69b128) returned 1 [0074.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea54) returned 1 [0074.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea60) returned 1 [0074.823] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75\\248xU1e.mp3", nBufferLength=0x105, lpBuffer=0x24e444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75\\248xU1e.mp3", lpFilePart=0x0) returned 0x44 [0074.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0074.823] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75\\248xU1e.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\3zqeaoma_fbl9vplcy75\\248xu1e.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.823] GetFileType (hFile=0x26c) returned 0x1 [0074.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e934) returned 1 [0074.823] GetFileType (hFile=0x26c) returned 0x1 [0074.823] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24ea40 | out: lpFileSizeHigh=0x24ea40*=0x0) returned 0x1c81 [0074.823] ReadFile (in: hFile=0x26c, lpBuffer=0x29b3280, nNumberOfBytesToRead=0x1c81, lpNumberOfBytesRead=0x24e9ec, lpOverlapped=0x0 | out: lpBuffer=0x29b3280*, lpNumberOfBytesRead=0x24e9ec*=0x1c81, lpOverlapped=0x0) returned 1 [0074.825] CloseHandle (hObject=0x26c) returned 1 [0074.845] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e558, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0074.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9b8) returned 1 [0074.845] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24ea34 | out: lpFileInformation=0x24ea34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0074.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9b4) returned 1 [0074.845] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75\\248xU1e.mp3", nBufferLength=0x105, lpBuffer=0x24e430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75\\248xU1e.mp3", lpFilePart=0x0) returned 0x44 [0074.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e924) returned 1 [0074.846] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75\\248xU1e.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\3zqeaoma_fbl9vplcy75\\248xu1e.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.847] GetFileType (hFile=0x26c) returned 0x1 [0074.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e920) returned 1 [0074.847] GetFileType (hFile=0x26c) returned 0x1 [0074.847] WriteFile (in: hFile=0x26c, lpBuffer=0x2a08f3c*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x24e9e0, lpOverlapped=0x0 | out: lpBuffer=0x2a08f3c*, lpNumberOfBytesWritten=0x24e9e0*=0x1c90, lpOverlapped=0x0) returned 1 [0074.848] CloseHandle (hObject=0x26c) returned 1 [0074.880] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75\\248xU1e.mp3", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75\\248xU1e.mp3", lpFilePart=0x0) returned 0x44 [0074.880] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75\\248xU1e.mp3.Crypted", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75\\248xU1e.mp3.Crypted", lpFilePart=0x0) returned 0x4c [0074.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9c4) returned 1 [0074.880] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75\\248xU1e.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\3zqeaoma_fbl9vplcy75\\248xu1e.mp3"), fInfoLevelId=0x0, lpFileInformation=0x24ea40 | out: lpFileInformation=0x24ea40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfffe1b00, ftCreationTime.dwHighDateTime=0x1d4c8a1, ftLastAccessTime.dwLowDateTime=0xd0342a90, ftLastAccessTime.dwHighDateTime=0x1d4d0fd, ftLastWriteTime.dwLowDateTime=0xfd866850, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x1c90)) returned 1 [0074.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9c0) returned 1 [0074.880] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75\\248xU1e.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\3zqeaoma_fbl9vplcy75\\248xu1e.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75\\248xU1e.mp3.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\3zqeaoma_fbl9vplcy75\\248xu1e.mp3.crypted")) returned 1 [0074.882] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75\\Dg3LAsvegzM13.mp3", nBufferLength=0x105, lpBuffer=0x24e444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75\\Dg3LAsvegzM13.mp3", lpFilePart=0x0) returned 0x4a [0074.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0074.882] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75\\Dg3LAsvegzM13.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\3zqeaoma_fbl9vplcy75\\dg3lasvegzm13.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.882] GetFileType (hFile=0x26c) returned 0x1 [0074.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e934) returned 1 [0074.882] GetFileType (hFile=0x26c) returned 0x1 [0074.882] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24ea40 | out: lpFileSizeHigh=0x24ea40*=0x0) returned 0x16be8 [0074.883] ReadFile (in: hFile=0x26c, lpBuffer=0x3a15810, nNumberOfBytesToRead=0x16be8, lpNumberOfBytesRead=0x24e9ec, lpOverlapped=0x0 | out: lpBuffer=0x3a15810*, lpNumberOfBytesRead=0x24e9ec*=0x16be8, lpOverlapped=0x0) returned 1 [0074.886] CloseHandle (hObject=0x26c) returned 1 [0074.918] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e558, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0074.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9b8) returned 1 [0074.918] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24ea34 | out: lpFileInformation=0x24ea34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0074.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9b4) returned 1 [0074.918] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75\\Dg3LAsvegzM13.mp3", nBufferLength=0x105, lpBuffer=0x24e430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75\\Dg3LAsvegzM13.mp3", lpFilePart=0x0) returned 0x4a [0074.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e924) returned 1 [0074.919] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75\\Dg3LAsvegzM13.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\3zqeaoma_fbl9vplcy75\\dg3lasvegzm13.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.960] GetFileType (hFile=0x26c) returned 0x1 [0074.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e920) returned 1 [0074.960] GetFileType (hFile=0x26c) returned 0x1 [0074.960] WriteFile (in: hFile=0x26c, lpBuffer=0x3a873f8*, nNumberOfBytesToWrite=0x16bf0, lpNumberOfBytesWritten=0x24e9e0, lpOverlapped=0x0 | out: lpBuffer=0x3a873f8*, lpNumberOfBytesWritten=0x24e9e0*=0x16bf0, lpOverlapped=0x0) returned 1 [0074.962] CloseHandle (hObject=0x26c) returned 1 [0074.969] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75\\Dg3LAsvegzM13.mp3", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75\\Dg3LAsvegzM13.mp3", lpFilePart=0x0) returned 0x4a [0074.969] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75\\Dg3LAsvegzM13.mp3.Crypted", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75\\Dg3LAsvegzM13.mp3.Crypted", lpFilePart=0x0) returned 0x52 [0074.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9c4) returned 1 [0074.969] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75\\Dg3LAsvegzM13.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\3zqeaoma_fbl9vplcy75\\dg3lasvegzm13.mp3"), fInfoLevelId=0x0, lpFileInformation=0x24ea40 | out: lpFileInformation=0x24ea40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc6d6c30, ftCreationTime.dwHighDateTime=0x1d4ce1d, ftLastAccessTime.dwLowDateTime=0xa8b32d90, ftLastAccessTime.dwHighDateTime=0x1d4d3a0, ftLastWriteTime.dwLowDateTime=0xfd924f30, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x16bf0)) returned 1 [0074.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9c0) returned 1 [0074.970] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75\\Dg3LAsvegzM13.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\3zqeaoma_fbl9vplcy75\\dg3lasvegzm13.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3ZQEAOMA_Fbl9VpLCy75\\Dg3LAsvegzM13.mp3.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\3zqeaoma_fbl9vplcy75\\dg3lasvegzm13.mp3.crypted")) returned 1 [0074.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0074.970] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc", lpFilePart=0x0) returned 0x34 [0074.970] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\", lpFilePart=0x0) returned 0x35 [0074.970] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0f900, ftCreationTime.dwHighDateTime=0x1d4c7a0, ftLastAccessTime.dwLowDateTime=0x3bb7d190, ftLastAccessTime.dwHighDateTime=0x1d4c5d7, ftLastWriteTime.dwLowDateTime=0x3bb7d190, ftLastWriteTime.dwHighDateTime=0x1d4c5d7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b1e8 [0074.971] FindNextFileW (in: hFindFile=0x69b1e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0f900, ftCreationTime.dwHighDateTime=0x1d4c7a0, ftLastAccessTime.dwLowDateTime=0x3bb7d190, ftLastAccessTime.dwHighDateTime=0x1d4c5d7, ftLastWriteTime.dwLowDateTime=0x3bb7d190, ftLastWriteTime.dwHighDateTime=0x1d4c5d7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.971] FindNextFileW (in: hFindFile=0x69b1e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece0a40, ftCreationTime.dwHighDateTime=0x1d4cf7e, ftLastAccessTime.dwLowDateTime=0xa3f3e890, ftLastAccessTime.dwHighDateTime=0x1d4cd91, ftLastWriteTime.dwLowDateTime=0xa3f3e890, ftLastWriteTime.dwHighDateTime=0x1d4cd91, nFileSizeHigh=0x0, nFileSizeLow=0xc2f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="1QdEBCaFdq8U pK.mp3", cAlternateFileName="1QDEBC~1.MP3")) returned 1 [0074.971] FindNextFileW (in: hFindFile=0x69b1e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2aa8ae0, ftCreationTime.dwHighDateTime=0x1d4ca09, ftLastAccessTime.dwLowDateTime=0x290b95d0, ftLastAccessTime.dwHighDateTime=0x1d4d0ff, ftLastWriteTime.dwLowDateTime=0x290b95d0, ftLastWriteTime.dwHighDateTime=0x1d4d0ff, nFileSizeHigh=0x0, nFileSizeLow=0x7f32, dwReserved0=0x0, dwReserved1=0x0, cFileName="5d SQJz5_wuih9jRXd.mp3", cAlternateFileName="5DSQJZ~1.MP3")) returned 1 [0074.971] FindNextFileW (in: hFindFile=0x69b1e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bb38700, ftCreationTime.dwHighDateTime=0x1d4c967, ftLastAccessTime.dwLowDateTime=0x1d972460, ftLastAccessTime.dwHighDateTime=0x1d4cb25, ftLastWriteTime.dwLowDateTime=0x1d972460, ftLastWriteTime.dwHighDateTime=0x1d4cb25, nFileSizeHigh=0x0, nFileSizeLow=0x155ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="a7JaJEttlY__v1f5hP.mp3", cAlternateFileName="A7JAJE~1.MP3")) returned 1 [0074.971] FindNextFileW (in: hFindFile=0x69b1e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c549ca0, ftCreationTime.dwHighDateTime=0x1d4c757, ftLastAccessTime.dwLowDateTime=0xd558a930, ftLastAccessTime.dwHighDateTime=0x1d4c7e6, ftLastWriteTime.dwLowDateTime=0xd558a930, ftLastWriteTime.dwHighDateTime=0x1d4c7e6, nFileSizeHigh=0x0, nFileSizeLow=0x14e86, dwReserved0=0x0, dwReserved1=0x0, cFileName="d6gojChV0k8T0GdS.wav", cAlternateFileName="D6GOJC~1.WAV")) returned 1 [0074.972] FindNextFileW (in: hFindFile=0x69b1e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e87e060, ftCreationTime.dwHighDateTime=0x1d4c9db, ftLastAccessTime.dwLowDateTime=0xee51840, ftLastAccessTime.dwHighDateTime=0x1d4caea, ftLastWriteTime.dwLowDateTime=0xee51840, ftLastWriteTime.dwHighDateTime=0x1d4caea, nFileSizeHigh=0x0, nFileSizeLow=0x15207, dwReserved0=0x0, dwReserved1=0x0, cFileName="Drs5G0SkcDJdCgj.m4a", cAlternateFileName="DRS5G0~1.M4A")) returned 1 [0074.972] FindNextFileW (in: hFindFile=0x69b1e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63adf320, ftCreationTime.dwHighDateTime=0x1d4c909, ftLastAccessTime.dwLowDateTime=0x7c891450, ftLastAccessTime.dwHighDateTime=0x1d4c770, ftLastWriteTime.dwLowDateTime=0x7c891450, ftLastWriteTime.dwHighDateTime=0x1d4c770, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gxW9AsIS4P5HAOHlUSm", cAlternateFileName="GXW9AS~1")) returned 1 [0074.972] FindNextFileW (in: hFindFile=0x69b1e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1c0b3c0, ftCreationTime.dwHighDateTime=0x1d4c86d, ftLastAccessTime.dwLowDateTime=0x6f63a700, ftLastAccessTime.dwHighDateTime=0x1d4d33b, ftLastWriteTime.dwLowDateTime=0x6f63a700, ftLastWriteTime.dwHighDateTime=0x1d4d33b, nFileSizeHigh=0x0, nFileSizeLow=0xbd42, dwReserved0=0x0, dwReserved1=0x0, cFileName="MEI0Tt-Wf1-E.m4a", cAlternateFileName="MEI0TT~1.M4A")) returned 1 [0074.972] FindNextFileW (in: hFindFile=0x69b1e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8316c0, ftCreationTime.dwHighDateTime=0x1d4d2dc, ftLastAccessTime.dwLowDateTime=0xf18b7b00, ftLastAccessTime.dwHighDateTime=0x1d4d13c, ftLastWriteTime.dwLowDateTime=0xf18b7b00, ftLastWriteTime.dwHighDateTime=0x1d4d13c, nFileSizeHigh=0x0, nFileSizeLow=0x7ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="q4kxPH5AzOF.mp3", cAlternateFileName="Q4KXPH~1.MP3")) returned 1 [0074.972] FindNextFileW (in: hFindFile=0x69b1e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45ef47c0, ftCreationTime.dwHighDateTime=0x1d4d418, ftLastAccessTime.dwLowDateTime=0x7f10e0, ftLastAccessTime.dwHighDateTime=0x1d4cc7e, ftLastWriteTime.dwLowDateTime=0x7f10e0, ftLastWriteTime.dwHighDateTime=0x1d4cc7e, nFileSizeHigh=0x0, nFileSizeLow=0x1492e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZCDwg-TeZ_HRVD.mp3", cAlternateFileName="ZCDWG-~1.MP3")) returned 1 [0074.973] FindNextFileW (in: hFindFile=0x69b1e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.973] FindClose (in: hFindFile=0x69b1e8 | out: hFindFile=0x69b1e8) returned 1 [0074.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea54) returned 1 [0074.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea60) returned 1 [0074.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0074.973] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc", lpFilePart=0x0) returned 0x34 [0074.973] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\", lpFilePart=0x0) returned 0x35 [0074.973] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0f900, ftCreationTime.dwHighDateTime=0x1d4c7a0, ftLastAccessTime.dwLowDateTime=0x3bb7d190, ftLastAccessTime.dwHighDateTime=0x1d4c5d7, ftLastWriteTime.dwLowDateTime=0x3bb7d190, ftLastWriteTime.dwHighDateTime=0x1d4c5d7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b1e8 [0074.973] FindNextFileW (in: hFindFile=0x69b1e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0f900, ftCreationTime.dwHighDateTime=0x1d4c7a0, ftLastAccessTime.dwLowDateTime=0x3bb7d190, ftLastAccessTime.dwHighDateTime=0x1d4c5d7, ftLastWriteTime.dwLowDateTime=0x3bb7d190, ftLastWriteTime.dwHighDateTime=0x1d4c5d7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.973] FindNextFileW (in: hFindFile=0x69b1e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece0a40, ftCreationTime.dwHighDateTime=0x1d4cf7e, ftLastAccessTime.dwLowDateTime=0xa3f3e890, ftLastAccessTime.dwHighDateTime=0x1d4cd91, ftLastWriteTime.dwLowDateTime=0xa3f3e890, ftLastWriteTime.dwHighDateTime=0x1d4cd91, nFileSizeHigh=0x0, nFileSizeLow=0xc2f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="1QdEBCaFdq8U pK.mp3", cAlternateFileName="1QDEBC~1.MP3")) returned 1 [0074.974] FindNextFileW (in: hFindFile=0x69b1e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2aa8ae0, ftCreationTime.dwHighDateTime=0x1d4ca09, ftLastAccessTime.dwLowDateTime=0x290b95d0, ftLastAccessTime.dwHighDateTime=0x1d4d0ff, ftLastWriteTime.dwLowDateTime=0x290b95d0, ftLastWriteTime.dwHighDateTime=0x1d4d0ff, nFileSizeHigh=0x0, nFileSizeLow=0x7f32, dwReserved0=0x0, dwReserved1=0x0, cFileName="5d SQJz5_wuih9jRXd.mp3", cAlternateFileName="5DSQJZ~1.MP3")) returned 1 [0074.974] FindNextFileW (in: hFindFile=0x69b1e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bb38700, ftCreationTime.dwHighDateTime=0x1d4c967, ftLastAccessTime.dwLowDateTime=0x1d972460, ftLastAccessTime.dwHighDateTime=0x1d4cb25, ftLastWriteTime.dwLowDateTime=0x1d972460, ftLastWriteTime.dwHighDateTime=0x1d4cb25, nFileSizeHigh=0x0, nFileSizeLow=0x155ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="a7JaJEttlY__v1f5hP.mp3", cAlternateFileName="A7JAJE~1.MP3")) returned 1 [0074.974] FindNextFileW (in: hFindFile=0x69b1e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c549ca0, ftCreationTime.dwHighDateTime=0x1d4c757, ftLastAccessTime.dwLowDateTime=0xd558a930, ftLastAccessTime.dwHighDateTime=0x1d4c7e6, ftLastWriteTime.dwLowDateTime=0xd558a930, ftLastWriteTime.dwHighDateTime=0x1d4c7e6, nFileSizeHigh=0x0, nFileSizeLow=0x14e86, dwReserved0=0x0, dwReserved1=0x0, cFileName="d6gojChV0k8T0GdS.wav", cAlternateFileName="D6GOJC~1.WAV")) returned 1 [0074.974] FindNextFileW (in: hFindFile=0x69b1e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e87e060, ftCreationTime.dwHighDateTime=0x1d4c9db, ftLastAccessTime.dwLowDateTime=0xee51840, ftLastAccessTime.dwHighDateTime=0x1d4caea, ftLastWriteTime.dwLowDateTime=0xee51840, ftLastWriteTime.dwHighDateTime=0x1d4caea, nFileSizeHigh=0x0, nFileSizeLow=0x15207, dwReserved0=0x0, dwReserved1=0x0, cFileName="Drs5G0SkcDJdCgj.m4a", cAlternateFileName="DRS5G0~1.M4A")) returned 1 [0074.974] FindNextFileW (in: hFindFile=0x69b1e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63adf320, ftCreationTime.dwHighDateTime=0x1d4c909, ftLastAccessTime.dwLowDateTime=0x7c891450, ftLastAccessTime.dwHighDateTime=0x1d4c770, ftLastWriteTime.dwLowDateTime=0x7c891450, ftLastWriteTime.dwHighDateTime=0x1d4c770, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gxW9AsIS4P5HAOHlUSm", cAlternateFileName="GXW9AS~1")) returned 1 [0074.974] FindNextFileW (in: hFindFile=0x69b1e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1c0b3c0, ftCreationTime.dwHighDateTime=0x1d4c86d, ftLastAccessTime.dwLowDateTime=0x6f63a700, ftLastAccessTime.dwHighDateTime=0x1d4d33b, ftLastWriteTime.dwLowDateTime=0x6f63a700, ftLastWriteTime.dwHighDateTime=0x1d4d33b, nFileSizeHigh=0x0, nFileSizeLow=0xbd42, dwReserved0=0x0, dwReserved1=0x0, cFileName="MEI0Tt-Wf1-E.m4a", cAlternateFileName="MEI0TT~1.M4A")) returned 1 [0074.974] FindNextFileW (in: hFindFile=0x69b1e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8316c0, ftCreationTime.dwHighDateTime=0x1d4d2dc, ftLastAccessTime.dwLowDateTime=0xf18b7b00, ftLastAccessTime.dwHighDateTime=0x1d4d13c, ftLastWriteTime.dwLowDateTime=0xf18b7b00, ftLastWriteTime.dwHighDateTime=0x1d4d13c, nFileSizeHigh=0x0, nFileSizeLow=0x7ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="q4kxPH5AzOF.mp3", cAlternateFileName="Q4KXPH~1.MP3")) returned 1 [0074.975] FindNextFileW (in: hFindFile=0x69b1e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45ef47c0, ftCreationTime.dwHighDateTime=0x1d4d418, ftLastAccessTime.dwLowDateTime=0x7f10e0, ftLastAccessTime.dwHighDateTime=0x1d4cc7e, ftLastWriteTime.dwLowDateTime=0x7f10e0, ftLastWriteTime.dwHighDateTime=0x1d4cc7e, nFileSizeHigh=0x0, nFileSizeLow=0x1492e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZCDwg-TeZ_HRVD.mp3", cAlternateFileName="ZCDWG-~1.MP3")) returned 1 [0074.975] FindNextFileW (in: hFindFile=0x69b1e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45ef47c0, ftCreationTime.dwHighDateTime=0x1d4d418, ftLastAccessTime.dwLowDateTime=0x7f10e0, ftLastAccessTime.dwHighDateTime=0x1d4cc7e, ftLastWriteTime.dwLowDateTime=0x7f10e0, ftLastWriteTime.dwHighDateTime=0x1d4cc7e, nFileSizeHigh=0x0, nFileSizeLow=0x1492e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZCDwg-TeZ_HRVD.mp3", cAlternateFileName="ZCDWG-~1.MP3")) returned 0 [0074.975] FindClose (in: hFindFile=0x69b1e8 | out: hFindFile=0x69b1e8) returned 1 [0074.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea54) returned 1 [0074.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea60) returned 1 [0074.975] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\1QdEBCaFdq8U pK.mp3", nBufferLength=0x105, lpBuffer=0x24e444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\1QdEBCaFdq8U pK.mp3", lpFilePart=0x0) returned 0x48 [0074.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0074.975] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\1QdEBCaFdq8U pK.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lfh_0-8r_aozrmjc\\1qdebcafdq8u pk.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0074.975] GetFileType (hFile=0x26c) returned 0x1 [0074.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e934) returned 1 [0074.976] GetFileType (hFile=0x26c) returned 0x1 [0074.976] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24ea40 | out: lpFileSizeHigh=0x24ea40*=0x0) returned 0xc2f6 [0074.976] ReadFile (in: hFile=0x26c, lpBuffer=0x2a5b9e4, nNumberOfBytesToRead=0xc2f6, lpNumberOfBytesRead=0x24e9ec, lpOverlapped=0x0 | out: lpBuffer=0x2a5b9e4*, lpNumberOfBytesRead=0x24e9ec*=0xc2f6, lpOverlapped=0x0) returned 1 [0075.025] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e558, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0075.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9b8) returned 1 [0075.025] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24ea34 | out: lpFileInformation=0x24ea34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0075.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9b4) returned 1 [0075.025] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\1QdEBCaFdq8U pK.mp3", nBufferLength=0x105, lpBuffer=0x24e430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\1QdEBCaFdq8U pK.mp3", lpFilePart=0x0) returned 0x48 [0075.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e924) returned 1 [0075.025] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\1QdEBCaFdq8U pK.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lfh_0-8r_aozrmjc\\1qdebcafdq8u pk.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.027] GetFileType (hFile=0x26c) returned 0x1 [0075.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e920) returned 1 [0075.027] GetFileType (hFile=0x26c) returned 0x1 [0075.027] WriteFile (in: hFile=0x26c, lpBuffer=0x2acd0e4*, nNumberOfBytesToWrite=0xc300, lpNumberOfBytesWritten=0x24e9e0, lpOverlapped=0x0 | out: lpBuffer=0x2acd0e4*, lpNumberOfBytesWritten=0x24e9e0*=0xc300, lpOverlapped=0x0) returned 1 [0075.028] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\1QdEBCaFdq8U pK.mp3", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\1QdEBCaFdq8U pK.mp3", lpFilePart=0x0) returned 0x48 [0075.028] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\1QdEBCaFdq8U pK.mp3.Crypted", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\1QdEBCaFdq8U pK.mp3.Crypted", lpFilePart=0x0) returned 0x50 [0075.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9c4) returned 1 [0075.029] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\1QdEBCaFdq8U pK.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lfh_0-8r_aozrmjc\\1qdebcafdq8u pk.mp3"), fInfoLevelId=0x0, lpFileInformation=0x24ea40 | out: lpFileInformation=0x24ea40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece0a40, ftCreationTime.dwHighDateTime=0x1d4cf7e, ftLastAccessTime.dwLowDateTime=0xa3f3e890, ftLastAccessTime.dwHighDateTime=0x1d4cd91, ftLastWriteTime.dwLowDateTime=0xfd9bd4b0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xc300)) returned 1 [0075.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9c0) returned 1 [0075.029] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\1QdEBCaFdq8U pK.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lfh_0-8r_aozrmjc\\1qdebcafdq8u pk.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\1QdEBCaFdq8U pK.mp3.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lfh_0-8r_aozrmjc\\1qdebcafdq8u pk.mp3.crypted")) returned 1 [0075.029] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\5d SQJz5_wuih9jRXd.mp3", nBufferLength=0x105, lpBuffer=0x24e444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\5d SQJz5_wuih9jRXd.mp3", lpFilePart=0x0) returned 0x4b [0075.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0075.029] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\5d SQJz5_wuih9jRXd.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lfh_0-8r_aozrmjc\\5d sqjz5_wuih9jrxd.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.030] GetFileType (hFile=0x26c) returned 0x1 [0075.030] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e934) returned 1 [0075.030] GetFileType (hFile=0x26c) returned 0x1 [0075.030] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24ea40 | out: lpFileSizeHigh=0x24ea40*=0x0) returned 0x7f32 [0075.030] ReadFile (in: hFile=0x26c, lpBuffer=0x2ad9a10, nNumberOfBytesToRead=0x7f32, lpNumberOfBytesRead=0x24e9ec, lpOverlapped=0x0 | out: lpBuffer=0x2ad9a10*, lpNumberOfBytesRead=0x24e9ec*=0x7f32, lpOverlapped=0x0) returned 1 [0075.089] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e558, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0075.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9b8) returned 1 [0075.090] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24ea34 | out: lpFileInformation=0x24ea34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0075.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9b4) returned 1 [0075.090] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\5d SQJz5_wuih9jRXd.mp3", nBufferLength=0x105, lpBuffer=0x24e430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\5d SQJz5_wuih9jRXd.mp3", lpFilePart=0x0) returned 0x4b [0075.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e924) returned 1 [0075.090] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\5d SQJz5_wuih9jRXd.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lfh_0-8r_aozrmjc\\5d sqjz5_wuih9jrxd.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.091] GetFileType (hFile=0x26c) returned 0x1 [0075.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e920) returned 1 [0075.091] GetFileType (hFile=0x26c) returned 0x1 [0075.091] WriteFile (in: hFile=0x26c, lpBuffer=0x27a0408*, nNumberOfBytesToWrite=0x7f40, lpNumberOfBytesWritten=0x24e9e0, lpOverlapped=0x0 | out: lpBuffer=0x27a0408*, lpNumberOfBytesWritten=0x24e9e0*=0x7f40, lpOverlapped=0x0) returned 1 [0075.092] CloseHandle (hObject=0x26c) returned 1 [0075.101] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\5d SQJz5_wuih9jRXd.mp3", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\5d SQJz5_wuih9jRXd.mp3", lpFilePart=0x0) returned 0x4b [0075.101] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\5d SQJz5_wuih9jRXd.mp3.Crypted", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\5d SQJz5_wuih9jRXd.mp3.Crypted", lpFilePart=0x0) returned 0x53 [0075.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9c4) returned 1 [0075.101] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\5d SQJz5_wuih9jRXd.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lfh_0-8r_aozrmjc\\5d sqjz5_wuih9jrxd.mp3"), fInfoLevelId=0x0, lpFileInformation=0x24ea40 | out: lpFileInformation=0x24ea40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2aa8ae0, ftCreationTime.dwHighDateTime=0x1d4ca09, ftLastAccessTime.dwLowDateTime=0x290b95d0, ftLastAccessTime.dwHighDateTime=0x1d4d0ff, ftLastWriteTime.dwLowDateTime=0xfda7bb90, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x7f40)) returned 1 [0075.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9c0) returned 1 [0075.101] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\5d SQJz5_wuih9jRXd.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lfh_0-8r_aozrmjc\\5d sqjz5_wuih9jrxd.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\5d SQJz5_wuih9jRXd.mp3.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lfh_0-8r_aozrmjc\\5d sqjz5_wuih9jrxd.mp3.crypted")) returned 1 [0075.102] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\a7JaJEttlY__v1f5hP.mp3", nBufferLength=0x105, lpBuffer=0x24e444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\a7JaJEttlY__v1f5hP.mp3", lpFilePart=0x0) returned 0x4b [0075.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0075.102] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\a7JaJEttlY__v1f5hP.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lfh_0-8r_aozrmjc\\a7jajettly__v1f5hp.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.102] GetFileType (hFile=0x26c) returned 0x1 [0075.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e934) returned 1 [0075.102] GetFileType (hFile=0x26c) returned 0x1 [0075.102] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24ea40 | out: lpFileSizeHigh=0x24ea40*=0x0) returned 0x155ca [0075.103] ReadFile (in: hFile=0x26c, lpBuffer=0x3771a50, nNumberOfBytesToRead=0x155ca, lpNumberOfBytesRead=0x24e9ec, lpOverlapped=0x0 | out: lpBuffer=0x3771a50*, lpNumberOfBytesRead=0x24e9ec*=0x155ca, lpOverlapped=0x0) returned 1 [0075.105] CloseHandle (hObject=0x26c) returned 1 [0075.135] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e558, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0075.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9b8) returned 1 [0075.135] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24ea34 | out: lpFileInformation=0x24ea34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0075.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9b4) returned 1 [0075.135] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\a7JaJEttlY__v1f5hP.mp3", nBufferLength=0x105, lpBuffer=0x24e430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\a7JaJEttlY__v1f5hP.mp3", lpFilePart=0x0) returned 0x4b [0075.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e924) returned 1 [0075.135] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\a7JaJEttlY__v1f5hP.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lfh_0-8r_aozrmjc\\a7jajettly__v1f5hp.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.137] GetFileType (hFile=0x26c) returned 0x1 [0075.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e920) returned 1 [0075.137] GetFileType (hFile=0x26c) returned 0x1 [0075.137] WriteFile (in: hFile=0x26c, lpBuffer=0x37dc798*, nNumberOfBytesToWrite=0x155d0, lpNumberOfBytesWritten=0x24e9e0, lpOverlapped=0x0 | out: lpBuffer=0x37dc798*, lpNumberOfBytesWritten=0x24e9e0*=0x155d0, lpOverlapped=0x0) returned 1 [0075.139] CloseHandle (hObject=0x26c) returned 1 [0075.141] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\a7JaJEttlY__v1f5hP.mp3", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\a7JaJEttlY__v1f5hP.mp3", lpFilePart=0x0) returned 0x4b [0075.141] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\a7JaJEttlY__v1f5hP.mp3.Crypted", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\a7JaJEttlY__v1f5hP.mp3.Crypted", lpFilePart=0x0) returned 0x53 [0075.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9c4) returned 1 [0075.141] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\a7JaJEttlY__v1f5hP.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lfh_0-8r_aozrmjc\\a7jajettly__v1f5hp.mp3"), fInfoLevelId=0x0, lpFileInformation=0x24ea40 | out: lpFileInformation=0x24ea40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bb38700, ftCreationTime.dwHighDateTime=0x1d4c967, ftLastAccessTime.dwLowDateTime=0x1d972460, ftLastAccessTime.dwHighDateTime=0x1d4cb25, ftLastWriteTime.dwLowDateTime=0xfdac7e50, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x155d0)) returned 1 [0075.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9c0) returned 1 [0075.141] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\a7JaJEttlY__v1f5hP.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lfh_0-8r_aozrmjc\\a7jajettly__v1f5hp.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\a7JaJEttlY__v1f5hP.mp3.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lfh_0-8r_aozrmjc\\a7jajettly__v1f5hp.mp3.crypted")) returned 1 [0075.142] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\q4kxPH5AzOF.mp3", nBufferLength=0x105, lpBuffer=0x24e444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\q4kxPH5AzOF.mp3", lpFilePart=0x0) returned 0x44 [0075.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0075.142] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\q4kxPH5AzOF.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lfh_0-8r_aozrmjc\\q4kxph5azof.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.142] GetFileType (hFile=0x26c) returned 0x1 [0075.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e934) returned 1 [0075.142] GetFileType (hFile=0x26c) returned 0x1 [0075.142] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24ea40 | out: lpFileSizeHigh=0x24ea40*=0x0) returned 0x7ad [0075.142] ReadFile (in: hFile=0x26c, lpBuffer=0x27f6708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x24e9ec, lpOverlapped=0x0 | out: lpBuffer=0x27f6708*, lpNumberOfBytesRead=0x24e9ec*=0x7ad, lpOverlapped=0x0) returned 1 [0075.149] CloseHandle (hObject=0x26c) returned 1 [0075.169] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e558, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0075.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9b8) returned 1 [0075.169] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24ea34 | out: lpFileInformation=0x24ea34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0075.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9b4) returned 1 [0075.170] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\q4kxPH5AzOF.mp3", nBufferLength=0x105, lpBuffer=0x24e430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\q4kxPH5AzOF.mp3", lpFilePart=0x0) returned 0x44 [0075.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e924) returned 1 [0075.170] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\q4kxPH5AzOF.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lfh_0-8r_aozrmjc\\q4kxph5azof.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.171] GetFileType (hFile=0x26c) returned 0x1 [0075.