# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Jun 3 2020 08:38:37 # Log Creation Date: 05.02.2021 02:39:17.809 Process: id = "1" image_name = "windowsformsapp1.exe" filename = "c:\\users\\fd1hvy\\desktop\\windowsformsapp1.exe" page_root = "0x98a1000" os_pid = "0x1220" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x560" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\WindowsFormsApp1.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x1230 [0068.843] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0069.745] RoInitialize () returned 0x1 [0069.745] RoUninitialize () returned 0x0 [0072.545] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x8fea70 | out: phkResult=0x8fea70*=0x0) returned 0x2 [0072.545] RegCloseKey (hKey=0x80000002) returned 0x0 [0073.141] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x104, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0073.174] IsAppThemed () returned 0x1 [0073.203] CoTaskMemAlloc (cb=0xf0) returned 0x956960 [0073.203] CreateActCtxA (pActCtx=0x8ff218) returned 0x956b54 [0073.740] CoTaskMemFree (pv=0x956960) [0073.771] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc151 [0073.772] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc198 [0076.062] CoTaskMemAlloc (cb=0x20c) returned 0x96c428 [0076.062] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x96c428 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 0x0 [0076.070] CoTaskMemFree (pv=0x96c428) [0076.070] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x18 [0076.070] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x18, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0076.070] CoTaskMemAlloc (cb=0x20c) returned 0x96c428 [0076.070] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x96c428 | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 0x0 [0076.071] CoTaskMemFree (pv=0x96c428) [0076.071] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1a [0076.071] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x1a, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0076.071] CoTaskMemAlloc (cb=0x20c) returned 0x96c428 [0076.071] SHGetFolderPathW (in: hwnd=0x0, csidl=39, hToken=0x0, dwFlags=0x0, pszPath=0x96c428 | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 0x0 [0076.072] CoTaskMemFree (pv=0x96c428) [0076.072] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0076.072] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", nBufferLength=0x19, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures", lpFilePart=0x0) returned 0x18 [0077.413] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\WindowsFormsApp1.exe.config", nBufferLength=0x105, lpBuffer=0x8fe3d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\WindowsFormsApp1.exe.config", lpFilePart=0x0) returned 0x33 [0078.288] GetCurrentProcess () returned 0xffffffff [0078.288] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fe738 | out: TokenHandle=0x8fe738*=0x360) returned 1 [0078.293] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0078.293] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x2f, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0078.298] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x8fe730 | out: lpFileInformation=0x8fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0078.300] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0078.301] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x44, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0078.301] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x8fe738 | out: lpFileInformation=0x8fe738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0078.302] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0078.302] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x44, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0078.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe670) returned 1 [0078.304] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x35c [0078.304] GetFileType (hFile=0x35c) returned 0x1 [0078.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe66c) returned 1 [0078.304] GetFileType (hFile=0x35c) returned 0x1 [0078.521] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\XML", ulOptions=0x0, samDesired=0x20019, phkResult=0x8fe6bc | out: phkResult=0x8fe6bc*=0x0) returned 0x2 [0078.521] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\XML", ulOptions=0x0, samDesired=0x20019, phkResult=0x8fe6bc | out: phkResult=0x8fe6bc*=0x0) returned 0x2 [0078.523] GetFileSize (in: hFile=0x35c, lpFileSizeHigh=0x8fe72c | out: lpFileSizeHigh=0x8fe72c*=0x0) returned 0x8c8f [0078.523] ReadFile (in: hFile=0x35c, lpBuffer=0x266aaa4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe6e8, lpOverlapped=0x0 | out: lpBuffer=0x266aaa4*, lpNumberOfBytesRead=0x8fe6e8*=0x1000, lpOverlapped=0x0) returned 1 [0078.579] ReadFile (in: hFile=0x35c, lpBuffer=0x266aaa4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe594, lpOverlapped=0x0 | out: lpBuffer=0x266aaa4*, lpNumberOfBytesRead=0x8fe594*=0x1000, lpOverlapped=0x0) returned 1 [0078.581] ReadFile (in: hFile=0x35c, lpBuffer=0x266aaa4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe448, lpOverlapped=0x0 | out: lpBuffer=0x266aaa4*, lpNumberOfBytesRead=0x8fe448*=0x1000, lpOverlapped=0x0) returned 1 [0078.582] ReadFile (in: hFile=0x35c, lpBuffer=0x266aaa4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe448, lpOverlapped=0x0 | out: lpBuffer=0x266aaa4*, lpNumberOfBytesRead=0x8fe448*=0x1000, lpOverlapped=0x0) returned 1 [0078.582] ReadFile (in: hFile=0x35c, lpBuffer=0x266aaa4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe448, lpOverlapped=0x0 | out: lpBuffer=0x266aaa4*, lpNumberOfBytesRead=0x8fe448*=0x1000, lpOverlapped=0x0) returned 1 [0078.582] ReadFile (in: hFile=0x35c, lpBuffer=0x266aaa4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe380, lpOverlapped=0x0 | out: lpBuffer=0x266aaa4*, lpNumberOfBytesRead=0x8fe380*=0x1000, lpOverlapped=0x0) returned 1 [0078.659] ReadFile (in: hFile=0x35c, lpBuffer=0x266aaa4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe504, lpOverlapped=0x0 | out: lpBuffer=0x266aaa4*, lpNumberOfBytesRead=0x8fe504*=0x1000, lpOverlapped=0x0) returned 1 [0078.661] ReadFile (in: hFile=0x35c, lpBuffer=0x266aaa4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe410, lpOverlapped=0x0 | out: lpBuffer=0x266aaa4*, lpNumberOfBytesRead=0x8fe410*=0x1000, lpOverlapped=0x0) returned 1 [0078.661] ReadFile (in: hFile=0x35c, lpBuffer=0x266aaa4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe410, lpOverlapped=0x0 | out: lpBuffer=0x266aaa4*, lpNumberOfBytesRead=0x8fe410*=0xc8f, lpOverlapped=0x0) returned 1 [0078.661] ReadFile (in: hFile=0x35c, lpBuffer=0x266aaa4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe4d4, lpOverlapped=0x0 | out: lpBuffer=0x266aaa4*, lpNumberOfBytesRead=0x8fe4d4*=0x0, lpOverlapped=0x0) returned 1 [0078.662] CloseHandle (hObject=0x35c) returned 1 [0078.664] GetCurrentProcess () returned 0xffffffff [0078.664] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fe880 | out: TokenHandle=0x8fe880*=0x35c) returned 1 [0078.664] GetCurrentProcess () returned 0xffffffff [0078.664] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fe880 | out: TokenHandle=0x8fe880*=0x354) returned 1 [0078.665] GetCurrentProcess () returned 0xffffffff [0078.665] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fe738 | out: TokenHandle=0x8fe738*=0x364) returned 1 [0078.665] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\WindowsFormsApp1.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\windowsformsapp1.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x8fe730 | out: lpFileInformation=0x8fe730*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0078.666] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\WindowsFormsApp1.exe.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0078.666] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\WindowsFormsApp1.exe.config", nBufferLength=0x34, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\WindowsFormsApp1.exe.config", lpFilePart=0x0) returned 0x33 [0078.666] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\WindowsFormsApp1.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\windowsformsapp1.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x8fe738 | out: lpFileInformation=0x8fe738*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0078.666] GetCurrentProcess () returned 0xffffffff [0078.667] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fe880 | out: TokenHandle=0x8fe880*=0x368) returned 1 [0078.667] GetCurrentProcess () returned 0xffffffff [0078.667] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fe880 | out: TokenHandle=0x8fe880*=0x36c) returned 1 [0078.699] GetCurrentProcess () returned 0xffffffff [0078.699] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fe6e0 | out: TokenHandle=0x8fe6e0*=0x370) returned 1 [0078.705] GetCurrentProcess () returned 0xffffffff [0078.705] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fe6f0 | out: TokenHandle=0x8fe6f0*=0x374) returned 1 [0078.712] GetCurrentProcess () returned 0xffffffff [0078.712] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fee24 | out: TokenHandle=0x8fee24*=0x378) returned 1 [0078.712] GetCurrentProcess () returned 0xffffffff [0078.712] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fee34 | out: TokenHandle=0x8fee34*=0x37c) returned 1 [0078.760] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0078.764] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x6fd40000 [0079.676] AdjustWindowRectEx (in: lpRect=0x8ff254, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x8ff254) returned 1 [0079.681] GetCurrentProcess () returned 0xffffffff [0079.682] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x8ff168, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x8ff168*=0x384) returned 1 [0079.694] GetCurrentActCtx (in: lphActCtx=0x8ff0c8 | out: lphActCtx=0x8ff0c8*=0x0) returned 1 [0079.694] ActivateActCtx (in: hActCtx=0x956b54, lpCookie=0x8ff0d8 | out: hActCtx=0x956b54, lpCookie=0x8ff0d8) returned 1 [0079.694] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0079.777] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x6fb30000 [0080.830] GetModuleHandleW (lpModuleName="user32.dll") returned 0x750c0000 [0080.831] GetProcAddress (hModule=0x750c0000, lpProcName="DefWindowProcW") returned 0x743c0140 [0080.831] GetStockObject (i=5) returned 0x900015 [0080.836] GetModuleHandleW (lpModuleName=0x0) returned 0x450000 [0080.838] CoTaskMemAlloc (cb=0x5a) returned 0x972ec0 [0080.838] RegisterClassW (lpWndClass=0x8fef7c) returned 0xc197 [0080.839] CoTaskMemFree (pv=0x972ec0) [0080.839] GetModuleHandleW (lpModuleName=0x0) returned 0x450000 [0080.840] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x450000, lpParam=0x0) returned 0x302c2 [0080.843] SetWindowLongW (hWnd=0x302c2, nIndex=-4, dwNewLong=1950089536) returned 79168998 [0080.843] GetWindowLongW (hWnd=0x302c2, nIndex=-4) returned 1950089536 [0080.845] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x8fe798 | out: phkResult=0x8fe798*=0x39c) returned 0x0 [0080.846] RegQueryValueExW (in: hKey=0x39c, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x8fe7b8, lpData=0x0, lpcbData=0x8fe7b4*=0x0 | out: lpType=0x8fe7b8*=0x0, lpData=0x0, lpcbData=0x8fe7b4*=0x0) returned 0x2 [0080.846] RegQueryValueExW (in: hKey=0x39c, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x8fe7b8, lpData=0x0, lpcbData=0x8fe7b4*=0x0 | out: lpType=0x8fe7b8*=0x0, lpData=0x0, lpcbData=0x8fe7b4*=0x0) returned 0x2 [0080.846] RegCloseKey (hKey=0x39c) returned 0x0 [0080.847] SetWindowLongW (hWnd=0x302c2, nIndex=-4, dwNewLong=79169038) returned 1950089536 [0080.847] GetWindowLongW (hWnd=0x302c2, nIndex=-4) returned 79169038 [0080.847] GetWindowLongW (hWnd=0x302c2, nIndex=-16) returned 113311744 [0080.848] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc19b [0080.853] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc19c [0080.853] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c2, Msg=0x81, wParam=0x0, lParam=0x8feae8) returned 0x1 [0080.855] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c2, Msg=0x83, wParam=0x0, lParam=0x8fead4) returned 0x0 [0081.258] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c2, Msg=0x1, wParam=0x0, lParam=0x8feae8) returned 0x0 [0081.259] GetClientRect (in: hWnd=0x302c2, lpRect=0x8fe7d0 | out: lpRect=0x8fe7d0) returned 1 [0081.259] GetWindowRect (in: hWnd=0x302c2, lpRect=0x8fe7d0 | out: lpRect=0x8fe7d0) returned 1 [0081.266] GetParent (hWnd=0x302c2) returned 0x0 [0081.266] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10e30001) returned 1 [0084.972] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0084.974] AdjustWindowRectEx (in: lpRect=0x8ff03c, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8ff03c) returned 1 [0084.974] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0084.974] AdjustWindowRectEx (in: lpRect=0x8ff03c, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8ff03c) returned 1 [0084.974] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0084.975] AdjustWindowRectEx (in: lpRect=0x8ff03c, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8ff03c) returned 1 [0085.269] GetSystemDefaultLCID () returned 0x409 [0085.269] GetStockObject (i=17) returned 0xa01c1 [0085.270] GetObjectW (in: h=0xa01c1, c=92, pv=0x8fedf8 | out: pv=0x8fedf8) returned 92 [0085.272] GetDC (hWnd=0x0) returned 0x60100ce [0087.341] GdiplusStartup (in: token=0x5e5ee8, input=0x8fe3b0, output=0x8fe400 | out: token=0x5e5ee8, output=0x8fe400) returned 0x0 [0087.353] CoTaskMemAlloc (cb=0x5c) returned 0x972ec0 [0087.362] GdipCreateFontFromLogfontW (hdc=0x60100ce, logfont=0x972ec0, font=0x8feec0) returned 0x0 [0087.855] CoTaskMemFree (pv=0x972ec0) [0087.856] CoTaskMemAlloc (cb=0x5c) returned 0x972ec0 [0087.856] CoTaskMemFree (pv=0x972ec0) [0087.857] CoTaskMemAlloc (cb=0x5c) returned 0x972ec0 [0087.857] CoTaskMemFree (pv=0x972ec0) [0087.857] GdipGetFontUnit (font=0x4dd1f08, unit=0x8fee88) returned 0x0 [0087.857] GdipGetFontSize (font=0x4dd1f08, size=0x8fee8c) returned 0x0 [0087.857] GdipGetFontStyle (font=0x4dd1f08, style=0x8fee84) returned 0x0 [0087.858] GdipGetFamily (font=0x4dd1f08, family=0x8fee80) returned 0x0 [0087.858] GdipGetFontSize (font=0x4dd1f08, size=0x2688154) returned 0x0 [0087.858] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0087.858] GetDC (hWnd=0x0) returned 0x10105d6 [0087.859] GdipCreateFromHDC (hdc=0x10105d6, graphics=0x8fee9c) returned 0x0 [0087.882] GdipGetDpiY (graphics=0x5fcf260, dpi=0x2688230) returned 0x0 [0087.882] GdipGetFontHeight (font=0x4dd1f08, graphics=0x5fcf260, height=0x8fee94) returned 0x0 [0087.883] GdipGetEmHeight (family=0x4dd8170, style=0, EmHeight=0x8fee9c) returned 0x0 [0087.883] GdipGetLineSpacing (family=0x4dd8170, style=0, LineSpacing=0x8fee9c) returned 0x0 [0087.883] GdipDeleteGraphics (graphics=0x5fcf260) returned 0x0 [0087.883] ReleaseDC (hWnd=0x0, hDC=0x10105d6) returned 1 [0087.884] GdipCreateFont (fontFamily=0x4dd8170, emSize=0x41040000, style=0, unit=0x3, font=0x268824c) returned 0x0 [0087.884] GdipGetFontSize (font=0x4ddef48, size=0x2688250) returned 0x0 [0087.884] GdipDeleteFont (font=0x4dd1f08) returned 0x0 [0087.884] GetDC (hWnd=0x0) returned 0x10105d6 [0087.884] GdipCreateFromHDC (hdc=0x10105d6, graphics=0x8fef10) returned 0x0 [0087.884] GdipGetFontHeight (font=0x4ddef48, graphics=0x5fcf260, height=0x8fef08) returned 0x0 [0087.884] GdipDeleteGraphics (graphics=0x5fcf260) returned 0x0 [0087.885] ReleaseDC (hWnd=0x0, hDC=0x10105d6) returned 1 [0087.886] GetSystemMetrics (nIndex=5) returned 1 [0087.886] GetSystemMetrics (nIndex=6) returned 1 [0087.886] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0087.887] AdjustWindowRectEx (in: lpRect=0x8ff038, dwStyle=0x560101c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x8ff038) returned 1 [0087.887] GetDC (hWnd=0x0) returned 0x10105d6 [0087.887] GdipCreateFromHDC (hdc=0x10105d6, graphics=0x8fef10) returned 0x0 [0087.888] GdipGetFontHeight (font=0x4ddef48, graphics=0x5fcf260, height=0x8fef08) returned 0x0 [0087.888] GdipDeleteGraphics (graphics=0x5fcf260) returned 0x0 [0087.888] ReleaseDC (hWnd=0x0, hDC=0x10105d6) returned 1 [0087.888] GetSystemMetrics (nIndex=5) returned 1 [0087.888] GetSystemMetrics (nIndex=6) returned 1 [0087.888] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0087.888] AdjustWindowRectEx (in: lpRect=0x8ff038, dwStyle=0x560101c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x8ff038) returned 1 [0087.889] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0087.889] AdjustWindowRectEx (in: lpRect=0x8ff03c, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8ff03c) returned 1 [0087.891] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0087.891] AdjustWindowRectEx (in: lpRect=0x8ff040, dwStyle=0x56010000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8ff040) returned 1 [0087.900] GdipCreateFontFamilyFromName (name="Yu Gothic", fontCollection=0x0, fontFamily=0x8ff018) returned 0x0 [0087.900] GdipCreateFont (fontFamily=0x4dddb00, emSize=0x41e1999a, style=0, unit=0x3, font=0x268893c) returned 0x0 [0091.973] GdipGetFontSize (font=0x4dd1f08, size=0x2688940) returned 0x0 [0092.131] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0092.132] AdjustWindowRectEx (in: lpRect=0x8fef9c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8fef9c) returned 1 [0092.143] GetUserObjectInformationA (in: hObj=0x13c, nIndex=1, pvInfo=0x26890e0, nLength=0xc, lpnLengthNeeded=0x8fee78 | out: pvInfo=0x26890e0, lpnLengthNeeded=0x8fee78) returned 1 [0092.147] SetConsoleCtrlHandler (HandlerRoutine=0x4b80636, Add=1) returned 1 [0092.147] GetModuleHandleW (lpModuleName=0x0) returned 0x450000 [0092.148] GetModuleHandleW (lpModuleName=0x0) returned 0x450000 [0092.149] GetClassInfoW (in: hInstance=0x450000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWndClass=0x2689144 | out: lpWndClass=0x2689144) returned 0 [0092.151] CoTaskMemAlloc (cb=0x58) returned 0x9570a0 [0092.151] RegisterClassW (lpWndClass=0x8fedc8) returned 0xc19e [0092.152] CoTaskMemFree (pv=0x9570a0) [0092.167] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x450000, lpParam=0x0) returned 0x302ce [0092.172] NtdllDefWindowProc_W (hWnd=0x302ce, Msg=0x83, wParam=0x0, lParam=0x8fe8f4) returned 0x0 [0092.172] NtdllDefWindowProc_W (hWnd=0x302ce, Msg=0x1, wParam=0x0, lParam=0x8fe908) returned 0x0 [0092.172] NtdllDefWindowProc_W (hWnd=0x302ce, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0092.172] NtdllDefWindowProc_W (hWnd=0x302ce, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0092.177] GetSysColor (nIndex=10) returned 0xb4b4b4 [0092.177] GetSysColor (nIndex=2) returned 0xd1b499 [0092.177] GetSysColor (nIndex=9) returned 0x0 [0092.177] GetSysColor (nIndex=12) returned 0xababab [0092.177] GetSysColor (nIndex=15) returned 0xf0f0f0 [0092.177] GetSysColor (nIndex=20) returned 0xffffff [0092.177] GetSysColor (nIndex=16) returned 0xa0a0a0 [0092.177] GetSysColor (nIndex=15) returned 0xf0f0f0 [0092.177] GetSysColor (nIndex=16) returned 0xa0a0a0 [0092.178] GetSysColor (nIndex=21) returned 0x696969 [0092.178] GetSysColor (nIndex=22) returned 0xe3e3e3 [0092.178] GetSysColor (nIndex=20) returned 0xffffff [0092.178] GetSysColor (nIndex=18) returned 0x0 [0092.178] GetSysColor (nIndex=1) returned 0x0 [0092.178] GetSysColor (nIndex=27) returned 0xead1b9 [0092.178] GetSysColor (nIndex=28) returned 0xf2e4d7 [0092.178] GetSysColor (nIndex=17) returned 0x6d6d6d [0092.178] GetSysColor (nIndex=13) returned 0xd77800 [0092.178] GetSysColor (nIndex=14) returned 0xffffff [0092.178] GetSysColor (nIndex=26) returned 0xcc6600 [0092.178] GetSysColor (nIndex=11) returned 0xfcf7f4 [0092.178] GetSysColor (nIndex=3) returned 0xdbcdbf [0092.178] GetSysColor (nIndex=19) returned 0x0 [0092.178] GetSysColor (nIndex=24) returned 0xe1ffff [0092.178] GetSysColor (nIndex=23) returned 0x0 [0092.178] GetSysColor (nIndex=4) returned 0xf0f0f0 [0092.178] GetSysColor (nIndex=30) returned 0xf0f0f0 [0092.178] GetSysColor (nIndex=29) returned 0xd77800 [0092.178] GetSysColor (nIndex=7) returned 0x0 [0092.178] GetSysColor (nIndex=0) returned 0xc8c8c8 [0092.178] GetSysColor (nIndex=5) returned 0xffffff [0092.178] GetSysColor (nIndex=6) returned 0x646464 [0092.178] GetSysColor (nIndex=8) returned 0x0 [0092.180] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0092.180] AdjustWindowRectEx (in: lpRect=0x8fef9c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8fef9c) returned 1 [0092.181] GdipCreateFontFamilyFromName (name="Yu Gothic", fontCollection=0x0, fontFamily=0x8ff018) returned 0x0 [0092.182] GdipCreateFont (fontFamily=0x4dddb00, emSize=0x41c00000, style=0, unit=0x3, font=0x2689684) returned 0x0 [0092.182] GdipGetFontSize (font=0x5fcae70, size=0x2689688) returned 0x0 [0092.182] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0092.182] AdjustWindowRectEx (in: lpRect=0x8fef9c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8fef9c) returned 1 [0092.182] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0092.182] AdjustWindowRectEx (in: lpRect=0x8fef9c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8fef9c) returned 1 [0092.182] GdipCreateFontFamilyFromName (name="Yu Gothic", fontCollection=0x0, fontFamily=0x8ff018) returned 0x0 [0092.182] GdipCreateFont (fontFamily=0x4dddb00, emSize=0x41c00000, style=0, unit=0x3, font=0x2689908) returned 0x0 [0092.183] GdipGetFontSize (font=0x5fcf260, size=0x268990c) returned 0x0 [0092.183] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0092.183] AdjustWindowRectEx (in: lpRect=0x8fef9c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8fef9c) returned 1 [0092.183] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0092.183] AdjustWindowRectEx (in: lpRect=0x8fef9c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8fef9c) returned 1 [0092.184] GdipCreateFontFamilyFromName (name="Yu Gothic", fontCollection=0x0, fontFamily=0x8ff018) returned 0x0 [0092.184] GdipCreateFont (fontFamily=0x4dddb00, emSize=0x41c00000, style=0, unit=0x3, font=0x2689bc0) returned 0x0 [0092.184] GdipGetFontSize (font=0x5fcf288, size=0x2689bc4) returned 0x0 [0092.184] GetDC (hWnd=0x0) returned 0x60100ce [0092.184] GdipCreateFromHDC (hdc=0x60100ce, graphics=0x8fefd8) returned 0x0 [0092.185] GdipGetFontHeight (font=0x5fcf288, graphics=0x5fcf2b0, height=0x8fefd0) returned 0x0 [0092.185] GdipDeleteGraphics (graphics=0x5fcf2b0) returned 0x0 [0092.185] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0092.185] GetDC (hWnd=0x0) returned 0x60100ce [0092.185] GdipCreateFromHDC (hdc=0x60100ce, graphics=0x8fef68) returned 0x0 [0092.185] GdipGetFontHeight (font=0x5fcf288, graphics=0x5fcf2b0, height=0x8fef60) returned 0x0 [0092.185] GdipDeleteGraphics (graphics=0x5fcf2b0) returned 0x0 [0092.186] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0092.186] GetSystemMetrics (nIndex=5) returned 1 [0092.186] GetSystemMetrics (nIndex=6) returned 1 [0092.186] GetSystemMetrics (nIndex=5) returned 1 [0092.186] GetSystemMetrics (nIndex=6) returned 1 [0092.186] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0092.186] AdjustWindowRectEx (in: lpRect=0x8fef2c, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x8fef2c) returned 1 [0092.186] GetSystemMetrics (nIndex=5) returned 1 [0092.186] GetSystemMetrics (nIndex=6) returned 1 [0092.186] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0092.186] AdjustWindowRectEx (in: lpRect=0x8fef9c, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x8fef9c) returned 1 [0092.189] GetSystemMetrics (nIndex=5) returned 1 [0092.189] GetSystemMetrics (nIndex=6) returned 1 [0092.189] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0092.189] AdjustWindowRectEx (in: lpRect=0x8fef9c, dwStyle=0x560108c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x8fef9c) returned 1 [0092.190] GdipCreateFontFamilyFromName (name="Yu Gothic", fontCollection=0x0, fontFamily=0x8ff018) returned 0x0 [0092.190] GdipCreateFont (fontFamily=0x4dddb00, emSize=0x41c00000, style=0, unit=0x3, font=0x2689ecc) returned 0x0 [0092.190] GdipGetFontSize (font=0x5fcf2b0, size=0x2689ed0) returned 0x0 [0092.190] GetDC (hWnd=0x0) returned 0x60100ce [0092.190] GdipCreateFromHDC (hdc=0x60100ce, graphics=0x8fefd8) returned 0x0 [0092.191] GdipGetFontHeight (font=0x5fcf2b0, graphics=0x5fcf2d8, height=0x8fefd0) returned 0x0 [0092.191] GdipDeleteGraphics (graphics=0x5fcf2d8) returned 0x0 [0092.191] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0092.191] GetDC (hWnd=0x0) returned 0x60100ce [0092.191] GdipCreateFromHDC (hdc=0x60100ce, graphics=0x8fef68) returned 0x0 [0092.191] GdipGetFontHeight (font=0x5fcf2b0, graphics=0x5fcf2d8, height=0x8fef60) returned 0x0 [0092.191] GdipDeleteGraphics (graphics=0x5fcf2d8) returned 0x0 [0092.191] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0092.191] GetSystemMetrics (nIndex=5) returned 1 [0092.191] GetSystemMetrics (nIndex=6) returned 1 [0092.192] GetSystemMetrics (nIndex=5) returned 1 [0092.192] GetSystemMetrics (nIndex=6) returned 1 [0092.192] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0092.192] AdjustWindowRectEx (in: lpRect=0x8fef2c, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x8fef2c) returned 1 [0092.192] GetSystemMetrics (nIndex=5) returned 1 [0092.192] GetSystemMetrics (nIndex=6) returned 1 [0092.192] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0092.192] AdjustWindowRectEx (in: lpRect=0x8fef9c, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x8fef9c) returned 1 [0092.192] GetSystemMetrics (nIndex=5) returned 1 [0092.192] GetSystemMetrics (nIndex=6) returned 1 [0092.192] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0092.192] AdjustWindowRectEx (in: lpRect=0x8fef9c, dwStyle=0x560108c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x8fef9c) returned 1 [0092.192] GdipCreateFontFamilyFromName (name="Yu Gothic", fontCollection=0x0, fontFamily=0x8ff018) returned 0x0 [0092.193] GdipCreateFont (fontFamily=0x4dddb00, emSize=0x41e1999a, style=0, unit=0x3, font=0x268a198) returned 0x0 [0092.193] GdipGetFontSize (font=0x5fcf2d8, size=0x268a19c) returned 0x0 [0092.193] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0092.193] AdjustWindowRectEx (in: lpRect=0x8fef9c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8fef9c) returned 1 [0092.193] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0092.193] AdjustWindowRectEx (in: lpRect=0x8fef9c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8fef9c) returned 1 [0092.242] EtwEventRegister (in: ProviderId=0x268a748, EnableCallback=0x4b80686, CallbackContext=0x0, RegHandle=0x268a724 | out: RegHandle=0x268a724) returned 0x0 [0092.249] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\WindowsFormsApp1.exe.config", nBufferLength=0x105, lpBuffer=0x8fe8b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\WindowsFormsApp1.exe.config", lpFilePart=0x0) returned 0x33 [0092.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed70) returned 1 [0092.250] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\WindowsFormsApp1.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\windowsformsapp1.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x8fedec | out: lpFileInformation=0x8fedec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0092.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fed6c) returned 1 [0102.576] GdipLoadImageFromStream (stream=0x4c30030, image=0x8fea50) returned 0x0 [0103.321] GdipImageForceValidation (image=0x5fcf300) returned 0x0 [0103.401] GdipGetImageType (image=0x5fcf300, type=0x8fea4c) returned 0x0 [0103.401] GdipGetImageRawFormat (image=0x5fcf300, format=0x8fe9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0103.449] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0103.449] AdjustWindowRectEx (in: lpRect=0x8fefc8, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8fefc8) returned 1 [0103.449] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0103.450] AdjustWindowRectEx (in: lpRect=0x8fefc8, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8fefc8) returned 1 [0103.454] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0103.454] AdjustWindowRectEx (in: lpRect=0x8feffc, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x8feffc) returned 1 [0103.454] GetSystemMetrics (nIndex=59) returned 1460 [0103.454] GetSystemMetrics (nIndex=60) returned 920 [0103.454] GetSystemMetrics (nIndex=34) returned 136 [0103.454] GetSystemMetrics (nIndex=35) returned 39 [0103.455] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0103.455] AdjustWindowRectEx (in: lpRect=0x8feefc, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x8feefc) returned 1 [0103.455] GetCurrentThreadId () returned 0x1230 [0103.455] GetCurrentThreadId () returned 0x1230 [0103.456] GetCurrentThreadId () returned 0x1230 [0103.456] GetCurrentThreadId () returned 0x1230 [0103.456] GetCurrentThreadId () returned 0x1230 [0103.456] GetCurrentThreadId () returned 0x1230 [0103.457] GetCurrentThreadId () returned 0x1230 [0103.457] GetCurrentThreadId () returned 0x1230 [0103.457] GetCurrentThreadId () returned 0x1230 [0103.457] GetCurrentThreadId () returned 0x1230 [0103.457] GetCurrentThreadId () returned 0x1230 [0103.457] GetCurrentThreadId () returned 0x1230 [0103.457] GetCurrentThreadId () returned 0x1230 [0103.457] GetCurrentThreadId () returned 0x1230 [0103.457] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0103.457] AdjustWindowRectEx (in: lpRect=0x8fef10, dwStyle=0x2cb0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x8fef10) returned 1 [0103.457] AdjustWindowRectEx (in: lpRect=0x8fefdc, dwStyle=0x2cb0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x8fefdc) returned 1 [0103.460] CreateCompatibleDC (hdc=0x0) returned 0x8b0107e8 [0103.460] GetDC (hWnd=0x0) returned 0x60100ce [0103.460] GdipCreateFromHDC (hdc=0x60100ce, graphics=0x8fee24) returned 0x0 [0103.461] CoTaskMemAlloc (cb=0x5c) returned 0x985838 [0103.463] GdipGetLogFontW (font=0x4ddef48, graphics=0x5fcffe0, logfontW=0x985838) returned 0x0 [0103.469] CoTaskMemFree (pv=0x985838) [0103.470] CoTaskMemAlloc (cb=0x5c) returned 0x985700 [0103.470] CoTaskMemFree (pv=0x985700) [0103.470] CoTaskMemAlloc (cb=0x5c) returned 0x9857d0 [0103.470] CoTaskMemFree (pv=0x9857d0) [0103.470] GdipDeleteGraphics (graphics=0x5fcffe0) returned 0x0 [0103.470] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0103.471] CoTaskMemAlloc (cb=0x5c) returned 0x9854f8 [0103.471] CreateFontIndirectW (lplf=0x9854f8) returned 0x580a0664 [0103.471] CoTaskMemFree (pv=0x9854f8) [0103.471] SelectObject (hdc=0x8b0107e8, h=0x580a0664) returned 0x8a01c2 [0103.471] GetTextMetricsW (in: hdc=0x8b0107e8, lptm=0x8fef30 | out: lptm=0x8fef30) returned 1 [0103.474] GetTextExtentPoint32W (in: hdc=0x8b0107e8, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x26c6f38 | out: psizl=0x26c6f38) returned 1 [0103.477] SelectObject (hdc=0x8b0107e8, h=0x8a01c2) returned 0x580a0664 [0103.477] DeleteDC (hdc=0x8b0107e8) returned 1 [0103.478] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0103.478] AdjustWindowRectEx (in: lpRect=0x8fec98, dwStyle=0x2c80000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x8fec98) returned 1 [0103.478] AdjustWindowRectEx (in: lpRect=0x8feebc, dwStyle=0x22c80000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x8feebc) returned 1 [0103.480] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0103.480] AdjustWindowRectEx (in: lpRect=0x8fec10, dwStyle=0x2c80000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x8fec10) returned 1 [0103.480] AdjustWindowRectEx (in: lpRect=0x8fecf4, dwStyle=0x22c80000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x8fecf4) returned 1 [0103.481] GetSystemMetrics (nIndex=34) returned 136 [0103.481] GetSystemMetrics (nIndex=35) returned 39 [0103.481] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0103.481] AdjustWindowRectEx (in: lpRect=0x8feba0, dwStyle=0x2c80000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x8feba0) returned 1 [0103.481] AdjustWindowRectEx (in: lpRect=0x8fec68, dwStyle=0x22c80000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x8fec68) returned 1 [0103.482] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0103.482] AdjustWindowRectEx (in: lpRect=0x8feeb4, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8feeb4) returned 1 [0103.482] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0103.482] AdjustWindowRectEx (in: lpRect=0x8fed18, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8fed18) returned 1 [0103.482] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0103.482] AdjustWindowRectEx (in: lpRect=0x8fecd4, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8fecd4) returned 1 [0103.483] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0103.483] AdjustWindowRectEx (in: lpRect=0x8feeb4, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8feeb4) returned 1 [0103.483] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0103.483] AdjustWindowRectEx (in: lpRect=0x8fed18, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8fed18) returned 1 [0103.483] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0103.484] AdjustWindowRectEx (in: lpRect=0x8feca8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8feca8) returned 1 [0103.484] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0103.484] AdjustWindowRectEx (in: lpRect=0x8feeb4, dwStyle=0x560108c1, bMenu=0, dwExStyle=0x200 | out: lpRect=0x8feeb4) returned 1 [0103.484] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0103.484] AdjustWindowRectEx (in: lpRect=0x8fed18, dwStyle=0x560108c1, bMenu=0, dwExStyle=0x200 | out: lpRect=0x8fed18) returned 1 [0103.484] GetSystemMetrics (nIndex=5) returned 1 [0103.484] GetSystemMetrics (nIndex=6) returned 1 [0103.485] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0103.485] AdjustWindowRectEx (in: lpRect=0x8feca8, dwStyle=0x560108c1, bMenu=0, dwExStyle=0x200 | out: lpRect=0x8feca8) returned 1 [0103.485] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0103.485] AdjustWindowRectEx (in: lpRect=0x8feeb4, dwStyle=0x560108c1, bMenu=0, dwExStyle=0x200 | out: lpRect=0x8feeb4) returned 1 [0103.485] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0103.485] AdjustWindowRectEx (in: lpRect=0x8fed18, dwStyle=0x560108c1, bMenu=0, dwExStyle=0x200 | out: lpRect=0x8fed18) returned 1 [0103.485] GetSystemMetrics (nIndex=5) returned 1 [0103.485] GetSystemMetrics (nIndex=6) returned 1 [0103.485] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0103.485] AdjustWindowRectEx (in: lpRect=0x8feca8, dwStyle=0x560108c1, bMenu=0, dwExStyle=0x200 | out: lpRect=0x8feca8) returned 1 [0103.486] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0103.486] AdjustWindowRectEx (in: lpRect=0x8feeb4, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8feeb4) returned 1 [0103.486] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0103.486] AdjustWindowRectEx (in: lpRect=0x8fed18, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8fed18) returned 1 [0103.486] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0103.486] AdjustWindowRectEx (in: lpRect=0x8feca8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8feca8) returned 1 [0103.486] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0103.486] AdjustWindowRectEx (in: lpRect=0x8feeb4, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8feeb4) returned 1 [0103.486] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0103.486] AdjustWindowRectEx (in: lpRect=0x8fed18, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8fed18) returned 1 [0103.487] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0103.487] AdjustWindowRectEx (in: lpRect=0x8feca8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8feca8) returned 1 [0103.487] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0103.487] AdjustWindowRectEx (in: lpRect=0x8feeb4, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8feeb4) returned 1 [0103.487] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0103.487] AdjustWindowRectEx (in: lpRect=0x8fed18, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8fed18) returned 1 [0103.487] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0103.487] AdjustWindowRectEx (in: lpRect=0x8feca8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8feca8) returned 1 [0103.489] GetCurrentActCtx (in: lphActCtx=0x8ff28c | out: lphActCtx=0x8ff28c*=0x0) returned 1 [0103.489] ActivateActCtx (in: hActCtx=0x956b54, lpCookie=0x8ff29c | out: hActCtx=0x956b54, lpCookie=0x8ff29c) returned 1 [0103.490] GetCurrentActCtx (in: lphActCtx=0x8ff0ac | out: lphActCtx=0x8ff0ac*=0x956b54) returned 1 [0103.490] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0103.490] AdjustWindowRectEx (in: lpRect=0x8ff00c, dwStyle=0x2c80000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x8ff00c) returned 1 [0103.490] GetModuleHandleW (lpModuleName=0x0) returned 0x450000 [0103.490] CreateWindowExW (dwExStyle=0x50000, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", lpWindowName="Warning!", dwStyle=0x22c80000, X=-2147483648, Y=-2147483648, nWidth=954, nHeight=572, hWndParent=0x0, hMenu=0x0, hInstance=0x450000, lpParam=0x0) returned 0x4008c [0103.529] SetWindowLongW (hWnd=0x4008c, nIndex=-4, dwNewLong=1950089536) returned 79168998 [0103.530] GetWindowLongW (hWnd=0x4008c, nIndex=-4) returned 1950089536 [0103.530] SetWindowLongW (hWnd=0x4008c, nIndex=-4, dwNewLong=79169886) returned 1950089536 [0103.530] GetWindowLongW (hWnd=0x4008c, nIndex=-4) returned 79169886 [0103.530] GetWindowLongW (hWnd=0x4008c, nIndex=-16) returned 650641408 [0103.530] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x81, wParam=0x0, lParam=0x8fead0) returned 0x1 [0103.532] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x83, wParam=0x0, lParam=0x8feabc) returned 0x0 [0103.533] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x1, wParam=0x0, lParam=0x8fead0) returned 0x0 [0103.533] GetClientRect (in: hWnd=0x4008c, lpRect=0x8fe788 | out: lpRect=0x8fe788) returned 1 [0103.533] GetWindowRect (in: hWnd=0x4008c, lpRect=0x8fe788 | out: lpRect=0x8fe788) returned 1 [0103.537] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0103.537] AdjustWindowRectEx (in: lpRect=0x8fe4b8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8fe4b8) returned 1 [0103.537] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0103.537] AdjustWindowRectEx (in: lpRect=0x8fe4b8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8fe4b8) returned 1 [0103.537] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0103.538] AdjustWindowRectEx (in: lpRect=0x8fe4b8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8fe4b8) returned 1 [0103.538] GetSystemMetrics (nIndex=5) returned 1 [0103.538] GetSystemMetrics (nIndex=6) returned 1 [0103.538] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0103.538] AdjustWindowRectEx (in: lpRect=0x8fe4b8, dwStyle=0x560108c1, bMenu=0, dwExStyle=0x200 | out: lpRect=0x8fe4b8) returned 1 [0103.538] GetSystemMetrics (nIndex=5) returned 1 [0103.538] GetSystemMetrics (nIndex=6) returned 1 [0103.538] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0103.538] AdjustWindowRectEx (in: lpRect=0x8fe4b8, dwStyle=0x560108c1, bMenu=0, dwExStyle=0x200 | out: lpRect=0x8fe4b8) returned 1 [0103.538] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0103.538] AdjustWindowRectEx (in: lpRect=0x8fe4b8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8fe4b8) returned 1 [0103.540] SetWindowTextW (hWnd=0x4008c, lpString="Warning!") returned 1 [0103.540] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0xc, wParam=0x0, lParam=0x268756c) returned 0x1 [0103.542] GetStartupInfoW (in: lpStartupInfo=0x26c7cfc | out: lpStartupInfo=0x26c7cfc*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\WindowsFormsApp1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0103.545] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x46, wParam=0x0, lParam=0x8feae4) returned 0x0 [0103.545] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x83, wParam=0x1, lParam=0x8feabc) returned 0x0 [0103.547] GetWindowPlacement (in: hWnd=0x4008c, lpwndpl=0x8fe810 | out: lpwndpl=0x8fe810) returned 1 [0103.547] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x47, wParam=0x0, lParam=0x8feae4) returned 0x0 [0103.547] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x3, wParam=0x0, lParam=0x83008300) returned 0x0 [0103.547] GetClientRect (in: hWnd=0x4008c, lpRect=0x8fe110 | out: lpRect=0x8fe110) returned 1 [0103.547] GetWindowRect (in: hWnd=0x4008c, lpRect=0x8fe110 | out: lpRect=0x8fe110) returned 1 [0103.547] GetWindowTextLengthW (hWnd=0x4008c) returned 8 [0103.547] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0103.548] GetSystemMetrics (nIndex=42) returned 0 [0103.548] GetWindowTextW (in: hWnd=0x4008c, lpString=0x8fdf78, nMaxCount=9 | out: lpString="Warning!") returned 8 [0103.548] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0xd, wParam=0x9, lParam=0x8fdf78) returned 0x8 [0103.548] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x5, wParam=0x1, lParam=0x0) returned 0x0 [0103.548] GetClientRect (in: hWnd=0x4008c, lpRect=0x8fe7c0 | out: lpRect=0x8fe7c0) returned 1 [0103.548] GetWindowRect (in: hWnd=0x4008c, lpRect=0x8fe7c0 | out: lpRect=0x8fe7c0) returned 1 [0103.551] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0103.551] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0103.551] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0103.554] GetParent (hWnd=0x4008c) returned 0x0 [0103.555] SetWindowLongW (hWnd=0x4008c, nIndex=-8, dwNewLong=0) returned 0 [0103.558] GetSystemMetrics (nIndex=11) returned 32 [0103.558] GetSystemMetrics (nIndex=12) returned 32 [0103.558] GetDC (hWnd=0x0) returned 0x10105d6 [0103.559] GetDeviceCaps (hdc=0x10105d6, index=12) returned 32 [0103.559] GetDeviceCaps (hdc=0x10105d6, index=14) returned 1 [0103.559] ReleaseDC (hWnd=0x0, hDC=0x10105d6) returned 1 [0103.559] CreateIconFromResourceEx (presbits=0x26ca810, dwResSize=0x10a8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x4b0091 [0103.561] GetSystemMetrics (nIndex=49) returned 16 [0103.561] GetSystemMetrics (nIndex=50) returned 16 [0103.561] CreateIconFromResourceEx (presbits=0x26cb8f4, dwResSize=0x468, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x2702b5 [0103.562] SendMessageW (hWnd=0x4008c, Msg=0x80, wParam=0x0, lParam=0x2702b5) returned 0x0 [0103.562] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x80, wParam=0x0, lParam=0x2702b5) returned 0x0 [0103.563] SendMessageW (hWnd=0x4008c, Msg=0x80, wParam=0x1, lParam=0x4b0091) returned 0x0 [0103.563] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x80, wParam=0x1, lParam=0x4b0091) returned 0x0 [0103.564] GetSystemMenu (hWnd=0x4008c, bRevert=0) returned 0x5f0295 [0103.566] GetWindowPlacement (in: hWnd=0x4008c, lpwndpl=0x8ff0bc | out: lpwndpl=0x8ff0bc) returned 1 [0103.566] EnableMenuItem (hMenu=0x5f0295, uIDEnableItem=0xf020, uEnable=0x1) returned 0 [0103.567] EnableMenuItem (hMenu=0x5f0295, uIDEnableItem=0xf030, uEnable=0x1) returned 0 [0103.567] EnableMenuItem (hMenu=0x5f0295, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0103.567] EnableMenuItem (hMenu=0x5f0295, uIDEnableItem=0xf120, uEnable=0x0) returned 0 [0103.567] EnableMenuItem (hMenu=0x5f0295, uIDEnableItem=0xf000, uEnable=0x1) returned 0 [0103.567] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0103.568] GetWindowLongW (hWnd=0x4008c, nIndex=-16) returned 650641408 [0103.568] GetWindowTextLengthW (hWnd=0x4008c) returned 8 [0103.568] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0103.568] GetSystemMetrics (nIndex=42) returned 0 [0103.568] GetWindowTextW (in: hWnd=0x4008c, lpString=0x8feffc, nMaxCount=9 | out: lpString="Warning!") returned 8 [0103.568] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0xd, wParam=0x9, lParam=0x8feffc) returned 0x8 [0103.568] GetWindowTextLengthW (hWnd=0x4008c) returned 8 [0103.568] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0103.568] GetSystemMetrics (nIndex=42) returned 0 [0103.568] GetWindowTextW (in: hWnd=0x4008c, lpString=0x8feffc, nMaxCount=9 | out: lpString="Warning!") returned 8 [0103.568] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0xd, wParam=0x9, lParam=0x8feffc) returned 0x8 [0103.568] AdjustWindowRectEx (in: lpRect=0x8ff04c, dwStyle=0x2c80000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x8ff04c) returned 1 [0103.568] GetWindowLongW (hWnd=0x4008c, nIndex=-16) returned 650641408 [0103.568] GetWindowLongW (hWnd=0x4008c, nIndex=-20) returned 327936 [0103.568] SetWindowLongW (hWnd=0x4008c, nIndex=-16, dwNewLong=583532544) returned 650641408 [0103.568] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x7c, wParam=0xfffffff0, lParam=0x8ff05c) returned 0x0 [0103.569] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x7d, wParam=0xfffffff0, lParam=0x8ff05c) returned 0x0 [0103.569] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x2702b5 [0103.569] SetWindowLongW (hWnd=0x4008c, nIndex=-20, dwNewLong=327680) returned 327936 [0103.569] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x7c, wParam=0xffffffec, lParam=0x8ff05c) returned 0x0 [0103.570] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x7d, wParam=0xffffffec, lParam=0x8ff05c) returned 0x0 [0103.570] SetWindowPos (hWnd=0x4008c, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0103.570] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x46, wParam=0x0, lParam=0x8ff074) returned 0x0 [0103.570] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x83, wParam=0x1, lParam=0x8ff04c) returned 0x0 [0103.572] GetWindowPlacement (in: hWnd=0x4008c, lpwndpl=0x8feda0 | out: lpwndpl=0x8feda0) returned 1 [0103.572] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x47, wParam=0x0, lParam=0x8ff074) returned 0x0 [0103.572] GetClientRect (in: hWnd=0x4008c, lpRect=0x8fed50 | out: lpRect=0x8fed50) returned 1 [0103.572] GetWindowRect (in: hWnd=0x4008c, lpRect=0x8fed50 | out: lpRect=0x8fed50) returned 1 [0103.573] RedrawWindow (hWnd=0x4008c, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0103.573] GetSystemMenu (hWnd=0x4008c, bRevert=0) returned 0x5f0295 [0103.573] GetWindowPlacement (in: hWnd=0x4008c, lpwndpl=0x8ff0ac | out: lpwndpl=0x8ff0ac) returned 1 [0103.573] EnableMenuItem (hMenu=0x5f0295, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0103.573] EnableMenuItem (hMenu=0x5f0295, uIDEnableItem=0xf030, uEnable=0x1) returned 1 [0103.573] EnableMenuItem (hMenu=0x5f0295, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0103.573] EnableMenuItem (hMenu=0x5f0295, uIDEnableItem=0xf120, uEnable=0x0) returned 0 [0103.573] EnableMenuItem (hMenu=0x5f0295, uIDEnableItem=0xf000, uEnable=0x1) returned 1 [0103.573] ShowWindow (hWnd=0x4008c, nCmdShow=2) returned 0 [0103.573] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x46, wParam=0x0, lParam=0x8ff124) returned 0x0 [0103.584] GetWindowPlacement (in: hWnd=0x4008c, lpwndpl=0x8fee50 | out: lpwndpl=0x8fee50) returned 1 [0103.584] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x47, wParam=0x0, lParam=0x8ff124) returned 0x0 [0103.584] GetClientRect (in: hWnd=0x4008c, lpRect=0x8fee00 | out: lpRect=0x8fee00) returned 1 [0103.584] GetWindowRect (in: hWnd=0x4008c, lpRect=0x8fee00 | out: lpRect=0x8fee00) returned 1 [0103.584] GetWindowTextLengthW (hWnd=0x4008c) returned 8 [0103.584] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0103.585] GetSystemMetrics (nIndex=42) returned 0 [0103.585] GetWindowTextW (in: hWnd=0x4008c, lpString=0x8ff00c, nMaxCount=9 | out: lpString="Warning!") returned 8 [0103.585] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0xd, wParam=0x9, lParam=0x8ff00c) returned 0x8 [0103.585] GetCurrentActCtx (in: lphActCtx=0x8ff00c | out: lphActCtx=0x8ff00c*=0x956b54) returned 1 [0103.585] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0103.585] GetModuleHandleW (lpModuleName=0x0) returned 0x450000 [0103.585] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", lpWindowName=0x0, dwStyle=0x56000000, X=403, Y=365, nWidth=148, nHeight=167, hWndParent=0x4008c, hMenu=0x0, hInstance=0x450000, lpParam=0x0) returned 0x7002e [0103.586] SetWindowLongW (hWnd=0x7002e, nIndex=-4, dwNewLong=1950089536) returned 79168998 [0103.586] GetWindowLongW (hWnd=0x7002e, nIndex=-4) returned 1950089536 [0103.586] SetWindowLongW (hWnd=0x7002e, nIndex=-4, dwNewLong=79169926) returned 1950089536 [0103.586] GetWindowLongW (hWnd=0x7002e, nIndex=-4) returned 79169926 [0103.586] GetWindowLongW (hWnd=0x7002e, nIndex=-16) returned 1174405120 [0103.586] GetWindowLongW (hWnd=0x7002e, nIndex=-12) returned 0 [0103.586] SetWindowLongW (hWnd=0x7002e, nIndex=-12, dwNewLong=458798) returned 0 [0103.586] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7002e, Msg=0x81, wParam=0x0, lParam=0x8fea30) returned 0x1 [0103.586] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7002e, Msg=0x83, wParam=0x0, lParam=0x8fea1c) returned 0x0 [0103.587] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7002e, Msg=0x1, wParam=0x0, lParam=0x8fea30) returned 0x0 [0103.587] GetWindow (hWnd=0x7002e, uCmd=0x3) returned 0x0 [0103.587] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fe718 | out: lpRect=0x8fe718) returned 1 [0103.587] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fe718 | out: lpRect=0x8fe718) returned 1 [0103.587] GetParent (hWnd=0x7002e) returned 0x4008c [0103.587] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x4008c, lpPoints=0x8fe718, cPoints=0x2 | out: lpPoints=0x8fe718) returned 2097184000 [0103.587] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7002e, Msg=0x5, wParam=0x0, lParam=0xa70094) returned 0x0 [0103.588] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7002e, Msg=0x3, wParam=0x0, lParam=0x16d0193) returned 0x0 [0103.588] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fe770 | out: lpRect=0x8fe770) returned 1 [0103.588] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fe770 | out: lpRect=0x8fe770) returned 1 [0103.588] GetParent (hWnd=0x7002e) returned 0x4008c [0103.588] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x4008c, lpPoints=0x8fe770, cPoints=0x2 | out: lpPoints=0x8fe770) returned 2097184000 [0103.588] SendMessageW (hWnd=0x7002e, Msg=0x2210, wParam=0x2e0001, lParam=0x7002e) returned 0x0 [0103.588] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7002e, Msg=0x2210, wParam=0x2e0001, lParam=0x7002e) returned 0x0 [0103.588] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7002e, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0103.589] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fea44) returned 0x0 [0103.590] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x8fea44) returned 0x0 [0103.590] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fe740 | out: lpRect=0x8fe740) returned 1 [0103.590] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fe740 | out: lpRect=0x8fe740) returned 1 [0103.590] GetParent (hWnd=0x7002e) returned 0x4008c [0103.590] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x4008c, lpPoints=0x8fe740, cPoints=0x2 | out: lpPoints=0x8fe740) returned 2097184000 [0103.590] GetParent (hWnd=0x7002e) returned 0x4008c [0103.590] GetParent (hWnd=0x7002e) returned 0x4008c [0103.595] GdipImageGetFrameDimensionsCount (image=0x5fcf300, count=0x8fefe8) returned 0x0 [0103.595] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x97a140 [0103.595] GdipImageGetFrameDimensionsList (image=0x5fcf300, dimensionIDs=0x97a140*(Data1=0x54002e, Data2=0x54, Data3=0x843, Data4=([0]=0x4d, [1]=0x0, [2]=0x53, [3]=0x0, [4]=0x49, [5]=0x0, [6]=0x4c, [7]=0x0)), count=0x1) returned 0x0 [0103.597] LocalFree (hMem=0x97a140) returned 0x0 [0103.599] GetCurrentActCtx (in: lphActCtx=0x8ff00c | out: lphActCtx=0x8ff00c*=0x956b54) returned 1 [0103.599] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0103.600] GetClassInfoW (in: hInstance=0x0, lpClassName="STATIC", lpWndClass=0x26cc2f0 | out: lpWndClass=0x26cc2f0) returned 1 [0103.601] GetModuleHandleW (lpModuleName=0x0) returned 0x450000 [0103.601] CoTaskMemAlloc (cb=0x56) returned 0x9571c0 [0103.601] RegisterClassW (lpWndClass=0x8feec0) returned 0xc19f [0103.602] CoTaskMemFree (pv=0x9571c0) [0103.602] GetModuleHandleW (lpModuleName=0x0) returned 0x450000 [0103.602] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r9_ad1", lpWindowName="In order to recover your data...", dwStyle=0x5600000d, X=10, Y=-472, nWidth=0, nHeight=87, hWndParent=0x4008c, hMenu=0x0, hInstance=0x450000, lpParam=0x0) returned 0x70036 [0103.602] SetWindowLongW (hWnd=0x70036, nIndex=-4, dwNewLong=1874504640) returned 79169966 [0103.602] GetWindowLongW (hWnd=0x70036, nIndex=-4) returned 1874504640 [0103.603] SetWindowLongW (hWnd=0x70036, nIndex=-4, dwNewLong=79170006) returned 1874504640 [0103.603] GetWindowLongW (hWnd=0x70036, nIndex=-4) returned 79170006 [0103.603] GetWindowLongW (hWnd=0x70036, nIndex=-16) returned 1174405133 [0103.603] GetWindowLongW (hWnd=0x70036, nIndex=-12) returned 0 [0103.603] SetWindowLongW (hWnd=0x70036, nIndex=-12, dwNewLong=458806) returned 0 [0103.603] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x81, wParam=0x0, lParam=0x8fea30) returned 0x1 [0103.604] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x83, wParam=0x0, lParam=0x8fea1c) returned 0x0 [0103.604] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x1, wParam=0x0, lParam=0x8fea30) returned 0x0 [0103.605] GetWindow (hWnd=0x70036, uCmd=0x3) returned 0x7002e [0103.605] GetClientRect (in: hWnd=0x70036, lpRect=0x8fe6dc | out: lpRect=0x8fe6dc) returned 1 [0103.605] GetWindowRect (in: hWnd=0x70036, lpRect=0x8fe6dc | out: lpRect=0x8fe6dc) returned 1 [0103.605] GetParent (hWnd=0x70036) returned 0x4008c [0103.605] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x4008c, lpPoints=0x8fe6dc, cPoints=0x2 | out: lpPoints=0x8fe6dc) returned 2097184000 [0103.605] SetWindowTextW (hWnd=0x70036, lpString="In order to recover