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e920) returned 1 [0075.171] GetFileType (hFile=0x26c) returned 0x1 [0075.171] WriteFile (in: hFile=0x26c, lpBuffer=0x2846e2c*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x24e9b4, lpOverlapped=0x0 | out: lpBuffer=0x2846e2c*, lpNumberOfBytesWritten=0x24e9b4*=0x7b0, lpOverlapped=0x0) returned 1 [0075.172] CloseHandle (hObject=0x26c) returned 1 [0075.173] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\q4kxPH5AzOF.mp3", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\q4kxPH5AzOF.mp3", lpFilePart=0x0) returned 0x44 [0075.173] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\q4kxPH5AzOF.mp3.Crypted", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\q4kxPH5AzOF.mp3.Crypted", lpFilePart=0x0) returned 0x4c [0075.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9c4) returned 1 [0075.173] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\q4kxPH5AzOF.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lfh_0-8r_aozrmjc\\q4kxph5azof.mp3"), fInfoLevelId=0x0, lpFileInformation=0x24ea40 | out: lpFileInformation=0x24ea40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8316c0, ftCreationTime.dwHighDateTime=0x1d4d2dc, ftLastAccessTime.dwLowDateTime=0xf18b7b00, ftLastAccessTime.dwHighDateTime=0x1d4d13c, ftLastWriteTime.dwLowDateTime=0xfdb14110, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x7b0)) returned 1 [0075.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9c0) returned 1 [0075.173] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\q4kxPH5AzOF.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lfh_0-8r_aozrmjc\\q4kxph5azof.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\q4kxPH5AzOF.mp3.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lfh_0-8r_aozrmjc\\q4kxph5azof.mp3.crypted")) returned 1 [0075.174] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\ZCDwg-TeZ_HRVD.mp3", nBufferLength=0x105, lpBuffer=0x24e444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\ZCDwg-TeZ_HRVD.mp3", lpFilePart=0x0) returned 0x47 [0075.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0075.174] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\ZCDwg-TeZ_HRVD.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lfh_0-8r_aozrmjc\\zcdwg-tez_hrvd.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.174] GetFileType (hFile=0x26c) returned 0x1 [0075.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e934) returned 1 [0075.174] GetFileType (hFile=0x26c) returned 0x1 [0075.174] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24ea40 | out: lpFileSizeHigh=0x24ea40*=0x0) returned 0x1492e [0075.174] ReadFile (in: hFile=0x26c, lpBuffer=0x2848164, nNumberOfBytesToRead=0x1492e, lpNumberOfBytesRead=0x24e9ec, lpOverlapped=0x0 | out: lpBuffer=0x2848164*, lpNumberOfBytesRead=0x24e9ec*=0x1492e, lpOverlapped=0x0) returned 1 [0075.176] CloseHandle (hObject=0x26c) returned 1 [0075.202] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e558, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0075.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9b8) returned 1 [0075.203] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24ea34 | out: lpFileInformation=0x24ea34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0075.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9b4) returned 1 [0075.203] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\ZCDwg-TeZ_HRVD.mp3", nBufferLength=0x105, lpBuffer=0x24e430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\ZCDwg-TeZ_HRVD.mp3", lpFilePart=0x0) returned 0x47 [0075.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e924) returned 1 [0075.203] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\ZCDwg-TeZ_HRVD.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lfh_0-8r_aozrmjc\\zcdwg-tez_hrvd.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.204] GetFileType (hFile=0x26c) returned 0x1 [0075.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e920) returned 1 [0075.205] GetFileType (hFile=0x26c) returned 0x1 [0075.205] WriteFile (in: hFile=0x26c, lpBuffer=0x28d2af4*, nNumberOfBytesToWrite=0x14930, lpNumberOfBytesWritten=0x24e9e0, lpOverlapped=0x0 | out: lpBuffer=0x28d2af4*, lpNumberOfBytesWritten=0x24e9e0*=0x14930, lpOverlapped=0x0) returned 1 [0075.214] CloseHandle (hObject=0x26c) returned 1 [0075.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\ZCDwg-TeZ_HRVD.mp3", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\ZCDwg-TeZ_HRVD.mp3", lpFilePart=0x0) returned 0x47 [0075.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\ZCDwg-TeZ_HRVD.mp3.Crypted", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\ZCDwg-TeZ_HRVD.mp3.Crypted", lpFilePart=0x0) returned 0x4f [0075.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9c4) returned 1 [0075.215] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\ZCDwg-TeZ_HRVD.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lfh_0-8r_aozrmjc\\zcdwg-tez_hrvd.mp3"), fInfoLevelId=0x0, lpFileInformation=0x24ea40 | out: lpFileInformation=0x24ea40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45ef47c0, ftCreationTime.dwHighDateTime=0x1d4d418, ftLastAccessTime.dwLowDateTime=0x7f10e0, ftLastAccessTime.dwHighDateTime=0x1d4cc7e, ftLastWriteTime.dwLowDateTime=0xfdb86530, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x14930)) returned 1 [0075.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9c0) returned 1 [0075.216] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\ZCDwg-TeZ_HRVD.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lfh_0-8r_aozrmjc\\zcdwg-tez_hrvd.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\ZCDwg-TeZ_HRVD.mp3.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lfh_0-8r_aozrmjc\\zcdwg-tez_hrvd.mp3.crypted")) returned 1 [0075.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea20) returned 1 [0075.216] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\gxW9AsIS4P5HAOHlUSm", nBufferLength=0x105, lpBuffer=0x24e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\gxW9AsIS4P5HAOHlUSm", lpFilePart=0x0) returned 0x48 [0075.216] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\gxW9AsIS4P5HAOHlUSm\\", nBufferLength=0x105, lpBuffer=0x24e4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\gxW9AsIS4P5HAOHlUSm\\", lpFilePart=0x0) returned 0x49 [0075.217] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\gxW9AsIS4P5HAOHlUSm\\*", lpFindFileData=0x24e748 | out: lpFindFileData=0x24e748*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63adf320, ftCreationTime.dwHighDateTime=0x1d4c909, ftLastAccessTime.dwLowDateTime=0x7c891450, ftLastAccessTime.dwHighDateTime=0x1d4c770, ftLastWriteTime.dwLowDateTime=0x7c891450, ftLastWriteTime.dwHighDateTime=0x1d4c770, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b1a8 [0075.217] FindNextFileW (in: hFindFile=0x69b1a8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63adf320, ftCreationTime.dwHighDateTime=0x1d4c909, ftLastAccessTime.dwLowDateTime=0x7c891450, ftLastAccessTime.dwHighDateTime=0x1d4c770, ftLastWriteTime.dwLowDateTime=0x7c891450, ftLastWriteTime.dwHighDateTime=0x1d4c770, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.217] FindNextFileW (in: hFindFile=0x69b1a8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ecf2e90, ftCreationTime.dwHighDateTime=0x1d4d2cd, ftLastAccessTime.dwLowDateTime=0x3cb765d0, ftLastAccessTime.dwHighDateTime=0x1d4d020, ftLastWriteTime.dwLowDateTime=0x3cb765d0, ftLastWriteTime.dwHighDateTime=0x1d4d020, nFileSizeHigh=0x0, nFileSizeLow=0x53cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="7yET2O.m4a", cAlternateFileName="")) returned 1 [0075.217] FindNextFileW (in: hFindFile=0x69b1a8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xff173830, ftCreationTime.dwHighDateTime=0x1d4d33b, ftLastAccessTime.dwLowDateTime=0x8afb1ed0, ftLastAccessTime.dwHighDateTime=0x1d4cb5c, ftLastWriteTime.dwLowDateTime=0x8afb1ed0, ftLastWriteTime.dwHighDateTime=0x1d4cb5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qrsp3-2NHCNY", cAlternateFileName="QRSP3-~1")) returned 1 [0075.217] FindNextFileW (in: hFindFile=0x69b1a8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xff173830, ftCreationTime.dwHighDateTime=0x1d4d33b, ftLastAccessTime.dwLowDateTime=0x8afb1ed0, ftLastAccessTime.dwHighDateTime=0x1d4cb5c, ftLastWriteTime.dwLowDateTime=0x8afb1ed0, ftLastWriteTime.dwHighDateTime=0x1d4cb5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qrsp3-2NHCNY", cAlternateFileName="QRSP3-~1")) returned 0 [0075.218] FindClose (in: hFindFile=0x69b1a8 | out: hFindFile=0x69b1a8) returned 1 [0075.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9e0) returned 1 [0075.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9ec) returned 1 [0075.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea20) returned 1 [0075.218] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\gxW9AsIS4P5HAOHlUSm", nBufferLength=0x105, lpBuffer=0x24e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\gxW9AsIS4P5HAOHlUSm", lpFilePart=0x0) returned 0x48 [0075.218] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\gxW9AsIS4P5HAOHlUSm\\", nBufferLength=0x105, lpBuffer=0x24e4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\gxW9AsIS4P5HAOHlUSm\\", lpFilePart=0x0) returned 0x49 [0075.218] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\gxW9AsIS4P5HAOHlUSm\\*", lpFindFileData=0x24e748 | out: lpFindFileData=0x24e748*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63adf320, ftCreationTime.dwHighDateTime=0x1d4c909, ftLastAccessTime.dwLowDateTime=0x7c891450, ftLastAccessTime.dwHighDateTime=0x1d4c770, ftLastWriteTime.dwLowDateTime=0x7c891450, ftLastWriteTime.dwHighDateTime=0x1d4c770, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b1a8 [0075.218] FindNextFileW (in: hFindFile=0x69b1a8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63adf320, ftCreationTime.dwHighDateTime=0x1d4c909, ftLastAccessTime.dwLowDateTime=0x7c891450, ftLastAccessTime.dwHighDateTime=0x1d4c770, ftLastWriteTime.dwLowDateTime=0x7c891450, ftLastWriteTime.dwHighDateTime=0x1d4c770, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.218] FindNextFileW (in: hFindFile=0x69b1a8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ecf2e90, ftCreationTime.dwHighDateTime=0x1d4d2cd, ftLastAccessTime.dwLowDateTime=0x3cb765d0, ftLastAccessTime.dwHighDateTime=0x1d4d020, ftLastWriteTime.dwLowDateTime=0x3cb765d0, ftLastWriteTime.dwHighDateTime=0x1d4d020, nFileSizeHigh=0x0, nFileSizeLow=0x53cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="7yET2O.m4a", cAlternateFileName="")) returned 1 [0075.219] FindNextFileW (in: hFindFile=0x69b1a8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xff173830, ftCreationTime.dwHighDateTime=0x1d4d33b, ftLastAccessTime.dwLowDateTime=0x8afb1ed0, ftLastAccessTime.dwHighDateTime=0x1d4cb5c, ftLastWriteTime.dwLowDateTime=0x8afb1ed0, ftLastWriteTime.dwHighDateTime=0x1d4cb5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qrsp3-2NHCNY", cAlternateFileName="QRSP3-~1")) returned 1 [0075.219] FindNextFileW (in: hFindFile=0x69b1a8, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.219] FindClose (in: hFindFile=0x69b1a8 | out: hFindFile=0x69b1a8) returned 1 [0075.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9e0) returned 1 [0075.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9ec) returned 1 [0075.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0075.219] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\gxW9AsIS4P5HAOHlUSm\\qrsp3-2NHCNY", nBufferLength=0x105, lpBuffer=0x24e4b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\gxW9AsIS4P5HAOHlUSm\\qrsp3-2NHCNY", lpFilePart=0x0) returned 0x55 [0075.219] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\gxW9AsIS4P5HAOHlUSm\\qrsp3-2NHCNY\\", nBufferLength=0x105, lpBuffer=0x24e488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\gxW9AsIS4P5HAOHlUSm\\qrsp3-2NHCNY\\", lpFilePart=0x0) returned 0x56 [0075.219] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\gxW9AsIS4P5HAOHlUSm\\qrsp3-2NHCNY\\*", lpFindFileData=0x24e6d4 | out: lpFindFileData=0x24e6d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xff173830, ftCreationTime.dwHighDateTime=0x1d4d33b, ftLastAccessTime.dwLowDateTime=0x8afb1ed0, ftLastAccessTime.dwHighDateTime=0x1d4cb5c, ftLastWriteTime.dwLowDateTime=0x8afb1ed0, ftLastWriteTime.dwHighDateTime=0x1d4cb5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b1a8 [0075.220] FindNextFileW (in: hFindFile=0x69b1a8, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xff173830, ftCreationTime.dwHighDateTime=0x1d4d33b, ftLastAccessTime.dwLowDateTime=0x8afb1ed0, ftLastAccessTime.dwHighDateTime=0x1d4cb5c, ftLastWriteTime.dwLowDateTime=0x8afb1ed0, ftLastWriteTime.dwHighDateTime=0x1d4cb5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.220] FindNextFileW (in: hFindFile=0x69b1a8, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18a78aa0, ftCreationTime.dwHighDateTime=0x1d4d4fb, ftLastAccessTime.dwLowDateTime=0xece71a00, ftLastAccessTime.dwHighDateTime=0x1d4c5e8, ftLastWriteTime.dwLowDateTime=0xece71a00, ftLastWriteTime.dwHighDateTime=0x1d4c5e8, nFileSizeHigh=0x0, nFileSizeLow=0x1510, dwReserved0=0x0, dwReserved1=0x0, cFileName="KClTdTzI02RHFPC.m4a", cAlternateFileName="KCLTDT~1.M4A")) returned 1 [0075.220] FindNextFileW (in: hFindFile=0x69b1a8, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33742a60, ftCreationTime.dwHighDateTime=0x1d4d027, ftLastAccessTime.dwLowDateTime=0xda1ed480, ftLastAccessTime.dwHighDateTime=0x1d4cc5f, ftLastWriteTime.dwLowDateTime=0xda1ed480, ftLastWriteTime.dwHighDateTime=0x1d4cc5f, nFileSizeHigh=0x0, nFileSizeLow=0x2e88, dwReserved0=0x0, dwReserved1=0x0, cFileName="kl8Q3i7Ku.mp3", cAlternateFileName="KL8Q3I~1.MP3")) returned 1 [0075.220] FindNextFileW (in: hFindFile=0x69b1a8, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f6aaa0, ftCreationTime.dwHighDateTime=0x1d4d0ee, ftLastAccessTime.dwLowDateTime=0xc77104d0, ftLastAccessTime.dwHighDateTime=0x1d4d226, ftLastWriteTime.dwLowDateTime=0xc77104d0, ftLastWriteTime.dwHighDateTime=0x1d4d226, nFileSizeHigh=0x0, nFileSizeLow=0xdde1, dwReserved0=0x0, dwReserved1=0x0, cFileName="s3hY0YJvNZ.m4a", cAlternateFileName="S3HY0Y~1.M4A")) returned 1 [0075.220] FindNextFileW (in: hFindFile=0x69b1a8, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x373eaf0, ftCreationTime.dwHighDateTime=0x1d4d552, ftLastAccessTime.dwLowDateTime=0x884304c0, ftLastAccessTime.dwHighDateTime=0x1d4c81c, ftLastWriteTime.dwLowDateTime=0x884304c0, ftLastWriteTime.dwHighDateTime=0x1d4c81c, nFileSizeHigh=0x0, nFileSizeLow=0x1b0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="tiR6Gocn.m4a", cAlternateFileName="")) returned 1 [0075.220] FindNextFileW (in: hFindFile=0x69b1a8, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.221] FindClose (in: hFindFile=0x69b1a8 | out: hFindFile=0x69b1a8) returned 1 [0075.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e96c) returned 1 [0075.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e978) returned 1 [0075.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0075.221] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\gxW9AsIS4P5HAOHlUSm\\qrsp3-2NHCNY", nBufferLength=0x105, lpBuffer=0x24e4b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\gxW9AsIS4P5HAOHlUSm\\qrsp3-2NHCNY", lpFilePart=0x0) returned 0x55 [0075.221] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\gxW9AsIS4P5HAOHlUSm\\qrsp3-2NHCNY\\", nBufferLength=0x105, lpBuffer=0x24e488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\gxW9AsIS4P5HAOHlUSm\\qrsp3-2NHCNY\\", lpFilePart=0x0) returned 0x56 [0075.221] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\gxW9AsIS4P5HAOHlUSm\\qrsp3-2NHCNY\\*", lpFindFileData=0x24e6d4 | out: lpFindFileData=0x24e6d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xff173830, ftCreationTime.dwHighDateTime=0x1d4d33b, ftLastAccessTime.dwLowDateTime=0x8afb1ed0, ftLastAccessTime.dwHighDateTime=0x1d4cb5c, ftLastWriteTime.dwLowDateTime=0x8afb1ed0, ftLastWriteTime.dwHighDateTime=0x1d4cb5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b1a8 [0075.221] FindNextFileW (in: hFindFile=0x69b1a8, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xff173830, ftCreationTime.dwHighDateTime=0x1d4d33b, ftLastAccessTime.dwLowDateTime=0x8afb1ed0, ftLastAccessTime.dwHighDateTime=0x1d4cb5c, ftLastWriteTime.dwLowDateTime=0x8afb1ed0, ftLastWriteTime.dwHighDateTime=0x1d4cb5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.222] FindNextFileW (in: hFindFile=0x69b1a8, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18a78aa0, ftCreationTime.dwHighDateTime=0x1d4d4fb, ftLastAccessTime.dwLowDateTime=0xece71a00, ftLastAccessTime.dwHighDateTime=0x1d4c5e8, ftLastWriteTime.dwLowDateTime=0xece71a00, ftLastWriteTime.dwHighDateTime=0x1d4c5e8, nFileSizeHigh=0x0, nFileSizeLow=0x1510, dwReserved0=0x0, dwReserved1=0x0, cFileName="KClTdTzI02RHFPC.m4a", cAlternateFileName="KCLTDT~1.M4A")) returned 1 [0075.222] FindNextFileW (in: hFindFile=0x69b1a8, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33742a60, ftCreationTime.dwHighDateTime=0x1d4d027, ftLastAccessTime.dwLowDateTime=0xda1ed480, ftLastAccessTime.dwHighDateTime=0x1d4cc5f, ftLastWriteTime.dwLowDateTime=0xda1ed480, ftLastWriteTime.dwHighDateTime=0x1d4cc5f, nFileSizeHigh=0x0, nFileSizeLow=0x2e88, dwReserved0=0x0, dwReserved1=0x0, cFileName="kl8Q3i7Ku.mp3", cAlternateFileName="KL8Q3I~1.MP3")) returned 1 [0075.222] FindNextFileW (in: hFindFile=0x69b1a8, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f6aaa0, ftCreationTime.dwHighDateTime=0x1d4d0ee, ftLastAccessTime.dwLowDateTime=0xc77104d0, ftLastAccessTime.dwHighDateTime=0x1d4d226, ftLastWriteTime.dwLowDateTime=0xc77104d0, ftLastWriteTime.dwHighDateTime=0x1d4d226, nFileSizeHigh=0x0, nFileSizeLow=0xdde1, dwReserved0=0x0, dwReserved1=0x0, cFileName="s3hY0YJvNZ.m4a", cAlternateFileName="S3HY0Y~1.M4A")) returned 1 [0075.222] FindNextFileW (in: hFindFile=0x69b1a8, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x373eaf0, ftCreationTime.dwHighDateTime=0x1d4d552, ftLastAccessTime.dwLowDateTime=0x884304c0, ftLastAccessTime.dwHighDateTime=0x1d4c81c, ftLastWriteTime.dwLowDateTime=0x884304c0, ftLastWriteTime.dwHighDateTime=0x1d4c81c, nFileSizeHigh=0x0, nFileSizeLow=0x1b0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="tiR6Gocn.m4a", cAlternateFileName="")) returned 1 [0075.222] FindNextFileW (in: hFindFile=0x69b1a8, lpFindFileData=0x24e6e4 | out: lpFindFileData=0x24e6e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x373eaf0, ftCreationTime.dwHighDateTime=0x1d4d552, ftLastAccessTime.dwLowDateTime=0x884304c0, ftLastAccessTime.dwHighDateTime=0x1d4c81c, ftLastWriteTime.dwLowDateTime=0x884304c0, ftLastWriteTime.dwHighDateTime=0x1d4c81c, nFileSizeHigh=0x0, nFileSizeLow=0x1b0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="tiR6Gocn.m4a", cAlternateFileName="")) returned 0 [0075.223] FindClose (in: hFindFile=0x69b1a8 | out: hFindFile=0x69b1a8) returned 1 [0075.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e96c) returned 1 [0075.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e978) returned 1 [0075.223] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\gxW9AsIS4P5HAOHlUSm\\qrsp3-2NHCNY\\kl8Q3i7Ku.mp3", nBufferLength=0x105, lpBuffer=0x24e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\gxW9AsIS4P5HAOHlUSm\\qrsp3-2NHCNY\\kl8Q3i7Ku.mp3", lpFilePart=0x0) returned 0x63 [0075.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e850) returned 1 [0075.223] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\gxW9AsIS4P5HAOHlUSm\\qrsp3-2NHCNY\\kl8Q3i7Ku.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lfh_0-8r_aozrmjc\\gxw9asis4p5haohlusm\\qrsp3-2nhcny\\kl8q3i7ku.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.223] GetFileType (hFile=0x26c) returned 0x1 [0075.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e84c) returned 1 [0075.223] GetFileType (hFile=0x26c) returned 0x1 [0075.223] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24e958 | out: lpFileSizeHigh=0x24e958*=0x0) returned 0x2e88 [0075.224] ReadFile (in: hFile=0x26c, lpBuffer=0x28ec3e8, nNumberOfBytesToRead=0x2e88, lpNumberOfBytesRead=0x24e904, lpOverlapped=0x0 | out: lpBuffer=0x28ec3e8*, lpNumberOfBytesRead=0x24e904*=0x2e88, lpOverlapped=0x0) returned 1 [0075.226] CloseHandle (hObject=0x26c) returned 1 [0075.268] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0075.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8d0) returned 1 [0075.268] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24e94c | out: lpFileInformation=0x24e94c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0075.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8cc) returned 1 [0075.269] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\gxW9AsIS4P5HAOHlUSm\\qrsp3-2NHCNY\\kl8Q3i7Ku.mp3", nBufferLength=0x105, lpBuffer=0x24e348, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\gxW9AsIS4P5HAOHlUSm\\qrsp3-2NHCNY\\kl8Q3i7Ku.mp3", lpFilePart=0x0) returned 0x63 [0075.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e83c) returned 1 [0075.269] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\gxW9AsIS4P5HAOHlUSm\\qrsp3-2NHCNY\\kl8Q3i7Ku.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lfh_0-8r_aozrmjc\\gxw9asis4p5haohlusm\\qrsp3-2nhcny\\kl8q3i7ku.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.269] GetFileType (hFile=0x26c) returned 0x1 [0075.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e838) returned 1 [0075.269] GetFileType (hFile=0x26c) returned 0x1 [0075.269] WriteFile (in: hFile=0x26c, lpBuffer=0x2947aa0*, nNumberOfBytesToWrite=0x2e90, lpNumberOfBytesWritten=0x24e8f8, lpOverlapped=0x0 | out: lpBuffer=0x2947aa0*, lpNumberOfBytesWritten=0x24e8f8*=0x2e90, lpOverlapped=0x0) returned 1 [0075.270] CloseHandle (hObject=0x26c) returned 1 [0075.273] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\gxW9AsIS4P5HAOHlUSm\\qrsp3-2NHCNY\\kl8Q3i7Ku.mp3", nBufferLength=0x105, lpBuffer=0x24e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\gxW9AsIS4P5HAOHlUSm\\qrsp3-2NHCNY\\kl8Q3i7Ku.mp3", lpFilePart=0x0) returned 0x63 [0075.273] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\gxW9AsIS4P5HAOHlUSm\\qrsp3-2NHCNY\\kl8Q3i7Ku.mp3.Crypted", nBufferLength=0x105, lpBuffer=0x24e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\gxW9AsIS4P5HAOHlUSm\\qrsp3-2NHCNY\\kl8Q3i7Ku.mp3.Crypted", lpFilePart=0x0) returned 0x6b [0075.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8dc) returned 1 [0075.273] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\gxW9AsIS4P5HAOHlUSm\\qrsp3-2NHCNY\\kl8Q3i7Ku.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lfh_0-8r_aozrmjc\\gxw9asis4p5haohlusm\\qrsp3-2nhcny\\kl8q3i7ku.mp3"), fInfoLevelId=0x0, lpFileInformation=0x24e958 | out: lpFileInformation=0x24e958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33742a60, ftCreationTime.dwHighDateTime=0x1d4d027, ftLastAccessTime.dwLowDateTime=0xda1ed480, ftLastAccessTime.dwHighDateTime=0x1d4cc5f, ftLastWriteTime.dwLowDateTime=0xfdc1eab0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x2e90)) returned 1 [0075.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8d8) returned 1 [0075.274] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\gxW9AsIS4P5HAOHlUSm\\qrsp3-2NHCNY\\kl8Q3i7Ku.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lfh_0-8r_aozrmjc\\gxw9asis4p5haohlusm\\qrsp3-2nhcny\\kl8q3i7ku.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\lFh_0-8r_AOzRmJc\\gxW9AsIS4P5HAOHlUSm\\qrsp3-2NHCNY\\kl8Q3i7Ku.mp3.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\lfh_0-8r_aozrmjc\\gxw9asis4p5haohlusm\\qrsp3-2nhcny\\kl8q3i7ku.mp3.crypted")) returned 1 [0075.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0075.275] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb", lpFilePart=0x0) returned 0x2d [0075.275] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\", lpFilePart=0x0) returned 0x2e [0075.276] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb7250, ftCreationTime.dwHighDateTime=0x1d4cf55, ftLastAccessTime.dwLowDateTime=0x30477c80, ftLastAccessTime.dwHighDateTime=0x1d4c8c9, ftLastWriteTime.dwLowDateTime=0x30477c80, ftLastWriteTime.dwHighDateTime=0x1d4c8c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b3e8 [0075.276] FindNextFileW (in: hFindFile=0x69b3e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb7250, ftCreationTime.dwHighDateTime=0x1d4cf55, ftLastAccessTime.dwLowDateTime=0x30477c80, ftLastAccessTime.dwHighDateTime=0x1d4c8c9, ftLastWriteTime.dwLowDateTime=0x30477c80, ftLastWriteTime.dwHighDateTime=0x1d4c8c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.276] FindNextFileW (in: hFindFile=0x69b3e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53d4ced0, ftCreationTime.dwHighDateTime=0x1d4d163, ftLastAccessTime.dwLowDateTime=0x2e4d5c80, ftLastAccessTime.dwHighDateTime=0x1d4c750, ftLastWriteTime.dwLowDateTime=0x2e4d5c80, ftLastWriteTime.dwHighDateTime=0x1d4c750, nFileSizeHigh=0x0, nFileSizeLow=0x14c78, dwReserved0=0x0, dwReserved1=0x0, cFileName="409RR n8oo_GjOOQB0Vp.wav", cAlternateFileName="409RRN~1.WAV")) returned 1 [0075.276] FindNextFileW (in: hFindFile=0x69b3e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20bb9ae0, ftCreationTime.dwHighDateTime=0x1d4d4b2, ftLastAccessTime.dwLowDateTime=0xa95b75e0, ftLastAccessTime.dwHighDateTime=0x1d4d42c, ftLastWriteTime.dwLowDateTime=0xa95b75e0, ftLastWriteTime.dwHighDateTime=0x1d4d42c, nFileSizeHigh=0x0, nFileSizeLow=0x45c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="6ZEisCRVCvympfV.mp3", cAlternateFileName="6ZEISC~1.MP3")) returned 1 [0075.276] FindNextFileW (in: hFindFile=0x69b3e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1462a8f0, ftCreationTime.dwHighDateTime=0x1d4d3d2, ftLastAccessTime.dwLowDateTime=0x572888b0, ftLastAccessTime.dwHighDateTime=0x1d4cf29, ftLastWriteTime.dwLowDateTime=0x572888b0, ftLastWriteTime.dwHighDateTime=0x1d4cf29, nFileSizeHigh=0x0, nFileSizeLow=0xd9a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="8BLnYSh83GxA-9.mp3", cAlternateFileName="8BLNYS~1.MP3")) returned 1 [0075.277] FindNextFileW (in: hFindFile=0x69b3e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fe6fe60, ftCreationTime.dwHighDateTime=0x1d4c747, ftLastAccessTime.dwLowDateTime=0x19e689a0, ftLastAccessTime.dwHighDateTime=0x1d4c5ad, ftLastWriteTime.dwLowDateTime=0x19e689a0, ftLastWriteTime.dwHighDateTime=0x1d4c5ad, nFileSizeHigh=0x0, nFileSizeLow=0x1581a, dwReserved0=0x0, dwReserved1=0x0, cFileName="elwER4Fihjs.m4a", cAlternateFileName="ELWER4~1.M4A")) returned 1 [0075.277] FindNextFileW (in: hFindFile=0x69b3e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a6cdc30, ftCreationTime.dwHighDateTime=0x1d4caac, ftLastAccessTime.dwLowDateTime=0xefd65c60, ftLastAccessTime.dwHighDateTime=0x1d4c8f6, ftLastWriteTime.dwLowDateTime=0xefd65c60, ftLastWriteTime.dwHighDateTime=0x1d4c8f6, nFileSizeHigh=0x0, nFileSizeLow=0x8d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fa5Lxj8W0.mp3", cAlternateFileName="FA5LXJ~1.MP3")) returned 1 [0075.277] FindNextFileW (in: hFindFile=0x69b3e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac179c0, ftCreationTime.dwHighDateTime=0x1d4d537, ftLastAccessTime.dwLowDateTime=0x2b44d200, ftLastAccessTime.dwHighDateTime=0x1d4cce3, ftLastWriteTime.dwLowDateTime=0x2b44d200, ftLastWriteTime.dwHighDateTime=0x1d4cce3, nFileSizeHigh=0x0, nFileSizeLow=0x11243, dwReserved0=0x0, dwReserved1=0x0, cFileName="h-dZPS6mkEMwP4.m4a", cAlternateFileName="H-DZPS~1.M4A")) returned 1 [0075.277] FindNextFileW (in: hFindFile=0x69b3e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91349950, ftCreationTime.dwHighDateTime=0x1d4cd9d, ftLastAccessTime.dwLowDateTime=0xed20e7e0, ftLastAccessTime.dwHighDateTime=0x1d4d500, ftLastWriteTime.dwLowDateTime=0xed20e7e0, ftLastWriteTime.dwHighDateTime=0x1d4d500, nFileSizeHigh=0x0, nFileSizeLow=0x16bc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEYgHQTTHHl7TYSV.wav", cAlternateFileName="IEYGHQ~1.WAV")) returned 1 [0075.277] FindNextFileW (in: hFindFile=0x69b3e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c194fd0, ftCreationTime.dwHighDateTime=0x1d4d33b, ftLastAccessTime.dwLowDateTime=0x3d765ed0, ftLastAccessTime.dwHighDateTime=0x1d4c7b6, ftLastWriteTime.dwLowDateTime=0x3d765ed0, ftLastWriteTime.dwHighDateTime=0x1d4c7b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LTXKegxxg", cAlternateFileName="LTXKEG~1")) returned 1 [0075.278] FindNextFileW (in: hFindFile=0x69b3e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59b1abb0, ftCreationTime.dwHighDateTime=0x1d4cd54, ftLastAccessTime.dwLowDateTime=0xd27099d0, ftLastAccessTime.dwHighDateTime=0x1d4cffc, ftLastWriteTime.dwLowDateTime=0xd27099d0, ftLastWriteTime.dwHighDateTime=0x1d4cffc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qYMeccuC6Z0KcUCkD1", cAlternateFileName="QYMECC~1")) returned 1 [0075.278] FindNextFileW (in: hFindFile=0x69b3e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5164450, ftCreationTime.dwHighDateTime=0x1d4d560, ftLastAccessTime.dwLowDateTime=0x4a3505e0, ftLastAccessTime.dwHighDateTime=0x1d4d517, ftLastWriteTime.dwLowDateTime=0x4a3505e0, ftLastWriteTime.dwHighDateTime=0x1d4d517, nFileSizeHigh=0x0, nFileSizeLow=0x5f38, dwReserved0=0x0, dwReserved1=0x0, cFileName="yN9QTx2FRCVDE.m4a", cAlternateFileName="YN9QTX~1.M4A")) returned 1 [0075.278] FindNextFileW (in: hFindFile=0x69b3e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.278] FindClose (in: hFindFile=0x69b3e8 | out: hFindFile=0x69b3e8) returned 1 [0075.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea54) returned 1 [0075.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea60) returned 1 [0075.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0075.279] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb", lpFilePart=0x0) returned 0x2d [0075.279] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\", lpFilePart=0x0) returned 0x2e [0075.279] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb7250, ftCreationTime.dwHighDateTime=0x1d4cf55, ftLastAccessTime.dwLowDateTime=0x30477c80, ftLastAccessTime.dwHighDateTime=0x1d4c8c9, ftLastWriteTime.dwLowDateTime=0x30477c80, ftLastWriteTime.dwHighDateTime=0x1d4c8c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b3e8 [0075.279] FindNextFileW (in: hFindFile=0x69b3e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb7250, ftCreationTime.dwHighDateTime=0x1d4cf55, ftLastAccessTime.dwLowDateTime=0x30477c80, ftLastAccessTime.dwHighDateTime=0x1d4c8c9, ftLastWriteTime.dwLowDateTime=0x30477c80, ftLastWriteTime.dwHighDateTime=0x1d4c8c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.279] FindNextFileW (in: hFindFile=0x69b3e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53d4ced0, ftCreationTime.dwHighDateTime=0x1d4d163, ftLastAccessTime.dwLowDateTime=0x2e4d5c80, ftLastAccessTime.dwHighDateTime=0x1d4c750, ftLastWriteTime.dwLowDateTime=0x2e4d5c80, ftLastWriteTime.dwHighDateTime=0x1d4c750, nFileSizeHigh=0x0, nFileSizeLow=0x14c78, dwReserved0=0x0, dwReserved1=0x0, cFileName="409RR n8oo_GjOOQB0Vp.wav", cAlternateFileName="409RRN~1.WAV")) returned 1 [0075.279] FindNextFileW (in: hFindFile=0x69b3e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20bb9ae0, ftCreationTime.dwHighDateTime=0x1d4d4b2, ftLastAccessTime.dwLowDateTime=0xa95b75e0, ftLastAccessTime.dwHighDateTime=0x1d4d42c, ftLastWriteTime.dwLowDateTime=0xa95b75e0, ftLastWriteTime.dwHighDateTime=0x1d4d42c, nFileSizeHigh=0x0, nFileSizeLow=0x45c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="6ZEisCRVCvympfV.mp3", cAlternateFileName="6ZEISC~1.MP3")) returned 1 [0075.280] FindNextFileW (in: hFindFile=0x69b3e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1462a8f0, ftCreationTime.dwHighDateTime=0x1d4d3d2, ftLastAccessTime.dwLowDateTime=0x572888b0, ftLastAccessTime.dwHighDateTime=0x1d4cf29, ftLastWriteTime.dwLowDateTime=0x572888b0, ftLastWriteTime.dwHighDateTime=0x1d4cf29, nFileSizeHigh=0x0, nFileSizeLow=0xd9a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="8BLnYSh83GxA-9.mp3", cAlternateFileName="8BLNYS~1.MP3")) returned 1 [0075.280] FindNextFileW (in: hFindFile=0x69b3e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fe6fe60, ftCreationTime.dwHighDateTime=0x1d4c747, ftLastAccessTime.dwLowDateTime=0x19e689a0, ftLastAccessTime.dwHighDateTime=0x1d4c5ad, ftLastWriteTime.dwLowDateTime=0x19e689a0, ftLastWriteTime.dwHighDateTime=0x1d4c5ad, nFileSizeHigh=0x0, nFileSizeLow=0x1581a, dwReserved0=0x0, dwReserved1=0x0, cFileName="elwER4Fihjs.m4a", cAlternateFileName="ELWER4~1.M4A")) returned 1 [0075.280] FindNextFileW (in: hFindFile=0x69b3e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a6cdc30, ftCreationTime.dwHighDateTime=0x1d4caac, ftLastAccessTime.dwLowDateTime=0xefd65c60, ftLastAccessTime.dwHighDateTime=0x1d4c8f6, ftLastWriteTime.dwLowDateTime=0xefd65c60, ftLastWriteTime.dwHighDateTime=0x1d4c8f6, nFileSizeHigh=0x0, nFileSizeLow=0x8d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fa5Lxj8W0.mp3", cAlternateFileName="FA5LXJ~1.MP3")) returned 1 [0075.280] FindNextFileW (in: hFindFile=0x69b3e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac179c0, ftCreationTime.dwHighDateTime=0x1d4d537, ftLastAccessTime.dwLowDateTime=0x2b44d200, ftLastAccessTime.dwHighDateTime=0x1d4cce3, ftLastWriteTime.dwLowDateTime=0x2b44d200, ftLastWriteTime.dwHighDateTime=0x1d4cce3, nFileSizeHigh=0x0, nFileSizeLow=0x11243, dwReserved0=0x0, dwReserved1=0x0, cFileName="h-dZPS6mkEMwP4.m4a", cAlternateFileName="H-DZPS~1.M4A")) returned 1 [0075.281] FindNextFileW (in: hFindFile=0x69b3e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91349950, ftCreationTime.dwHighDateTime=0x1d4cd9d, ftLastAccessTime.dwLowDateTime=0xed20e7e0, ftLastAccessTime.dwHighDateTime=0x1d4d500, ftLastWriteTime.dwLowDateTime=0xed20e7e0, ftLastWriteTime.dwHighDateTime=0x1d4d500, nFileSizeHigh=0x0, nFileSizeLow=0x16bc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEYgHQTTHHl7TYSV.wav", cAlternateFileName="IEYGHQ~1.WAV")) returned 1 [0075.281] FindNextFileW (in: hFindFile=0x69b3e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c194fd0, ftCreationTime.dwHighDateTime=0x1d4d33b, ftLastAccessTime.dwLowDateTime=0x3d765ed0, ftLastAccessTime.dwHighDateTime=0x1d4c7b6, ftLastWriteTime.dwLowDateTime=0x3d765ed0, ftLastWriteTime.dwHighDateTime=0x1d4c7b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LTXKegxxg", cAlternateFileName="LTXKEG~1")) returned 1 [0075.281] FindNextFileW (in: hFindFile=0x69b3e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59b1abb0, ftCreationTime.dwHighDateTime=0x1d4cd54, ftLastAccessTime.dwLowDateTime=0xd27099d0, ftLastAccessTime.dwHighDateTime=0x1d4cffc, ftLastWriteTime.dwLowDateTime=0xd27099d0, ftLastWriteTime.dwHighDateTime=0x1d4cffc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qYMeccuC6Z0KcUCkD1", cAlternateFileName="QYMECC~1")) returned 1 [0075.281] FindNextFileW (in: hFindFile=0x69b3e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5164450, ftCreationTime.dwHighDateTime=0x1d4d560, ftLastAccessTime.dwLowDateTime=0x4a3505e0, ftLastAccessTime.dwHighDateTime=0x1d4d517, ftLastWriteTime.dwLowDateTime=0x4a3505e0, ftLastWriteTime.dwHighDateTime=0x1d4d517, nFileSizeHigh=0x0, nFileSizeLow=0x5f38, dwReserved0=0x0, dwReserved1=0x0, cFileName="yN9QTx2FRCVDE.m4a", cAlternateFileName="YN9QTX~1.M4A")) returned 1 [0075.281] FindNextFileW (in: hFindFile=0x69b3e8, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5164450, ftCreationTime.dwHighDateTime=0x1d4d560, ftLastAccessTime.dwLowDateTime=0x4a3505e0, ftLastAccessTime.dwHighDateTime=0x1d4d517, ftLastWriteTime.dwLowDateTime=0x4a3505e0, ftLastWriteTime.dwHighDateTime=0x1d4d517, nFileSizeHigh=0x0, nFileSizeLow=0x5f38, dwReserved0=0x0, dwReserved1=0x0, cFileName="yN9QTx2FRCVDE.m4a", cAlternateFileName="YN9QTX~1.M4A")) returned 0 [0075.282] FindClose (in: hFindFile=0x69b3e8 | out: hFindFile=0x69b3e8) returned 1 [0075.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea54) returned 1 [0075.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea60) returned 1 [0075.282] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\6ZEisCRVCvympfV.mp3", nBufferLength=0x105, lpBuffer=0x24e444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\6ZEisCRVCvympfV.mp3", lpFilePart=0x0) returned 0x41 [0075.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0075.282] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\6ZEisCRVCvympfV.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\va44ujdrb\\6zeiscrvcvympfv.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.282] GetFileType (hFile=0x26c) returned 0x1 [0075.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e934) returned 1 [0075.282] GetFileType (hFile=0x26c) returned 0x1 [0075.283] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24ea40 | out: lpFileSizeHigh=0x24ea40*=0x0) returned 0x45c9 [0075.283] ReadFile (in: hFile=0x26c, lpBuffer=0x294e310, nNumberOfBytesToRead=0x45c9, lpNumberOfBytesRead=0x24e9ec, lpOverlapped=0x0 | out: lpBuffer=0x294e310*, lpNumberOfBytesRead=0x24e9ec*=0x45c9, lpOverlapped=0x0) returned 1 [0075.290] CloseHandle (hObject=0x26c) returned 1 [0075.345] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e558, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0075.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9b8) returned 1 [0075.345] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24ea34 | out: lpFileInformation=0x24ea34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0075.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9b4) returned 1 [0075.345] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\6ZEisCRVCvympfV.mp3", nBufferLength=0x105, lpBuffer=0x24e430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\6ZEisCRVCvympfV.mp3", lpFilePart=0x0) returned 0x41 [0075.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e924) returned 1 [0075.346] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\6ZEisCRVCvympfV.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\va44ujdrb\\6zeiscrvcvympfv.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.347] GetFileType (hFile=0x26c) returned 0x1 [0075.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e920) returned 1 [0075.347] GetFileType (hFile=0x26c) returned 0x1 [0075.347] WriteFile (in: hFile=0x26c, lpBuffer=0x27c4100*, nNumberOfBytesToWrite=0x45d0, lpNumberOfBytesWritten=0x24e9e0, lpOverlapped=0x0 | out: lpBuffer=0x27c4100*, lpNumberOfBytesWritten=0x24e9e0*=0x45d0, lpOverlapped=0x0) returned 1 [0075.349] CloseHandle (hObject=0x26c) returned 1 [0075.352] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\6ZEisCRVCvympfV.mp3", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\6ZEisCRVCvympfV.mp3", lpFilePart=0x0) returned 0x41 [0075.352] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\6ZEisCRVCvympfV.mp3.Crypted", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\6ZEisCRVCvympfV.mp3.Crypted", lpFilePart=0x0) returned 0x49 [0075.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9c4) returned 1 [0075.353] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\6ZEisCRVCvympfV.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\va44ujdrb\\6zeiscrvcvympfv.mp3"), fInfoLevelId=0x0, lpFileInformation=0x24ea40 | out: lpFileInformation=0x24ea40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20bb9ae0, ftCreationTime.dwHighDateTime=0x1d4d4b2, ftLastAccessTime.dwLowDateTime=0xa95b75e0, ftLastAccessTime.dwHighDateTime=0x1d4d42c, ftLastWriteTime.dwLowDateTime=0xfdcdd190, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x45d0)) returned 1 [0075.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9c0) returned 1 [0075.353] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\6ZEisCRVCvympfV.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\va44ujdrb\\6zeiscrvcvympfv.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\6ZEisCRVCvympfV.mp3.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\va44ujdrb\\6zeiscrvcvympfv.mp3.crypted")) returned 1 [0075.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\8BLnYSh83GxA-9.mp3", nBufferLength=0x105, lpBuffer=0x24e444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\8BLnYSh83GxA-9.mp3", lpFilePart=0x0) returned 0x40 [0075.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0075.353] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\8BLnYSh83GxA-9.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\va44ujdrb\\8blnysh83gxa-9.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.353] GetFileType (hFile=0x26c) returned 0x1 [0075.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e934) returned 1 [0075.353] GetFileType (hFile=0x26c) returned 0x1 [0075.354] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24ea40 | out: lpFileSizeHigh=0x24ea40*=0x0) returned 0xd9a7 [0075.354] ReadFile (in: hFile=0x26c, lpBuffer=0x27c8ca0, nNumberOfBytesToRead=0xd9a7, lpNumberOfBytesRead=0x24e9ec, lpOverlapped=0x0 | out: lpBuffer=0x27c8ca0*, lpNumberOfBytesRead=0x24e9ec*=0xd9a7, lpOverlapped=0x0) returned 1 [0075.357] CloseHandle (hObject=0x26c) returned 1 [0075.372] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e558, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0075.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9b8) returned 1 [0075.372] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24ea34 | out: lpFileInformation=0x24ea34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0075.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9b4) returned 1 [0075.372] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\8BLnYSh83GxA-9.mp3", nBufferLength=0x105, lpBuffer=0x24e430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\8BLnYSh83GxA-9.mp3", lpFilePart=0x0) returned 0x40 [0075.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e924) returned 1 [0075.372] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\8BLnYSh83GxA-9.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\va44ujdrb\\8blnysh83gxa-9.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.373] GetFileType (hFile=0x26c) returned 0x1 [0075.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e920) returned 1 [0075.373] GetFileType (hFile=0x26c) returned 0x1 [0075.373] WriteFile (in: hFile=0x26c, lpBuffer=0x283e90c*, nNumberOfBytesToWrite=0xd9b0, lpNumberOfBytesWritten=0x24e9e0, lpOverlapped=0x0 | out: lpBuffer=0x283e90c*, lpNumberOfBytesWritten=0x24e9e0*=0xd9b0, lpOverlapped=0x0) returned 1 [0075.374] CloseHandle (hObject=0x26c) returned 1 [0075.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\8BLnYSh83GxA-9.mp3", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\8BLnYSh83GxA-9.mp3", lpFilePart=0x0) returned 0x40 [0075.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\8BLnYSh83GxA-9.mp3.Crypted", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\8BLnYSh83GxA-9.mp3.Crypted", lpFilePart=0x0) returned 0x48 [0075.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9c4) returned 1 [0075.376] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\8BLnYSh83GxA-9.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\va44ujdrb\\8blnysh83gxa-9.mp3"), fInfoLevelId=0x0, lpFileInformation=0x24ea40 | out: lpFileInformation=0x24ea40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1462a8f0, ftCreationTime.dwHighDateTime=0x1d4d3d2, ftLastAccessTime.dwLowDateTime=0x572888b0, ftLastAccessTime.dwHighDateTime=0x1d4cf29, ftLastWriteTime.dwLowDateTime=0xfdd032f0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xd9b0)) returned 1 [0075.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9c0) returned 1 [0075.376] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\8BLnYSh83GxA-9.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\va44ujdrb\\8blnysh83gxa-9.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\8BLnYSh83GxA-9.mp3.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\va44ujdrb\\8blnysh83gxa-9.mp3.crypted")) returned 1 [0075.377] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\Fa5Lxj8W0.mp3", nBufferLength=0x105, lpBuffer=0x24e444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\Fa5Lxj8W0.mp3", lpFilePart=0x0) returned 0x3b [0075.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e938) returned 1 [0075.377] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\Fa5Lxj8W0.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\va44ujdrb\\fa5lxj8w0.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.377] GetFileType (hFile=0x26c) returned 0x1 [0075.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e934) returned 1 [0075.377] GetFileType (hFile=0x26c) returned 0x1 [0075.377] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24ea40 | out: lpFileSizeHigh=0x24ea40*=0x0) returned 0x8d86 [0075.377] ReadFile (in: hFile=0x26c, lpBuffer=0x284c88c, nNumberOfBytesToRead=0x8d86, lpNumberOfBytesRead=0x24e9ec, lpOverlapped=0x0 | out: lpBuffer=0x284c88c*, lpNumberOfBytesRead=0x24e9ec*=0x8d86, lpOverlapped=0x0) returned 1 [0075.379] CloseHandle (hObject=0x26c) returned 1 [0075.395] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e558, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0075.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9b8) returned 1 [0075.395] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24ea34 | out: lpFileInformation=0x24ea34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0075.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9b4) returned 1 [0075.395] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\Fa5Lxj8W0.mp3", nBufferLength=0x105, lpBuffer=0x24e430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\Fa5Lxj8W0.mp3", lpFilePart=0x0) returned 0x3b [0075.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e924) returned 1 [0075.395] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\Fa5Lxj8W0.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\va44ujdrb\\fa5lxj8w0.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.396] GetFileType (hFile=0x26c) returned 0x1 [0075.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e920) returned 1 [0075.396] GetFileType (hFile=0x26c) returned 0x1 [0075.396] WriteFile (in: hFile=0x26c, lpBuffer=0x28c5a48*, nNumberOfBytesToWrite=0x8d90, lpNumberOfBytesWritten=0x24e9e0, lpOverlapped=0x0 | out: lpBuffer=0x28c5a48*, lpNumberOfBytesWritten=0x24e9e0*=0x8d90, lpOverlapped=0x0) returned 1 [0075.398] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\Fa5Lxj8W0.mp3", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\Fa5Lxj8W0.mp3", lpFilePart=0x0) returned 0x3b [0075.398] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\Fa5Lxj8W0.mp3.Crypted", nBufferLength=0x105, lpBuffer=0x24e564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\Fa5Lxj8W0.mp3.Crypted", lpFilePart=0x0) returned 0x43 [0075.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9c4) returned 1 [0075.398] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\Fa5Lxj8W0.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\va44ujdrb\\fa5lxj8w0.mp3"), fInfoLevelId=0x0, lpFileInformation=0x24ea40 | out: lpFileInformation=0x24ea40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a6cdc30, ftCreationTime.dwHighDateTime=0x1d4caac, ftLastAccessTime.dwLowDateTime=0xefd65c60, ftLastAccessTime.dwHighDateTime=0x1d4c8f6, ftLastWriteTime.dwLowDateTime=0xfdd4f5b0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x8d90)) returned 1 [0075.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9c0) returned 1 [0075.399] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\Fa5Lxj8W0.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\va44ujdrb\\fa5lxj8w0.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\Fa5Lxj8W0.mp3.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\va44ujdrb\\fa5lxj8w0.mp3.crypted")) returned 1 [0075.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea20) returned 1 [0075.404] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\LTXKegxxg", nBufferLength=0x105, lpBuffer=0x24e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\LTXKegxxg", lpFilePart=0x0) returned 0x37 [0075.404] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\LTXKegxxg\\", nBufferLength=0x105, lpBuffer=0x24e4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\LTXKegxxg\\", lpFilePart=0x0) returned 0x38 [0075.405] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\LTXKegxxg\\*", lpFindFileData=0x24e748 | out: lpFindFileData=0x24e748*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c194fd0, ftCreationTime.dwHighDateTime=0x1d4d33b, ftLastAccessTime.dwLowDateTime=0x3d765ed0, ftLastAccessTime.dwHighDateTime=0x1d4c7b6, ftLastWriteTime.dwLowDateTime=0x3d765ed0, ftLastWriteTime.dwHighDateTime=0x1d4c7b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b368 [0075.405] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c194fd0, ftCreationTime.dwHighDateTime=0x1d4d33b, ftLastAccessTime.dwLowDateTime=0x3d765ed0, ftLastAccessTime.dwHighDateTime=0x1d4c7b6, ftLastWriteTime.dwLowDateTime=0x3d765ed0, ftLastWriteTime.dwHighDateTime=0x1d4c7b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.405] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0576d00, ftCreationTime.dwHighDateTime=0x1d4d103, ftLastAccessTime.dwLowDateTime=0xd4346d80, ftLastAccessTime.dwHighDateTime=0x1d4caa4, ftLastWriteTime.dwLowDateTime=0xd4346d80, ftLastWriteTime.dwHighDateTime=0x1d4caa4, nFileSizeHigh=0x0, nFileSizeLow=0xe28, dwReserved0=0x0, dwReserved1=0x0, cFileName="8OWK7na.wav", cAlternateFileName="")) returned 1 [0075.405] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8be31de0, ftCreationTime.dwHighDateTime=0x1d4c777, ftLastAccessTime.dwLowDateTime=0x4cce6970, ftLastAccessTime.dwHighDateTime=0x1d4cbd7, ftLastWriteTime.dwLowDateTime=0x4cce6970, ftLastWriteTime.dwHighDateTime=0x1d4cbd7, nFileSizeHigh=0x0, nFileSizeLow=0x1838e, dwReserved0=0x0, dwReserved1=0x0, cFileName="dssB8bm.m4a", cAlternateFileName="")) returned 1 [0075.405] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35b36cf0, ftCreationTime.dwHighDateTime=0x1d4cbfe, ftLastAccessTime.dwLowDateTime=0x9df606f0, ftLastAccessTime.dwHighDateTime=0x1d4ce02, ftLastWriteTime.dwLowDateTime=0x9df606f0, ftLastWriteTime.dwHighDateTime=0x1d4ce02, nFileSizeHigh=0x0, nFileSizeLow=0xe972, dwReserved0=0x0, dwReserved1=0x0, cFileName="j9czenTf.m4a", cAlternateFileName="")) returned 1 [0075.405] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b271c00, ftCreationTime.dwHighDateTime=0x1d4cf75, ftLastAccessTime.dwLowDateTime=0x3d190fb0, ftLastAccessTime.dwHighDateTime=0x1d4ca3f, ftLastWriteTime.dwLowDateTime=0x3d190fb0, ftLastWriteTime.dwHighDateTime=0x1d4ca3f, nFileSizeHigh=0x0, nFileSizeLow=0x14a84, dwReserved0=0x0, dwReserved1=0x0, cFileName="M6Ta_I1.wav", cAlternateFileName="")) returned 1 [0075.405] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.406] FindClose (in: hFindFile=0x69b368 | out: hFindFile=0x69b368) returned 1 [0075.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9e0) returned 1 [0075.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9ec) returned 1 [0075.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea20) returned 1 [0075.406] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\LTXKegxxg", nBufferLength=0x105, lpBuffer=0x24e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\LTXKegxxg", lpFilePart=0x0) returned 0x37 [0075.406] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\LTXKegxxg\\", nBufferLength=0x105, lpBuffer=0x24e4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\LTXKegxxg\\", lpFilePart=0x0) returned 0x38 [0075.406] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\LTXKegxxg\\*", lpFindFileData=0x24e748 | out: lpFindFileData=0x24e748*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c194fd0, ftCreationTime.dwHighDateTime=0x1d4d33b, ftLastAccessTime.dwLowDateTime=0x3d765ed0, ftLastAccessTime.dwHighDateTime=0x1d4c7b6, ftLastWriteTime.dwLowDateTime=0x3d765ed0, ftLastWriteTime.dwHighDateTime=0x1d4c7b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b368 [0075.406] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c194fd0, ftCreationTime.dwHighDateTime=0x1d4d33b, ftLastAccessTime.dwLowDateTime=0x3d765ed0, ftLastAccessTime.dwHighDateTime=0x1d4c7b6, ftLastWriteTime.dwLowDateTime=0x3d765ed0, ftLastWriteTime.dwHighDateTime=0x1d4c7b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.406] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0576d00, ftCreationTime.dwHighDateTime=0x1d4d103, ftLastAccessTime.dwLowDateTime=0xd4346d80, ftLastAccessTime.dwHighDateTime=0x1d4caa4, ftLastWriteTime.dwLowDateTime=0xd4346d80, ftLastWriteTime.dwHighDateTime=0x1d4caa4, nFileSizeHigh=0x0, nFileSizeLow=0xe28, dwReserved0=0x0, dwReserved1=0x0, cFileName="8OWK7na.wav", cAlternateFileName="")) returned 1 [0075.406] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8be31de0, ftCreationTime.dwHighDateTime=0x1d4c777, ftLastAccessTime.dwLowDateTime=0x4cce6970, ftLastAccessTime.dwHighDateTime=0x1d4cbd7, ftLastWriteTime.dwLowDateTime=0x4cce6970, ftLastWriteTime.dwHighDateTime=0x1d4cbd7, nFileSizeHigh=0x0, nFileSizeLow=0x1838e, dwReserved0=0x0, dwReserved1=0x0, cFileName="dssB8bm.m4a", cAlternateFileName="")) returned 1 [0075.407] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35b36cf0, ftCreationTime.dwHighDateTime=0x1d4cbfe, ftLastAccessTime.dwLowDateTime=0x9df606f0, ftLastAccessTime.dwHighDateTime=0x1d4ce02, ftLastWriteTime.dwLowDateTime=0x9df606f0, ftLastWriteTime.dwHighDateTime=0x1d4ce02, nFileSizeHigh=0x0, nFileSizeLow=0xe972, dwReserved0=0x0, dwReserved1=0x0, cFileName="j9czenTf.m4a", cAlternateFileName="")) returned 1 [0075.407] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b271c00, ftCreationTime.dwHighDateTime=0x1d4cf75, ftLastAccessTime.dwLowDateTime=0x3d190fb0, ftLastAccessTime.dwHighDateTime=0x1d4ca3f, ftLastWriteTime.dwLowDateTime=0x3d190fb0, ftLastWriteTime.dwHighDateTime=0x1d4ca3f, nFileSizeHigh=0x0, nFileSizeLow=0x14a84, dwReserved0=0x0, dwReserved1=0x0, cFileName="M6Ta_I1.wav", cAlternateFileName="")) returned 1 [0075.407] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b271c00, ftCreationTime.dwHighDateTime=0x1d4cf75, ftLastAccessTime.dwLowDateTime=0x3d190fb0, ftLastAccessTime.dwHighDateTime=0x1d4ca3f, ftLastWriteTime.dwLowDateTime=0x3d190fb0, ftLastWriteTime.dwHighDateTime=0x1d4ca3f, nFileSizeHigh=0x0, nFileSizeLow=0x14a84, dwReserved0=0x0, dwReserved1=0x0, cFileName="M6Ta_I1.wav", cAlternateFileName="")) returned 0 [0075.407] FindClose (in: hFindFile=0x69b368 | out: hFindFile=0x69b368) returned 1 [0075.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9e0) returned 1 [0075.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9ec) returned 1 [0075.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea20) returned 1 [0075.407] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\qYMeccuC6Z0KcUCkD1", nBufferLength=0x105, lpBuffer=0x24e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\qYMeccuC6Z0KcUCkD1", lpFilePart=0x0) returned 0x40 [0075.407] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\qYMeccuC6Z0KcUCkD1\\", nBufferLength=0x105, lpBuffer=0x24e4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\qYMeccuC6Z0KcUCkD1\\", lpFilePart=0x0) returned 0x41 [0075.407] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\qYMeccuC6Z0KcUCkD1\\*", lpFindFileData=0x24e748 | out: lpFindFileData=0x24e748*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59b1abb0, ftCreationTime.dwHighDateTime=0x1d4cd54, ftLastAccessTime.dwLowDateTime=0xd27099d0, ftLastAccessTime.dwHighDateTime=0x1d4cffc, ftLastWriteTime.dwLowDateTime=0xd27099d0, ftLastWriteTime.dwHighDateTime=0x1d4cffc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b368 [0075.408] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59b1abb0, ftCreationTime.dwHighDateTime=0x1d4cd54, ftLastAccessTime.dwLowDateTime=0xd27099d0, ftLastAccessTime.dwHighDateTime=0x1d4cffc, ftLastWriteTime.dwLowDateTime=0xd27099d0, ftLastWriteTime.dwHighDateTime=0x1d4cffc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.408] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38b9bd40, ftCreationTime.dwHighDateTime=0x1d4c65a, ftLastAccessTime.dwLowDateTime=0x94bc1230, ftLastAccessTime.dwHighDateTime=0x1d4cfe9, ftLastWriteTime.dwLowDateTime=0x94bc1230, ftLastWriteTime.dwHighDateTime=0x1d4cfe9, nFileSizeHigh=0x0, nFileSizeLow=0xf994, dwReserved0=0x0, dwReserved1=0x0, cFileName="FchQeGc1vtemrPlF.m4a", cAlternateFileName="FCHQEG~1.M4A")) returned 1 [0075.408] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d3bc30, ftCreationTime.dwHighDateTime=0x1d4d4ac, ftLastAccessTime.dwLowDateTime=0x7a8b860, ftLastAccessTime.dwHighDateTime=0x1d4d34c, ftLastWriteTime.dwLowDateTime=0x7a8b860, ftLastWriteTime.dwHighDateTime=0x1d4d34c, nFileSizeHigh=0x0, nFileSizeLow=0x14fba, dwReserved0=0x0, dwReserved1=0x0, cFileName="g5zOc0.m4a", cAlternateFileName="")) returned 1 [0075.408] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadba8910, ftCreationTime.dwHighDateTime=0x1d4d412, ftLastAccessTime.dwLowDateTime=0x520023b0, ftLastAccessTime.dwHighDateTime=0x1d4d204, ftLastWriteTime.dwLowDateTime=0x520023b0, ftLastWriteTime.dwHighDateTime=0x1d4d204, nFileSizeHigh=0x0, nFileSizeLow=0xd470, dwReserved0=0x0, dwReserved1=0x0, cFileName="I7KafLthUTLvToF.wav", cAlternateFileName="I7KAFL~1.WAV")) returned 1 [0075.408] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e3b9930, ftCreationTime.dwHighDateTime=0x1d4d2d6, ftLastAccessTime.dwLowDateTime=0xd8f92590, ftLastAccessTime.dwHighDateTime=0x1d4d378, ftLastWriteTime.dwLowDateTime=0xd8f92590, ftLastWriteTime.dwHighDateTime=0x1d4d378, nFileSizeHigh=0x0, nFileSizeLow=0xb72b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NKZA0XY6aiHfVG-Q_.mp3", cAlternateFileName="NKZA0X~1.MP3")) returned 1 [0075.408] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc584a260, ftCreationTime.dwHighDateTime=0x1d4d15b, ftLastAccessTime.dwLowDateTime=0x57222020, ftLastAccessTime.dwHighDateTime=0x1d4c983, ftLastWriteTime.dwLowDateTime=0x57222020, ftLastWriteTime.dwHighDateTime=0x1d4c983, nFileSizeHigh=0x0, nFileSizeLow=0xfe5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q8h1tQ.m4a", cAlternateFileName="")) returned 1 [0075.409] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.409] FindClose (in: hFindFile=0x69b368 | out: hFindFile=0x69b368) returned 1 [0075.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9e0) returned 1 [0075.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9ec) returned 1 [0075.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea20) returned 1 [0075.409] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\qYMeccuC6Z0KcUCkD1", nBufferLength=0x105, lpBuffer=0x24e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\qYMeccuC6Z0KcUCkD1", lpFilePart=0x0) returned 0x40 [0075.409] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\qYMeccuC6Z0KcUCkD1\\", nBufferLength=0x105, lpBuffer=0x24e4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\qYMeccuC6Z0KcUCkD1\\", lpFilePart=0x0) returned 0x41 [0075.409] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\qYMeccuC6Z0KcUCkD1\\*", lpFindFileData=0x24e748 | out: lpFindFileData=0x24e748*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59b1abb0, ftCreationTime.dwHighDateTime=0x1d4cd54, ftLastAccessTime.dwLowDateTime=0xd27099d0, ftLastAccessTime.dwHighDateTime=0x1d4cffc, ftLastWriteTime.dwLowDateTime=0xd27099d0, ftLastWriteTime.dwHighDateTime=0x1d4cffc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b368 [0075.409] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59b1abb0, ftCreationTime.dwHighDateTime=0x1d4cd54, ftLastAccessTime.dwLowDateTime=0xd27099d0, ftLastAccessTime.dwHighDateTime=0x1d4cffc, ftLastWriteTime.dwLowDateTime=0xd27099d0, ftLastWriteTime.dwHighDateTime=0x1d4cffc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.409] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38b9bd40, ftCreationTime.dwHighDateTime=0x1d4c65a, ftLastAccessTime.dwLowDateTime=0x94bc1230, ftLastAccessTime.dwHighDateTime=0x1d4cfe9, ftLastWriteTime.dwLowDateTime=0x94bc1230, ftLastWriteTime.dwHighDateTime=0x1d4cfe9, nFileSizeHigh=0x0, nFileSizeLow=0xf994, dwReserved0=0x0, dwReserved1=0x0, cFileName="FchQeGc1vtemrPlF.m4a", cAlternateFileName="FCHQEG~1.M4A")) returned 1 [0075.410] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d3bc30, ftCreationTime.dwHighDateTime=0x1d4d4ac, ftLastAccessTime.dwLowDateTime=0x7a8b860, ftLastAccessTime.dwHighDateTime=0x1d4d34c, ftLastWriteTime.dwLowDateTime=0x7a8b860, ftLastWriteTime.dwHighDateTime=0x1d4d34c, nFileSizeHigh=0x0, nFileSizeLow=0x14fba, dwReserved0=0x0, dwReserved1=0x0, cFileName="g5zOc0.m4a", cAlternateFileName="")) returned 1 [0075.410] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadba8910, ftCreationTime.dwHighDateTime=0x1d4d412, ftLastAccessTime.dwLowDateTime=0x520023b0, ftLastAccessTime.dwHighDateTime=0x1d4d204, ftLastWriteTime.dwLowDateTime=0x520023b0, ftLastWriteTime.dwHighDateTime=0x1d4d204, nFileSizeHigh=0x0, nFileSizeLow=0xd470, dwReserved0=0x0, dwReserved1=0x0, cFileName="I7KafLthUTLvToF.wav", cAlternateFileName="I7KAFL~1.WAV")) returned 1 [0075.410] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e3b9930, ftCreationTime.dwHighDateTime=0x1d4d2d6, ftLastAccessTime.dwLowDateTime=0xd8f92590, ftLastAccessTime.dwHighDateTime=0x1d4d378, ftLastWriteTime.dwLowDateTime=0xd8f92590, ftLastWriteTime.dwHighDateTime=0x1d4d378, nFileSizeHigh=0x0, nFileSizeLow=0xb72b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NKZA0XY6aiHfVG-Q_.mp3", cAlternateFileName="NKZA0X~1.MP3")) returned 1 [0075.410] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc584a260, ftCreationTime.dwHighDateTime=0x1d4d15b, ftLastAccessTime.dwLowDateTime=0x57222020, ftLastAccessTime.dwHighDateTime=0x1d4c983, ftLastWriteTime.dwLowDateTime=0x57222020, ftLastWriteTime.dwHighDateTime=0x1d4c983, nFileSizeHigh=0x0, nFileSizeLow=0xfe5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q8h1tQ.m4a", cAlternateFileName="")) returned 1 [0075.410] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e758 | out: lpFindFileData=0x24e758*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc584a260, ftCreationTime.dwHighDateTime=0x1d4d15b, ftLastAccessTime.dwLowDateTime=0x57222020, ftLastAccessTime.dwHighDateTime=0x1d4c983, ftLastWriteTime.dwLowDateTime=0x57222020, ftLastWriteTime.dwHighDateTime=0x1d4c983, nFileSizeHigh=0x0, nFileSizeLow=0xfe5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q8h1tQ.m4a", cAlternateFileName="")) returned 0 [0075.411] FindClose (in: hFindFile=0x69b368 | out: hFindFile=0x69b368) returned 1 [0075.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9e0) returned 1 [0075.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9ec) returned 1 [0075.411] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\qYMeccuC6Z0KcUCkD1\\NKZA0XY6aiHfVG-Q_.mp3", nBufferLength=0x105, lpBuffer=0x24e3d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\qYMeccuC6Z0KcUCkD1\\NKZA0XY6aiHfVG-Q_.mp3", lpFilePart=0x0) returned 0x56 [0075.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8c4) returned 1 [0075.411] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\qYMeccuC6Z0KcUCkD1\\NKZA0XY6aiHfVG-Q_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\va44ujdrb\\qymeccuc6z0kcuckd1\\nkza0xy6aihfvg-q_.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.411] GetFileType (hFile=0x26c) returned 0x1 [0075.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8c0) returned 1 [0075.411] GetFileType (hFile=0x26c) returned 0x1 [0075.411] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24e9cc | out: lpFileSizeHigh=0x24e9cc*=0x0) returned 0xb72b [0075.411] ReadFile (in: hFile=0x26c, lpBuffer=0x28d3608, nNumberOfBytesToRead=0xb72b, lpNumberOfBytesRead=0x24e978, lpOverlapped=0x0 | out: lpBuffer=0x28d3608*, lpNumberOfBytesRead=0x24e978*=0xb72b, lpOverlapped=0x0) returned 1 [0075.428] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e4e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0075.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e944) returned 1 [0075.428] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24e9c0 | out: lpFileInformation=0x24e9c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0075.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e940) returned 1 [0075.428] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\qYMeccuC6Z0KcUCkD1\\NKZA0XY6aiHfVG-Q_.mp3", nBufferLength=0x105, lpBuffer=0x24e3bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\qYMeccuC6Z0KcUCkD1\\NKZA0XY6aiHfVG-Q_.mp3", lpFilePart=0x0) returned 0x56 [0075.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e8b0) returned 1 [0075.428] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\qYMeccuC6Z0KcUCkD1\\NKZA0XY6aiHfVG-Q_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\va44ujdrb\\qymeccuc6z0kcuckd1\\nkza0xy6aihfvg-q_.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.429] GetFileType (hFile=0x26c) returned 0x1 [0075.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e8ac) returned 1 [0075.429] GetFileType (hFile=0x26c) returned 0x1 [0075.429] WriteFile (in: hFile=0x26c, lpBuffer=0x2942998*, nNumberOfBytesToWrite=0xb730, lpNumberOfBytesWritten=0x24e96c, lpOverlapped=0x0 | out: lpBuffer=0x2942998*, lpNumberOfBytesWritten=0x24e96c*=0xb730, lpOverlapped=0x0) returned 1 [0075.431] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\qYMeccuC6Z0KcUCkD1\\NKZA0XY6aiHfVG-Q_.mp3", nBufferLength=0x105, lpBuffer=0x24e4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\qYMeccuC6Z0KcUCkD1\\NKZA0XY6aiHfVG-Q_.mp3", lpFilePart=0x0) returned 0x56 [0075.431] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\qYMeccuC6Z0KcUCkD1\\NKZA0XY6aiHfVG-Q_.mp3.Crypted", nBufferLength=0x105, lpBuffer=0x24e4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\qYMeccuC6Z0KcUCkD1\\NKZA0XY6aiHfVG-Q_.mp3.Crypted", lpFilePart=0x0) returned 0x5e [0075.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e950) returned 1 [0075.431] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\qYMeccuC6Z0KcUCkD1\\NKZA0XY6aiHfVG-Q_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\va44ujdrb\\qymeccuc6z0kcuckd1\\nkza0xy6aihfvg-q_.mp3"), fInfoLevelId=0x0, lpFileInformation=0x24e9cc | out: lpFileInformation=0x24e9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e3b9930, ftCreationTime.dwHighDateTime=0x1d4d2d6, ftLastAccessTime.dwLowDateTime=0xd8f92590, ftLastAccessTime.dwHighDateTime=0x1d4d378, ftLastWriteTime.dwLowDateTime=0xfdd9b870, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xb730)) returned 1 [0075.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e94c) returned 1 [0075.431] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\qYMeccuC6Z0KcUCkD1\\NKZA0XY6aiHfVG-Q_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\va44ujdrb\\qymeccuc6z0kcuckd1\\nkza0xy6aihfvg-q_.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\va44UjDRb\\qYMeccuC6Z0KcUCkD1\\NKZA0XY6aiHfVG-Q_.mp3.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\va44ujdrb\\qymeccuc6z0kcuckd1\\nkza0xy6aihfvg-q_.mp3.crypted")) returned 1 [0075.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eb08) returned 1 [0075.434] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\OneDrive", nBufferLength=0x105, lpBuffer=0x24e610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\OneDrive", lpFilePart=0x0) returned 0x26 [0075.434] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\OneDrive\\", nBufferLength=0x105, lpBuffer=0x24e5e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\OneDrive\\", lpFilePart=0x0) returned 0x27 [0075.434] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\OneDrive\\*", lpFindFileData=0x24e830 | out: lpFindFileData=0x24e830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eacc) returned 1 [0075.