your data...") returned 1 [0103.605] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0xc, wParam=0x0, lParam=0x26874e0) returned 0x1 [0103.608] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x5, wParam=0x0, lParam=0x570000) returned 0x0 [0103.608] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x3, wParam=0x0, lParam=0xfe28000a) returned 0x0 [0103.608] GetClientRect (in: hWnd=0x70036, lpRect=0x8fe734 | out: lpRect=0x8fe734) returned 1 [0103.608] GetWindowRect (in: hWnd=0x70036, lpRect=0x8fe734 | out: lpRect=0x8fe734) returned 1 [0103.608] GetParent (hWnd=0x70036) returned 0x4008c [0103.608] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x4008c, lpPoints=0x8fe734, cPoints=0x2 | out: lpPoints=0x8fe734) returned 2097184000 [0103.608] SendMessageW (hWnd=0x70036, Msg=0x2210, wParam=0x360001, lParam=0x70036) returned 0x0 [0103.608] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x2210, wParam=0x360001, lParam=0x70036) returned 0x0 [0103.609] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0103.609] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x46, wParam=0x0, lParam=0x8fea44) returned 0x0 [0103.610] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x47, wParam=0x0, lParam=0x8fea44) returned 0x0 [0103.610] GetClientRect (in: hWnd=0x70036, lpRect=0x8fe704 | out: lpRect=0x8fe704) returned 1 [0103.610] GetWindowRect (in: hWnd=0x70036, lpRect=0x8fe704 | out: lpRect=0x8fe704) returned 1 [0103.610] GetParent (hWnd=0x70036) returned 0x4008c [0103.610] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x4008c, lpPoints=0x8fe704, cPoints=0x2 | out: lpPoints=0x8fe704) returned 2097184000 [0103.610] GetParent (hWnd=0x70036) returned 0x4008c [0103.610] GetParent (hWnd=0x70036) returned 0x4008c [0103.610] GetCurrentActCtx (in: lphActCtx=0x8feff4 | out: lphActCtx=0x8feff4*=0x956b54) returned 1 [0103.611] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0103.611] GetClassInfoW (in: hInstance=0x0, lpClassName="EDIT", lpWndClass=0x26cc628 | out: lpWndClass=0x26cc628) returned 1 [0103.611] GetModuleHandleW (lpModuleName=0x0) returned 0x450000 [0103.612] CoTaskMemAlloc (cb=0x52) returned 0x9571c0 [0103.612] RegisterClassW (lpWndClass=0x8feea8) returned 0xc1a1 [0103.612] CoTaskMemFree (pv=0x9571c0) [0103.612] GetModuleHandleW (lpModuleName=0x0) returned 0x450000 [0103.612] CreateWindowExW (dwExStyle=0x200, lpClassName="WindowsForms10.EDIT.app.0.141b42a_r9_ad1", lpWindowName="friendly.cyber.criminal@gmail.com", dwStyle=0x560108c1, X=-333, Y=-232, nWidth=677, nHeight=59, hWndParent=0x4008c, hMenu=0x0, hInstance=0x450000, lpParam=0x0) returned 0x70030 [0103.612] SetWindowLongW (hWnd=0x70030, nIndex=-4, dwNewLong=1874383968) returned 79170046 [0103.613] GetWindowLongW (hWnd=0x70030, nIndex=-4) returned 1874383968 [0103.613] SetWindowLongW (hWnd=0x70030, nIndex=-4, dwNewLong=79170086) returned 1874383968 [0103.613] GetWindowLongW (hWnd=0x70030, nIndex=-4) returned 79170086 [0103.613] GetWindowLongW (hWnd=0x70030, nIndex=-16) returned 1174472897 [0103.613] GetWindowLongW (hWnd=0x70030, nIndex=-12) returned 0 [0103.613] SetWindowLongW (hWnd=0x70030, nIndex=-12, dwNewLong=458800) returned 0 [0103.613] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x81, wParam=0x0, lParam=0x8fea18) returned 0x1 [0103.618] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x83, wParam=0x0, lParam=0x8fea04) returned 0x0 [0103.618] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x1, wParam=0x0, lParam=0x8fea18) returned 0x1 [0103.628] SendMessageW (hWnd=0x70030, Msg=0x2111, wParam=0x4000030, lParam=0x70030) returned 0x0 [0103.628] SendMessageW (hWnd=0x70030, Msg=0x2111, wParam=0x3000030, lParam=0x70030) returned 0x0 [0103.629] SendMessageW (hWnd=0x70030, Msg=0x2055, wParam=0x70030, lParam=0x3) returned 0x2 [0103.629] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x0 [0103.629] GetWindow (hWnd=0x70030, uCmd=0x3) returned 0x70036 [0103.629] GetClientRect (in: hWnd=0x70030, lpRect=0x8fe6d8 | out: lpRect=0x8fe6d8) returned 1 [0103.629] GetWindowRect (in: hWnd=0x70030, lpRect=0x8fe6d8 | out: lpRect=0x8fe6d8) returned 1 [0103.629] GetParent (hWnd=0x70030) returned 0x4008c [0103.629] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x4008c, lpPoints=0x8fe6d8, cPoints=0x2 | out: lpPoints=0x8fe6d8) returned 2097184000 [0103.629] GetDC (hWnd=0x0) returned 0x10105d6 [0103.629] GdipCreateFromHDC (hdc=0x10105d6, graphics=0x8fe574) returned 0x0 [0103.630] CoTaskMemAlloc (cb=0x5c) returned 0x985838 [0103.630] GdipGetLogFontW (font=0x5fcf2b0, graphics=0x5fcffe0, logfontW=0x985838) returned 0x0 [0103.630] CoTaskMemFree (pv=0x985838) [0103.630] CoTaskMemAlloc (cb=0x5c) returned 0x985768 [0103.630] CoTaskMemFree (pv=0x985768) [0103.630] CoTaskMemAlloc (cb=0x5c) returned 0x985560 [0103.630] CoTaskMemFree (pv=0x985560) [0103.630] GdipDeleteGraphics (graphics=0x5fcffe0) returned 0x0 [0103.630] ReleaseDC (hWnd=0x0, hDC=0x10105d6) returned 1 [0103.631] CoTaskMemAlloc (cb=0x5c) returned 0x985b10 [0103.631] CreateFontIndirectW (lplf=0x985b10) returned 0x1e0a07d9 [0103.631] CoTaskMemFree (pv=0x985b10) [0103.631] SendMessageW (hWnd=0x70030, Msg=0x30, wParam=0x1e0a07d9, lParam=0x0) returned 0x1 [0103.631] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x30, wParam=0x1e0a07d9, lParam=0x0) returned 0x1 [0103.791] SendMessageW (hWnd=0x70030, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0 [0103.792] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0 [0103.792] SetWindowTextW (hWnd=0x70030, lpString="friendly.cyber.criminal@gmail.com") returned 1 [0103.792] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0xc, wParam=0x0, lParam=0x2687474) returned 0x1 [0103.793] SendMessageW (hWnd=0x70030, Msg=0x2111, wParam=0x4000030, lParam=0x70030) returned 0x0 [0103.793] SendMessageW (hWnd=0x70030, Msg=0x2111, wParam=0x3000030, lParam=0x70030) returned 0x0 [0103.793] GetSystemMetrics (nIndex=5) returned 1 [0103.793] GetSystemMetrics (nIndex=6) returned 1 [0103.793] SendMessageW (hWnd=0x70030, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1 [0103.793] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1 [0103.817] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x5, wParam=0x0, lParam=0x3702a1) returned 0x0 [0103.817] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x3, wParam=0x0, lParam=0xff1afeb5) returned 0x0 [0103.817] GetClientRect (in: hWnd=0x70030, lpRect=0x8fe730 | out: lpRect=0x8fe730) returned 1 [0103.817] GetWindowRect (in: hWnd=0x70030, lpRect=0x8fe730 | out: lpRect=0x8fe730) returned 1 [0103.817] GetParent (hWnd=0x70030) returned 0x4008c [0103.817] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x4008c, lpPoints=0x8fe730, cPoints=0x2 | out: lpPoints=0x8fe730) returned 2097184000 [0103.817] SendMessageW (hWnd=0x70030, Msg=0x2210, wParam=0x300001, lParam=0x70030) returned 0x0 [0103.817] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x2210, wParam=0x300001, lParam=0x70030) returned 0x0 [0103.818] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0103.818] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x46, wParam=0x0, lParam=0x8fea2c) returned 0x0 [0103.820] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x47, wParam=0x0, lParam=0x8fea2c) returned 0x0 [0103.820] GetClientRect (in: hWnd=0x70030, lpRect=0x8fe700 | out: lpRect=0x8fe700) returned 1 [0103.821] GetWindowRect (in: hWnd=0x70030, lpRect=0x8fe700 | out: lpRect=0x8fe700) returned 1 [0103.821] GetParent (hWnd=0x70030) returned 0x4008c [0103.821] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x4008c, lpPoints=0x8fe700, cPoints=0x2 | out: lpPoints=0x8fe700) returned 2097184000 [0103.821] GetParent (hWnd=0x70030) returned 0x4008c [0103.821] GetParent (hWnd=0x70030) returned 0x4008c [0103.821] GetCurrentActCtx (in: lphActCtx=0x8feff4 | out: lphActCtx=0x8feff4*=0x956b54) returned 1 [0103.821] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0103.823] GetModuleHandleW (lpModuleName=0x0) returned 0x450000 [0103.823] CreateWindowExW (dwExStyle=0x200, lpClassName="WindowsForms10.EDIT.app.0.141b42a_r9_ad1", lpWindowName="1BtUL5dhVXHwKLqSdhjyjK9Pe64Vc6CEH1", dwStyle=0x560108c1, X=-333, Y=-345, nWidth=677, nHeight=59, hWndParent=0x4008c, hMenu=0x0, hInstance=0x450000, lpParam=0x0) returned 0x502ba [0103.823] SetWindowLongW (hWnd=0x502ba, nIndex=-4, dwNewLong=1874383968) returned 79170046 [0103.824] GetWindowLongW (hWnd=0x502ba, nIndex=-4) returned 1874383968 [0103.824] SetWindowLongW (hWnd=0x502ba, nIndex=-4, dwNewLong=79170126) returned 1874383968 [0103.824] GetWindowLongW (hWnd=0x502ba, nIndex=-4) returned 79170126 [0103.824] GetWindowLongW (hWnd=0x502ba, nIndex=-16) returned 1174472897 [0103.824] GetWindowLongW (hWnd=0x502ba, nIndex=-12) returned 0 [0103.824] SetWindowLongW (hWnd=0x502ba, nIndex=-12, dwNewLong=328378) returned 0 [0103.824] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x81, wParam=0x0, lParam=0x8fea18) returned 0x1 [0103.827] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x83, wParam=0x0, lParam=0x8fea04) returned 0x0 [0103.828] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x1, wParam=0x0, lParam=0x8fea18) returned 0x1 [0103.829] SendMessageW (hWnd=0x502ba, Msg=0x2111, wParam=0x40002ba, lParam=0x502ba) returned 0x0 [0103.829] SendMessageW (hWnd=0x502ba, Msg=0x2111, wParam=0x30002ba, lParam=0x502ba) returned 0x0 [0103.829] SendMessageW (hWnd=0x502ba, Msg=0x2055, wParam=0x502ba, lParam=0x3) returned 0x2 [0103.829] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x0 [0103.829] GetWindow (hWnd=0x502ba, uCmd=0x3) returned 0x70030 [0103.829] GetClientRect (in: hWnd=0x502ba, lpRect=0x8fe6d8 | out: lpRect=0x8fe6d8) returned 1 [0103.830] GetWindowRect (in: hWnd=0x502ba, lpRect=0x8fe6d8 | out: lpRect=0x8fe6d8) returned 1 [0103.830] GetParent (hWnd=0x502ba) returned 0x4008c [0103.830] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x4008c, lpPoints=0x8fe6d8, cPoints=0x2 | out: lpPoints=0x8fe6d8) returned 2097184000 [0103.830] GetDC (hWnd=0x0) returned 0x10105d6 [0103.830] GdipCreateFromHDC (hdc=0x10105d6, graphics=0x8fe574) returned 0x0 [0103.830] CoTaskMemAlloc (cb=0x5c) returned 0x985908 [0103.831] GdipGetLogFontW (font=0x5fcf288, graphics=0x5fcffe0, logfontW=0x985908) returned 0x0 [0103.831] CoTaskMemFree (pv=0x985908) [0103.831] CoTaskMemAlloc (cb=0x5c) returned 0x985700 [0103.831] CoTaskMemFree (pv=0x985700) [0103.831] CoTaskMemAlloc (cb=0x5c) returned 0x9855c8 [0103.831] CoTaskMemFree (pv=0x9855c8) [0103.831] GdipDeleteGraphics (graphics=0x5fcffe0) returned 0x0 [0103.831] ReleaseDC (hWnd=0x0, hDC=0x10105d6) returned 1 [0103.831] CoTaskMemAlloc (cb=0x5c) returned 0x985560 [0103.831] CreateFontIndirectW (lplf=0x985560) returned 0x170a07eb [0103.832] CoTaskMemFree (pv=0x985560) [0103.832] SendMessageW (hWnd=0x502ba, Msg=0x30, wParam=0x170a07eb, lParam=0x0) returned 0x1 [0103.832] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x30, wParam=0x170a07eb, lParam=0x0) returned 0x1 [0103.833] SendMessageW (hWnd=0x502ba, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0 [0103.833] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0 [0103.833] SetWindowTextW (hWnd=0x502ba, lpString="1BtUL5dhVXHwKLqSdhjyjK9Pe64Vc6CEH1") returned 1 [0103.833] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0xc, wParam=0x0, lParam=0x26873f4) returned 0x1 [0103.833] SendMessageW (hWnd=0x502ba, Msg=0x2111, wParam=0x40002ba, lParam=0x502ba) returned 0x0 [0103.833] SendMessageW (hWnd=0x502ba, Msg=0x2111, wParam=0x30002ba, lParam=0x502ba) returned 0x0 [0103.834] GetSystemMetrics (nIndex=5) returned 1 [0103.834] GetSystemMetrics (nIndex=6) returned 1 [0103.834] SendMessageW (hWnd=0x502ba, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1 [0103.834] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1 [0103.834] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x5, wParam=0x0, lParam=0x3702a1) returned 0x0 [0103.835] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x3, wParam=0x0, lParam=0xfea9feb5) returned 0x0 [0103.835] GetClientRect (in: hWnd=0x502ba, lpRect=0x8fe730 | out: lpRect=0x8fe730) returned 1 [0103.835] GetWindowRect (in: hWnd=0x502ba, lpRect=0x8fe730 | out: lpRect=0x8fe730) returned 1 [0103.835] GetParent (hWnd=0x502ba) returned 0x4008c [0103.835] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x4008c, lpPoints=0x8fe730, cPoints=0x2 | out: lpPoints=0x8fe730) returned 2097184000 [0103.835] SendMessageW (hWnd=0x502ba, Msg=0x2210, wParam=0x2ba0001, lParam=0x502ba) returned 0x0 [0103.835] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x2210, wParam=0x2ba0001, lParam=0x502ba) returned 0x0 [0103.835] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0103.835] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x46, wParam=0x0, lParam=0x8fea2c) returned 0x0 [0103.837] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x47, wParam=0x0, lParam=0x8fea2c) returned 0x0 [0103.837] GetClientRect (in: hWnd=0x502ba, lpRect=0x8fe700 | out: lpRect=0x8fe700) returned 1 [0103.837] GetWindowRect (in: hWnd=0x502ba, lpRect=0x8fe700 | out: lpRect=0x8fe700) returned 1 [0103.837] GetParent (hWnd=0x502ba) returned 0x4008c [0103.837] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x4008c, lpPoints=0x8fe700, cPoints=0x2 | out: lpPoints=0x8fe700) returned 2097184000 [0103.837] GetParent (hWnd=0x502ba) returned 0x4008c [0103.837] GetParent (hWnd=0x502ba) returned 0x4008c [0103.837] GetCurrentActCtx (in: lphActCtx=0x8ff00c | out: lphActCtx=0x8ff00c*=0x956b54) returned 