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eb08) returned 1 [0075.436] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games", nBufferLength=0x105, lpBuffer=0x24e610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games", lpFilePart=0x0) returned 0x29 [0075.436] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\", nBufferLength=0x105, lpBuffer=0x24e5e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\", lpFilePart=0x0) returned 0x2a [0075.436] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*", lpFindFileData=0x24e830 | out: lpFindFileData=0x24e830*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69af68 [0075.436] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.436] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0075.436] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.436] FindClose (in: hFindFile=0x69af68 | out: hFindFile=0x69af68) returned 1 [0075.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eac8) returned 1 [0075.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ead4) returned 1 [0075.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eb08) returned 1 [0075.437] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games", nBufferLength=0x105, lpBuffer=0x24e610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games", lpFilePart=0x0) returned 0x29 [0075.437] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\", nBufferLength=0x105, lpBuffer=0x24e5e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\", lpFilePart=0x0) returned 0x2a [0075.437] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*", lpFindFileData=0x24e830 | out: lpFindFileData=0x24e830*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69af68 [0075.437] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.437] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0075.437] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0075.437] FindClose (in: hFindFile=0x69af68 | out: hFindFile=0x69af68) returned 1 [0075.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eac8) returned 1 [0075.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ead4) returned 1 [0075.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eb08) returned 1 [0075.437] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites", nBufferLength=0x105, lpBuffer=0x24e610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites", lpFilePart=0x0) returned 0x27 [0075.437] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", nBufferLength=0x105, lpBuffer=0x24e5e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", lpFilePart=0x0) returned 0x28 [0075.438] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", lpFindFileData=0x24e830 | out: lpFindFileData=0x24e830*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69af68 [0075.440] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.440] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0075.440] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0075.440] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0075.440] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0075.440] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0075.440] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0075.440] FindClose (in: hFindFile=0x69af68 | out: hFindFile=0x69af68) returned 1 [0075.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eac8) returned 1 [0075.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ead4) returned 1 [0075.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eb08) returned 1 [0075.465] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites", nBufferLength=0x105, lpBuffer=0x24e610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites", lpFilePart=0x0) returned 0x27 [0075.465] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", nBufferLength=0x105, lpBuffer=0x24e5e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", lpFilePart=0x0) returned 0x28 [0075.465] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", lpFindFileData=0x24e830 | out: lpFindFileData=0x24e830*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69af68 [0075.466] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.466] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0075.466] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0075.467] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0075.467] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0075.467] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0075.467] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.467] FindClose (in: hFindFile=0x69af68 | out: hFindFile=0x69af68) returned 1 [0075.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eac8) returned 1 [0075.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ead4) returned 1 [0075.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0075.468] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", lpFilePart=0x0) returned 0x2d [0075.468] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\", lpFilePart=0x0) returned 0x2e [0075.468] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69af68 [0075.469] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.470] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0075.470] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Suggested Sites.url", cAlternateFileName="SUGGES~1.URL")) returned 1 [0075.470] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1 [0075.470] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.470] FindClose (in: hFindFile=0x69af68 | out: hFindFile=0x69af68) returned 1 [0075.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea54) returned 1 [0075.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea60) returned 1 [0075.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0075.470] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", lpFilePart=0x0) returned 0x2d [0075.471] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\", lpFilePart=0x0) returned 0x2e [0075.471] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69af68 [0075.471] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.471] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0075.471] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Suggested Sites.url", cAlternateFileName="SUGGES~1.URL")) returned 1 [0075.471] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1 [0075.472] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0 [0075.472] FindClose (in: hFindFile=0x69af68 | out: hFindFile=0x69af68) returned 1 [0075.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea54) returned 1 [0075.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea60) returned 1 [0075.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0075.472] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", lpFilePart=0x0) returned 0x3a [0075.472] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\", lpFilePart=0x0) returned 0x3b [0075.472] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69af68 [0075.525] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.526] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1 [0075.526] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1 [0075.526] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1 [0075.526] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1 [0075.526] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1 [0075.526] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.526] FindClose (in: hFindFile=0x69af68 | out: hFindFile=0x69af68) returned 1 [0075.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea54) returned 1 [0075.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea60) returned 1 [0075.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0075.527] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", lpFilePart=0x0) returned 0x3a [0075.528] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\", lpFilePart=0x0) returned 0x3b [0075.528] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69af68 [0075.529] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.529] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1 [0075.529] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1 [0075.529] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1 [0075.529] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1 [0075.530] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1 [0075.530] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 0 [0075.530] FindClose (in: hFindFile=0x69af68 | out: hFindFile=0x69af68) returned 1 [0075.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea54) returned 1 [0075.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea60) returned 1 [0075.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0075.531] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", lpFilePart=0x0) returned 0x34 [0075.531] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\", lpFilePart=0x0) returned 0x35 [0075.531] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69af68 [0075.533] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.533] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1 [0075.534] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1 [0075.534] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1 [0075.534] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1 [0075.534] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN.url", cAlternateFileName="")) returned 1 [0075.534] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1 [0075.534] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.535] FindClose (in: hFindFile=0x69af68 | out: hFindFile=0x69af68) returned 1 [0075.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea54) returned 1 [0075.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea60) returned 1 [0075.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0075.536] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", lpFilePart=0x0) returned 0x34 [0075.536] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\", lpFilePart=0x0) returned 0x35 [0075.536] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69af68 [0075.537] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.537] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1 [0075.537] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1 [0075.538] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1 [0075.538] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1 [0075.538] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN.url", cAlternateFileName="")) returned 1 [0075.538] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1 [0075.539] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 0 [0075.539] FindClose (in: hFindFile=0x69af68 | out: hFindFile=0x69af68) returned 1 [0075.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea54) returned 1 [0075.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea60) returned 1 [0075.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0075.540] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live", lpFilePart=0x0) returned 0x34 [0075.540] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\", lpFilePart=0x0) returned 0x35 [0075.540] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69af68 [0075.542] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.543] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1 [0075.543] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 1 [0075.543] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 1 [0075.543] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 1 [0075.543] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.543] FindClose (in: hFindFile=0x69af68 | out: hFindFile=0x69af68) returned 1 [0075.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea54) returned 1 [0075.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea60) returned 1 [0075.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0075.544] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live", lpFilePart=0x0) returned 0x34 [0075.545] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\", lpFilePart=0x0) returned 0x35 [0075.545] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69af68 [0075.546] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.546] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1 [0075.546] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 1 [0075.546] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 1 [0075.546] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 1 [0075.547] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0 [0075.547] FindClose (in: hFindFile=0x69af68 | out: hFindFile=0x69af68) returned 1 [0075.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea54) returned 1 [0075.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea60) returned 1 [0075.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eb08) returned 1 [0075.548] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches", nBufferLength=0x105, lpBuffer=0x24e610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches", lpFilePart=0x0) returned 0x26 [0075.548] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\", nBufferLength=0x105, lpBuffer=0x24e5e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\", lpFilePart=0x0) returned 0x27 [0075.548] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*", lpFindFileData=0x24e830 | out: lpFindFileData=0x24e830*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69af68 [0075.553] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.553] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0075.553] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0075.553] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0075.553] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.553] FindClose (in: hFindFile=0x69af68 | out: hFindFile=0x69af68) returned 1 [0075.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eac8) returned 1 [0075.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ead4) returned 1 [0075.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eb08) returned 1 [0075.554] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches", nBufferLength=0x105, lpBuffer=0x24e610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches", lpFilePart=0x0) returned 0x26 [0075.554] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\", nBufferLength=0x105, lpBuffer=0x24e5e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\", lpFilePart=0x0) returned 0x27 [0075.554] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*", lpFindFileData=0x24e830 | out: lpFindFileData=0x24e830*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69af68 [0075.555] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.556] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0075.556] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0075.556] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0075.556] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0 [0075.556] FindClose (in: hFindFile=0x69af68 | out: hFindFile=0x69af68) returned 1 [0075.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eac8) returned 1 [0075.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ead4) returned 1 [0075.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eb08) returned 1 [0075.557] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", nBufferLength=0x105, lpBuffer=0x24e610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", lpFilePart=0x0) returned 0x24 [0075.557] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", nBufferLength=0x105, lpBuffer=0x24e5e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", lpFilePart=0x0) returned 0x25 [0075.557] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*", lpFindFileData=0x24e830 | out: lpFindFileData=0x24e830*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xddc78bc0, ftLastAccessTime.dwHighDateTime=0x1d50efb, ftLastWriteTime.dwLowDateTime=0xddc78bc0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69af68 [0075.558] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xddc78bc0, ftLastAccessTime.dwHighDateTime=0x1d50efb, ftLastWriteTime.dwLowDateTime=0xddc78bc0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.558] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52146080, ftCreationTime.dwHighDateTime=0x1d4cefa, ftLastAccessTime.dwLowDateTime=0x3ba89880, ftLastAccessTime.dwHighDateTime=0x1d4d43f, ftLastWriteTime.dwLowDateTime=0x3ba89880, ftLastWriteTime.dwHighDateTime=0x1d4d43f, nFileSizeHigh=0x0, nFileSizeLow=0xaa93, dwReserved0=0x0, dwReserved1=0x0, cFileName="1aAF.flv", cAlternateFileName="")) returned 1 [0075.558] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x921b32b0, ftCreationTime.dwHighDateTime=0x1d4d546, ftLastAccessTime.dwLowDateTime=0xcce2a80, ftLastAccessTime.dwHighDateTime=0x1d4cd2c, ftLastWriteTime.dwLowDateTime=0xcce2a80, ftLastWriteTime.dwHighDateTime=0x1d4cd2c, nFileSizeHigh=0x0, nFileSizeLow=0x14a23, dwReserved0=0x0, dwReserved1=0x0, cFileName="1IJhi1j.mkv", cAlternateFileName="")) returned 1 [0075.558] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62729cd0, ftCreationTime.dwHighDateTime=0x1d4c770, ftLastAccessTime.dwLowDateTime=0x6349fc70, ftLastAccessTime.dwHighDateTime=0x1d4cb12, ftLastWriteTime.dwLowDateTime=0x6349fc70, ftLastWriteTime.dwHighDateTime=0x1d4cb12, nFileSizeHigh=0x0, nFileSizeLow=0x10fe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="962UBXf64ZGKpgBLTm.flv", cAlternateFileName="962UBX~1.FLV")) returned 1 [0075.558] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x202f5d10, ftCreationTime.dwHighDateTime=0x1d4cfa7, ftLastAccessTime.dwLowDateTime=0xccbe8e80, ftLastAccessTime.dwHighDateTime=0x1d4cd5d, ftLastWriteTime.dwLowDateTime=0xccbe8e80, ftLastWriteTime.dwHighDateTime=0x1d4cd5d, nFileSizeHigh=0x0, nFileSizeLow=0x15f89, dwReserved0=0x0, dwReserved1=0x0, cFileName="9AEAWnWGK9ozVdZvNu__.avi", cAlternateFileName="9AEAWN~1.AVI")) returned 1 [0075.558] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa0aa10, ftCreationTime.dwHighDateTime=0x1d4d0ff, ftLastAccessTime.dwLowDateTime=0xb3325e50, ftLastAccessTime.dwHighDateTime=0x1d4ce5d, ftLastWriteTime.dwLowDateTime=0xb3325e50, ftLastWriteTime.dwHighDateTime=0x1d4ce5d, nFileSizeHigh=0x0, nFileSizeLow=0x16eb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A-nvH4.swf", cAlternateFileName="")) returned 1 [0075.558] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4629170, ftCreationTime.dwHighDateTime=0x1d4c6f1, ftLastAccessTime.dwLowDateTime=0xfb26fef0, ftLastAccessTime.dwHighDateTime=0x1d4d08d, ftLastWriteTime.dwLowDateTime=0xfb26fef0, ftLastWriteTime.dwHighDateTime=0x1d4d08d, nFileSizeHigh=0x0, nFileSizeLow=0x13921, dwReserved0=0x0, dwReserved1=0x0, cFileName="aDoCAdsQh18um3j.flv", cAlternateFileName="ADOCAD~1.FLV")) returned 1 [0075.559] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6078cb90, ftCreationTime.dwHighDateTime=0x1d4c813, ftLastAccessTime.dwLowDateTime=0x514cf970, ftLastAccessTime.dwHighDateTime=0x1d4cbe7, ftLastWriteTime.dwLowDateTime=0x514cf970, ftLastWriteTime.dwHighDateTime=0x1d4cbe7, nFileSizeHigh=0x0, nFileSizeLow=0x162cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="C9iuTMWL.mkv", cAlternateFileName="")) returned 1 [0075.559] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0075.559] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1a9e7a0, ftCreationTime.dwHighDateTime=0x1d4d577, ftLastAccessTime.dwLowDateTime=0xd4363b30, ftLastAccessTime.dwHighDateTime=0x1d4d308, ftLastWriteTime.dwLowDateTime=0xd4363b30, ftLastWriteTime.dwHighDateTime=0x1d4d308, nFileSizeHigh=0x0, nFileSizeLow=0x7329, dwReserved0=0x0, dwReserved1=0x0, cFileName="G0UpBgN4TxB42HiLDRXl.mp4", cAlternateFileName="G0UPBG~1.MP4")) returned 1 [0075.559] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddf897d0, ftCreationTime.dwHighDateTime=0x1d4d3a8, ftLastAccessTime.dwLowDateTime=0x62335990, ftLastAccessTime.dwHighDateTime=0x1d4d1e7, ftLastWriteTime.dwLowDateTime=0x62335990, ftLastWriteTime.dwHighDateTime=0x1d4d1e7, nFileSizeHigh=0x0, nFileSizeLow=0x15e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="gg MR DS.mkv", cAlternateFileName="GGMRDS~1.MKV")) returned 1 [0075.559] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf489f90, ftCreationTime.dwHighDateTime=0x1d4cce6, ftLastAccessTime.dwLowDateTime=0x476fb5a0, ftLastAccessTime.dwHighDateTime=0x1d4c935, ftLastWriteTime.dwLowDateTime=0x476fb5a0, ftLastWriteTime.dwHighDateTime=0x1d4c935, nFileSizeHigh=0x0, nFileSizeLow=0x7921, dwReserved0=0x0, dwReserved1=0x0, cFileName="GVadprR_eGnOi-wmgB.mkv", cAlternateFileName="GVADPR~1.MKV")) returned 1 [0075.559] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b7cd10, ftCreationTime.dwHighDateTime=0x1d4cbba, ftLastAccessTime.dwLowDateTime=0xc13a3e20, ftLastAccessTime.dwHighDateTime=0x1d4c58c, ftLastWriteTime.dwLowDateTime=0xc13a3e20, ftLastWriteTime.dwHighDateTime=0x1d4c58c, nFileSizeHigh=0x0, nFileSizeLow=0xa72c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISFxPLLqSj- snR.swf", cAlternateFileName="ISFXPL~1.SWF")) returned 1 [0075.559] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ecaa0, ftCreationTime.dwHighDateTime=0x1d4d0aa, ftLastAccessTime.dwLowDateTime=0xabe1a070, ftLastAccessTime.dwHighDateTime=0x1d4d3bc, ftLastWriteTime.dwLowDateTime=0xabe1a070, ftLastWriteTime.dwHighDateTime=0x1d4d3bc, nFileSizeHigh=0x0, nFileSizeLow=0x36b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JaIHulCaHs.mkv", cAlternateFileName="JAIHUL~1.MKV")) returned 1 [0075.559] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbb18f0, ftCreationTime.dwHighDateTime=0x1d4d22e, ftLastAccessTime.dwLowDateTime=0xbd739880, ftLastAccessTime.dwHighDateTime=0x1d4cdf8, ftLastWriteTime.dwLowDateTime=0xbd739880, ftLastWriteTime.dwHighDateTime=0x1d4cdf8, nFileSizeHigh=0x0, nFileSizeLow=0x7999, dwReserved0=0x0, dwReserved1=0x0, cFileName="jZ5qqpw.mkv", cAlternateFileName="")) returned 1 [0075.560] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd555ed60, ftCreationTime.dwHighDateTime=0x1d4c8d3, ftLastAccessTime.dwLowDateTime=0xfcffa4a0, ftLastAccessTime.dwHighDateTime=0x1d4c93c, ftLastWriteTime.dwLowDateTime=0xfcffa4a0, ftLastWriteTime.dwHighDateTime=0x1d4c93c, nFileSizeHigh=0x0, nFileSizeLow=0x154ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="ofLa_3t9ZcX.flv", cAlternateFileName="OFLA_3~1.FLV")) returned 1 [0075.560] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12118f0, ftCreationTime.dwHighDateTime=0x1d4d475, ftLastAccessTime.dwLowDateTime=0xf2057b80, ftLastAccessTime.dwHighDateTime=0x1d4cbe2, ftLastWriteTime.dwLowDateTime=0xf2057b80, ftLastWriteTime.dwHighDateTime=0x1d4cbe2, nFileSizeHigh=0x0, nFileSizeLow=0xa571, dwReserved0=0x0, dwReserved1=0x0, cFileName="okgxxKWmbCR-gV uQ.mp4", cAlternateFileName="OKGXXK~1.MP4")) returned 1 [0075.560] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60d3e860, ftCreationTime.dwHighDateTime=0x1d4c91a, ftLastAccessTime.dwLowDateTime=0xe4d8f20, ftLastAccessTime.dwHighDateTime=0x1d4ce4b, ftLastWriteTime.dwLowDateTime=0xe4d8f20, ftLastWriteTime.dwHighDateTime=0x1d4ce4b, nFileSizeHigh=0x0, nFileSizeLow=0x1637f, dwReserved0=0x0, dwReserved1=0x0, cFileName="OYrxw81mV_8Ml1Y0HPwN.mkv", cAlternateFileName="OYRXW8~1.MKV")) returned 1 [0075.560] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31e4eb40, ftCreationTime.dwHighDateTime=0x1d4cc6b, ftLastAccessTime.dwLowDateTime=0x29edf7a0, ftLastAccessTime.dwHighDateTime=0x1d4d351, ftLastWriteTime.dwLowDateTime=0x29edf7a0, ftLastWriteTime.dwHighDateTime=0x1d4d351, nFileSizeHigh=0x0, nFileSizeLow=0x5e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="qjIq1qERjUiHLNlN.mkv", cAlternateFileName="QJIQ1Q~1.MKV")) returned 1 [0075.560] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8165b2e0, ftCreationTime.dwHighDateTime=0x1d4cfd0, ftLastAccessTime.dwLowDateTime=0xb7c9fb50, ftLastAccessTime.dwHighDateTime=0x1d4cc4e, ftLastWriteTime.dwLowDateTime=0xb7c9fb50, ftLastWriteTime.dwHighDateTime=0x1d4cc4e, nFileSizeHigh=0x0, nFileSizeLow=0x3012, dwReserved0=0x0, dwReserved1=0x0, cFileName="rFlA.mp4", cAlternateFileName="")) returned 1 [0075.560] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8714e5d0, ftCreationTime.dwHighDateTime=0x1d4d1b0, ftLastAccessTime.dwLowDateTime=0x4af43820, ftLastAccessTime.dwHighDateTime=0x1d4ce7d, ftLastWriteTime.dwLowDateTime=0x4af43820, ftLastWriteTime.dwHighDateTime=0x1d4ce7d, nFileSizeHigh=0x0, nFileSizeLow=0x15f5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="s1dSGnHiktwyq1.flv", cAlternateFileName="S1DSGN~1.FLV")) returned 1 [0075.560] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ce55b0, ftCreationTime.dwHighDateTime=0x1d4c651, ftLastAccessTime.dwLowDateTime=0x2cff9c20, ftLastAccessTime.dwHighDateTime=0x1d4d02a, ftLastWriteTime.dwLowDateTime=0x2cff9c20, ftLastWriteTime.dwHighDateTime=0x1d4d02a, nFileSizeHigh=0x0, nFileSizeLow=0x18d8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="tCfhU.flv", cAlternateFileName="")) returned 1 [0075.560] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7cc7240, ftCreationTime.dwHighDateTime=0x1d4cf1a, ftLastAccessTime.dwLowDateTime=0x733089a0, ftLastAccessTime.dwHighDateTime=0x1d4d450, ftLastWriteTime.dwLowDateTime=0x733089a0, ftLastWriteTime.dwHighDateTime=0x1d4d450, nFileSizeHigh=0x0, nFileSizeLow=0x9622, dwReserved0=0x0, dwReserved1=0x0, cFileName="veSPbKMeSdRbB.avi", cAlternateFileName="VESPBK~1.AVI")) returned 1 [0075.560] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x241881c0, ftCreationTime.dwHighDateTime=0x1d4c7de, ftLastAccessTime.dwLowDateTime=0xeb881540, ftLastAccessTime.dwHighDateTime=0x1d4c6a3, ftLastWriteTime.dwLowDateTime=0xeb881540, ftLastWriteTime.dwHighDateTime=0x1d4c6a3, nFileSizeHigh=0x0, nFileSizeLow=0x12085, dwReserved0=0x0, dwReserved1=0x0, cFileName="WdN6KwU-j9ZW-gx.avi", cAlternateFileName="WDN6KW~1.AVI")) returned 1 [0075.560] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6db0fb10, ftCreationTime.dwHighDateTime=0x1d4ceb3, ftLastAccessTime.dwLowDateTime=0xc8540d90, ftLastAccessTime.dwHighDateTime=0x1d4d2f1, ftLastWriteTime.dwLowDateTime=0xc8540d90, ftLastWriteTime.dwHighDateTime=0x1d4d2f1, nFileSizeHigh=0x0, nFileSizeLow=0x49cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="XKPZGAxx.swf", cAlternateFileName="")) returned 1 [0075.561] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d65ddb0, ftCreationTime.dwHighDateTime=0x1d4cfeb, ftLastAccessTime.dwLowDateTime=0x884fa130, ftLastAccessTime.dwHighDateTime=0x1d4ca88, ftLastWriteTime.dwLowDateTime=0x884fa130, ftLastWriteTime.dwHighDateTime=0x1d4ca88, nFileSizeHigh=0x0, nFileSizeLow=0x104dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="z2HMXP-ZglSad.mp4", cAlternateFileName="Z2HMXP~1.MP4")) returned 1 [0075.561] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ed851b0, ftCreationTime.dwHighDateTime=0x1d4ca26, ftLastAccessTime.dwLowDateTime=0xfd9a40c0, ftLastAccessTime.dwHighDateTime=0x1d4d4de, ftLastWriteTime.dwLowDateTime=0xfd9a40c0, ftLastWriteTime.dwHighDateTime=0x1d4d4de, nFileSizeHigh=0x0, nFileSizeLow=0x4651, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z2M-GOgcvm3.flv", cAlternateFileName="Z2M-GO~1.FLV")) returned 1 [0075.561] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8f80f0, ftCreationTime.dwHighDateTime=0x1d4c633, ftLastAccessTime.dwLowDateTime=0x7b286700, ftLastAccessTime.dwHighDateTime=0x1d4c66c, ftLastWriteTime.dwLowDateTime=0x7b286700, ftLastWriteTime.dwHighDateTime=0x1d4c66c, nFileSizeHigh=0x0, nFileSizeLow=0xa336, dwReserved0=0x0, dwReserved1=0x0, cFileName="zw1Mn5NX.mkv", cAlternateFileName="")) returned 1 [0075.561] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78678290, ftCreationTime.dwHighDateTime=0x1d4c93b, ftLastAccessTime.dwLowDateTime=0x3ff94920, ftLastAccessTime.dwHighDateTime=0x1d4cbe8, ftLastWriteTime.dwLowDateTime=0x3ff94920, ftLastWriteTime.dwHighDateTime=0x1d4cbe8, nFileSizeHigh=0x0, nFileSizeLow=0x1229c, dwReserved0=0x0, dwReserved1=0x0, cFileName="_hL.swf", cAlternateFileName="")) returned 1 [0075.561] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.561] FindClose (in: hFindFile=0x69af68 | out: hFindFile=0x69af68) returned 1 [0075.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eac8) returned 1 [0075.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ead4) returned 1 [0075.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eb08) returned 1 [0075.561] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", nBufferLength=0x105, lpBuffer=0x24e610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", lpFilePart=0x0) returned 0x24 [0075.561] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", nBufferLength=0x105, lpBuffer=0x24e5e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", lpFilePart=0x0) returned 0x25 [0075.561] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*", lpFindFileData=0x24e830 | out: lpFindFileData=0x24e830*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xddc78bc0, ftLastAccessTime.dwHighDateTime=0x1d50efb, ftLastWriteTime.dwLowDateTime=0xddc78bc0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69af68 [0075.561] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xddc78bc0, ftLastAccessTime.dwHighDateTime=0x1d50efb, ftLastWriteTime.dwLowDateTime=0xddc78bc0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.562] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52146080, ftCreationTime.dwHighDateTime=0x1d4cefa, ftLastAccessTime.dwLowDateTime=0x3ba89880, ftLastAccessTime.dwHighDateTime=0x1d4d43f, ftLastWriteTime.dwLowDateTime=0x3ba89880, ftLastWriteTime.dwHighDateTime=0x1d4d43f, nFileSizeHigh=0x0, nFileSizeLow=0xaa93, dwReserved0=0x0, dwReserved1=0x0, cFileName="1aAF.flv", cAlternateFileName="")) returned 1 [0075.562] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x921b32b0, ftCreationTime.dwHighDateTime=0x1d4d546, ftLastAccessTime.dwLowDateTime=0xcce2a80, ftLastAccessTime.dwHighDateTime=0x1d4cd2c, ftLastWriteTime.dwLowDateTime=0xcce2a80, ftLastWriteTime.dwHighDateTime=0x1d4cd2c, nFileSizeHigh=0x0, nFileSizeLow=0x14a23, dwReserved0=0x0, dwReserved1=0x0, cFileName="1IJhi1j.mkv", cAlternateFileName="")) returned 1 [0075.562] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62729cd0, ftCreationTime.dwHighDateTime=0x1d4c770, ftLastAccessTime.dwLowDateTime=0x6349fc70, ftLastAccessTime.dwHighDateTime=0x1d4cb12, ftLastWriteTime.dwLowDateTime=0x6349fc70, ftLastWriteTime.dwHighDateTime=0x1d4cb12, nFileSizeHigh=0x0, nFileSizeLow=0x10fe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="962UBXf64ZGKpgBLTm.flv", cAlternateFileName="962UBX~1.FLV")) returned 1 [0075.562] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x202f5d10, ftCreationTime.dwHighDateTime=0x1d4cfa7, ftLastAccessTime.dwLowDateTime=0xccbe8e80, ftLastAccessTime.dwHighDateTime=0x1d4cd5d, ftLastWriteTime.dwLowDateTime=0xccbe8e80, ftLastWriteTime.dwHighDateTime=0x1d4cd5d, nFileSizeHigh=0x0, nFileSizeLow=0x15f89, dwReserved0=0x0, dwReserved1=0x0, cFileName="9AEAWnWGK9ozVdZvNu__.avi", cAlternateFileName="9AEAWN~1.AVI")) returned 1 [0075.562] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa0aa10, ftCreationTime.dwHighDateTime=0x1d4d0ff, ftLastAccessTime.dwLowDateTime=0xb3325e50, ftLastAccessTime.dwHighDateTime=0x1d4ce5d, ftLastWriteTime.dwLowDateTime=0xb3325e50, ftLastWriteTime.dwHighDateTime=0x1d4ce5d, nFileSizeHigh=0x0, nFileSizeLow=0x16eb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A-nvH4.swf", cAlternateFileName="")) returned 1 [0075.562] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4629170, ftCreationTime.dwHighDateTime=0x1d4c6f1, ftLastAccessTime.dwLowDateTime=0xfb26fef0, ftLastAccessTime.dwHighDateTime=0x1d4d08d, ftLastWriteTime.dwLowDateTime=0xfb26fef0, ftLastWriteTime.dwHighDateTime=0x1d4d08d, nFileSizeHigh=0x0, nFileSizeLow=0x13921, dwReserved0=0x0, dwReserved1=0x0, cFileName="aDoCAdsQh18um3j.flv", cAlternateFileName="ADOCAD~1.FLV")) returned 1 [0075.562] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6078cb90, ftCreationTime.dwHighDateTime=0x1d4c813, ftLastAccessTime.dwLowDateTime=0x514cf970, ftLastAccessTime.dwHighDateTime=0x1d4cbe7, ftLastWriteTime.dwLowDateTime=0x514cf970, ftLastWriteTime.dwHighDateTime=0x1d4cbe7, nFileSizeHigh=0x0, nFileSizeLow=0x162cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="C9iuTMWL.mkv", cAlternateFileName="")) returned 1 [0075.562] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0075.563] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1a9e7a0, ftCreationTime.dwHighDateTime=0x1d4d577, ftLastAccessTime.dwLowDateTime=0xd4363b30, ftLastAccessTime.dwHighDateTime=0x1d4d308, ftLastWriteTime.dwLowDateTime=0xd4363b30, ftLastWriteTime.dwHighDateTime=0x1d4d308, nFileSizeHigh=0x0, nFileSizeLow=0x7329, dwReserved0=0x0, dwReserved1=0x0, cFileName="G0UpBgN4TxB42HiLDRXl.mp4", cAlternateFileName="G0UPBG~1.MP4")) returned 1 [0075.563] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddf897d0, ftCreationTime.dwHighDateTime=0x1d4d3a8, ftLastAccessTime.dwLowDateTime=0x62335990, ftLastAccessTime.dwHighDateTime=0x1d4d1e7, ftLastWriteTime.dwLowDateTime=0x62335990, ftLastWriteTime.dwHighDateTime=0x1d4d1e7, nFileSizeHigh=0x0, nFileSizeLow=0x15e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="gg MR DS.mkv", cAlternateFileName="GGMRDS~1.MKV")) returned 1 [0075.563] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf489f90, ftCreationTime.dwHighDateTime=0x1d4cce6, ftLastAccessTime.dwLowDateTime=0x476fb5a0, ftLastAccessTime.dwHighDateTime=0x1d4c935, ftLastWriteTime.dwLowDateTime=0x476fb5a0, ftLastWriteTime.dwHighDateTime=0x1d4c935, nFileSizeHigh=0x0, nFileSizeLow=0x7921, dwReserved0=0x0, dwReserved1=0x0, cFileName="GVadprR_eGnOi-wmgB.mkv", cAlternateFileName="GVADPR~1.MKV")) returned 1 [0075.563] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b7cd10, ftCreationTime.dwHighDateTime=0x1d4cbba, ftLastAccessTime.dwLowDateTime=0xc13a3e20, ftLastAccessTime.dwHighDateTime=0x1d4c58c, ftLastWriteTime.dwLowDateTime=0xc13a3e20, ftLastWriteTime.dwHighDateTime=0x1d4c58c, nFileSizeHigh=0x0, nFileSizeLow=0xa72c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISFxPLLqSj- snR.swf", cAlternateFileName="ISFXPL~1.SWF")) returned 1 [0075.563] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ecaa0, ftCreationTime.dwHighDateTime=0x1d4d0aa, ftLastAccessTime.dwLowDateTime=0xabe1a070, ftLastAccessTime.dwHighDateTime=0x1d4d3bc, ftLastWriteTime.dwLowDateTime=0xabe1a070, ftLastWriteTime.dwHighDateTime=0x1d4d3bc, nFileSizeHigh=0x0, nFileSizeLow=0x36b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JaIHulCaHs.mkv", cAlternateFileName="JAIHUL~1.MKV")) returned 1 [0075.563] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbb18f0, ftCreationTime.dwHighDateTime=0x1d4d22e, ftLastAccessTime.dwLowDateTime=0xbd739880, ftLastAccessTime.dwHighDateTime=0x1d4cdf8, ftLastWriteTime.dwLowDateTime=0xbd739880, ftLastWriteTime.dwHighDateTime=0x1d4cdf8, nFileSizeHigh=0x0, nFileSizeLow=0x7999, dwReserved0=0x0, dwReserved1=0x0, cFileName="jZ5qqpw.mkv", cAlternateFileName="")) returned 1 [0075.563] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd555ed60, ftCreationTime.dwHighDateTime=0x1d4c8d3, ftLastAccessTime.dwLowDateTime=0xfcffa4a0, ftLastAccessTime.dwHighDateTime=0x1d4c93c, ftLastWriteTime.dwLowDateTime=0xfcffa4a0, ftLastWriteTime.dwHighDateTime=0x1d4c93c, nFileSizeHigh=0x0, nFileSizeLow=0x154ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="ofLa_3t9ZcX.flv", cAlternateFileName="OFLA_3~1.FLV")) returned 1 [0075.563] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12118f0, ftCreationTime.dwHighDateTime=0x1d4d475, ftLastAccessTime.dwLowDateTime=0xf2057b80, ftLastAccessTime.dwHighDateTime=0x1d4cbe2, ftLastWriteTime.dwLowDateTime=0xf2057b80, ftLastWriteTime.dwHighDateTime=0x1d4cbe2, nFileSizeHigh=0x0, nFileSizeLow=0xa571, dwReserved0=0x0, dwReserved1=0x0, cFileName="okgxxKWmbCR-gV uQ.mp4", cAlternateFileName="OKGXXK~1.MP4")) returned 1 [0075.564] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60d3e860, ftCreationTime.dwHighDateTime=0x1d4c91a, ftLastAccessTime.dwLowDateTime=0xe4d8f20, ftLastAccessTime.dwHighDateTime=0x1d4ce4b, ftLastWriteTime.dwLowDateTime=0xe4d8f20, ftLastWriteTime.dwHighDateTime=0x1d4ce4b, nFileSizeHigh=0x0, nFileSizeLow=0x1637f, dwReserved0=0x0, dwReserved1=0x0, cFileName="OYrxw81mV_8Ml1Y0HPwN.mkv", cAlternateFileName="OYRXW8~1.MKV")) returned 1 [0075.564] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31e4eb40, ftCreationTime.dwHighDateTime=0x1d4cc6b, ftLastAccessTime.dwLowDateTime=0x29edf7a0, ftLastAccessTime.dwHighDateTime=0x1d4d351, ftLastWriteTime.dwLowDateTime=0x29edf7a0, ftLastWriteTime.dwHighDateTime=0x1d4d351, nFileSizeHigh=0x0, nFileSizeLow=0x5e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="qjIq1qERjUiHLNlN.mkv", cAlternateFileName="QJIQ1Q~1.MKV")) returned 1 [0075.564] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8165b2e0, ftCreationTime.dwHighDateTime=0x1d4cfd0, ftLastAccessTime.dwLowDateTime=0xb7c9fb50, ftLastAccessTime.dwHighDateTime=0x1d4cc4e, ftLastWriteTime.dwLowDateTime=0xb7c9fb50, ftLastWriteTime.dwHighDateTime=0x1d4cc4e, nFileSizeHigh=0x0, nFileSizeLow=0x3012, dwReserved0=0x0, dwReserved1=0x0, cFileName="rFlA.mp4", cAlternateFileName="")) returned 1 [0075.564] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8714e5d0, ftCreationTime.dwHighDateTime=0x1d4d1b0, ftLastAccessTime.dwLowDateTime=0x4af43820, ftLastAccessTime.dwHighDateTime=0x1d4ce7d, ftLastWriteTime.dwLowDateTime=0x4af43820, ftLastWriteTime.dwHighDateTime=0x1d4ce7d, nFileSizeHigh=0x0, nFileSizeLow=0x15f5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="s1dSGnHiktwyq1.flv", cAlternateFileName="S1DSGN~1.FLV")) returned 1 [0075.564] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ce55b0, ftCreationTime.dwHighDateTime=0x1d4c651, ftLastAccessTime.dwLowDateTime=0x2cff9c20, ftLastAccessTime.dwHighDateTime=0x1d4d02a, ftLastWriteTime.dwLowDateTime=0x2cff9c20, ftLastWriteTime.dwHighDateTime=0x1d4d02a, nFileSizeHigh=0x0, nFileSizeLow=0x18d8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="tCfhU.flv", cAlternateFileName="")) returned 1 [0075.564] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7cc7240, ftCreationTime.dwHighDateTime=0x1d4cf1a, ftLastAccessTime.dwLowDateTime=0x733089a0, ftLastAccessTime.dwHighDateTime=0x1d4d450, ftLastWriteTime.dwLowDateTime=0x733089a0, ftLastWriteTime.dwHighDateTime=0x1d4d450, nFileSizeHigh=0x0, nFileSizeLow=0x9622, dwReserved0=0x0, dwReserved1=0x0, cFileName="veSPbKMeSdRbB.avi", cAlternateFileName="VESPBK~1.AVI")) returned 1 [0075.565] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x241881c0, ftCreationTime.dwHighDateTime=0x1d4c7de, ftLastAccessTime.dwLowDateTime=0xeb881540, ftLastAccessTime.dwHighDateTime=0x1d4c6a3, ftLastWriteTime.dwLowDateTime=0xeb881540, ftLastWriteTime.dwHighDateTime=0x1d4c6a3, nFileSizeHigh=0x0, nFileSizeLow=0x12085, dwReserved0=0x0, dwReserved1=0x0, cFileName="WdN6KwU-j9ZW-gx.avi", cAlternateFileName="WDN6KW~1.AVI")) returned 1 [0075.565] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6db0fb10, ftCreationTime.dwHighDateTime=0x1d4ceb3, ftLastAccessTime.dwLowDateTime=0xc8540d90, ftLastAccessTime.dwHighDateTime=0x1d4d2f1, ftLastWriteTime.dwLowDateTime=0xc8540d90, ftLastWriteTime.dwHighDateTime=0x1d4d2f1, nFileSizeHigh=0x0, nFileSizeLow=0x49cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="XKPZGAxx.swf", cAlternateFileName="")) returned 1 [0075.565] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d65ddb0, ftCreationTime.dwHighDateTime=0x1d4cfeb, ftLastAccessTime.dwLowDateTime=0x884fa130, ftLastAccessTime.dwHighDateTime=0x1d4ca88, ftLastWriteTime.dwLowDateTime=0x884fa130, ftLastWriteTime.dwHighDateTime=0x1d4ca88, nFileSizeHigh=0x0, nFileSizeLow=0x104dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="z2HMXP-ZglSad.mp4", cAlternateFileName="Z2HMXP~1.MP4")) returned 1 [0075.565] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ed851b0, ftCreationTime.dwHighDateTime=0x1d4ca26, ftLastAccessTime.dwLowDateTime=0xfd9a40c0, ftLastAccessTime.dwHighDateTime=0x1d4d4de, ftLastWriteTime.dwLowDateTime=0xfd9a40c0, ftLastWriteTime.dwHighDateTime=0x1d4d4de, nFileSizeHigh=0x0, nFileSizeLow=0x4651, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z2M-GOgcvm3.flv", cAlternateFileName="Z2M-GO~1.FLV")) returned 1 [0075.565] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8f80f0, ftCreationTime.dwHighDateTime=0x1d4c633, ftLastAccessTime.dwLowDateTime=0x7b286700, ftLastAccessTime.dwHighDateTime=0x1d4c66c, ftLastWriteTime.dwLowDateTime=0x7b286700, ftLastWriteTime.dwHighDateTime=0x1d4c66c, nFileSizeHigh=0x0, nFileSizeLow=0xa336, dwReserved0=0x0, dwReserved1=0x0, cFileName="zw1Mn5NX.mkv", cAlternateFileName="")) returned 1 [0075.566] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78678290, ftCreationTime.dwHighDateTime=0x1d4c93b, ftLastAccessTime.dwLowDateTime=0x3ff94920, ftLastAccessTime.dwHighDateTime=0x1d4cbe8, ftLastWriteTime.dwLowDateTime=0x3ff94920, ftLastWriteTime.dwHighDateTime=0x1d4cbe8, nFileSizeHigh=0x0, nFileSizeLow=0x1229c, dwReserved0=0x0, dwReserved1=0x0, cFileName="_hL.swf", cAlternateFileName="")) returned 1 [0075.566] FindNextFileW (in: hFindFile=0x69af68, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78678290, ftCreationTime.dwHighDateTime=0x1d4c93b, ftLastAccessTime.dwLowDateTime=0x3ff94920, ftLastAccessTime.dwHighDateTime=0x1d4cbe8, ftLastWriteTime.dwLowDateTime=0x3ff94920, ftLastWriteTime.dwHighDateTime=0x1d4cbe8, nFileSizeHigh=0x0, nFileSizeLow=0x1229c, dwReserved0=0x0, dwReserved1=0x0, cFileName="_hL.swf", cAlternateFileName="")) returned 0 [0075.566] FindClose (in: hFindFile=0x69af68 | out: hFindFile=0x69af68) returned 1 [0075.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eac8) returned 1 [0075.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ead4) returned 1 [0075.566] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1IJhi1j.mkv", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1IJhi1j.mkv", lpFilePart=0x0) returned 0x30 [0075.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0075.566] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1IJhi1j.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1ijhi1j.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.567] GetFileType (hFile=0x26c) returned 0x1 [0075.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0075.567] GetFileType (hFile=0x26c) returned 0x1 [0075.567] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x14a23 [0075.567] ReadFile (in: hFile=0x26c, lpBuffer=0x2962a04, nNumberOfBytesToRead=0x14a23, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x2962a04*, lpNumberOfBytesRead=0x24ea60*=0x14a23, lpOverlapped=0x0) returned 1 [0075.570] CloseHandle (hObject=0x26c) returned 1 [0075.621] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0075.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0075.622] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0075.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0075.622] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1IJhi1j.mkv", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1IJhi1j.mkv", lpFilePart=0x0) returned 0x30 [0075.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0075.622] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1IJhi1j.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1ijhi1j.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.623] GetFileType (hFile=0x26c) returned 0x1 [0075.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0075.624] GetFileType (hFile=0x26c) returned 0x1 [0075.624] WriteFile (in: hFile=0x26c, lpBuffer=0x27fa560*, nNumberOfBytesToWrite=0x14a30, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x27fa560*, lpNumberOfBytesWritten=0x24ea54*=0x14a30, lpOverlapped=0x0) returned 1 [0075.628] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1IJhi1j.mkv", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1IJhi1j.mkv", lpFilePart=0x0) returned 0x30 [0075.628] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1IJhi1j.mkv.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1IJhi1j.mkv.Crypted", lpFilePart=0x0) returned 0x38 [0075.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0075.628] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1IJhi1j.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1ijhi1j.mkv"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x921b32b0, ftCreationTime.dwHighDateTime=0x1d4d546, ftLastAccessTime.dwLowDateTime=0xcce2a80, ftLastAccessTime.dwHighDateTime=0x1d4cd2c, ftLastWriteTime.dwLowDateTime=0xfdf648f0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x14a30)) returned 1 [0075.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0075.629] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1IJhi1j.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1ijhi1j.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1IJhi1j.mkv.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1ijhi1j.mkv.crypted")) returned 1 [0075.629] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\9AEAWnWGK9ozVdZvNu__.avi", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\9AEAWnWGK9ozVdZvNu__.avi", lpFilePart=0x0) returned 0x3d [0075.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0075.629] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\9AEAWnWGK9ozVdZvNu__.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\9aeawnwgk9ozvdzvnu__.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.630] GetFileType (hFile=0x26c) returned 0x1 [0075.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0075.630] GetFileType (hFile=0x26c) returned 0x1 [0075.630] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x15f89 [0075.630] ReadFile (in: hFile=0x26c, lpBuffer=0x3876608, nNumberOfBytesToRead=0x15f89, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x3876608*, lpNumberOfBytesRead=0x24ea60*=0x15f89, lpOverlapped=0x0) returned 1 [0075.700] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0075.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0075.700] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0075.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0075.700] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\9AEAWnWGK9ozVdZvNu__.avi", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\9AEAWnWGK9ozVdZvNu__.avi", lpFilePart=0x0) returned 0x3d [0075.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0075.700] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\9AEAWnWGK9ozVdZvNu__.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\9aeawnwgk9ozvdzvnu__.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.702] GetFileType (hFile=0x26c) returned 0x1 [0075.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0075.702] GetFileType (hFile=0x26c) returned 0x1 [0075.702] WriteFile (in: hFile=0x26c, lpBuffer=0x38e4410*, nNumberOfBytesToWrite=0x15f90, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x38e4410*, lpNumberOfBytesWritten=0x24ea54*=0x15f90, lpOverlapped=0x0) returned 1 [0075.705] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\9AEAWnWGK9ozVdZvNu__.avi", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\9AEAWnWGK9ozVdZvNu__.avi", lpFilePart=0x0) returned 0x3d [0075.705] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\9AEAWnWGK9ozVdZvNu__.avi.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\9AEAWnWGK9ozVdZvNu__.avi.Crypted", lpFilePart=0x0) returned 0x45 [0075.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0075.706] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\9AEAWnWGK9ozVdZvNu__.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\9aeawnwgk9ozvdzvnu__.avi"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x202f5d10, ftCreationTime.dwHighDateTime=0x1d4cfa7, ftLastAccessTime.dwLowDateTime=0xccbe8e80, ftLastAccessTime.dwHighDateTime=0x1d4cd5d, ftLastWriteTime.dwLowDateTime=0xfe022fd0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x15f90)) returned 1 [0075.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0075.706] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\9AEAWnWGK9ozVdZvNu__.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\9aeawnwgk9ozvdzvnu__.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\9AEAWnWGK9ozVdZvNu__.avi.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\9aeawnwgk9ozvdzvnu__.avi.crypted")) returned 1 [0075.709] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\C9iuTMWL.mkv", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\C9iuTMWL.mkv", lpFilePart=0x0) returned 0x31 [0075.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0075.709] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\C9iuTMWL.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\c9iutmwl.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.709] GetFileType (hFile=0x26c) returned 0x1 [0075.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0075.709] GetFileType (hFile=0x26c) returned 0x1 [0075.709] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x162cc [0075.710] ReadFile (in: hFile=0x26c, lpBuffer=0x38fa3c0, nNumberOfBytesToRead=0x162cc, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x38fa3c0*, lpNumberOfBytesRead=0x24ea60*=0x162cc, lpOverlapped=0x0) returned 1 [0075.747] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0075.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0075.747] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0075.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0075.747] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\C9iuTMWL.mkv", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\C9iuTMWL.mkv", lpFilePart=0x0) returned 0x31 [0075.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0075.747] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\C9iuTMWL.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\c9iutmwl.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.749] GetFileType (hFile=0x26c) returned 0x1 [0075.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0075.749] GetFileType (hFile=0x26c) returned 0x1 [0075.749] WriteFile (in: hFile=0x26c, lpBuffer=0x3969208*, nNumberOfBytesToWrite=0x162d0, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x3969208*, lpNumberOfBytesWritten=0x24ea54*=0x162d0, lpOverlapped=0x0) returned 1 [0075.752] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\C9iuTMWL.mkv", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\C9iuTMWL.mkv", lpFilePart=0x0) returned 0x31 [0075.752] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\C9iuTMWL.mkv.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\C9iuTMWL.mkv.Crypted", lpFilePart=0x0) returned 0x39 [0075.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0075.752] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\C9iuTMWL.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\c9iutmwl.mkv"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6078cb90, ftCreationTime.dwHighDateTime=0x1d4c813, ftLastAccessTime.dwLowDateTime=0x514cf970, ftLastAccessTime.dwHighDateTime=0x1d4cbe7, ftLastWriteTime.dwLowDateTime=0xfe0953f0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x162d0)) returned 1 [0075.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0075.752] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\C9iuTMWL.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\c9iutmwl.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\C9iuTMWL.mkv.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\c9iutmwl.mkv.crypted")) returned 1 [0075.753] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\G0UpBgN4TxB42HiLDRXl.mp4", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\G0UpBgN4TxB42HiLDRXl.mp4", lpFilePart=0x0) returned 0x3d [0075.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0075.753] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\G0UpBgN4TxB42HiLDRXl.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\g0upbgn4txb42hildrxl.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.753] GetFileType (hFile=0x26c) returned 0x1 [0075.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0075.753] GetFileType (hFile=0x26c) returned 0x1 [0075.754] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x7329 [0075.754] ReadFile (in: hFile=0x26c, lpBuffer=0x28a9d4c, nNumberOfBytesToRead=0x7329, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x28a9d4c*, lpNumberOfBytesRead=0x24ea60*=0x7329, lpOverlapped=0x0) returned 1 [0075.785] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0075.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0075.785] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0075.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0075.786] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\G0UpBgN4TxB42HiLDRXl.mp4", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\G0UpBgN4TxB42HiLDRXl.mp4", lpFilePart=0x0) returned 0x3d [0075.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0075.786] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\G0UpBgN4TxB42HiLDRXl.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\g0upbgn4txb42hildrxl.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.787] GetFileType (hFile=0x26c) returned 0x1 [0075.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0075.787] GetFileType (hFile=0x26c) returned 0x1 [0075.787] WriteFile (in: hFile=0x26c, lpBuffer=0x291ab28*, nNumberOfBytesToWrite=0x7330, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x291ab28*, lpNumberOfBytesWritten=0x24ea54*=0x7330, lpOverlapped=0x0) returned 1 [0075.789] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\G0UpBgN4TxB42HiLDRXl.mp4", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\G0UpBgN4TxB42HiLDRXl.mp4", lpFilePart=0x0) returned 0x3d [0075.789] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\G0UpBgN4TxB42HiLDRXl.mp4.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\G0UpBgN4TxB42HiLDRXl.mp4.Crypted", lpFilePart=0x0) returned 0x45 [0075.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0075.789] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\G0UpBgN4TxB42HiLDRXl.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\g0upbgn4txb42hildrxl.mp4"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1a9e7a0, ftCreationTime.dwHighDateTime=0x1d4d577, ftLastAccessTime.dwLowDateTime=0xd4363b30, ftLastAccessTime.dwHighDateTime=0x1d4d308, ftLastWriteTime.dwLowDateTime=0xfe107810, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x7330)) returned 1 [0075.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0075.790] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\G0UpBgN4TxB42HiLDRXl.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\g0upbgn4txb42hildrxl.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\G0UpBgN4TxB42HiLDRXl.mp4.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\g0upbgn4txb42hildrxl.mp4.crypted")) returned 1 [0075.795] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gg MR DS.mkv", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gg MR DS.mkv", lpFilePart=0x0) returned 0x31 [0075.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0075.795] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gg MR DS.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gg mr ds.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.795] GetFileType (hFile=0x26c) returned 0x1 [0075.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0075.795] GetFileType (hFile=0x26c) returned 0x1 [0075.795] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x15e3 [0075.795] ReadFile (in: hFile=0x26c, lpBuffer=0x29223e8, nNumberOfBytesToRead=0x15e3, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x29223e8*, lpNumberOfBytesRead=0x24ea60*=0x15e3, lpOverlapped=0x0) returned 1 [0075.817] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0075.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0075.817] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0075.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0075.817] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gg MR DS.mkv", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gg MR DS.mkv", lpFilePart=0x0) returned 0x31 [0075.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0075.817] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gg MR DS.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gg mr ds.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.819] GetFileType (hFile=0x26c) returned 0x1 [0075.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0075.819] GetFileType (hFile=0x26c) returned 0x1 [0075.819] WriteFile (in: hFile=0x26c, lpBuffer=0x2975f84*, nNumberOfBytesToWrite=0x15f0, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x2975f84*, lpNumberOfBytesWritten=0x24ea54*=0x15f0, lpOverlapped=0x0) returned 1 [0075.820] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gg MR DS.mkv", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gg MR DS.mkv", lpFilePart=0x0) returned 0x31 [0075.820] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gg MR DS.mkv.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gg MR DS.mkv.Crypted", lpFilePart=0x0) returned 0x39 [0075.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0075.820] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gg MR DS.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gg mr ds.mkv"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddf897d0, ftCreationTime.dwHighDateTime=0x1d4d3a8, ftLastAccessTime.dwLowDateTime=0x62335990, ftLastAccessTime.dwHighDateTime=0x1d4d1e7, ftLastWriteTime.dwLowDateTime=0xfe153ad0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x15f0)) returned 1 [0075.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0075.820] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gg MR DS.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gg mr ds.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gg MR DS.mkv.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gg mr ds.mkv.crypted")) returned 1 [0075.821] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\GVadprR_eGnOi-wmgB.mkv", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\GVadprR_eGnOi-wmgB.mkv", lpFilePart=0x0) returned 0x3b [0075.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0075.821] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\GVadprR_eGnOi-wmgB.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gvadprr_egnoi-wmgb.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.821] GetFileType (hFile=0x26c) returned 0x1 [0075.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0075.821] GetFileType (hFile=0x26c) returned 0x1 [0075.822] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x7921 [0075.822] ReadFile (in: hFile=0x26c, lpBuffer=0x2977ab4, nNumberOfBytesToRead=0x7921, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x2977ab4*, lpNumberOfBytesRead=0x24ea60*=0x7921, lpOverlapped=0x0) returned 1 [0075.880] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0075.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0075.880] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0075.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0075.880] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\GVadprR_eGnOi-wmgB.mkv", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\GVadprR_eGnOi-wmgB.mkv", lpFilePart=0x0) returned 0x3b [0075.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0075.880] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\GVadprR_eGnOi-wmgB.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gvadprr_egnoi-wmgb.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.882] GetFileType (hFile=0x26c) returned 0x1 [0075.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0075.882] GetFileType (hFile=0x26c) returned 0x1 [0075.882] WriteFile (in: hFile=0x26c, lpBuffer=0x27d3428*, nNumberOfBytesToWrite=0x7930, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x27d3428*, lpNumberOfBytesWritten=0x24ea54*=0x7930, lpOverlapped=0x0) returned 1 [0075.883] CloseHandle (hObject=0x26c) returned 1 [0075.888] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\GVadprR_eGnOi-wmgB.mkv", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\GVadprR_eGnOi-wmgB.mkv", lpFilePart=0x0) returned 0x3b [0075.888] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\GVadprR_eGnOi-wmgB.mkv.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\GVadprR_eGnOi-wmgB.mkv.Crypted", lpFilePart=0x0) returned 0x43 [0075.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0075.888] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\GVadprR_eGnOi-wmgB.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gvadprr_egnoi-wmgb.mkv"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf489f90, ftCreationTime.dwHighDateTime=0x1d4cce6, ftLastAccessTime.dwLowDateTime=0x476fb5a0, ftLastAccessTime.dwHighDateTime=0x1d4c935, ftLastWriteTime.dwLowDateTime=0xfe1ec050, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x7930)) returned 1 [0075.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0075.888] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\GVadprR_eGnOi-wmgB.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gvadprr_egnoi-wmgb.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\GVadprR_eGnOi-wmgB.mkv.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gvadprr_egnoi-wmgb.mkv.crypted")) returned 1 [0075.889] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JaIHulCaHs.mkv", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JaIHulCaHs.mkv", lpFilePart=0x0) returned 0x33 [0075.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0075.889] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JaIHulCaHs.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\jaihulcahs.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.889] GetFileType (hFile=0x26c) returned 0x1 [0075.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0075.890] GetFileType (hFile=0x26c) returned 0x1 [0075.890] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x36b0 [0075.890] ReadFile (in: hFile=0x26c, lpBuffer=0x27db2f4, nNumberOfBytesToRead=0x36b0, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x27db2f4*, lpNumberOfBytesRead=0x24ea60*=0x36b0, lpOverlapped=0x0) returned 1 [0075.895] CloseHandle (hObject=0x26c) returned 1 [0075.915] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0075.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0075.915] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0075.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0075.915] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JaIHulCaHs.mkv", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JaIHulCaHs.mkv", lpFilePart=0x0) returned 0x33 [0075.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0075.915] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JaIHulCaHs.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\jaihulcahs.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.916] GetFileType (hFile=0x26c) returned 0x1 [0075.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0075.916] GetFileType (hFile=0x26c) returned 0x1 [0075.917] WriteFile (in: hFile=0x26c, lpBuffer=0x28393f8*, nNumberOfBytesToWrite=0x36c0, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x28393f8*, lpNumberOfBytesWritten=0x24ea54*=0x36c0, lpOverlapped=0x0) returned 1 [0075.918] CloseHandle (hObject=0x26c) returned 1 [0075.925] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JaIHulCaHs.mkv", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JaIHulCaHs.mkv", lpFilePart=0x0) returned 0x33 [0075.925] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JaIHulCaHs.mkv.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JaIHulCaHs.mkv.Crypted", lpFilePart=0x0) returned 0x3b [0075.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0075.925] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JaIHulCaHs.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\jaihulcahs.mkv"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ecaa0, ftCreationTime.dwHighDateTime=0x1d4d0aa, ftLastAccessTime.dwLowDateTime=0xabe1a070, ftLastAccessTime.dwHighDateTime=0x1d4d3bc, ftLastWriteTime.dwLowDateTime=0xfe25e470, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x36c0)) returned 1 [0075.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0075.925] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JaIHulCaHs.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\jaihulcahs.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JaIHulCaHs.mkv.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\jaihulcahs.mkv.crypted")) returned 1 [0075.926] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\jZ5qqpw.mkv", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\jZ5qqpw.mkv", lpFilePart=0x0) returned 0x30 [0075.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0075.926] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\jZ5qqpw.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\jz5qqpw.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.926] GetFileType (hFile=0x26c) returned 0x1 [0075.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0075.926] GetFileType (hFile=0x26c) returned 0x1 [0075.926] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x7999 [0075.927] ReadFile (in: hFile=0x26c, lpBuffer=0x283cfe0, nNumberOfBytesToRead=0x7999, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x283cfe0*, lpNumberOfBytesRead=0x24ea60*=0x7999, lpOverlapped=0x0) returned 1 [0075.935] CloseHandle (hObject=0x26c) returned 1 [0075.959] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0075.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0075.959] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0075.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0075.959] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\jZ5qqpw.mkv", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\jZ5qqpw.mkv", lpFilePart=0x0) returned 0x30 [0075.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0075.961] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\jZ5qqpw.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\jz5qqpw.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.965] GetFileType (hFile=0x26c) returned 0x1 [0075.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0075.965] GetFileType (hFile=0x26c) returned 0x1 [0075.965] WriteFile (in: hFile=0x26c, lpBuffer=0x28afdec*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x28afdec*, lpNumberOfBytesWritten=0x24ea54*=0x79a0, lpOverlapped=0x0) returned 1 [0075.967] CloseHandle (hObject=0x26c) returned 1 [0075.972] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\jZ5qqpw.mkv", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\jZ5qqpw.mkv", lpFilePart=0x0) returned 0x30 [0075.972] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\jZ5qqpw.mkv.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\jZ5qqpw.mkv.Crypted", lpFilePart=0x0) returned 0x38 [0075.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0075.972] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\jZ5qqpw.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\jz5qqpw.mkv"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbb18f0, ftCreationTime.dwHighDateTime=0x1d4d22e, ftLastAccessTime.dwLowDateTime=0xbd739880, ftLastAccessTime.dwHighDateTime=0x1d4cdf8, ftLastWriteTime.dwLowDateTime=0xfe2d0890, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x79a0)) returned 1 [0075.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0075.973] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\jZ5qqpw.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\jz5qqpw.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\jZ5qqpw.mkv.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\jz5qqpw.mkv.crypted")) returned 1 [0075.973] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\okgxxKWmbCR-gV uQ.mp4", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\okgxxKWmbCR-gV uQ.mp4", lpFilePart=0x0) returned 0x3a [0075.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0075.973] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\okgxxKWmbCR-gV uQ.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\okgxxkwmbcr-gv uq.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.974] GetFileType (hFile=0x26c) returned 0x1 [0075.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0075.974] GetFileType (hFile=0x26c) returned 0x1 [0075.974] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0xa571 [0075.974] ReadFile (in: hFile=0x26c, lpBuffer=0x28b7cdc, nNumberOfBytesToRead=0xa571, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x28b7cdc*, lpNumberOfBytesRead=0x24ea60*=0xa571, lpOverlapped=0x0) returned 1 [0075.976] CloseHandle (hObject=0x26c) returned 1 [0075.996] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0075.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0075.996] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0075.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0075.996] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\okgxxKWmbCR-gV uQ.mp4", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\okgxxKWmbCR-gV uQ.mp4", lpFilePart=0x0) returned 0x3a [0075.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0075.996] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\okgxxKWmbCR-gV uQ.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\okgxxkwmbcr-gv uq.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0075.997] GetFileType (hFile=0x26c) returned 0x1 [0075.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0075.997] GetFileType (hFile=0x26c) returned 0x1 [0075.998] WriteFile (in: hFile=0x26c, lpBuffer=0x2938648*, nNumberOfBytesToWrite=0xa580, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x2938648*, lpNumberOfBytesWritten=0x24ea54*=0xa580, lpOverlapped=0x0) returned 1 [0075.999] CloseHandle (hObject=0x26c) returned 1 [0076.008] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\okgxxKWmbCR-gV uQ.mp4", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\okgxxKWmbCR-gV uQ.mp4", lpFilePart=0x0) returned 0x3a [0076.008] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\okgxxKWmbCR-gV uQ.mp4.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\okgxxKWmbCR-gV uQ.mp4.Crypted", lpFilePart=0x0) returned 0x42 [0076.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0076.009] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\okgxxKWmbCR-gV uQ.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\okgxxkwmbcr-gv uq.mp4"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12118f0, ftCreationTime.dwHighDateTime=0x1d4d475, ftLastAccessTime.dwLowDateTime=0xf2057b80, ftLastAccessTime.dwHighDateTime=0x1d4cbe2, ftLastWriteTime.dwLowDateTime=0xfe31cb50, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xa580)) returned 1 [0076.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0076.009] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\okgxxKWmbCR-gV uQ.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\okgxxkwmbcr-gv uq.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\okgxxKWmbCR-gV uQ.mp4.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\okgxxkwmbcr-gv uq.mp4.crypted")) returned 1 [0076.010] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\OYrxw81mV_8Ml1Y0HPwN.mkv", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\OYrxw81mV_8Ml1Y0HPwN.mkv", lpFilePart=0x0) returned 0x3d [0076.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0076.010] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\OYrxw81mV_8Ml1Y0HPwN.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\oyrxw81mv_8ml1y0hpwn.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0076.010] GetFileType (hFile=0x26c) returned 0x1 [0076.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0076.010] GetFileType (hFile=0x26c) returned 0x1 [0076.010] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x1637f [0076.011] ReadFile (in: hFile=0x26c, lpBuffer=0x397f4f8, nNumberOfBytesToRead=0x1637f, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x397f4f8*, lpNumberOfBytesRead=0x24ea60*=0x1637f, lpOverlapped=0x0) returned 1 [0076.031] CloseHandle (hObject=0x26c) returned 1 [0076.105] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0076.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0076.105] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0076.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0076.106] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\OYrxw81mV_8Ml1Y0HPwN.mkv", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\OYrxw81mV_8Ml1Y0HPwN.mkv", lpFilePart=0x0) returned 0x3d [0076.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0076.106] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\OYrxw81mV_8Ml1Y0HPwN.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\oyrxw81mv_8ml1y0hpwn.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0076.107] GetFileType (hFile=0x26c) returned 0x1 [0076.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0076.108] GetFileType (hFile=0x26c) returned 0x1 [0076.108] WriteFile (in: hFile=0x26c, lpBuffer=0x39ee6b8*, nNumberOfBytesToWrite=0x16380, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x39ee6b8*, lpNumberOfBytesWritten=0x24ea54*=0x16380, lpOverlapped=0x0) returned 1 [0076.110] CloseHandle (hObject=0x26c) returned 1 [0076.116] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\OYrxw81mV_8Ml1Y0HPwN.mkv", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\OYrxw81mV_8Ml1Y0HPwN.mkv", lpFilePart=0x0) returned 0x3d [0076.116] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\OYrxw81mV_8Ml1Y0HPwN.mkv.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\OYrxw81mV_8Ml1Y0HPwN.mkv.Crypted", lpFilePart=0x0) returned 0x45 [0076.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0076.116] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\OYrxw81mV_8Ml1Y0HPwN.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\oyrxw81mv_8ml1y0hpwn.mkv"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60d3e860, ftCreationTime.dwHighDateTime=0x1d4c91a, ftLastAccessTime.dwLowDateTime=0xe4d8f20, ftLastAccessTime.dwHighDateTime=0x1d4ce4b, ftLastWriteTime.dwLowDateTime=0xfe4274f0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x16380)) returned 1 [0076.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0076.116] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\OYrxw81mV_8Ml1Y0HPwN.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\oyrxw81mv_8ml1y0hpwn.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\OYrxw81mV_8Ml1Y0HPwN.mkv.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\oyrxw81mv_8ml1y0hpwn.mkv.crypted")) returned 1 [0076.117] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qjIq1qERjUiHLNlN.mkv", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qjIq1qERjUiHLNlN.mkv", lpFilePart=0x0) returned 0x39 [0076.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0076.117] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qjIq1qERjUiHLNlN.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qjiq1qerjuihlnln.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0076.117] GetFileType (hFile=0x26c) returned 0x1 [0076.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0076.118] GetFileType (hFile=0x26c) returned 0x1 [0076.118] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x5e60 [0076.118] ReadFile (in: hFile=0x26c, lpBuffer=0x2788c0c, nNumberOfBytesToRead=0x5e60, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x2788c0c*, lpNumberOfBytesRead=0x24ea60*=0x5e60, lpOverlapped=0x0) returned 1 [0076.120] CloseHandle (hObject=0x26c) returned 1 [0076.144] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0076.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0076.144] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0076.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0076.145] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qjIq1qERjUiHLNlN.mkv", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qjIq1qERjUiHLNlN.mkv", lpFilePart=0x0) returned 0x39 [0076.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0076.145] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qjIq1qERjUiHLNlN.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qjiq1qerjuihlnln.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0076.146] GetFileType (hFile=0x26c) returned 0x1 [0076.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0076.146] GetFileType (hFile=0x26c) returned 0x1 [0076.146] WriteFile (in: hFile=0x26c, lpBuffer=0x27f3380*, nNumberOfBytesToWrite=0x5e70, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x27f3380*, lpNumberOfBytesWritten=0x24ea54*=0x5e70, lpOverlapped=0x0) returned 1 [0076.147] CloseHandle (hObject=0x26c) returned 1 [0076.150] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qjIq1qERjUiHLNlN.mkv", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qjIq1qERjUiHLNlN.mkv", lpFilePart=0x0) returned 0x39 [0076.150] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qjIq1qERjUiHLNlN.mkv.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qjIq1qERjUiHLNlN.mkv.Crypted", lpFilePart=0x0) returned 0x41 [0076.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0076.150] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qjIq1qERjUiHLNlN.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qjiq1qerjuihlnln.mkv"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31e4eb40, ftCreationTime.dwHighDateTime=0x1d4cc6b, ftLastAccessTime.dwLowDateTime=0x29edf7a0, ftLastAccessTime.dwHighDateTime=0x1d4d351, ftLastWriteTime.dwLowDateTime=0xfe4737b0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x5e70)) returned 1 [0076.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0076.150] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qjIq1qERjUiHLNlN.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qjiq1qerjuihlnln.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qjIq1qERjUiHLNlN.mkv.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qjiq1qerjuihlnln.mkv.crypted")) returned 1 [0076.151] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rFlA.mp4", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rFlA.mp4", lpFilePart=0x0) returned 0x2d [0076.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0076.151] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rFlA.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rfla.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0076.151] GetFileType (hFile=0x26c) returned 0x1 [0076.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0076.152] GetFileType (hFile=0x26c) returned 0x1 [0076.152] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x3012 [0076.152] ReadFile (in: hFile=0x26c, lpBuffer=0x27f9748, nNumberOfBytesToRead=0x3012, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x27f9748*, lpNumberOfBytesRead=0x24ea60*=0x3012, lpOverlapped=0x0) returned 1 [0076.154] CloseHandle (hObject=0x26c) returned 1 [0076.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0076.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0076.176] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0076.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0076.177] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rFlA.mp4", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rFlA.mp4", lpFilePart=0x0) returned 0x2d [0076.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0076.177] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rFlA.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rfla.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0076.178] GetFileType (hFile=0x26c) returned 0x1 [0076.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0076.178] GetFileType (hFile=0x26c) returned 0x1 [0076.178] WriteFile (in: hFile=0x26c, lpBuffer=0x28555d4*, nNumberOfBytesToWrite=0x3020, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x28555d4*, lpNumberOfBytesWritten=0x24ea54*=0x3020, lpOverlapped=0x0) returned 1 [0076.179] CloseHandle (hObject=0x26c) returned 1 [0076.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rFlA.mp4", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rFlA.mp4", lpFilePart=0x0) returned 0x2d [0076.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rFlA.mp4.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rFlA.mp4.Crypted", lpFilePart=0x0) returned 0x35 [0076.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0076.184] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rFlA.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rfla.mp4"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8165b2e0, ftCreationTime.dwHighDateTime=0x1d4cfd0, ftLastAccessTime.dwLowDateTime=0xb7c9fb50, ftLastAccessTime.dwHighDateTime=0x1d4cc4e, ftLastWriteTime.dwLowDateTime=0xfe4bfa70, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x3020)) returned 1 [0076.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0076.184] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rFlA.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rfla.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rFlA.mp4.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rfla.mp4.crypted")) returned 1 [0076.185] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\veSPbKMeSdRbB.avi", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\veSPbKMeSdRbB.avi", lpFilePart=0x0) returned 0x36 [0076.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0076.185] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\veSPbKMeSdRbB.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vespbkmesdrbb.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0076.185] GetFileType (hFile=0x26c) returned 0x1 [0076.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0076.185] GetFileType (hFile=0x26c) returned 0x1 [0076.185] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x9622 [0076.186] ReadFile (in: hFile=0x26c, lpBuffer=0x2858b28, nNumberOfBytesToRead=0x9622, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x2858b28*, lpNumberOfBytesRead=0x24ea60*=0x9622, lpOverlapped=0x0) returned 1 [0076.187] CloseHandle (hObject=0x26c) returned 1 [0076.209] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0076.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0076.209] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0076.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0076.210] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\veSPbKMeSdRbB.avi", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\veSPbKMeSdRbB.avi", lpFilePart=0x0) returned 0x36 [0076.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0076.210] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\veSPbKMeSdRbB.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vespbkmesdrbb.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0076.211] GetFileType (hFile=0x26c) returned 0x1 [0076.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0076.212] GetFileType (hFile=0x26c) returned 0x1 [0076.212] WriteFile (in: hFile=0x26c, lpBuffer=0x28d4804*, nNumberOfBytesToWrite=0x9630, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x28d4804*, lpNumberOfBytesWritten=0x24ea54*=0x9630, lpOverlapped=0x0) returned 1 [0076.213] CloseHandle (hObject=0x26c) returned 1 [0076.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\veSPbKMeSdRbB.avi", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\veSPbKMeSdRbB.avi", lpFilePart=0x0) returned 0x36 [0076.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\veSPbKMeSdRbB.avi.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\veSPbKMeSdRbB.avi.Crypted", lpFilePart=0x0) returned 0x3e [0076.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0076.215] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\veSPbKMeSdRbB.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vespbkmesdrbb.avi"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7cc7240, ftCreationTime.dwHighDateTime=0x1d4cf1a, ftLastAccessTime.dwLowDateTime=0x733089a0, ftLastAccessTime.dwHighDateTime=0x1d4d450, ftLastWriteTime.dwLowDateTime=0xfe50bd30, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x9630)) returned 1 [0076.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0076.215] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\veSPbKMeSdRbB.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vespbkmesdrbb.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\veSPbKMeSdRbB.avi.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vespbkmesdrbb.avi.crypted")) returned 1 [0076.216] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\WdN6KwU-j9ZW-gx.avi", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\WdN6KwU-j9ZW-gx.avi", lpFilePart=0x0) returned 0x38 [0076.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0076.216] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\WdN6KwU-j9ZW-gx.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\wdn6kwu-j9zw-gx.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0076.216] GetFileType (hFile=0x26c) returned 0x1 [0076.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0076.216] GetFileType (hFile=0x26c) returned 0x1 [0076.217] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x12085 [0076.217] ReadFile (in: hFile=0x26c, lpBuffer=0x28de3a0, nNumberOfBytesToRead=0x12085, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x28de3a0*, lpNumberOfBytesRead=0x24ea60*=0x12085, lpOverlapped=0x0) returned 1 [0076.229] CloseHandle (hObject=0x26c) returned 1 [0076.253] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0076.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0076.254] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0076.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0076.254] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\WdN6KwU-j9ZW-gx.avi", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\WdN6KwU-j9ZW-gx.avi", lpFilePart=0x0) returned 0x38 [0076.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0076.254] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\WdN6KwU-j9ZW-gx.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\wdn6kwu-j9zw-gx.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0076.255] GetFileType (hFile=0x26c) returned 0x1 [0076.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0076.256] GetFileType (hFile=0x26c) returned 0x1 [0076.256] WriteFile (in: hFile=0x26c, lpBuffer=0x2961350*, nNumberOfBytesToWrite=0x12090, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x2961350*, lpNumberOfBytesWritten=0x24ea54*=0x12090, lpOverlapped=0x0) returned 1 [0076.258] CloseHandle (hObject=0x26c) returned 1 [0076.264] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\WdN6KwU-j9ZW-gx.avi", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\WdN6KwU-j9ZW-gx.avi", lpFilePart=0x0) returned 0x38 [0076.264] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\WdN6KwU-j9ZW-gx.avi.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\WdN6KwU-j9ZW-gx.avi.Crypted", lpFilePart=0x0) returned 0x40 [0076.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0076.267] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\WdN6KwU-j9ZW-gx.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\wdn6kwu-j9zw-gx.avi"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x241881c0, ftCreationTime.dwHighDateTime=0x1d4c7de, ftLastAccessTime.dwLowDateTime=0xeb881540, ftLastAccessTime.dwHighDateTime=0x1d4c6a3, ftLastWriteTime.dwLowDateTime=0xfe57e150, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x12090)) returned 1 [0076.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0076.267] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\WdN6KwU-j9ZW-gx.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\wdn6kwu-j9zw-gx.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\WdN6KwU-j9ZW-gx.avi.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\wdn6kwu-j9zw-gx.avi.crypted")) returned 1 [0076.269] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z2HMXP-ZglSad.mp4", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z2HMXP-ZglSad.mp4", lpFilePart=0x0) returned 0x36 [0076.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0076.269] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z2HMXP-ZglSad.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z2hmxp-zglsad.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0076.269] GetFileType (hFile=0x26c) returned 0x1 [0076.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0076.269] GetFileType (hFile=0x26c) returned 0x1 [0076.269] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0x104dc [0076.270] ReadFile (in: hFile=0x26c, lpBuffer=0x2973970, nNumberOfBytesToRead=0x104dc, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x2973970*, lpNumberOfBytesRead=0x24ea60*=0x104dc, lpOverlapped=0x0) returned 1 [0076.277] CloseHandle (hObject=0x26c) returned 1 [0076.359] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0076.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0076.360] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0076.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0076.360] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z2HMXP-ZglSad.mp4", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z2HMXP-ZglSad.mp4", lpFilePart=0x0) returned 0x36 [0076.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0076.360] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z2HMXP-ZglSad.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z2hmxp-zglsad.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0076.362] GetFileType (hFile=0x26c) returned 0x1 [0076.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0076.362] GetFileType (hFile=0x26c) returned 0x1 [0076.362] WriteFile (in: hFile=0x26c, lpBuffer=0x2801ad4*, nNumberOfBytesToWrite=0x104e0, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x2801ad4*, lpNumberOfBytesWritten=0x24ea54*=0x104e0, lpOverlapped=0x0) returned 1 [0076.364] CloseHandle (hObject=0x26c) returned 1 [0076.372] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z2HMXP-ZglSad.mp4", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z2HMXP-ZglSad.mp4", lpFilePart=0x0) returned 0x36 [0076.372] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z2HMXP-ZglSad.mp4.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z2HMXP-ZglSad.mp4.Crypted", lpFilePart=0x0) returned 0x3e [0076.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0076.372] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z2HMXP-ZglSad.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z2hmxp-zglsad.mp4"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d65ddb0, ftCreationTime.dwHighDateTime=0x1d4cfeb, ftLastAccessTime.dwLowDateTime=0x884fa130, ftLastAccessTime.dwHighDateTime=0x1d4ca88, ftLastWriteTime.dwLowDateTime=0xfe688af0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x104e0)) returned 1 [0076.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0076.372] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z2HMXP-ZglSad.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z2hmxp-zglsad.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\z2HMXP-ZglSad.mp4.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\z2hmxp-zglsad.mp4.crypted")) returned 1 [0076.373] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\zw1Mn5NX.mkv", nBufferLength=0x105, lpBuffer=0x24e4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\zw1Mn5NX.mkv", lpFilePart=0x0) returned 0x31 [0076.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e9ac) returned 1 [0076.374] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\zw1Mn5NX.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\zw1mn5nx.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0076.374] GetFileType (hFile=0x26c) returned 0x1 [0076.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e9a8) returned 1 [0076.374] GetFileType (hFile=0x26c) returned 0x1 [0076.374] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x24eab4 | out: lpFileSizeHigh=0x24eab4*=0x0) returned 0xa336 [0076.374] ReadFile (in: hFile=0x26c, lpBuffer=0x281251c, nNumberOfBytesToRead=0xa336, lpNumberOfBytesRead=0x24ea60, lpOverlapped=0x0 | out: lpBuffer=0x281251c*, lpNumberOfBytesRead=0x24ea60*=0xa336, lpOverlapped=0x0) returned 1 [0076.377] CloseHandle (hObject=0x26c) returned 1 [0076.399] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0076.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea2c) returned 1 [0076.399] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), fInfoLevelId=0x0, lpFileInformation=0x24eaa8 | out: lpFileInformation=0x24eaa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0076.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea28) returned 1 [0076.399] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\zw1Mn5NX.mkv", nBufferLength=0x105, lpBuffer=0x24e4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\zw1Mn5NX.mkv", lpFilePart=0x0) returned 0x31 [0076.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e998) returned 1 [0076.399] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\zw1Mn5NX.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\zw1mn5nx.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0076.401] GetFileType (hFile=0x26c) returned 0x1 [0076.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e994) returned 1 [0076.401] GetFileType (hFile=0x26c) returned 0x1 [0076.401] WriteFile (in: hFile=0x26c, lpBuffer=0x28924a4*, nNumberOfBytesToWrite=0xa340, lpNumberOfBytesWritten=0x24ea54, lpOverlapped=0x0 | out: lpBuffer=0x28924a4*, lpNumberOfBytesWritten=0x24ea54*=0xa340, lpOverlapped=0x0) returned 1 [0076.403] CloseHandle (hObject=0x26c) returned 1 [0076.408] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\zw1Mn5NX.mkv", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\zw1Mn5NX.mkv", lpFilePart=0x0) returned 0x31 [0076.408] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\zw1Mn5NX.mkv.Crypted", nBufferLength=0x105, lpBuffer=0x24e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\zw1Mn5NX.mkv.Crypted", lpFilePart=0x0) returned 0x39 [0076.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea38) returned 1 [0076.409] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\zw1Mn5NX.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\zw1mn5nx.mkv"), fInfoLevelId=0x0, lpFileInformation=0x24eab4 | out: lpFileInformation=0x24eab4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8f80f0, ftCreationTime.dwHighDateTime=0x1d4c633, ftLastAccessTime.dwLowDateTime=0x7b286700, ftLastAccessTime.dwHighDateTime=0x1d4c66c, ftLastWriteTime.dwLowDateTime=0xfe6d4db0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xa340)) returned 1 [0076.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea34) returned 1 [0076.409] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\zw1Mn5NX.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\zw1mn5nx.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\zw1Mn5NX.mkv.Crypted" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\zw1mn5nx.mkv.crypted")) returned 1 [0076.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eb08) returned 1 [0076.422] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x24e610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0076.422] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x105, lpBuffer=0x24e5e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x0) returned 0x26 [0076.422] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x24e830 | out: lpFindFileData=0x24e830*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xfa9635d0, ftLastAccessTime.dwHighDateTime=0x1d50efb, ftLastWriteTime.dwLowDateTime=0xfa9635d0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b368 [0076.422] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xfa9635d0, ftLastAccessTime.dwHighDateTime=0x1d50efb, ftLastWriteTime.dwLowDateTime=0xfa9635d0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.423] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7622b9a0, ftCreationTime.dwHighDateTime=0x1d4ca62, ftLastAccessTime.dwLowDateTime=0xb7597ca0, ftLastAccessTime.dwHighDateTime=0x1d4d459, ftLastWriteTime.dwLowDateTime=0xf9e61010, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xfd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="0OLU_WDuO-G.avi.Crypted", cAlternateFileName="0OLU_W~1.CRY")) returned 1 [0076.423] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24739f10, ftCreationTime.dwHighDateTime=0x1d4d16b, ftLastAccessTime.dwLowDateTime=0x77cc720, ftLastAccessTime.dwHighDateTime=0x1d4d3e0, ftLastWriteTime.dwLowDateTime=0xf9f1f6f0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x72a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7pUxu.png.Crypted", cAlternateFileName="7PUXUP~1.CRY")) returned 1 [0076.423] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52672e70, ftCreationTime.dwHighDateTime=0x1d4cf89, ftLastAccessTime.dwLowDateTime=0x2d3efa40, ftLastAccessTime.dwHighDateTime=0x1d4cd65, ftLastWriteTime.dwLowDateTime=0x2d3efa40, ftLastWriteTime.dwHighDateTime=0x1d4cd65, nFileSizeHigh=0x0, nFileSizeLow=0x16263, dwReserved0=0x0, dwReserved1=0x0, cFileName="bUlZ.wav", cAlternateFileName="")) returned 1 [0076.423] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x180aadf0, ftCreationTime.dwHighDateTime=0x1d4c6cf, ftLastAccessTime.dwLowDateTime=0xe6c351e0, ftLastAccessTime.dwHighDateTime=0x1d4d333, ftLastWriteTime.dwLowDateTime=0xf9f91b10, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x9580, dwReserved0=0x0, dwReserved1=0x0, cFileName="C7Tgr_.mp3.Crypted", cAlternateFileName="C7TGR_~1.CRY")) returned 1 [0076.423] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0076.423] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa36ad200, ftCreationTime.dwHighDateTime=0x1d4c9d9, ftLastAccessTime.dwLowDateTime=0xe44280a0, ftLastAccessTime.dwHighDateTime=0x1d4d205, ftLastWriteTime.dwLowDateTime=0xfa003f30, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xac80, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehKvWyeZ2fgJX_l-SQv.odt.Crypted", cAlternateFileName="EHKVWY~1.CRY")) returned 1 [0076.424] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x330f14a0, ftCreationTime.dwHighDateTime=0x1d4c950, ftLastAccessTime.dwLowDateTime=0x207b1130, ftLastAccessTime.dwHighDateTime=0x1d4d53b, ftLastWriteTime.dwLowDateTime=0x207b1130, ftLastWriteTime.dwHighDateTime=0x1d4d53b, nFileSizeHigh=0x0, nFileSizeLow=0x45ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="epsNS8Zd30l2YZ.wav", cAlternateFileName="EPSNS8~1.WAV")) returned 1 [0076.424] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a65e080, ftCreationTime.dwHighDateTime=0x1d4cfec, ftLastAccessTime.dwLowDateTime=0x24c63e70, ftLastAccessTime.dwHighDateTime=0x1d4d385, ftLastWriteTime.dwLowDateTime=0x24c63e70, ftLastWriteTime.dwHighDateTime=0x1d4d385, nFileSizeHigh=0x0, nFileSizeLow=0x17541, dwReserved0=0x0, dwReserved1=0x0, cFileName="fgwF.gif", cAlternateFileName="")) returned 1 [0076.424] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9818ac90, ftCreationTime.dwHighDateTime=0x1d4ca08, ftLastAccessTime.dwLowDateTime=0x776582b0, ftLastAccessTime.dwHighDateTime=0x1d4c8c9, ftLastWriteTime.dwLowDateTime=0xfa076350, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xdd70, dwReserved0=0x0, dwReserved1=0x0, cFileName="fOu vb-KkZCDXb9.jpg.Crypted", cAlternateFileName="FOUVB-~1.CRY")) returned 1 [0076.424] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33dcb9b0, ftCreationTime.dwHighDateTime=0x1d4cc15, ftLastAccessTime.dwLowDateTime=0x72684d50, ftLastAccessTime.dwHighDateTime=0x1d4cc5d, ftLastWriteTime.dwLowDateTime=0xfa134a30, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x15390, dwReserved0=0x0, dwReserved1=0x0, cFileName="g_9K8WeNfm7cNWN.avi.Crypted", cAlternateFileName="G_9K8W~1.CRY")) returned 1 [0076.424] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b06ef50, ftCreationTime.dwHighDateTime=0x1d4d57a, ftLastAccessTime.dwLowDateTime=0x93e98300, ftLastAccessTime.dwHighDateTime=0x1d4ca22, ftLastWriteTime.dwLowDateTime=0x93e98300, ftLastWriteTime.dwHighDateTime=0x1d4ca22, nFileSizeHigh=0x0, nFileSizeLow=0x15e99, dwReserved0=0x0, dwReserved1=0x0, cFileName="i WSBk_FJLr5B.swf", cAlternateFileName="IWSBK_~1.SWF")) returned 1 [0076.424] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x579a5a10, ftCreationTime.dwHighDateTime=0x1d4d4cb, ftLastAccessTime.dwLowDateTime=0x62419550, ftLastAccessTime.dwHighDateTime=0x1d4c5fd, ftLastWriteTime.dwLowDateTime=0xfa1f3110, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x163c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jmcbdzrWyd.bmp.Crypted", cAlternateFileName="JMCBDZ~1.CRY")) returned 1 [0076.424] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c2bb620, ftCreationTime.dwHighDateTime=0x1d4cf81, ftLastAccessTime.dwLowDateTime=0x8cf2c530, ftLastAccessTime.dwHighDateTime=0x1d4d4d5, ftLastWriteTime.dwLowDateTime=0xfa28b690, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x15f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="L3ak099rEdj LwgUyNK1.avi.Crypted", cAlternateFileName="L3AK09~1.CRY")) returned 1 [0076.425] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ace7530, ftCreationTime.dwHighDateTime=0x1d4cd9b, ftLastAccessTime.dwLowDateTime=0x5ced7c90, ftLastAccessTime.dwHighDateTime=0x1d4cce2, ftLastWriteTime.dwLowDateTime=0x5ced7c90, ftLastWriteTime.dwHighDateTime=0x1d4cce2, nFileSizeHigh=0x0, nFileSizeLow=0x85b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LPK_cvxMn51.flv", cAlternateFileName="LPK_CV~1.FLV")) returned 1 [0076.426] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3404ca0, ftCreationTime.dwHighDateTime=0x1d4cbba, ftLastAccessTime.dwLowDateTime=0xb44536b0, ftLastAccessTime.dwHighDateTime=0x1d4cb64, ftLastWriteTime.dwLowDateTime=0xb44536b0, ftLastWriteTime.dwHighDateTime=0x1d4cb64, nFileSizeHigh=0x0, nFileSizeLow=0x110c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MvpDo gJgfX3JI6.wav", cAlternateFileName="MVPDOG~1.WAV")) returned 1 [0076.427] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x285e5d50, ftCreationTime.dwHighDateTime=0x1d4d359, ftLastAccessTime.dwLowDateTime=0xb4f103f0, ftLastAccessTime.dwHighDateTime=0x1d4cd0d, ftLastWriteTime.dwLowDateTime=0xfa323c10, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x6030, dwReserved0=0x0, dwReserved1=0x0, cFileName="nJXrOz1j2S6p.jpg.Crypted", cAlternateFileName="NJXROZ~1.CRY")) returned 1 [0076.427] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4a31750, ftCreationTime.dwHighDateTime=0x1d4d008, ftLastAccessTime.dwLowDateTime=0x56af3fc0, ftLastAccessTime.dwHighDateTime=0x1d4c5c2, ftLastWriteTime.dwLowDateTime=0xfa3bc190, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x128d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OJ5vU.pdf.Crypted", cAlternateFileName="OJ5VUP~1.CRY")) returned 1 [0076.427] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0ffa5a0, ftCreationTime.dwHighDateTime=0x1d4c6f1, ftLastAccessTime.dwLowDateTime=0xf45b3070, ftLastAccessTime.dwHighDateTime=0x1d4d176, ftLastWriteTime.dwLowDateTime=0xfa47a870, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x17c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="p62r5li3xXj_mf.xlsx.Crypted", cAlternateFileName="P62R5L~1.CRY")) returned 1 [0076.427] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee597350, ftCreationTime.dwHighDateTime=0x1d4c567, ftLastAccessTime.dwLowDateTime=0x5f4dee0, ftLastAccessTime.dwHighDateTime=0x1d4d180, ftLastWriteTime.dwLowDateTime=0xfa538f50, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x1d10, dwReserved0=0x0, dwReserved1=0x0, cFileName="pb2 NStFVGwaAZx.mp4.Crypted", cAlternateFileName="PB2NST~1.CRY")) returned 1 [0076.427] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b13850, ftCreationTime.dwHighDateTime=0x1d4d1f6, ftLastAccessTime.dwLowDateTime=0x418f19a0, ftLastAccessTime.dwHighDateTime=0x1d4d0f1, ftLastWriteTime.dwLowDateTime=0xfa5d14d0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x16940, dwReserved0=0x0, dwReserved1=0x0, cFileName="pqSzgB SaW6XQP.mp3.Crypted", cAlternateFileName="PQSZGB~1.CRY")) returned 1 [0076.427] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedd1b1a0, ftCreationTime.dwHighDateTime=0x1d4ccfa, ftLastAccessTime.dwLowDateTime=0x7ffbc380, ftLastAccessTime.dwHighDateTime=0x1d4d3be, ftLastWriteTime.dwLowDateTime=0xfa68fbb0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x7930, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReEoWMb1tgQr2M.avi.Crypted", cAlternateFileName="REEOWM~1.CRY")) returned 1 [0076.428] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc40ce7c0, ftCreationTime.dwHighDateTime=0x1d4cc7f, ftLastAccessTime.dwLowDateTime=0x22bd1e90, ftLastAccessTime.dwHighDateTime=0x1d4cd0f, ftLastWriteTime.dwLowDateTime=0xfa6dbe70, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xb170, dwReserved0=0x0, dwReserved1=0x0, cFileName="RLbcXhJHI.bmp.Crypted", cAlternateFileName="RLBCXH~1.CRY")) returned 1 [0076.428] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca9f78f0, ftCreationTime.dwHighDateTime=0x1d4ccb6, ftLastAccessTime.dwLowDateTime=0xfac832b0, ftLastAccessTime.dwHighDateTime=0x1d50efb, ftLastWriteTime.dwLowDateTime=0xfac832b0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rLFrgATixAVohSfL9n", cAlternateFileName="RLFRGA~1")) returned 1 [0076.428] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b8a4cf0, ftCreationTime.dwHighDateTime=0x1d4caef, ftLastAccessTime.dwLowDateTime=0xc9dd0990, ftLastAccessTime.dwHighDateTime=0x1d4cef6, ftLastWriteTime.dwLowDateTime=0xfa74e290, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xc4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpQ8TM.mp4.Crypted", cAlternateFileName="SPQ8TM~1.CRY")) returned 1 [0076.428] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf539e80, ftCreationTime.dwHighDateTime=0x1d4d111, ftLastAccessTime.dwLowDateTime=0x2e87c7f0, ftLastAccessTime.dwHighDateTime=0x1d4cb36, ftLastWriteTime.dwLowDateTime=0xfa79a550, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xcf50, dwReserved0=0x0, dwReserved1=0x0, cFileName="vbMHGI79vM_PtDv8.avi.Crypted", cAlternateFileName="VBMHGI~1.CRY")) returned 1 [0076.428] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13d3ebe0, ftCreationTime.dwHighDateTime=0x1d4cb1e, ftLastAccessTime.dwLowDateTime=0x7c2c3590, ftLastAccessTime.dwHighDateTime=0x1d4c7e4, ftLastWriteTime.dwLowDateTime=0x7c2c3590, ftLastWriteTime.dwHighDateTime=0x1d4c7e4, nFileSizeHigh=0x0, nFileSizeLow=0xb03e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vwzr.pps", cAlternateFileName="")) returned 1 [0076.428] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12e8e160, ftCreationTime.dwHighDateTime=0x1d4c9e6, ftLastAccessTime.dwLowDateTime=0xf865da00, ftLastAccessTime.dwHighDateTime=0x1d4d007, ftLastWriteTime.dwLowDateTime=0xfa87ed90, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x10ed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x4IIvHjetTqBaG.xlsx.Crypted", cAlternateFileName="X4IIVH~1.CRY")) returned 1 [0076.429] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5abc7d90, ftCreationTime.dwHighDateTime=0x1d4ce68, ftLastAccessTime.dwLowDateTime=0x74830d0, ftLastAccessTime.dwHighDateTime=0x1d4cb54, ftLastWriteTime.dwLowDateTime=0xfa8cb050, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xeca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z3XMtXvu.doc.Crypted", cAlternateFileName="Z3XMTX~1.CRY")) returned 1 [0076.429] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6139640, ftCreationTime.dwHighDateTime=0x1d4cfec, ftLastAccessTime.dwLowDateTime=0xf5afc3e0, ftLastAccessTime.dwHighDateTime=0x1d4cfc9, ftLastWriteTime.dwLowDateTime=0xfa917310, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x4620, dwReserved0=0x0, dwReserved1=0x0, cFileName="zIHHqGfcI.mp3.Crypted", cAlternateFileName="ZIHHQG~1.CRY")) returned 1 [0076.429] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7868ce30, ftCreationTime.dwHighDateTime=0x1d4c953, ftLastAccessTime.dwLowDateTime=0xf30618c0, ftLastAccessTime.dwHighDateTime=0x1d4d48c, ftLastWriteTime.dwLowDateTime=0xfa9635d0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xa440, dwReserved0=0x0, dwReserved1=0x0, cFileName="zUV-2s2ldl.rtf.Crypted", cAlternateFileName="ZUV-2S~1.CRY")) returned 1 [0076.429] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2499cb0, ftCreationTime.dwHighDateTime=0x1d4d372, ftLastAccessTime.dwLowDateTime=0x56aef580, ftLastAccessTime.dwHighDateTime=0x1d4c98f, ftLastWriteTime.dwLowDateTime=0x56aef580, ftLastWriteTime.dwHighDateTime=0x1d4c98f, nFileSizeHigh=0x0, nFileSizeLow=0x8fb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="_aeDeuxDfMl6neBTOKj.wav", cAlternateFileName="_AEDEU~1.WAV")) returned 1 [0076.429] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0076.430] FindClose (in: hFindFile=0x69b368 | out: hFindFile=0x69b368) returned 1 [0076.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eac8) returned 1 [0076.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ead4) returned 1 [0076.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eb08) returned 1 [0076.430] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x24e610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0076.430] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x105, lpBuffer=0x24e5e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x0) returned 0x26 [0076.430] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x24e830 | out: lpFindFileData=0x24e830*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xfa9635d0, ftLastAccessTime.dwHighDateTime=0x1d50efb, ftLastWriteTime.dwLowDateTime=0xfa9635d0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b368 [0076.430] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xfa9635d0, ftLastAccessTime.dwHighDateTime=0x1d50efb, ftLastWriteTime.dwLowDateTime=0xfa9635d0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.431] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7622b9a0, ftCreationTime.dwHighDateTime=0x1d4ca62, ftLastAccessTime.dwLowDateTime=0xb7597ca0, ftLastAccessTime.dwHighDateTime=0x1d4d459, ftLastWriteTime.dwLowDateTime=0xf9e61010, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xfd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="0OLU_WDuO-G.avi.Crypted", cAlternateFileName="0OLU_W~1.CRY")) returned 1 [0076.431] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24739f10, ftCreationTime.dwHighDateTime=0x1d4d16b, ftLastAccessTime.dwLowDateTime=0x77cc720, ftLastAccessTime.dwHighDateTime=0x1d4d3e0, ftLastWriteTime.dwLowDateTime=0xf9f1f6f0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x72a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7pUxu.png.Crypted", cAlternateFileName="7PUXUP~1.CRY")) returned 1 [0076.431] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52672e70, ftCreationTime.dwHighDateTime=0x1d4cf89, ftLastAccessTime.dwLowDateTime=0x2d3efa40, ftLastAccessTime.dwHighDateTime=0x1d4cd65, ftLastWriteTime.dwLowDateTime=0x2d3efa40, ftLastWriteTime.dwHighDateTime=0x1d4cd65, nFileSizeHigh=0x0, nFileSizeLow=0x16263, dwReserved0=0x0, dwReserved1=0x0, cFileName="bUlZ.wav", cAlternateFileName="")) returned 1 [0076.431] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x180aadf0, ftCreationTime.dwHighDateTime=0x1d4c6cf, ftLastAccessTime.dwLowDateTime=0xe6c351e0, ftLastAccessTime.dwHighDateTime=0x1d4d333, ftLastWriteTime.dwLowDateTime=0xf9f91b10, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x9580, dwReserved0=0x0, dwReserved1=0x0, cFileName="C7Tgr_.mp3.Crypted", cAlternateFileName="C7TGR_~1.CRY")) returned 1 [0076.431] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0076.432] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa36ad200, ftCreationTime.dwHighDateTime=0x1d4c9d9, ftLastAccessTime.dwLowDateTime=0xe44280a0, ftLastAccessTime.dwHighDateTime=0x1d4d205, ftLastWriteTime.dwLowDateTime=0xfa003f30, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xac80, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehKvWyeZ2fgJX_l-SQv.odt.Crypted", cAlternateFileName="EHKVWY~1.CRY")) returned 1 [0076.432] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x330f14a0, ftCreationTime.dwHighDateTime=0x1d4c950, ftLastAccessTime.dwLowDateTime=0x207b1130, ftLastAccessTime.dwHighDateTime=0x1d4d53b, ftLastWriteTime.dwLowDateTime=0x207b1130, ftLastWriteTime.dwHighDateTime=0x1d4d53b, nFileSizeHigh=0x0, nFileSizeLow=0x45ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="epsNS8Zd30l2YZ.wav", cAlternateFileName="EPSNS8~1.WAV")) returned 1 [0076.432] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a65e080, ftCreationTime.dwHighDateTime=0x1d4cfec, ftLastAccessTime.dwLowDateTime=0x24c63e70, ftLastAccessTime.dwHighDateTime=0x1d4d385, ftLastWriteTime.dwLowDateTime=0x24c63e70, ftLastWriteTime.dwHighDateTime=0x1d4d385, nFileSizeHigh=0x0, nFileSizeLow=0x17541, dwReserved0=0x0, dwReserved1=0x0, cFileName="fgwF.gif", cAlternateFileName="")) returned 1 [0076.432] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9818ac90, ftCreationTime.dwHighDateTime=0x1d4ca08, ftLastAccessTime.dwLowDateTime=0x776582b0, ftLastAccessTime.dwHighDateTime=0x1d4c8c9, ftLastWriteTime.dwLowDateTime=0xfa076350, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xdd70, dwReserved0=0x0, dwReserved1=0x0, cFileName="fOu vb-KkZCDXb9.jpg.Crypted", cAlternateFileName="FOUVB-~1.CRY")) returned 1 [0076.432] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33dcb9b0, ftCreationTime.dwHighDateTime=0x1d4cc15, ftLastAccessTime.dwLowDateTime=0x72684d50, ftLastAccessTime.dwHighDateTime=0x1d4cc5d, ftLastWriteTime.dwLowDateTime=0xfa134a30, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x15390, dwReserved0=0x0, dwReserved1=0x0, cFileName="g_9K8WeNfm7cNWN.avi.Crypted", cAlternateFileName="G_9K8W~1.CRY")) returned 1 [0076.433] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b06ef50, ftCreationTime.dwHighDateTime=0x1d4d57a, ftLastAccessTime.dwLowDateTime=0x93e98300, ftLastAccessTime.dwHighDateTime=0x1d4ca22, ftLastWriteTime.dwLowDateTime=0x93e98300, ftLastWriteTime.dwHighDateTime=0x1d4ca22, nFileSizeHigh=0x0, nFileSizeLow=0x15e99, dwReserved0=0x0, dwReserved1=0x0, cFileName="i WSBk_FJLr5B.swf", cAlternateFileName="IWSBK_~1.SWF")) returned 1 [0076.433] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x579a5a10, ftCreationTime.dwHighDateTime=0x1d4d4cb, ftLastAccessTime.dwLowDateTime=0x62419550, ftLastAccessTime.dwHighDateTime=0x1d4c5fd, ftLastWriteTime.dwLowDateTime=0xfa1f3110, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x163c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jmcbdzrWyd.bmp.Crypted", cAlternateFileName="JMCBDZ~1.CRY")) returned 1 [0076.433] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c2bb620, ftCreationTime.dwHighDateTime=0x1d4cf81, ftLastAccessTime.dwLowDateTime=0x8cf2c530, ftLastAccessTime.dwHighDateTime=0x1d4d4d5, ftLastWriteTime.dwLowDateTime=0xfa28b690, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x15f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="L3ak099rEdj LwgUyNK1.avi.Crypted", cAlternateFileName="L3AK09~1.CRY")) returned 1 [0076.433] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ace7530, ftCreationTime.dwHighDateTime=0x1d4cd9b, ftLastAccessTime.dwLowDateTime=0x5ced7c90, ftLastAccessTime.dwHighDateTime=0x1d4cce2, ftLastWriteTime.dwLowDateTime=0x5ced7c90, ftLastWriteTime.dwHighDateTime=0x1d4cce2, nFileSizeHigh=0x0, nFileSizeLow=0x85b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LPK_cvxMn51.flv", cAlternateFileName="LPK_CV~1.FLV")) returned 1 [0076.434] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3404ca0, ftCreationTime.dwHighDateTime=0x1d4cbba, ftLastAccessTime.dwLowDateTime=0xb44536b0, ftLastAccessTime.dwHighDateTime=0x1d4cb64, ftLastWriteTime.dwLowDateTime=0xb44536b0, ftLastWriteTime.dwHighDateTime=0x1d4cb64, nFileSizeHigh=0x0, nFileSizeLow=0x110c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MvpDo gJgfX3JI6.wav", cAlternateFileName="MVPDOG~1.WAV")) returned 1 [0076.434] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x285e5d50, ftCreationTime.dwHighDateTime=0x1d4d359, ftLastAccessTime.dwLowDateTime=0xb4f103f0, ftLastAccessTime.dwHighDateTime=0x1d4cd0d, ftLastWriteTime.dwLowDateTime=0xfa323c10, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x6030, dwReserved0=0x0, dwReserved1=0x0, cFileName="nJXrOz1j2S6p.jpg.Crypted", cAlternateFileName="NJXROZ~1.CRY")) returned 1 [0076.434] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4a31750, ftCreationTime.dwHighDateTime=0x1d4d008, ftLastAccessTime.dwLowDateTime=0x56af3fc0, ftLastAccessTime.dwHighDateTime=0x1d4c5c2, ftLastWriteTime.dwLowDateTime=0xfa3bc190, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x128d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OJ5vU.pdf.Crypted", cAlternateFileName="OJ5VUP~1.CRY")) returned 1 [0076.434] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0ffa5a0, ftCreationTime.dwHighDateTime=0x1d4c6f1, ftLastAccessTime.dwLowDateTime=0xf45b3070, ftLastAccessTime.dwHighDateTime=0x1d4d176, ftLastWriteTime.dwLowDateTime=0xfa47a870, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x17c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="p62r5li3xXj_mf.xlsx.Crypted", cAlternateFileName="P62R5L~1.CRY")) returned 1 [0076.434] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee597350, ftCreationTime.dwHighDateTime=0x1d4c567, ftLastAccessTime.dwLowDateTime=0x5f4dee0, ftLastAccessTime.dwHighDateTime=0x1d4d180, ftLastWriteTime.dwLowDateTime=0xfa538f50, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x1d10, dwReserved0=0x0, dwReserved1=0x0, cFileName="pb2 NStFVGwaAZx.mp4.Crypted", cAlternateFileName="PB2NST~1.CRY")) returned 1 [0076.435] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b13850, ftCreationTime.dwHighDateTime=0x1d4d1f6, ftLastAccessTime.dwLowDateTime=0x418f19a0, ftLastAccessTime.dwHighDateTime=0x1d4d0f1, ftLastWriteTime.dwLowDateTime=0xfa5d14d0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x16940, dwReserved0=0x0, dwReserved1=0x0, cFileName="pqSzgB SaW6XQP.mp3.Crypted", cAlternateFileName="PQSZGB~1.CRY")) returned 1 [0076.435] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedd1b1a0, ftCreationTime.dwHighDateTime=0x1d4ccfa, ftLastAccessTime.dwLowDateTime=0x7ffbc380, ftLastAccessTime.dwHighDateTime=0x1d4d3be, ftLastWriteTime.dwLowDateTime=0xfa68fbb0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x7930, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReEoWMb1tgQr2M.avi.Crypted", cAlternateFileName="REEOWM~1.CRY")) returned 1 [0076.435] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc40ce7c0, ftCreationTime.dwHighDateTime=0x1d4cc7f, ftLastAccessTime.dwLowDateTime=0x22bd1e90, ftLastAccessTime.dwHighDateTime=0x1d4cd0f, ftLastWriteTime.dwLowDateTime=0xfa6dbe70, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xb170, dwReserved0=0x0, dwReserved1=0x0, cFileName="RLbcXhJHI.bmp.Crypted", cAlternateFileName="RLBCXH~1.CRY")) returned 1 [0076.435] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca9f78f0, ftCreationTime.dwHighDateTime=0x1d4ccb6, ftLastAccessTime.dwLowDateTime=0xfac832b0, ftLastAccessTime.dwHighDateTime=0x1d50efb, ftLastWriteTime.dwLowDateTime=0xfac832b0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rLFrgATixAVohSfL9n", cAlternateFileName="RLFRGA~1")) returned 1 [0076.435] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b8a4cf0, ftCreationTime.dwHighDateTime=0x1d4caef, ftLastAccessTime.dwLowDateTime=0xc9dd0990, ftLastAccessTime.dwHighDateTime=0x1d4cef6, ftLastWriteTime.dwLowDateTime=0xfa74e290, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xc4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpQ8TM.mp4.Crypted", cAlternateFileName="SPQ8TM~1.CRY")) returned 1 [0076.436] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf539e80, ftCreationTime.dwHighDateTime=0x1d4d111, ftLastAccessTime.dwLowDateTime=0x2e87c7f0, ftLastAccessTime.dwHighDateTime=0x1d4cb36, ftLastWriteTime.dwLowDateTime=0xfa79a550, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xcf50, dwReserved0=0x0, dwReserved1=0x0, cFileName="vbMHGI79vM_PtDv8.avi.Crypted", cAlternateFileName="VBMHGI~1.CRY")) returned 1 [0076.436] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13d3ebe0, ftCreationTime.dwHighDateTime=0x1d4cb1e, ftLastAccessTime.dwLowDateTime=0x7c2c3590, ftLastAccessTime.dwHighDateTime=0x1d4c7e4, ftLastWriteTime.dwLowDateTime=0x7c2c3590, ftLastWriteTime.dwHighDateTime=0x1d4c7e4, nFileSizeHigh=0x0, nFileSizeLow=0xb03e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vwzr.pps", cAlternateFileName="")) returned 1 [0076.436] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12e8e160, ftCreationTime.dwHighDateTime=0x1d4c9e6, ftLastAccessTime.dwLowDateTime=0xf865da00, ftLastAccessTime.dwHighDateTime=0x1d4d007, ftLastWriteTime.dwLowDateTime=0xfa87ed90, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x10ed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x4IIvHjetTqBaG.xlsx.Crypted", cAlternateFileName="X4IIVH~1.CRY")) returned 1 [0076.436] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5abc7d90, ftCreationTime.dwHighDateTime=0x1d4ce68, ftLastAccessTime.dwLowDateTime=0x74830d0, ftLastAccessTime.dwHighDateTime=0x1d4cb54, ftLastWriteTime.dwLowDateTime=0xfa8cb050, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xeca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z3XMtXvu.doc.Crypted", cAlternateFileName="Z3XMTX~1.CRY")) returned 1 [0076.436] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6139640, ftCreationTime.dwHighDateTime=0x1d4cfec, ftLastAccessTime.dwLowDateTime=0xf5afc3e0, ftLastAccessTime.dwHighDateTime=0x1d4cfc9, ftLastWriteTime.dwLowDateTime=0xfa917310, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x4620, dwReserved0=0x0, dwReserved1=0x0, cFileName="zIHHqGfcI.mp3.Crypted", cAlternateFileName="ZIHHQG~1.CRY")) returned 1 [0076.437] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7868ce30, ftCreationTime.dwHighDateTime=0x1d4c953, ftLastAccessTime.dwLowDateTime=0xf30618c0, ftLastAccessTime.dwHighDateTime=0x1d4d48c, ftLastWriteTime.dwLowDateTime=0xfa9635d0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xa440, dwReserved0=0x0, dwReserved1=0x0, cFileName="zUV-2s2ldl.rtf.Crypted", cAlternateFileName="ZUV-2S~1.CRY")) returned 1 [0076.437] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2499cb0, ftCreationTime.dwHighDateTime=0x1d4d372, ftLastAccessTime.dwLowDateTime=0x56aef580, ftLastAccessTime.dwHighDateTime=0x1d4c98f, ftLastWriteTime.dwLowDateTime=0x56aef580, ftLastWriteTime.dwHighDateTime=0x1d4c98f, nFileSizeHigh=0x0, nFileSizeLow=0x8fb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="_aeDeuxDfMl6neBTOKj.wav", cAlternateFileName="_AEDEU~1.WAV")) returned 1 [0076.437] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e840 | out: lpFindFileData=0x24e840*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2499cb0, ftCreationTime.dwHighDateTime=0x1d4d372, ftLastAccessTime.dwLowDateTime=0x56aef580, ftLastAccessTime.dwHighDateTime=0x1d4c98f, ftLastWriteTime.dwLowDateTime=0x56aef580, ftLastWriteTime.dwHighDateTime=0x1d4c98f, nFileSizeHigh=0x0, nFileSizeLow=0x8fb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="_aeDeuxDfMl6neBTOKj.wav", cAlternateFileName="_AEDEU~1.WAV")) returned 0 [0076.437] FindClose (in: hFindFile=0x69b368 | out: hFindFile=0x69b368) returned 1 [0076.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eac8) returned 1 [0076.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ead4) returned 1 [0076.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0076.438] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n", lpFilePart=0x0) returned 0x38 [0076.438] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\", lpFilePart=0x0) returned 0x39 [0076.438] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca9f78f0, ftCreationTime.dwHighDateTime=0x1d4ccb6, ftLastAccessTime.dwLowDateTime=0xfac832b0, ftLastAccessTime.dwHighDateTime=0x1d50efb, ftLastWriteTime.dwLowDateTime=0xfac832b0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b368 [0076.438] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca9f78f0, ftCreationTime.dwHighDateTime=0x1d4ccb6, ftLastAccessTime.dwLowDateTime=0xfac832b0, ftLastAccessTime.dwHighDateTime=0x1d50efb, ftLastWriteTime.dwLowDateTime=0xfac832b0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.438] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4967bdf0, ftCreationTime.dwHighDateTime=0x1d4d1ad, ftLastAccessTime.dwLowDateTime=0x17949fd0, ftLastAccessTime.dwHighDateTime=0x1d4cf70, ftLastWriteTime.dwLowDateTime=0x17949fd0, ftLastWriteTime.dwHighDateTime=0x1d4cf70, nFileSizeHigh=0x0, nFileSizeLow=0x700b, dwReserved0=0x0, dwReserved1=0x0, cFileName="2EB4B-2WT0hASHP.wav", cAlternateFileName="2EB4B-~1.WAV")) returned 1 [0076.439] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bd14630, ftCreationTime.dwHighDateTime=0x1d4cdea, ftLastAccessTime.dwLowDateTime=0x10585cc0, ftLastAccessTime.dwHighDateTime=0x1d4d18c, ftLastWriteTime.dwLowDateTime=0xfaa21cb0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xd750, dwReserved0=0x0, dwReserved1=0x0, cFileName="67dOKAPnjN2x.csv.Crypted", cAlternateFileName="67DOKA~1.CRY")) returned 1 [0076.439] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7178a20, ftCreationTime.dwHighDateTime=0x1d4d102, ftLastAccessTime.dwLowDateTime=0xcea19d0, ftLastAccessTime.dwHighDateTime=0x1d4c740, ftLastWriteTime.dwLowDateTime=0xcea19d0, ftLastWriteTime.dwHighDateTime=0x1d4c740, nFileSizeHigh=0x0, nFileSizeLow=0x4165, dwReserved0=0x0, dwReserved1=0x0, cFileName="9qtL_jhF8GzsNbrNKF.swf", cAlternateFileName="9QTL_J~1.SWF")) returned 1 [0076.439] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x609f8d0, ftCreationTime.dwHighDateTime=0x1d4cac2, ftLastAccessTime.dwLowDateTime=0xb43b6680, ftLastAccessTime.dwHighDateTime=0x1d4d0a5, ftLastWriteTime.dwLowDateTime=0xb43b6680, ftLastWriteTime.dwHighDateTime=0x1d4d0a5, nFileSizeHigh=0x0, nFileSizeLow=0x18c0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="C5vaFHqg.flv", cAlternateFileName="")) returned 1 [0076.439] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc2e0ac0, ftCreationTime.dwHighDateTime=0x1d4cd0f, ftLastAccessTime.dwLowDateTime=0x178f7540, ftLastAccessTime.dwHighDateTime=0x1d4cfa8, ftLastWriteTime.dwLowDateTime=0xfaa940d0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x14790, dwReserved0=0x0, dwReserved1=0x0, cFileName="dKGpmJ65l.mp4.Crypted", cAlternateFileName="DKGPMJ~1.CRY")) returned 1 [0076.439] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec17e320, ftCreationTime.dwHighDateTime=0x1d4d21d, ftLastAccessTime.dwLowDateTime=0x3c34ec30, ftLastAccessTime.dwHighDateTime=0x1d4c658, ftLastWriteTime.dwLowDateTime=0xfaae0390, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x164d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hz9X2Shn0.mp4.Crypted", cAlternateFileName="HZ9X2S~1.CRY")) returned 1 [0076.675] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e0f8930, ftCreationTime.dwHighDateTime=0x1d4c616, ftLastAccessTime.dwLowDateTime=0x345cdf0, ftLastAccessTime.dwHighDateTime=0x1d4d250, ftLastWriteTime.dwLowDateTime=0xfab78910, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x12c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IGCbggAf_Nct.mp4.Crypted", cAlternateFileName="IGCBGG~1.CRY")) returned 1 [0076.675] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d8bfd30, ftCreationTime.dwHighDateTime=0x1d4d3ff, ftLastAccessTime.dwLowDateTime=0x8921af0, ftLastAccessTime.dwHighDateTime=0x1d4c63b, ftLastWriteTime.dwLowDateTime=0x8921af0, ftLastWriteTime.dwHighDateTime=0x1d4c63b, nFileSizeHigh=0x0, nFileSizeLow=0xd4ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="k1aNSWAPplNTI7.m4a", cAlternateFileName="K1ANSW~1.M4A")) returned 1 [0076.675] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a4dc8a0, ftCreationTime.dwHighDateTime=0x1d4cade, ftLastAccessTime.dwLowDateTime=0x190eeed0, ftLastAccessTime.dwHighDateTime=0x1d4d315, ftLastWriteTime.dwLowDateTime=0x190eeed0, ftLastWriteTime.dwHighDateTime=0x1d4d315, nFileSizeHigh=0x0, nFileSizeLow=0x12dc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="nt6RHYmsSeDAl2yNB9X.flv", cAlternateFileName="NT6RHY~1.FLV")) returned 1 [0076.675] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e8c180, ftCreationTime.dwHighDateTime=0x1d4c5cd, ftLastAccessTime.dwLowDateTime=0xef440570, ftLastAccessTime.dwHighDateTime=0x1d4d2d0, ftLastWriteTime.dwLowDateTime=0xef440570, ftLastWriteTime.dwHighDateTime=0x1d4d2d0, nFileSizeHigh=0x0, nFileSizeLow=0x3e81, dwReserved0=0x0, dwReserved1=0x0, cFileName="TrFOau0_R6INSQTQhu.wav", cAlternateFileName="TRFOAU~1.WAV")) returned 1 [0076.676] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8945e30, ftCreationTime.dwHighDateTime=0x1d4d37c, ftLastAccessTime.dwLowDateTime=0xea312350, ftLastAccessTime.dwHighDateTime=0x1d4cb2e, ftLastWriteTime.dwLowDateTime=0xfac832b0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x189d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UjQDqOcmc-0Sq.jpg.Crypted", cAlternateFileName="UJQDQO~1.CRY")) returned 1 [0076.676] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x717c53d0, ftCreationTime.dwHighDateTime=0x1d4d088, ftLastAccessTime.dwLowDateTime=0x52035bb0, ftLastAccessTime.dwHighDateTime=0x1d4d0ca, ftLastWriteTime.dwLowDateTime=0x52035bb0, ftLastWriteTime.dwHighDateTime=0x1d4d0ca, nFileSizeHigh=0x0, nFileSizeLow=0xd125, dwReserved0=0x0, dwReserved1=0x0, cFileName="vCupig8i.wav", cAlternateFileName="")) returned 1 [0076.676] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c725650, ftCreationTime.dwHighDateTime=0x1d4cb05, ftLastAccessTime.dwLowDateTime=0x51ec6e20, ftLastAccessTime.dwHighDateTime=0x1d4d384, ftLastWriteTime.dwLowDateTime=0x51ec6e20, ftLastWriteTime.dwHighDateTime=0x1d4d384, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="vnCWUYv9oTJ.pps", cAlternateFileName="VNCWUY~1.PPS")) returned 1 [0076.676] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0076.676] FindClose (in: hFindFile=0x69b368 | out: hFindFile=0x69b368) returned 1 [0076.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea54) returned 1 [0076.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea60) returned 1 [0076.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24ea94) returned 1 [0076.677] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n", nBufferLength=0x105, lpBuffer=0x24e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n", lpFilePart=0x0) returned 0x38 [0076.677] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\", nBufferLength=0x105, lpBuffer=0x24e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\", lpFilePart=0x0) returned 0x39 [0076.677] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rLFrgATixAVohSfL9n\\*", lpFindFileData=0x24e7bc | out: lpFindFileData=0x24e7bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca9f78f0, ftCreationTime.dwHighDateTime=0x1d4ccb6, ftLastAccessTime.dwLowDateTime=0xfac832b0, ftLastAccessTime.dwHighDateTime=0x1d50efb, ftLastWriteTime.dwLowDateTime=0xfac832b0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x69b368 [0076.677] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca9f78f0, ftCreationTime.dwHighDateTime=0x1d4ccb6, ftLastAccessTime.dwLowDateTime=0xfac832b0, ftLastAccessTime.dwHighDateTime=0x1d50efb, ftLastWriteTime.dwLowDateTime=0xfac832b0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.677] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4967bdf0, ftCreationTime.dwHighDateTime=0x1d4d1ad, ftLastAccessTime.dwLowDateTime=0x17949fd0, ftLastAccessTime.dwHighDateTime=0x1d4cf70, ftLastWriteTime.dwLowDateTime=0x17949fd0, ftLastWriteTime.dwHighDateTime=0x1d4cf70, nFileSizeHigh=0x0, nFileSizeLow=0x700b, dwReserved0=0x0, dwReserved1=0x0, cFileName="2EB4B-2WT0hASHP.wav", cAlternateFileName="2EB4B-~1.WAV")) returned 1 [0076.677] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bd14630, ftCreationTime.dwHighDateTime=0x1d4cdea, ftLastAccessTime.dwLowDateTime=0x10585cc0, ftLastAccessTime.dwHighDateTime=0x1d4d18c, ftLastWriteTime.dwLowDateTime=0xfaa21cb0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0xd750, dwReserved0=0x0, dwReserved1=0x0, cFileName="67dOKAPnjN2x.csv.Crypted", cAlternateFileName="67DOKA~1.CRY")) returned 1 [0076.678] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7178a20, ftCreationTime.dwHighDateTime=0x1d4d102, ftLastAccessTime.dwLowDateTime=0xcea19d0, ftLastAccessTime.dwHighDateTime=0x1d4c740, ftLastWriteTime.dwLowDateTime=0xcea19d0, ftLastWriteTime.dwHighDateTime=0x1d4c740, nFileSizeHigh=0x0, nFileSizeLow=0x4165, dwReserved0=0x0, dwReserved1=0x0, cFileName="9qtL_jhF8GzsNbrNKF.swf", cAlternateFileName="9QTL_J~1.SWF")) returned 1 [0076.678] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x609f8d0, ftCreationTime.dwHighDateTime=0x1d4cac2, ftLastAccessTime.dwLowDateTime=0xb43b6680, ftLastAccessTime.dwHighDateTime=0x1d4d0a5, ftLastWriteTime.dwLowDateTime=0xb43b6680, ftLastWriteTime.dwHighDateTime=0x1d4d0a5, nFileSizeHigh=0x0, nFileSizeLow=0x18c0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="C5vaFHqg.flv", cAlternateFileName="")) returned 1 [0076.678] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc2e0ac0, ftCreationTime.dwHighDateTime=0x1d4cd0f, ftLastAccessTime.dwLowDateTime=0x178f7540, ftLastAccessTime.dwHighDateTime=0x1d4cfa8, ftLastWriteTime.dwLowDateTime=0xfaa940d0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x14790, dwReserved0=0x0, dwReserved1=0x0, cFileName="dKGpmJ65l.mp4.Crypted", cAlternateFileName="DKGPMJ~1.CRY")) returned 1 [0076.678] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec17e320, ftCreationTime.dwHighDateTime=0x1d4d21d, ftLastAccessTime.dwLowDateTime=0x3c34ec30, ftLastAccessTime.dwHighDateTime=0x1d4c658, ftLastWriteTime.dwLowDateTime=0xfaae0390, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x164d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hz9X2Shn0.mp4.Crypted", cAlternateFileName="HZ9X2S~1.CRY")) returned 1 [0076.678] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e0f8930, ftCreationTime.dwHighDateTime=0x1d4c616, ftLastAccessTime.dwLowDateTime=0x345cdf0, ftLastAccessTime.dwHighDateTime=0x1d4d250, ftLastWriteTime.dwLowDateTime=0xfab78910, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x12c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IGCbggAf_Nct.mp4.Crypted", cAlternateFileName="IGCBGG~1.CRY")) returned 1 [0076.678] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d8bfd30, ftCreationTime.dwHighDateTime=0x1d4d3ff, ftLastAccessTime.dwLowDateTime=0x8921af0, ftLastAccessTime.dwHighDateTime=0x1d4c63b, ftLastWriteTime.dwLowDateTime=0x8921af0, ftLastWriteTime.dwHighDateTime=0x1d4c63b, nFileSizeHigh=0x0, nFileSizeLow=0xd4ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="k1aNSWAPplNTI7.m4a", cAlternateFileName="K1ANSW~1.M4A")) returned 1 [0076.679] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a4dc8a0, ftCreationTime.dwHighDateTime=0x1d4cade, ftLastAccessTime.dwLowDateTime=0x190eeed0, ftLastAccessTime.dwHighDateTime=0x1d4d315, ftLastWriteTime.dwLowDateTime=0x190eeed0, ftLastWriteTime.dwHighDateTime=0x1d4d315, nFileSizeHigh=0x0, nFileSizeLow=0x12dc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="nt6RHYmsSeDAl2yNB9X.flv", cAlternateFileName="NT6RHY~1.FLV")) returned 1 [0076.679] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e8c180, ftCreationTime.dwHighDateTime=0x1d4c5cd, ftLastAccessTime.dwLowDateTime=0xef440570, ftLastAccessTime.dwHighDateTime=0x1d4d2d0, ftLastWriteTime.dwLowDateTime=0xef440570, ftLastWriteTime.dwHighDateTime=0x1d4d2d0, nFileSizeHigh=0x0, nFileSizeLow=0x3e81, dwReserved0=0x0, dwReserved1=0x0, cFileName="TrFOau0_R6INSQTQhu.wav", cAlternateFileName="TRFOAU~1.WAV")) returned 1 [0076.679] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8945e30, ftCreationTime.dwHighDateTime=0x1d4d37c, ftLastAccessTime.dwLowDateTime=0xea312350, ftLastAccessTime.dwHighDateTime=0x1d4cb2e, ftLastWriteTime.dwLowDateTime=0xfac832b0, ftLastWriteTime.dwHighDateTime=0x1d50efb, nFileSizeHigh=0x0, nFileSizeLow=0x189d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UjQDqOcmc-0Sq.jpg.Crypted", cAlternateFileName="UJQDQO~1.CRY")) returned 1 [0076.679] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x717c53d0, ftCreationTime.dwHighDateTime=0x1d4d088, ftLastAccessTime.dwLowDateTime=0x52035bb0, ftLastAccessTime.dwHighDateTime=0x1d4d0ca, ftLastWriteTime.dwLowDateTime=0x52035bb0, ftLastWriteTime.dwHighDateTime=0x1d4d0ca, nFileSizeHigh=0x0, nFileSizeLow=0xd125, dwReserved0=0x0, dwReserved1=0x0, cFileName="vCupig8i.wav", cAlternateFileName="")) returned 1 [0076.679] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c725650, ftCreationTime.dwHighDateTime=0x1d4cb05, ftLastAccessTime.dwLowDateTime=0x51ec6e20, ftLastAccessTime.dwHighDateTime=0x1d4d384, ftLastWriteTime.dwLowDateTime=0x51ec6e20, ftLastWriteTime.dwHighDateTime=0x1d4d384, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="vnCWUYv9oTJ.pps", cAlternateFileName="VNCWUY~1.PPS")) returned 1 [0076.680] FindNextFileW (in: hFindFile=0x69b368, lpFindFileData=0x24e7cc | out: lpFindFileData=0x24e7cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c725650, ftCreationTime.dwHighDateTime=0x1d4cb05, ftLastAccessTime.dwLowDateTime=0x51ec6e20, ftLastAccessTime.dwHighDateTime=0x1d4d384, ftLastWriteTime.dwLowDateTime=0x51ec6e20, ftLastWriteTime.dwHighDateTime=0x1d4d384, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="vnCWUYv9oTJ.pps", cAlternateFileName="VNCWUY~1.PPS")) returned 0 [0076.680] FindClose (in: hFindFile=0x69b368 | out: hFindFile=0x69b368) returned 1 [0076.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea54) returned 1 [0076.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24ea60) returned 1 [0076.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eb08) returned 1 [0076.680] GetFullPathNameW (in: lpFileName="D:\\", nBufferLength=0x105, lpBuffer=0x24e610, lpFilePart=0x0 | out: lpBuffer="D:\\", lpFilePart=0x0) returned 0x3 [0076.680] GetFullPathNameW (in: lpFileName="D:\\", nBufferLength=0x105, lpBuffer=0x24e5e4, lpFilePart=0x0 | out: lpBuffer="D:\\", lpFilePart=0x0) returned 0x3 [0076.680] FindFirstFileW (in: lpFileName="D:\\*", lpFindFileData=0x24e830 | out: lpFindFileData=0x24e830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0076.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eacc) returned 1 [0076.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eb08) returned 1 [0076.682] GetFullPathNameW (in: lpFileName="E:\\", nBufferLength=0x105, lpBuffer=0x24e610, lpFilePart=0x0 | out: lpBuffer="E:\\", lpFilePart=0x0) returned 0x3 [0076.682] GetFullPathNameW (in: lpFileName="E:\\", nBufferLength=0x105, lpBuffer=0x24e5e4, lpFilePart=0x0 | out: lpBuffer="E:\\", lpFilePart=0x0) returned 0x3 [0076.682] FindFirstFileW (in: lpFileName="E:\\*", lpFindFileData=0x24e830 | out: lpFindFileData=0x24e830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0076.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eacc) returned 1 [0076.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eb08) returned 1 [0076.683] GetFullPathNameW (in: lpFileName="B:\\", nBufferLength=0x105, lpBuffer=0x24e610, lpFilePart=0x0 | out: lpBuffer="B:\\", lpFilePart=0x0) returned 0x3 [0076.683] GetFullPathNameW (in: lpFileName="B:\\", nBufferLength=0x105, lpBuffer=0x24e5e4, lpFilePart=0x0 | out: lpBuffer="B:\\", lpFilePart=0x0) returned 0x3 [0076.683] FindFirstFileW (in: lpFileName="B:\\*", lpFindFileData=0x24e830 | out: lpFindFileData=0x24e830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0076.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eacc) returned 1 [0076.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eb08) returned 1 [0076.685] GetFullPathNameW (in: lpFileName="F:\\", nBufferLength=0x105, lpBuffer=0x24e610, lpFilePart=0x0 | out: lpBuffer="F:\\", lpFilePart=0x0) returned 0x3 [0076.685] GetFullPathNameW (in: lpFileName="F:\\", nBufferLength=0x105, lpBuffer=0x24e5e4, lpFilePart=0x0 | out: lpBuffer="F:\\", lpFilePart=0x0) returned 0x3 [0076.685] FindFirstFileW (in: lpFileName="F:\\*", lpFindFileData=0x24e830 | out: lpFindFileData=0x24e830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0076.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eacc) returned 1 [0076.693] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", nBufferLength=0x105, lpBuffer=0x24e5f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt", lpFilePart=0x0) returned 0x3e [0076.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24eaec) returned 1 [0076.694] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x26c [0076.695] GetFileType (hFile=0x26c) returned 0x1 [0076.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24eae8) returned 1 [0076.695] GetFileType (hFile=0x26c) returned 0x1 [0076.696] WriteFile (in: hFile=0x26c, lpBuffer=0x28acba0*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x24eb68, lpOverlapped=0x0 | out: lpBuffer=0x28acba0*, lpNumberOfBytesWritten=0x24eb68*=0x2e0, lpOverlapped=0x0) returned 1 [0076.697] CloseHandle (hObject=0x26c) returned 1 [0077.157] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ss.exe.config", nBufferLength=0x105, lpBuffer=0x24e530, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ss.exe.config", lpFilePart=0x0) returned 0x33 [0077.157] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ss.exe.config", nBufferLength=0x105, lpBuffer=0x24e4dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ss.exe.config", lpFilePart=0x0) returned 0x33 [0078.656] GetCurrentProcess () returned 0xffffffff [0078.656] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x24e884 | out: TokenHandle=0x24e884*=0x270) returned 1 [0078.660] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x24e364, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0078.666] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x24e884 | out: lpFileInformation=0x24e884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0cc4300, ftCreationTime.dwHighDateTime=0x1cd5cf4, ftLastAccessTime.dwLowDateTime=0xcf7ee640, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc0cc4300, ftLastWriteTime.dwHighDateTime=0x1cd5cf4, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0078.667] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x24e330, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0078.667] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x24e884 | out: lpFileInformation=0x24e884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0cc4300, ftCreationTime.dwHighDateTime=0x1cd5cf4, ftLastAccessTime.dwLowDateTime=0xcf7ee640, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc0cc4300, ftLastWriteTime.dwHighDateTime=0x1cd5cf4, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0078.667] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x24e2bc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0078.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x24e7b0) returned 1 [0078.667] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x268 [0078.667] GetFileType (hFile=0x268) returned 0x1 [0078.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x24e7ac) returned 1 [0078.667] GetFileType (hFile=0x268) returned 0x1 [0079.159] GetFileSize (in: hFile=0x268, lpFileSizeHigh=0x24e878 | out: lpFileSizeHigh=0x24e878*=0x0) returned 0x8c8f [0079.159] ReadFile (in: hFile=0x268, lpBuffer=0x274ce94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x24e834, lpOverlapped=0x0 | out: lpBuffer=0x274ce94*, lpNumberOfBytesRead=0x24e834*=0x1000, lpOverlapped=0x0) returned 1 [0079.269] ReadFile (in: hFile=0x268, lpBuffer=0x274ce94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x24e6d0, lpOverlapped=0x0 | out: lpBuffer=0x274ce94*, lpNumberOfBytesRead=0x24e6d0*=0x1000, lpOverlapped=0x0) returned 1 [0079.619] ReadFile (in: hFile=0x268, lpBuffer=0x274ce94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x24e584, lpOverlapped=0x0 | out: lpBuffer=0x274ce94*, lpNumberOfBytesRead=0x24e584*=0x1000, lpOverlapped=0x0) returned 1 [0079.619] ReadFile (in: hFile=0x268, lpBuffer=0x274ce94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x24e584, lpOverlapped=0x0 | out: lpBuffer=0x274ce94*, lpNumberOfBytesRead=0x24e584*=0x1000, lpOverlapped=0x0) returned 1 [0079.619] ReadFile (in: hFile=0x268, lpBuffer=0x274ce94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x24e584, lpOverlapped=0x0 | out: lpBuffer=0x274ce94*, lpNumberOfBytesRead=0x24e584*=0x1000, lpOverlapped=0x0) returned 1 [0079.620] ReadFile (in: hFile=0x268, lpBuffer=0x274ce94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x24e4bc, lpOverlapped=0x0 | out: lpBuffer=0x274ce94*, lpNumberOfBytesRead=0x24e4bc*=0x1000, lpOverlapped=0x0) returned 1 [0079.623] ReadFile (in: hFile=0x268, lpBuffer=0x274ce94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x24e638, lpOverlapped=0x0 | out: lpBuffer=0x274ce94*, lpNumberOfBytesRead=0x24e638*=0x1000, lpOverlapped=0x0) returned 1 [0079.624] ReadFile (in: hFile=0x268, lpBuffer=0x274ce94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x24e54c, lpOverlapped=0x0 | out: lpBuffer=0x274ce94*, lpNumberOfBytesRead=0x24e54c*=0x1000, lpOverlapped=0x0) returned 1 [0079.624] ReadFile (in: hFile=0x268, lpBuffer=0x274ce94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x24e54c, lpOverlapped=0x0 | out: lpBuffer=0x274ce94*, lpNumberOfBytesRead=0x24e54c*=0xc8f, lpOverlapped=0x0) returned 1 [0079.624] ReadFile (in: hFile=0x268, lpBuffer=0x274ce94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x24e60c, lpOverlapped=0x0 | out: lpBuffer=0x274ce94*, lpNumberOfBytesRead=0x24e60c*=0x0, lpOverlapped=0x0) returned 1 [0079.624] CloseHandle (hObject=0x268) returned 1 [0079.625] GetCurrentProcess () returned 0xffffffff [0079.625] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x24e9b8 | out: TokenHandle=0x24e9b8*=0x268) returned 1 [0079.626] GetCurrentProcess () returned 0xffffffff [0079.626] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x24e9b8 | out: TokenHandle=0x24e9b8*=0x274) returned 1 [0079.627] GetCurrentProcess () returned 0xffffffff [0079.627] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x24e884 | out: TokenHandle=0x24e884*=0x278) returned 1 [0079.627] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ss.exe.config" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ss.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x24e884 | out: lpFileInformation=0x24e884*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0079.627] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ss.exe.config", nBufferLength=0x105, lpBuffer=0x24e330, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ss.exe.config", lpFilePart=0x0) returned 0x33 [0079.627] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ss.exe.config" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ss.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x24e884 | out: lpFileInformation=0x24e884*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0079.628] GetCurrentProcess () returned 0xffffffff [0079.628] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x24e9b8 | out: TokenHandle=0x24e9b8*=0x27c) returned 1 [0079.628] GetCurrentProcess () returned 0xffffffff [0079.628] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x24e9b8 | out: TokenHandle=0x24e9b8*=0x280) returned 1 [0079.647] GetCurrentProcess () returned 0xffffffff [0079.647] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x24e780 | out: TokenHandle=0x24e780*=0x284) returned 1 [0079.667] GetCurrentProcess () returned 0xffffffff [0079.667] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x24e790 | out: TokenHandle=0x24e790*=0x288) returned 1 [0079.676] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x28c [0079.676] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x290 [0079.679] GetCurrentProcess () returned 0xffffffff [0079.679] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x24e7a0 | out: TokenHandle=0x24e7a0*=0x294) returned 1 [0079.681] GetCurrentProcess () returned 0xffffffff [0079.681] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x24e7b0 | out: TokenHandle=0x24e7b0*=0x298) returned 1 [0079.683] QueryPerformanceFrequency (in: lpFrequency=0xc5a28 | out: lpFrequency=0xc5a28*=100000000) returned 1 [0079.684] QueryPerformanceCounter (in: lpPerformanceCount=0x24ebb4 | out: lpPerformanceCount=0x24ebb4*=19455943266) returned 1 [0079.687] GetCurrentProcess () returned 0xffffffff [0079.688] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x24e76c | out: TokenHandle=0x24e76c*=0x29c) returned 1 [0079.691] GetCurrentProcess () returned 0xffffffff [0079.691] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x24e77c | out: TokenHandle=0x24e77c*=0x2a0) returned 1 [0079.699] GetCurrentProcess () returned 0xffffffff [0079.699] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x24e780 | out: TokenHandle=0x24e780*=0x2a4) returned 1 [0079.702] GetCurrentProcess () returned 0xffffffff [0079.702] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x24e790 | out: TokenHandle=0x24e790*=0x2a8) returned 1 [0079.706] GetCurrentProcess () returned 0xffffffff [0079.706] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x24ea9c | out: TokenHandle=0x24ea9c*=0x2ac) returned 1 [0079.712] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x24dbe4 | out: phkResult=0x24dbe4*=0x2b0) returned 0x0 [0079.712] RegQueryValueExW (in: hKey=0x2b0, lpValueName="InstallationType", lpReserved=0x0, lpType=0x24dc04, lpData=0x0, lpcbData=0x24dc00*=0x0 | out: lpType=0x24dc04*=0x1, lpData=0x0, lpcbData=0x24dc00*=0xe) returned 0x0 [0079.712] RegQueryValueExW (in: hKey=0x2b0, lpValueName="InstallationType", lpReserved=0x0, lpType=0x24dc04, lpData=0x276ea90, lpcbData=0x24dc00*=0xe | out: lpType=0x24dc04*=0x1, lpData="Client", lpcbData=0x24dc00*=0xe) returned 0x0 [0079.713] RegCloseKey (hKey=0x2b0) returned 0x0 [0080.665] CoTaskMemAlloc (cb=0xcc0) returned 0x6dba80 [0080.669] RasEnumConnectionsW (in: param_1=0x6dba80, param_2=0x24eaac, param_3=0x24eab0 | out: param_1=0x6dba80, param_2=0x24eaac, param_3=0x24eab0) returned 0x0 [0081.041] CoTaskMemFree (pv=0x6dba80) [0081.046] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x24e894 | out: lpWSAData=0x24e894) returned 0 [0081.055] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x2f0 [0081.329] setsockopt (s=0x2f0, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0081.329] closesocket (s=0x2f0) returned 0 [0081.329] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x2f0 [0081.357] setsockopt (s=0x2f0, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0081.357] closesocket (s=0x2f0) returned 0 [0081.357] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x2f0 [0081.357] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2f4 [0081.358] ioctlsocket (in: s=0x2f0, cmd=-2147195266, argp=0x24eab4 | out: argp=0x24eab4) returned 0 [0081.358] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x2f8 [0081.358] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2fc [0081.358] ioctlsocket (in: s=0x2f8, cmd=-2147195266, argp=0x24eab4 | out: argp=0x24eab4) returned 0 [0081.359] WSAIoctl (in: s=0x2f0, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x24ea9c, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x24ea9c, lpOverlapped=0x0) returned -1 [0081.360] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x24e7cc, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0081.415] WSAEventSelect (s=0x2f0, hEventObject=0x2f4, lNetworkEvents=512) returned 0 [0081.415] WSAIoctl (in: s=0x2f8, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x24ea9c, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x24ea9c, lpOverlapped=0x0) returned -1 [0081.415] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x24e7cc, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0081.415] WSAEventSelect (s=0x2f8, hEventObject=0x2fc, lNetworkEvents=512) returned 0 [0081.415] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x304 [0081.415] RasConnectionNotificationW (param_1=0xffffffff, param_2=0x304, param_3=0x3) returned 0x0 [0081.419] RegOpenCurrentUser (in: samDesired=0x20019, phkResult=0x24eac8 | out: phkResult=0x24eac8*=0x31c) returned 0x0 [0081.420] RegOpenKeyExW (in: hKey=0x31c, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x24ea78 | out: phkResult=0x24ea78*=0x320) returned 0x0 [0081.420] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x324 [0081.420] RegNotifyChangeKeyValue (hKey=0x320, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x324, fAsynchronous=1) returned 0x0 [0081.421] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x24ea7c | out: phkResult=0x24ea7c*=0x328) returned 0x0 [0081.421] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x32c [0081.421] RegNotifyChangeKeyValue (hKey=0x328, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x32c, fAsynchronous=1) returned 0x0 [0081.421] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x24ea7c | out: phkResult=0x24ea7c*=0x330) returned 0x0 [0081.421] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x334 [0081.421] RegNotifyChangeKeyValue (hKey=0x330, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x334, fAsynchronous=1) returned 0x0 [0081.421] GetCurrentProcess () returned 0xffffffff [0081.421] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x24ea70 | out: TokenHandle=0x24ea70*=0x338) returned 1 [0081.424] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x24e380 | out: phkResult=0x24e380*=0x33c) returned 0x0 [0081.425] RegQueryValueExW (in: hKey=0x33c, lpValueName="LegacyWPADSupport", lpReserved=0x0, lpType=0x24e39c, lpData=0x0, lpcbData=0x24e398*=0x0 | out: lpType=0x24e39c*=0x0, lpData=0x0, lpcbData=0x24e398*=0x0) returned 0x2 [0081.425] RegCloseKey (hKey=0x33c) returned 0x0 [0082.155] WinHttpOpen (pszAgentW=0x0, dwAccessType=0x1, pszProxyW=0x0, pszProxyBypassW=0x0, dwFlags=0x0) returned 0x6dc650 [0082.339] WinHttpSetTimeouts (hInternet=0x6dc650, nResolveTimeout=60000, nConnectTimeout=60000, nSendTimeout=60000, nReceiveTimeout=60000) returned 1 [0082.339] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x24ea7c | out: pProxyConfig=0x24ea7c) returned 1 [0082.815] CoTaskMemAlloc (cb=0x20e) returned 0x6ea548 [0082.815] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_Disabled", lpBuffer=0x6ea548, nSize=0x105 | out: lpBuffer="Иo꫈n") returned 0x0 [0082.815] CoTaskMemFree (pv=0x6ea548) [0082.815] CoTaskMemAlloc (cb=0x20e) returned 0x6ea548 [0082.815] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_MinCount", lpBuffer=0x6ea548, nSize=0x105 | out: lpBuffer="Иo꫈n") returned 0x0 [0082.815] CoTaskMemFree (pv=0x6ea548) [0082.819] EtwEventRegister () returned 0x0 [0083.501] GetCurrentProcess () returned 0xffffffff [0083.501] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x24e748 | out: TokenHandle=0x24e748*=0x350) returned 1 [0083.503] GetCurrentProcess () returned 0xffffffff [0083.503] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x24e758 | out: TokenHandle=0x24e758*=0x354) returned 1 [0083.507] SetEvent (hEvent=0x28c) returned 1 [0083.517] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x24e9ec*=0x304, lpdwindex=0x24e80c | out: lpdwindex=0x24e80c) returned 0x80010115 [0083.774] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x24e9cc*=0x2f4, lpdwindex=0x24e7ec | out: lpdwindex=0x24e7ec) returned 0x80010115 [0083.774] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x24e9cc*=0x2fc, lpdwindex=0x24e7ec | out: lpdwindex=0x24e7ec) returned 0x80010115 [0083.774] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x24ea20*=0x324, lpdwindex=0x24e83c | out: lpdwindex=0x24e83c) returned 0x80010115 [0083.774] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x24ea20*=0x32c, lpdwindex=0x24e83c | out: lpdwindex=0x24e83c) returned 0x80010115 [0083.774] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x24ea20*=0x334, lpdwindex=0x24e83c | out: lpdwindex=0x24e83c) returned 0x80010115 [0083.775] WinHttpGetProxyForUrl (in: hSession=0x6dc650, lpcwszUrl="https://www.google.com/", pAutoProxyOptions=0x24e9b0, pProxyInfo=0x24ea20 | out: pProxyInfo=0x24ea20) returned 0 [0101.029] GetCurrentProcess () returned 0xffffffff [0101.029] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x24e6c4 | out: TokenHandle=0x24e6c4*=0x390) returned 1 [0101.030] GetCurrentProcess () returned 0xffffffff [0101.030] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x24e6d4 | out: TokenHandle=0x24e6d4*=0x354) returned 1 [0101.031] GetTimeZoneInformation (in: lpTimeZoneInformation=0x24e8d4 | out: lpTimeZoneInformation=0x24e8d4) returned 0x1 [0101.041] GetDynamicTimeZoneInformation (in: pTimeZoneInformation=0x24e728 | out: pTimeZoneInformation=0x24e728) returned 0x1 [0101.042] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\AUS Eastern Standard Time", ulOptions=0x0, samDesired=0x20019, phkResult=0x24e80c | out: phkResult=0x24e80c*=0x350) returned 0x0 [0101.043] RegQueryValueExW (in: hKey=0x350, lpValueName="TZI", lpReserved=0x0, lpType=0x24e828, lpData=0x0, lpcbData=0x24e824*=0x0 | out: lpType=0x24e828*=0x3, lpData=0x0, lpcbData=0x24e824*=0x2c) returned 0x0 [0101.043] RegQueryValueExW (in: hKey=0x350, lpValueName="TZI", lpReserved=0x0, lpType=0x24e828, lpData=0x2774b5c, lpcbData=0x24e824*=0x2c | out: lpType=0x24e828*=0x3, lpData=0x2774b5c*, lpcbData=0x24e824*=0x2c) returned 0x0 [0101.043] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\AUS Eastern Standard Time\\Dynamic DST", ulOptions=0x0, samDesired=0x20019, phkResult=0x24e660 | out: phkResult=0x24e660*=0x2ac) returned 0x0 [0101.043] RegQueryValueExW (in: hKey=0x2ac, lpValueName="FirstEntry", lpReserved=0x0, lpType=0x24e67c, lpData=0x0, lpcbData=0x24e678*=0x0 | out: lpType=0x24e67c*=0x4, lpData=0x0, lpcbData=0x24e678*=0x4) returned 0x0 [0101.043] RegQueryValueExW (in: hKey=0x2ac, lpValueName="FirstEntry", lpReserved=0x0, lpType=0x24e67c, lpData=0x24e668, lpcbData=0x24e678*=0x4 | out: lpType=0x24e67c*=0x4, lpData=0x24e668*=0x7d7, lpcbData=0x24e678*=0x4) returned 0x0 [0101.043] RegQueryValueExW (in: hKey=0x2ac, lpValueName="LastEntry", lpReserved=0x0, lpType=0x24e67c, lpData=0x0, lpcbData=0x24e678*=0x0 | out: lpType=0x24e67c*=0x4, lpData=0x0, lpcbData=0x24e678*=0x4) returned 0x0 [0101.043] RegQueryValueExW (in: hKey=0x2ac, lpValueName="LastEntry", lpReserved=0x0, lpType=0x24e67c, lpData=0x24e668, lpcbData=0x24e678*=0x4 | out: lpType=0x24e67c*=0x4, lpData=0x24e668*=0x7d8, lpcbData=0x24e678*=0x4) returned 0x0 [0101.043] RegQueryValueExW (in: hKey=0x2ac, lpValueName="2007", lpReserved=0x0, lpType=0x24e67c, lpData=0x0, lpcbData=0x24e678*=0x0 | out: lpType=0x24e67c*=0x3, lpData=0x0, lpcbData=0x24e678*=0x2c) returned 0x0 [0101.044] RegQueryValueExW (in: hKey=0x2ac, lpValueName="2007", lpReserved=0x0, lpType=0x24e67c, lpData=0x2774ff0, lpcbData=0x24e678*=0x2c | out: lpType=0x24e67c*=0x3, lpData=0x2774ff0*, lpcbData=0x24e678*=0x2c) returned 0x0 [0101.044] RegQueryValueExW (in: hKey=0x2ac, lpValueName="2008", lpReserved=0x0, lpType=0x24e67c, lpData=0x0, lpcbData=0x24e678*=0x0 | out: lpType=0x24e67c*=0x3, lpData=0x0, lpcbData=0x24e678*=0x2c) returned 0x0 [0101.044] RegQueryValueExW (in: hKey=0x2ac, lpValueName="2008", lpReserved=0x0, lpType=0x24e67c, lpData=0x27750b0, lpcbData=0x24e678*=0x2c | out: lpType=0x24e67c*=0x3, lpData=0x27750b0*, lpcbData=0x24e678*=0x2c) returned 0x0 [0101.044] RegCloseKey (hKey=0x2ac) returned 0x0 [0101.044] RegQueryValueExW (in: hKey=0x350, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x24e800, lpData=0x0, lpcbData=0x24e7fc*=0x0 | out: lpType=0x24e800*=0x1, lpData=0x0, lpcbData=0x24e7fc*=0x20) returned 0x0 [0101.044] RegQueryValueExW (in: hKey=0x350, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x24e800, lpData=0x27751f8, lpcbData=0x24e7fc*=0x20 | out: lpType=0x24e800*=0x1, lpData="@tzres.dll,-670", lpcbData=0x24e7fc*=0x20) returned 0x0 [0101.044] RegQueryValueExW (in: hKey=0x350, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x24e800, lpData=0x0, lpcbData=0x24e7fc*=0x0 | out: lpType=0x24e800*=0x1, lpData=0x0, lpcbData=0x24e7fc*=0x20) returned 0x0 [0101.044] RegQueryValueExW (in: hKey=0x350, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x24e800, lpData=0x2775250, lpcbData=0x24e7fc*=0x20 | out: lpType=0x24e800*=0x1, lpData="@tzres.dll,-672", lpcbData=0x24e7fc*=0x20) returned 0x0 [0101.044] RegQueryValueExW (in: hKey=0x350, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x24e800, lpData=0x0, lpcbData=0x24e7fc*=0x0 | out: lpType=0x24e800*=0x1, lpData=0x0, lpcbData=0x24e7fc*=0x20) returned 0x0 [0101.044] RegQueryValueExW (in: hKey=0x350, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x24e800, lpData=0x27752a8, lpcbData=0x24e7fc*=0x20 | out: lpType=0x24e800*=0x1, lpData="@tzres.dll,-671", lpcbData=0x24e7fc*=0x20) returned 0x0 [0101.055] CoTaskMemAlloc (cb=0x20c) returned 0x6fea78 [0101.055] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x6fea78 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0101.058] CoTaskMemFree (pv=0x6fea78) [0101.058] CoTaskMemAlloc (cb=0x20e) returned 0x6fea78 [0101.058] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x24e81c, pwszFileMUIPath=0x6fea78, pcchFileMUIPath=0x24e820, pululEnumerator=0x24e814 | out: pwszLanguage=0x0, pcchLanguage=0x24e81c, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x24e820, pululEnumerator=0x24e814) returned 1 [0101.084] CoTaskMemFree (pv=0x0) [0101.084] CoTaskMemFree (pv=0x6fea78) [0101.084] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x370001 [0101.128] CoTaskMemAlloc (cb=0x3ec) returned 0x701f18 [0101.128] LoadStringW (in: hInstance=0x370001, uID=0x29e, lpBuffer=0x701f18, cchBufferMax=500 | out: lpBuffer="(UTC+10:00) Canberra, Melbourne, Sydney") returned 0x27 [0101.129] CoTaskMemFree (pv=0x701f18) [0101.129] FreeLibrary (hLibModule=0x370001) returned 1 [0101.129] CoTaskMemAlloc (cb=0x20c) returned 0x6ffd00 [0101.129] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x6ffd00 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0101.129] CoTaskMemFree (pv=0x6ffd00) [0101.129] CoTaskMemAlloc (cb=0x20e) returned 0x6ffd00 [0101.129] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x24e81c, pwszFileMUIPath=0x6ffd00, pcchFileMUIPath=0x24e820, pululEnumerator=0x24e814 | out: pwszLanguage=0x0, pcchLanguage=0x24e81c, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x24e820, pululEnumerator=0x24e814) returned 1 [0101.130] CoTaskMemFree (pv=0x0) [0101.130] CoTaskMemFree (pv=0x6ffd00) [0101.130] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x370001 [0101.130] CoTaskMemAlloc (cb=0x3ec) returned 0x701f18 [0101.131] LoadStringW (in: hInstance=0x370001, uID=0x2a0, lpBuffer=0x701f18, cchBufferMax=500 | out: lpBuffer="AUS Eastern Standard Time") returned 0x19 [0101.131] CoTaskMemFree (pv=0x701f18) [0101.131] FreeLibrary (hLibModule=0x370001) returned 1 [0101.131] CoTaskMemAlloc (cb=0x20c) returned 0x6ffd00 [0101.131] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x6ffd00 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0101.131] CoTaskMemFree (pv=0x6ffd00) [0101.131] CoTaskMemAlloc (cb=0x20e) returned 0x6ffd00 [0101.131] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x24e81c, pwszFileMUIPath=0x6ffd00, pcchFileMUIPath=0x24e820, pululEnumerator=0x24e814 | out: pwszLanguage=0x0, pcchLanguage=0x24e81c, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x24e820, pululEnumerator=0x24e814) returned 1 [0101.132] CoTaskMemFree (pv=0x0) [0101.132] CoTaskMemFree (pv=0x6ffd00) [0101.132] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x370001 [0101.133] CoTaskMemAlloc (cb=0x3ec) returned 0x701f18 [0101.133] LoadStringW (in: hInstance=0x370001, uID=0x29f, lpBuffer=0x701f18, cchBufferMax=500 | out: lpBuffer="AUS Eastern Daylight Time") returned 0x19 [0101.133] CoTaskMemFree (pv=0x701f18) [0101.133] FreeLibrary (hLibModule=0x370001) returned 1 [0101.133] RegCloseKey (hKey=0x350) returned 0x0 [0101.133] SetEvent (hEvent=0x28c) returned 1 [0101.141] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x24ea30 | out: pFixedInfo=0x0, pOutBufLen=0x24ea30) returned 0x6f [0101.281] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x701f18 [0101.281] GetNetworkParams (in: pFixedInfo=0x701f18, pOutBufLen=0x24ea30 | out: pFixedInfo=0x701f18, pOutBufLen=0x24ea30) returned 0x0 [0101.296] LocalFree (hMem=0x701f18) returned 0x0 [0101.297] CoTaskMemAlloc (cb=0x20e) returned 0x6ffd00 [0101.297] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_Disabled", lpBuffer=0x6ffd00, nSize=0x105 | out: lpBuffer="\xea78\x6f\xe2d8\x6f\x1000") returned 0x0 [0101.297] CoTaskMemFree (pv=0x6ffd00) [0101.297] CoTaskMemAlloc (cb=0x20e) returned 0x6ffd00 [0101.298] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_MinCount", lpBuffer=0x6ffd00, nSize=0x105 | out: lpBuffer="\xea78\x6f\xe2d8\x6f\x1000") returned 0x0 [0101.298] CoTaskMemFree (pv=0x6ffd00) [0101.300] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x3a4 [0101.301] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x3a0 [0101.302] GetAddrInfoW (in: pNodeName="www.google.com", pServiceName=0x0, pHints=0x24e920*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x24e8c8 | out: ppResult=0x24e8c8*=0x6284958*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="www.google.com", ai_addr=0x6284980*(sa_family=2, sin_port=0x0, sin_addr="172.217.22.36"), ai_next=0x0)) returned 0 [0101.690] FreeAddrInfoW (pAddrInfo=0x6284958*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="www.google.com", ai_addr=0x6284980*(sa_family=2, sin_port=0x0, sin_addr="172.217.22.36"), ai_next=0x0)) [0101.691] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x3ac [0101.692] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3b4 [0101.692] ioctlsocket (in: s=0x3ac, cmd=-2147195266, argp=0x24e8f8 | out: argp=0x24e8f8) returned 0 [0101.692] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x3b8 [0101.692] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3bc [0101.692] ioctlsocket (in: s=0x3b8, cmd=-2147195266, argp=0x24e8f8 | out: argp=0x24e8f8) returned 0 [0101.692] WSAIoctl (in: s=0x3ac, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x24e8e0, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x24e8e0, lpOverlapped=0x0) returned -1 [0101.693] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x24e610, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0101.693] WSAEventSelect (s=0x3ac, hEventObject=0x3b4, lNetworkEvents=512) returned 0 [0101.693] WSAIoctl (in: s=0x3b8, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x24e8e0, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x24e8e0, lpOverlapped=0x0) returned -1 [0101.693] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x24e610, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0101.693] WSAEventSelect (s=0x3b8, hEventObject=0x3bc, lNetworkEvents=512) returned 0 [0101.693] GetAdaptersAddresses () returned 0x6f [0101.714] LocalAlloc (uFlags=0x0, uBytes=0xa54) returned 0x703938 [0101.714] GetAdaptersAddresses () returned 0x0 [0101.725] LocalFree (hMem=0x703938) returned 0x0 [0101.727] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x24e8f0 | out: phkResult=0x24e8f0*=0x3c0) returned 0x0 [0101.727] RegQueryValueExW (in: hKey=0x3c0, lpValueName="HWRPortReuseOnSocketBind", lpReserved=0x0, lpType=0x24e90c, lpData=0x0, lpcbData=0x24e908*=0x0 | out: lpType=0x24e90c*=0x0, lpData=0x0, lpcbData=0x24e908*=0x0) returned 0x2 [0101.727] RegCloseKey (hKey=0x3c0) returned 0x0 [0101.728] WSAConnect (in: s=0x3a4, name=0x27812e8*(sa_family=2, sin_port=0x1bb, sin_addr="172.217.22.36"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0101.858] closesocket (s=0x3a0) returned 0 Thread: id = 2 os_tid = 0x9fc Thread: id = 3 os_tid = 0xa00 [0051.611] CoGetContextToken (in: pToken=0xfaf4bc | out: pToken=0xfaf4bc) returned 0x800401f0 [0051.611] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0081.849] CloseHandle (hObject=0x2a8) returned 1 [0081.849] CloseHandle (hObject=0x280) returned 1 [0081.849] CloseHandle (hObject=0x298) returned 1 [0081.849] CloseHandle (hObject=0x27c) returned 1 [0081.849] CloseHandle (hObject=0x2a0) returned 1 [0081.849] CloseHandle (hObject=0x278) returned 1 [0081.849] CloseHandle (hObject=0x294) returned 1 [0081.849] CloseHandle (hObject=0x274) returned 1 [0081.849] CloseHandle (hObject=0x2a4) returned 1 [0081.850] CloseHandle (hObject=0x268) returned 1 [0081.850] CloseHandle (hObject=0x288) returned 1 [0081.850] CloseHandle (hObject=0x29c) returned 1 [0081.850] CloseHandle (hObject=0x284) returned 1 [0081.850] CloseHandle (hObject=0x270) returned 1 [0084.539] CloseHandle (hObject=0x2ac) returned 1 [0084.539] CloseHandle (hObject=0x350) returned 1 [0084.539] CloseHandle (hObject=0x354) returned 1 Thread: id = 4 os_tid = 0xa04 Thread: id = 5 os_tid = 0xa44 Thread: id = 6 os_tid = 0xa88 Thread: id = 7 os_tid = 0xa8c Thread: id = 8 os_tid = 0xa90 Thread: id = 9 os_tid = 0xa94 [0083.512] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0083.513] ResetEvent (hEvent=0x28c) returned 1 Thread: id = 10 os_tid = 0xa98