1 [0103.837] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0103.838] GetModuleHandleW (lpModuleName=0x0) returned 0x450000 [0103.838] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r9_ad1", lpWindowName="Next, E-mail your transaction ID to the following address:", dwStyle=0x5600000d, X=10, Y=-291, nWidth=0, nHeight=55, hWndParent=0x4008c, hMenu=0x0, hInstance=0x450000, lpParam=0x0) returned 0x18001c [0103.838] SetWindowLongW (hWnd=0x18001c, nIndex=-4, dwNewLong=1874504640) returned 79169966 [0103.839] GetWindowLongW (hWnd=0x18001c, nIndex=-4) returned 1874504640 [0103.839] SetWindowLongW (hWnd=0x18001c, nIndex=-4, dwNewLong=79170166) returned 1874504640 [0103.839] GetWindowLongW (hWnd=0x18001c, nIndex=-4) returned 79170166 [0103.839] GetWindowLongW (hWnd=0x18001c, nIndex=-16) returned 1174405133 [0103.839] GetWindowLongW (hWnd=0x18001c, nIndex=-12) returned 0 [0103.839] SetWindowLongW (hWnd=0x18001c, nIndex=-12, dwNewLong=1572892) returned 0 [0103.839] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x81, wParam=0x0, lParam=0x8fea30) returned 0x1 [0103.840] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x83, wParam=0x0, lParam=0x8fea1c) returned 0x0 [0103.841] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x1, wParam=0x0, lParam=0x8fea30) returned 0x0 [0103.842] GetWindow (hWnd=0x18001c, uCmd=0x3) returned 0x502ba [0103.842] GetClientRect (in: hWnd=0x18001c, lpRect=0x8fe6dc | out: lpRect=0x8fe6dc) returned 1 [0103.842] GetWindowRect (in: hWnd=0x18001c, lpRect=0x8fe6dc | out: lpRect=0x8fe6dc) returned 1 [0103.842] GetParent (hWnd=0x18001c) returned 0x4008c [0103.842] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x4008c, lpPoints=0x8fe6dc, cPoints=0x2 | out: lpPoints=0x8fe6dc) returned 2097184000 [0103.842] SetWindowTextW (hWnd=0x18001c, lpString="Next, E-mail your transaction ID to the following address:") returned 1 [0103.842] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0xc, wParam=0x0, lParam=0x2687340) returned 0x1 [0103.843] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x5, wParam=0x0, lParam=0x370000) returned 0x0 [0103.843] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x3, wParam=0x0, lParam=0xfedd000a) returned 0x0 [0103.843] GetClientRect (in: hWnd=0x18001c, lpRect=0x8fe734 | out: lpRect=0x8fe734) returned 1 [0103.843] GetWindowRect (in: hWnd=0x18001c, lpRect=0x8fe734 | out: lpRect=0x8fe734) returned 1 [0103.843] GetParent (hWnd=0x18001c) returned 0x4008c [0103.843] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x4008c, lpPoints=0x8fe734, cPoints=0x2 | out: lpPoints=0x8fe734) returned 2097184000 [0103.843] SendMessageW (hWnd=0x18001c, Msg=0x2210, wParam=0x1c0001, lParam=0x18001c) returned 0x0 [0103.843] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x2210, wParam=0x1c0001, lParam=0x18001c) returned 0x0 [0103.843] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0103.843] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x46, wParam=0x0, lParam=0x8fea44) returned 0x0 [0103.845] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x47, wParam=0x0, lParam=0x8fea44) returned 0x0 [0103.845] GetClientRect (in: hWnd=0x18001c, lpRect=0x8fe704 | out: lpRect=0x8fe704) returned 1 [0103.845] GetWindowRect (in: hWnd=0x18001c, lpRect=0x8fe704 | out: lpRect=0x8fe704) returned 1 [0103.845] GetParent (hWnd=0x18001c) returned 0x4008c [0103.845] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x4008c, lpPoints=0x8fe704, cPoints=0x2 | out: lpPoints=0x8fe704) returned 2097184000 [0103.845] GetParent (hWnd=0x18001c) returned 0x4008c [0103.845] GetParent (hWnd=0x18001c) returned 0x4008c [0103.845] GetCurrentActCtx (in: lphActCtx=0x8ff00c | out: lphActCtx=0x8ff00c*=0x956b54) returned 1 [0103.846] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0103.846] GetModuleHandleW (lpModuleName=0x0) returned 0x450000 [0103.846] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r9_ad1", lpWindowName="Please send n Bitcoin(s) to the following BTC address:", dwStyle=0x5600000d, X=10, Y=-396, nWidth=0, nHeight=55, hWndParent=0x4008c, hMenu=0x0, hInstance=0x450000, lpParam=0x0) returned 0x202cc [0103.847] SetWindowLongW (hWnd=0x202cc, nIndex=-4, dwNewLong=1874504640) returned 79169966 [0103.847] GetWindowLongW (hWnd=0x202cc, nIndex=-4) returned 1874504640 [0103.847] SetWindowLongW (hWnd=0x202cc, nIndex=-4, dwNewLong=79170206) returned 1874504640 [0103.847] GetWindowLongW (hWnd=0x202cc, nIndex=-4) returned 79170206 [0103.847] GetWindowLongW (hWnd=0x202cc, nIndex=-16) returned 1174405133 [0103.847] GetWindowLongW (hWnd=0x202cc, nIndex=-12) returned 0 [0103.847] SetWindowLongW (hWnd=0x202cc, nIndex=-12, dwNewLong=131788) returned 0 [0103.847] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202cc, Msg=0x81, wParam=0x0, lParam=0x8fea30) returned 0x1 [0103.848] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202cc, Msg=0x83, wParam=0x0, lParam=0x8fea1c) returned 0x0 [0103.848] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202cc, Msg=0x1, wParam=0x0, lParam=0x8fea30) returned 0x0 [0103.849] GetWindow (hWnd=0x202cc, uCmd=0x3) returned 0x18001c [0103.849] GetClientRect (in: hWnd=0x202cc, lpRect=0x8fe6dc | out: lpRect=0x8fe6dc) returned 1 [0103.849] GetWindowRect (in: hWnd=0x202cc, lpRect=0x8fe6dc | out: lpRect=0x8fe6dc) returned 1 [0103.849] GetParent (hWnd=0x202cc) returned 0x4008c [0103.849] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x4008c, lpPoints=0x8fe6dc, cPoints=0x2 | out: lpPoints=0x8fe6dc) returned 2097184000 [0103.849] SetWindowTextW (hWnd=0x202cc, lpString="Please send n Bitcoin(s) to the following BTC address:") returned 1 [0103.849] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202cc, Msg=0xc, wParam=0x0, lParam=0x26872a8) returned 0x1 [0103.850] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202cc, Msg=0x5, wParam=0x0, lParam=0x370000) returned 0x0 [0103.850] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202cc, Msg=0x3, wParam=0x0, lParam=0xfe74000a) returned 0x0 [0103.850] GetClientRect (in: hWnd=0x202cc, lpRect=0x8fe734 | out: lpRect=0x8fe734) returned 1 [0103.850] GetWindowRect (in: hWnd=0x202cc, lpRect=0x8fe734 | out: lpRect=0x8fe734) returned 1 [0103.850] GetParent (hWnd=0x202cc) returned 0x4008c [0103.850] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x4008c, lpPoints=0x8fe734, cPoints=0x2 | out: lpPoints=0x8fe734) returned 2097184000 [0103.850] SendMessageW (hWnd=0x202cc, Msg=0x2210, wParam=0x2cc0001, lParam=0x202cc) returned 0x0 [0103.850] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202cc, Msg=0x2210, wParam=0x2cc0001, lParam=0x202cc) returned 0x0 [0103.851] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202cc, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0103.851] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202cc, Msg=0x46, wParam=0x0, lParam=0x8fea44) returned 0x0 [0103.852] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202cc, Msg=0x47, wParam=0x0, lParam=0x8fea44) returned 0x0 [0103.852] GetClientRect (in: hWnd=0x202cc, lpRect=0x8fe704 | out: lpRect=0x8fe704) returned 1 [0103.852] GetWindowRect (in: hWnd=0x202cc, lpRect=0x8fe704 | out: lpRect=0x8fe704) returned 1 [0103.852] GetParent (hWnd=0x202cc) returned 0x4008c [0103.852] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x4008c, lpPoints=0x8fe704, cPoints=0x2 | out: lpPoints=0x8fe704) returned 2097184000 [0103.852] GetParent (hWnd=0x202cc) returned 0x4008c [0103.853] GetParent (hWnd=0x202cc) returned 0x4008c [0103.853] GetCurrentActCtx (in: lphActCtx=0x8ff00c | out: lphActCtx=0x8ff00c*=0x956b54) returned 1 [0103.853] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0103.853] GetModuleHandleW (lpModuleName=0x0) returned 0x450000 [0103.853] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r9_ad1", lpWindowName="Your files (count: n) have been encrypted!", dwStyle=0x5600000d, X=10, Y=-527, nWidth=0, nHeight=55, hWndParent=0x4008c, hMenu=0x0, hInstance=0x450000, lpParam=0x0) returned 0x302ac [0103.854] SetWindowLongW (hWnd=0x302ac, nIndex=-4, dwNewLong=1874504640) returned 79169966 [0103.854] GetWindowLongW (hWnd=0x302ac, nIndex=-4) returned 1874504640 [0103.854] SetWindowLongW (hWnd=0x302ac, nIndex=-4, dwNewLong=79170246) returned 1874504640 [0103.854] GetWindowLongW (hWnd=0x302ac, nIndex=-4) returned 79170246 [0103.854] GetWindowLongW (hWnd=0x302ac, nIndex=-16) returned 1174405133 [0103.854] GetWindowLongW (hWnd=0x302ac, nIndex=-12) returned 0 [0103.855] SetWindowLongW (hWnd=0x302ac, nIndex=-12, dwNewLong=197292) returned 0 [0103.855] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x302ac, Msg=0x81, wParam=0x0, lParam=0x8fea30) returned 0x1 [0103.855] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x302ac, Msg=0x83, wParam=0x0, lParam=0x8fea1c) returned 0x0 [0103.856] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x302ac, Msg=0x1, wParam=0x0, lParam=0x8fea30) returned 0x0 [0103.856] GetWindow (hWnd=0x302ac, uCmd=0x3) returned 0x202cc [0103.856] GetClientRect (in: hWnd=0x302ac, lpRect=0x8fe6dc | out: lpRect=0x8fe6dc) returned 1 [0103.856] GetWindowRect (in: hWnd=0x302ac, lpRect=0x8fe6dc | out: lpRect=0x8fe6dc) returned 1 [0103.856] GetParent (hWnd=0x302ac) returned 0x4008c [0103.857] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x4008c, lpPoints=0x8fe6dc, cPoints=0x2 | out: lpPoints=0x8fe6dc) returned 2097184000 [0103.857] SetWindowTextW (hWnd=0x302ac, lpString="Your files (count: n) have been encrypted!") returned 1 [0103.857] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x302ac, Msg=0xc, wParam=0x0, lParam=0x2687214) returned 0x1 [0103.857] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x302ac, Msg=0x5, wParam=0x0, lParam=0x370000) returned 0x0 [0103.857] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x302ac, Msg=0x3, wParam=0x0, lParam=0xfdf1000a) returned 0x0 [0103.857] GetClientRect (in: hWnd=0x302ac, lpRect=0x8fe734 | out: lpRect=0x8fe734) returned 1 [0103.857] GetWindowRect (in: hWnd=0x302ac, lpRect=0x8fe734 | out: lpRect=0x8fe734) returned 1 [0103.857] GetParent (hWnd=0x302ac) returned 0x4008c [0103.857] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x4008c, lpPoints=0x8fe734, cPoints=0x2 | out: lpPoints=0x8fe734) returned 2097184000 [0103.858] SendMessageW (hWnd=0x302ac, Msg=0x2210, wParam=0x2ac0001, lParam=0x302ac) returned 0x0 [0103.858] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x302ac, Msg=0x2210, wParam=0x2ac0001, lParam=0x302ac) returned 0x0 [0103.858] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x302ac, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0103.858] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x302ac, Msg=0x46, wParam=0x0, lParam=0x8fea44) returned 0x0 [0103.859] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x302ac, Msg=0x47, wParam=0x0, lParam=0x8fea44) returned 0x0 [0103.859] GetClientRect (in: hWnd=0x302ac, lpRect=0x8fe704 | out: lpRect=0x8fe704) returned 1 [0103.859] GetWindowRect (in: hWnd=0x302ac, lpRect=0x8fe704 | out: lpRect=0x8fe704) returned 1 [0103.859] GetParent (hWnd=0x302ac) returned 0x4008c [0103.859] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x4008c, lpPoints=0x8fe704, cPoints=0x2 | out: lpPoints=0x8fe704) returned 2097184000 [0103.859] GetParent (hWnd=0x302ac) returned 0x4008c [0103.859] GetParent (hWnd=0x302ac) returned 0x4008c [0103.859] SendMessageW (hWnd=0x4008c, Msg=0x18, wParam=0x1, lParam=0x0) [0103.859] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0103.859] GetParent (hWnd=0x7002e) returned 0x4008c [0103.859] GetParent (hWnd=0x70036) returned 0x4008c [0103.860] GetParent (hWnd=0x70030) returned 0x4008c [0103.860] GetParent (hWnd=0x502ba) returned 0x4008c [0103.860] GetParent (hWnd=0x18001c) returned 0x4008c [0103.860] GetParent (hWnd=0x202cc) returned 0x4008c [0103.860] GetParent (hWnd=0x302ac) returned 0x4008c [0103.860] GetWindowTextLengthW (hWnd=0x4008c) returned 8 [0103.860] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0103.860] GetSystemMetrics (nIndex=42) returned 0 [0103.860] GetWindowTextW (in: hWnd=0x4008c, lpString=0x8fed70, nMaxCount=9 | out: lpString="Warning!") returned 8 [0103.860] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0xd, wParam=0x9, lParam=0x8fed70) returned 0x8 [0103.947] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0103.948] GetWindowLongW (hWnd=0x4008c, nIndex=-16) returned 919076864 [0103.948] GetWindowTextLengthW (hWnd=0x4008c) returned 8 [0103.948] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0103.948] GetSystemMetrics (nIndex=42) returned 0 [0103.948] GetWindowTextW (in: hWnd=0x4008c, lpString=0x8fec4c, nMaxCount=9 | out: lpString="Warning!") returned 8 [0103.948] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0xd, wParam=0x9, lParam=0x8fec4c) returned 0x8 [0103.948] GetWindowTextLengthW (hWnd=0x4008c) returned 8 [0103.948] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0103.948] GetSystemMetrics (nIndex=42) returned 0 [0103.948] GetWindowTextW (in: hWnd=0x4008c, lpString=0x8fec4c, nMaxCount=9 | out: lpString="Warning!") returned 8 [0103.948] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0xd, wParam=0x9, lParam=0x8fec4c) returned 0x8 [0103.948] AdjustWindowRectEx (in: lpRect=0x8fec9c, dwStyle=0x12c80000, bMenu=0, dwExStyle=0xd0000 | out: lpRect=0x8fec9c) returned 1 [0103.948] GetWindowLongW (hWnd=0x4008c, nIndex=-16) returned 919076864 [0103.948] GetWindowLongW (hWnd=0x4008c, nIndex=-20) returned 327936 [0103.948] SetWindowLongW (hWnd=0x4008c, nIndex=-16, dwNewLong=851968000) returned 919076864 [0103.948] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x7c, wParam=0xfffffff0, lParam=0x8fecac) returned 0x0 [0103.949] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x7d, wParam=0xfffffff0, lParam=0x8fecac) returned 0x0 [0103.949] SetWindowLongW (hWnd=0x4008c, nIndex=-20, dwNewLong=851968) returned 327936 [0103.952] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x7c, wParam=0xffffffec, lParam=0x8fecac) returned 0x0 [0103.953] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x7d, wParam=0xffffffec, lParam=0x8fecac) returned 0x0 [0103.953] SetWindowPos (hWnd=0x4008c, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0103.953] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x46, wParam=0x0, lParam=0x8fecc4) returned 0x0 [0103.953] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x83, wParam=0x1, lParam=0x8fec9c) returned 0x0 [0103.955] GetWindowPlacement (in: hWnd=0x4008c, lpwndpl=0x8fe9f0 | out: lpwndpl=0x8fe9f0) returned 1 [0103.955] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x47, wParam=0x0, lParam=0x8fecc4) returned 0x0 [0103.955] GetClientRect (in: hWnd=0x4008c, lpRect=0x8fe9a0 | out: lpRect=0x8fe9a0) returned 1 [0103.955] GetWindowRect (in: hWnd=0x4008c, lpRect=0x8fe9a0 | out: lpRect=0x8fe9a0) returned 1 [0103.955] RedrawWindow (hWnd=0x4008c, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0103.956] GetSystemMenu (hWnd=0x4008c, bRevert=0) returned 0x5f0295 [0103.956] GetWindowPlacement (in: hWnd=0x4008c, lpwndpl=0x8fecfc | out: lpwndpl=0x8fecfc) returned 1 [0103.956] EnableMenuItem (hMenu=0x5f0295, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0103.956] EnableMenuItem (hMenu=0x5f0295, uIDEnableItem=0xf030, uEnable=0x1) returned 1 [0103.956] EnableMenuItem (hMenu=0x5f0295, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0103.956] EnableMenuItem (hMenu=0x5f0295, uIDEnableItem=0xf120, uEnable=0x0) returned 0 [0103.956] EnableMenuItem (hMenu=0x5f0295, uIDEnableItem=0xf000, uEnable=0x1) returned 1 [0103.960] SetLayeredWindowAttributes (hwnd=0x4008c, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0103.961] GetWindowPlacement (in: hWnd=0x4008c, lpwndpl=0x8fedcc | out: lpwndpl=0x8fedcc) returned 1 [0103.963] GetCurrentThreadId () returned 0x1230 [0103.970] EnumThreadWindows (dwThreadId=0x1230, lpfn=0x4b80aee, lParam=0x4008c) returned 1 [0104.049] GetWindowLongW (hWnd=0x302ce, nIndex=-8) returned 0 [0104.049] GetWindowLongW (hWnd=0x4008c, nIndex=-8) returned 0 [0104.049] GetWindowLongW (hWnd=0x402b8, nIndex=-8) returned 197326 [0104.055] GetParent (hWnd=0x4008c) returned 0x0 [0104.058] GetWindowThreadProcessId (in: hWnd=0x7002e, lpdwProcessId=0x8fed14 | out: lpdwProcessId=0x8fed14) returned 0x1230 [0104.062] GetCurrentActCtx (in: lphActCtx=0x8fec7c | out: lphActCtx=0x8fec7c*=0x956b54) returned 1 [0104.062] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0104.062] GetModuleHandleW (lpModuleName=0x0) returned 0x450000 [0104.062] CreateWindowExW (dwExStyle=0x10000, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", lpWindowName="WindowsFormsParkingWindow", dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x450000, lpParam=0x0) returned 0x300ec [0104.063] SetWindowLongW (hWnd=0x300ec, nIndex=-4, dwNewLong=1950089536) returned 79168998 [0104.063] GetWindowLongW (hWnd=0x300ec, nIndex=-4) returned 1950089536 [0104.065] SetWindowLongW (hWnd=0x300ec, nIndex=-4, dwNewLong=79168694) returned 1950089536 [0104.066] GetWindowLongW (hWnd=0x300ec, nIndex=-4) returned 79168694 [0104.066] GetWindowLongW (hWnd=0x300ec, nIndex=-16) returned 113311744 [0104.066] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x300ec, Msg=0x24, wParam=0x0, lParam=0x8fe6ac) returned 0x0 [0104.066] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x300ec, Msg=0x81, wParam=0x0, lParam=0x8fe6a0) returned 0x1 [0104.067] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x300ec, Msg=0x83, wParam=0x0, lParam=0x8fe68c) returned 0x0 [0104.067] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x300ec, Msg=0x1, wParam=0x0, lParam=0x8fe6a0) returned 0x0 [0104.067] GetClientRect (in: hWnd=0x300ec, lpRect=0x8fe36c | out: lpRect=0x8fe36c) returned 1 [0104.067] GetWindowRect (in: hWnd=0x300ec, lpRect=0x8fe36c | out: lpRect=0x8fe36c) returned 1 [0104.067] SetWindowTextW (hWnd=0x300ec, lpString="WindowsFormsParkingWindow") returned 1 [0104.067] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x300ec, Msg=0xc, wParam=0x0, lParam=0x26cd680) returned 0x1 [0104.068] GetParent (hWnd=0x300ec) returned 0x0 [0104.068] SetParent (hWndChild=0x7002e, hWndNewParent=0x300ec) returned 0x4008c [0104.068] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7002e, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0104.068] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fec74) returned 0x0 [0104.070] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x8fec74) returned 0x0 [0104.070] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fe970 | out: lpRect=0x8fe970) returned 1 [0104.070] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fe970 | out: lpRect=0x8fe970) returned 1 [0104.070] GetParent (hWnd=0x7002e) returned 0x4008c [0104.070] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x4008c, lpPoints=0x8fe970, cPoints=0x2 | out: lpPoints=0x8fe970) returned 2097184000 [0104.070] GetParent (hWnd=0x7002e) returned 0x4008c [0104.070] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fec74) returned 0x0 [0104.072] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7002e, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0104.072] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x8fec74) returned 0x0 [0104.072] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7002e, Msg=0x3, wParam=0x0, lParam=0x16d0193) returned 0x0 [0104.072] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fe318 | out: lpRect=0x8fe318) returned 1 [0104.072] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fe318 | out: lpRect=0x8fe318) returned 1 [0104.072] GetParent (hWnd=0x7002e) returned 0x300ec [0104.072] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x300ec, lpPoints=0x8fe318, cPoints=0x2 | out: lpPoints=0x8fe318) returned -1966088 [0104.072] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fe970 | out: lpRect=0x8fe970) returned 1 [0104.072] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fe970 | out: lpRect=0x8fe970) returned 1 [0104.072] GetParent (hWnd=0x7002e) returned 0x300ec [0104.072] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x300ec, lpPoints=0x8fe970, cPoints=0x2 | out: lpPoints=0x8fe970) returned -1966088 [0104.072] GetParent (hWnd=0x7002e) returned 0x300ec [0104.072] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7002e, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0104.072] GetWindowThreadProcessId (in: hWnd=0x70036, lpdwProcessId=0x8fed14 | out: lpdwProcessId=0x8fed14) returned 0x1230 [0104.072] SetParent (hWndChild=0x70036, hWndNewParent=0x300ec) returned 0x4008c [0104.072] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0104.073] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x46, wParam=0x0, lParam=0x8fec74) returned 0x0 [0104.074] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x47, wParam=0x0, lParam=0x8fec74) returned 0x0 [0104.074] GetClientRect (in: hWnd=0x70036, lpRect=0x8fe934 | out: lpRect=0x8fe934) returned 1 [0104.074] GetWindowRect (in: hWnd=0x70036, lpRect=0x8fe934 | out: lpRect=0x8fe934) returned 1 [0104.074] GetParent (hWnd=0x70036) returned 0x4008c [0104.074] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x4008c, lpPoints=0x8fe934, cPoints=0x2 | out: lpPoints=0x8fe934) returned 2097184000 [0104.079] GetParent (hWnd=0x70036) returned 0x4008c [0104.079] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x46, wParam=0x0, lParam=0x8fec74) returned 0x0 [0104.080] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0104.080] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x47, wParam=0x0, lParam=0x8fec74) returned 0x0 [0104.080] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x3, wParam=0x0, lParam=0xfe28000a) returned 0x0 [0104.080] GetClientRect (in: hWnd=0x70036, lpRect=0x8fe204 | out: lpRect=0x8fe204) returned 1 [0104.080] GetWindowRect (in: hWnd=0x70036, lpRect=0x8fe204 | out: lpRect=0x8fe204) returned 1 [0104.080] GetParent (hWnd=0x70036) returned 0x300ec [0104.080] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x300ec, lpPoints=0x8fe204, cPoints=0x2 | out: lpPoints=0x8fe204) returned -1966088 [0104.080] GetClientRect (in: hWnd=0x70036, lpRect=0x8fe934 | out: lpRect=0x8fe934) returned 1 [0104.081] GetWindowRect (in: hWnd=0x70036, lpRect=0x8fe934 | out: lpRect=0x8fe934) returned 1 [0104.081] GetParent (hWnd=0x70036) returned 0x300ec [0104.081] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x300ec, lpPoints=0x8fe934, cPoints=0x2 | out: lpPoints=0x8fe934) returned -1966088 [0104.081] GetParent (hWnd=0x70036) returned 0x300ec [0104.081] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0104.081] GetWindowThreadProcessId (in: hWnd=0x70030, lpdwProcessId=0x8fed14 | out: lpdwProcessId=0x8fed14) returned 0x1230 [0104.081] SetParent (hWndChild=0x70030, hWndNewParent=0x300ec) returned 0x4008c [0104.081] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0104.081] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x46, wParam=0x0, lParam=0x8fec74) returned 0x0 [0104.082] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x47, wParam=0x0, lParam=0x8fec74) returned 0x0 [0104.082] GetClientRect (in: hWnd=0x70030, lpRect=0x8fe948 | out: lpRect=0x8fe948) returned 1 [0104.082] GetWindowRect (in: hWnd=0x70030, lpRect=0x8fe948 | out: lpRect=0x8fe948) returned 1 [0104.082] GetParent (hWnd=0x70030) returned 0x4008c [0104.082] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x4008c, lpPoints=0x8fe948, cPoints=0x2 | out: lpPoints=0x8fe948) returned 2097184000 [0104.082] GetParent (hWnd=0x70030) returned 0x4008c [0104.083] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x46, wParam=0x0, lParam=0x8fec74) returned 0x0 [0104.084] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0104.084] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x47, wParam=0x0, lParam=0x8fec74) returned 0x0 [0104.084] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x3, wParam=0x0, lParam=0xff1afeb5) returned 0x0 [0104.084] GetClientRect (in: hWnd=0x70030, lpRect=0x8fe218 | out: lpRect=0x8fe218) returned 1 [0104.084] GetWindowRect (in: hWnd=0x70030, lpRect=0x8fe218 | out: lpRect=0x8fe218) returned 1 [0104.084] GetParent (hWnd=0x70030) returned 0x300ec [0104.084] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x300ec, lpPoints=0x8fe218, cPoints=0x2 | out: lpPoints=0x8fe218) returned -1966088 [0104.084] GetClientRect (in: hWnd=0x70030, lpRect=0x8fe948 | out: lpRect=0x8fe948) returned 1 [0104.084] GetWindowRect (in: hWnd=0x70030, lpRect=0x8fe948 | out: lpRect=0x8fe948) returned 1 [0104.084] GetParent (hWnd=0x70030) returned 0x300ec [0104.084] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x300ec, lpPoints=0x8fe948, cPoints=0x2 | out: lpPoints=0x8fe948) returned -1966088 [0104.084] GetParent (hWnd=0x70030) returned 0x300ec [0104.085] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0104.085] GetWindowThreadProcessId (in: hWnd=0x502ba, lpdwProcessId=0x8fed14 | out: lpdwProcessId=0x8fed14) returned 0x1230 [0104.085] SetParent (hWndChild=0x502ba, hWndNewParent=0x300ec) returned 0x4008c [0104.085] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0104.085] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x46, wParam=0x0, lParam=0x8fec74) returned 0x0 [0104.086] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x47, wParam=0x0, lParam=0x8fec74) returned 0x0 [0104.086] GetClientRect (in: hWnd=0x502ba, lpRect=0x8fe948 | out: lpRect=0x8fe948) returned 1 [0104.086] GetWindowRect (in: hWnd=0x502ba, lpRect=0x8fe948 | out: lpRect=0x8fe948) returned 1 [0104.086] GetParent (hWnd=0x502ba) returned 0x4008c [0104.086] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x4008c, lpPoints=0x8fe948, cPoints=0x2 | out: lpPoints=0x8fe948) returned 2097184000 [0104.086] GetParent (hWnd=0x502ba) returned 0x4008c [0104.087] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x46, wParam=0x0, lParam=0x8fec74) returned 0x0 [0104.088] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0104.088] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x47, wParam=0x0, lParam=0x8fec74) returned 0x0 [0104.088] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x3, wParam=0x0, lParam=0xfea9feb5) returned 0x0 [0104.088] GetClientRect (in: hWnd=0x502ba, lpRect=0x8fe218 | out: lpRect=0x8fe218) returned 1 [0104.088] GetWindowRect (in: hWnd=0x502ba, lpRect=0x8fe218 | out: lpRect=0x8fe218) returned 1 [0104.088] GetParent (hWnd=0x502ba) returned 0x300ec [0104.088] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x300ec, lpPoints=0x8fe218, cPoints=0x2 | out: lpPoints=0x8fe218) returned -1966088 [0104.088] GetClientRect (in: hWnd=0x502ba, lpRect=0x8fe948 | out: lpRect=0x8fe948) returned 1 [0104.088] GetWindowRect (in: hWnd=0x502ba, lpRect=0x8fe948 | out: lpRect=0x8fe948) returned 1 [0104.088] GetParent (hWnd=0x502ba) returned 0x300ec [0104.088] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x300ec, lpPoints=0x8fe948, cPoints=0x2 | out: lpPoints=0x8fe948) returned -1966088 [0104.088] GetParent (hWnd=0x502ba) returned 0x300ec [0104.088] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0104.089] GetWindowThreadProcessId (in: hWnd=0x18001c, lpdwProcessId=0x8fed14 | out: lpdwProcessId=0x8fed14) returned 0x1230 [0104.089] SetParent (hWndChild=0x18001c, hWndNewParent=0x300ec) returned 0x4008c [0104.089] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0104.089] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x46, wParam=0x0, lParam=0x8fec74) returned 0x0 [0104.090] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x47, wParam=0x0, lParam=0x8fec74) returned 0x0 [0104.090] GetClientRect (in: hWnd=0x18001c, lpRect=0x8fe934 | out: lpRect=0x8fe934) returned 1 [0104.090] GetWindowRect (in: hWnd=0x18001c, lpRect=0x8fe934 | out: lpRect=0x8fe934) returned 1 [0104.090] GetParent (hWnd=0x18001c) returned 0x4008c [0104.090] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x4008c, lpPoints=0x8fe934, cPoints=0x2 | out: lpPoints=0x8fe934) returned 2097184000 [0104.090] GetParent (hWnd=0x18001c) returned 0x4008c [0104.091] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x46, wParam=0x0, lParam=0x8fec74) returned 0x0 [0104.092] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0104.092] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x47, wParam=0x0, lParam=0x8fec74) returned 0x0 [0104.092] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x3, wParam=0x0, lParam=0xfedd000a) returned 0x0 [0104.092] GetClientRect (in: hWnd=0x18001c, lpRect=0x8fe204 | out: lpRect=0x8fe204) returned 1 [0104.092] GetWindowRect (in: hWnd=0x18001c, lpRect=0x8fe204 | out: lpRect=0x8fe204) returned 1 [0104.092] GetParent (hWnd=0x18001c) returned 0x300ec [0104.092] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x300ec, lpPoints=0x8fe204, cPoints=0x2 | out: lpPoints=0x8fe204) returned -1966088 [0104.092] GetClientRect (in: hWnd=0x18001c, lpRect=0x8fe934 | out: lpRect=0x8fe934) returned 1 [0104.092] GetWindowRect (in: hWnd=0x18001c, lpRect=0x8fe934 | out: lpRect=0x8fe934) returned 1 [0104.092] GetParent (hWnd=0x18001c) returned 0x300ec [0104.092] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x300ec, lpPoints=0x8fe934, cPoints=0x2 | out: lpPoints=0x8fe934) returned -1966088 [0104.092] GetParent (hWnd=0x18001c) returned 0x300ec [0104.092] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0104.092] GetWindowThreadProcessId (in: hWnd=0x202cc, lpdwProcessId=0x8fed14 | out: lpdwProcessId=0x8fed14) returned 0x1230 [0104.092] SetParent (hWndChild=0x202cc, hWndNewParent=0x300ec) returned 0x4008c [0104.092] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202cc, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0104.092] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202cc, Msg=0x46, wParam=0x0, lParam=0x8fec74) returned 0x0 [0104.094] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202cc, Msg=0x47, wParam=0x0, lParam=0x8fec74) returned 0x0 [0104.094] GetClientRect (in: hWnd=0x202cc, lpRect=0x8fe934 | out: lpRect=0x8fe934) returned 1 [0104.094] GetWindowRect (in: hWnd=0x202cc, lpRect=0x8fe934 | out: lpRect=0x8fe934) returned 1 [0104.094] GetParent (hWnd=0x202cc) returned 0x4008c [0104.094] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x4008c, lpPoints=0x8fe934, cPoints=0x2 | out: lpPoints=0x8fe934) returned 2097184000 [0104.094] GetParent (hWnd=0x202cc) returned 0x4008c [0104.094] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202cc, Msg=0x46, wParam=0x0, lParam=0x8fec74) returned 0x0 [0104.095] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202cc, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0104.096] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202cc, Msg=0x47, wParam=0x0, lParam=0x8fec74) returned 0x0 [0104.096] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202cc, Msg=0x3, wParam=0x0, lParam=0xfe74000a) returned 0x0 [0104.096] GetClientRect (in: hWnd=0x202cc, lpRect=0x8fe204 | out: lpRect=0x8fe204) returned 1 [0104.096] GetWindowRect (in: hWnd=0x202cc, lpRect=0x8fe204 | out: lpRect=0x8fe204) returned 1 [0104.096] GetParent (hWnd=0x202cc) returned 0x300ec [0104.096] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x300ec, lpPoints=0x8fe204, cPoints=0x2 | out: lpPoints=0x8fe204) returned -1966088 [0104.096] GetClientRect (in: hWnd=0x202cc, lpRect=0x8fe934 | out: lpRect=0x8fe934) returned 1 [0104.096] GetWindowRect (in: hWnd=0x202cc, lpRect=0x8fe934 | out: lpRect=0x8fe934) returned 1 [0104.096] GetParent (hWnd=0x202cc) returned 0x300ec [0104.096] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x300ec, lpPoints=0x8fe934, cPoints=0x2 | out: lpPoints=0x8fe934) returned -1966088 [0104.096] GetParent (hWnd=0x202cc) returned 0x300ec [0104.096] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202cc, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0104.096] GetWindowThreadProcessId (in: hWnd=0x302ac, lpdwProcessId=0x8fed14 | out: lpdwProcessId=0x8fed14) returned 0x1230 [0104.096] SetParent (hWndChild=0x302ac, hWndNewParent=0x300ec) returned 0x4008c [0104.096] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x302ac, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0104.097] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x302ac, Msg=0x46, wParam=0x0, lParam=0x8fec74) returned 0x0 [0104.098] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x302ac, Msg=0x47, wParam=0x0, lParam=0x8fec74) returned 0x0 [0104.098] GetClientRect (in: hWnd=0x302ac, lpRect=0x8fe934 | out: lpRect=0x8fe934) returned 1 [0104.098] GetWindowRect (in: hWnd=0x302ac, lpRect=0x8fe934 | out: lpRect=0x8fe934) returned 1 [0104.098] GetParent (hWnd=0x302ac) returned 0x4008c [0104.098] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x4008c, lpPoints=0x8fe934, cPoints=0x2 | out: lpPoints=0x8fe934) returned 2097184000 [0104.098] GetParent (hWnd=0x302ac) returned 0x4008c [0104.098] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x302ac, Msg=0x46, wParam=0x0, lParam=0x8fec74) returned 0x0 [0104.099] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x302ac, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0104.099] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x302ac, Msg=0x47, wParam=0x0, lParam=0x8fec74) returned 0x0 [0104.099] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x302ac, Msg=0x3, wParam=0x0, lParam=0xfdf1000a) returned 0x0 [0104.100] GetClientRect (in: hWnd=0x302ac, lpRect=0x8fe204 | out: lpRect=0x8fe204) returned 1 [0104.100] GetWindowRect (in: hWnd=0x302ac, lpRect=0x8fe204 | out: lpRect=0x8fe204) returned 1 [0104.100] GetParent (hWnd=0x302ac) returned 0x300ec [0104.100] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x300ec, lpPoints=0x8fe204, cPoints=0x2 | out: lpPoints=0x8fe204) returned -1966088 [0104.100] GetClientRect (in: hWnd=0x302ac, lpRect=0x8fe934 | out: lpRect=0x8fe934) returned 1 [0104.100] GetWindowRect (in: hWnd=0x302ac, lpRect=0x8fe934 | out: lpRect=0x8fe934) returned 1 [0104.100] GetParent (hWnd=0x302ac) returned 0x300ec [0104.100] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x300ec, lpPoints=0x8fe934, cPoints=0x2 | out: lpPoints=0x8fe934) returned -1966088 [0104.100] GetParent (hWnd=0x302ac) returned 0x300ec [0104.100] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x302ac, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0104.100] GetWindowLongW (hWnd=0x4008c, nIndex=-20) returned 852224 [0104.100] DestroyWindow (hWnd=0x4008c) returned 1 [0104.100] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0104.101] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x46, wParam=0x0, lParam=0x8febfc) returned 0x0 [0104.103] GetWindowPlacement (in: hWnd=0x4008c, lpwndpl=0x8fe928 | out: lpwndpl=0x8fe928) returned 1 [0104.103] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x47, wParam=0x0, lParam=0x8febfc) returned 0x0 [0104.103] GetClientRect (in: hWnd=0x4008c, lpRect=0x8fe8d8 | out: lpRect=0x8fe8d8) returned 1 [0104.103] GetWindowRect (in: hWnd=0x4008c, lpRect=0x8fe8d8 | out: lpRect=0x8fe8d8) returned 1 [0104.103] GetWindowTextLengthW (hWnd=0x4008c) returned 8 [0104.103] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0104.104] GetSystemMetrics (nIndex=42) returned 0 [0104.104] GetWindowTextW (in: hWnd=0x4008c, lpString=0x8fe800, nMaxCount=9 | out: lpString="Warning!") returned 8 [0104.104] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0xd, wParam=0x9, lParam=0x8fe800) returned 0x8 [0104.104] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0104.104] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x4008c, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0104.111] GetCurrentActCtx (in: lphActCtx=0x8fec5c | out: lphActCtx=0x8fec5c*=0x956b54) returned 1 [0104.111] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0104.111] AdjustWindowRectEx (in: lpRect=0x8febbc, dwStyle=0x12c80000, bMenu=0, dwExStyle=0x90000 | out: lpRect=0x8febbc) returned 1 [0104.111] GetModuleHandleW (lpModuleName=0x0) returned 0x450000 [0104.112] CreateWindowExW (dwExStyle=0x90000, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", lpWindowName="Warning!", dwStyle=0x22c80000, X=-32000, Y=-32000, nWidth=16, nHeight=39, hWndParent=0x0, hMenu=0x0, hInstance=0x450000, lpParam=0x0) returned 0x5008c [0104.112] SetWindowLongW (hWnd=0x5008c, nIndex=-4, dwNewLong=1950089536) returned 79168998 [0104.112] GetWindowLongW (hWnd=0x5008c, nIndex=-4) returned 1950089536 [0104.112] SetWindowLongW (hWnd=0x5008c, nIndex=-4, dwNewLong=79182526) returned 1950089536 [0104.112] GetWindowLongW (hWnd=0x5008c, nIndex=-4) returned 79182526 [0104.112] GetWindowLongW (hWnd=0x5008c, nIndex=-16) returned 650641408 [0104.114] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0x81, wParam=0x0, lParam=0x8fe680) returned 0x1 [0104.115] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0x83, wParam=0x0, lParam=0x8fe66c) returned 0x0 [0104.116] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0x1, wParam=0x0, lParam=0x8fe680) returned 0x0 [0104.116] GetClientRect (in: hWnd=0x5008c, lpRect=0x8fe338 | out: lpRect=0x8fe338) returned 1 [0104.116] GetWindowRect (in: hWnd=0x5008c, lpRect=0x8fe338 | out: lpRect=0x8fe338) returned 1 [0104.116] SetWindowTextW (hWnd=0x5008c, lpString="Warning!") returned 1 [0104.116] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0xc, wParam=0x0, lParam=0x26cd968) returned 0x1 [0104.117] SetLayeredWindowAttributes (hwnd=0x5008c, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0104.118] GetStartupInfoW (in: lpStartupInfo=0x26cdc50 | out: lpStartupInfo=0x26cdc50*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\WindowsFormsApp1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0104.122] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0x46, wParam=0x0, lParam=0x8fe694) returned 0x0 [0104.122] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0x83, wParam=0x1, lParam=0x8fe66c) returned 0x0 [0104.125] GetWindowPlacement (in: hWnd=0x5008c, lpwndpl=0x8fe3c0 | out: lpwndpl=0x8fe3c0) returned 1 [0104.125] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0x47, wParam=0x0, lParam=0x8fe694) returned 0x0 [0104.125] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0x5, wParam=0x1, lParam=0x0) returned 0x0 [0104.125] GetClientRect (in: hWnd=0x5008c, lpRect=0x8fe370 | out: lpRect=0x8fe370) returned 1 [0104.125] GetWindowRect (in: hWnd=0x5008c, lpRect=0x8fe370 | out: lpRect=0x8fe370) returned 1 [0104.125] GetWindowTextLengthW (hWnd=0x5008c) returned 8 [0104.125] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0104.125] GetSystemMetrics (nIndex=42) returned 0 [0104.125] GetWindowTextW (in: hWnd=0x5008c, lpString=0x8fe1d8, nMaxCount=9 | out: lpString="Warning!") returned 8 [0104.125] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0xd, wParam=0x9, lParam=0x8fe1d8) returned 0x8 [0104.126] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0104.126] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0104.126] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0104.128] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0x83, wParam=0x1, lParam=0x8fe1ac) returned 0x0 [0104.131] GetParent (hWnd=0x5008c) returned 0x0 [0104.131] GetStockObject (i=5) returned 0x900015 [0104.131] GetModuleHandleW (lpModuleName=0x0) returned 0x450000 [0104.132] CoTaskMemAlloc (cb=0x5a) returned 0x9859d8 [0104.132] RegisterClassW (lpWndClass=0x8feb38) returned 0xc1a2 [0104.132] CoTaskMemFree (pv=0x9859d8) [0104.132] GetModuleHandleW (lpModuleName=0x0) returned 0x450000 [0104.132] CreateWindowExW (dwExStyle=0x80, lpClassName="WindowsForms10.Window.0.app.0.141b42a_r9_ad1", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x450000, lpParam=0x0) returned 0x202d0 [0104.133] SetWindowLongW (hWnd=0x202d0, nIndex=-4, dwNewLong=1950089536) returned 79183286 [0104.133] GetWindowLongW (hWnd=0x202d0, nIndex=-4) returned 1950089536 [0104.134] SetWindowLongW (hWnd=0x202d0, nIndex=-4, dwNewLong=79182766) returned 1950089536 [0104.134] GetWindowLongW (hWnd=0x202d0, nIndex=-4) returned 79182766 [0104.134] GetWindowLongW (hWnd=0x202d0, nIndex=-16) returned 79691776 [0104.134] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202d0, Msg=0x24, wParam=0x0, lParam=0x8fe6b4) returned 0x0 [0104.134] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202d0, Msg=0x81, wParam=0x0, lParam=0x8fe6a8) returned 0x1 [0104.134] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202d0, Msg=0x83, wParam=0x0, lParam=0x8fe694) returned 0x0 [0104.136] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202d0, Msg=0x1, wParam=0x0, lParam=0x8fe6a8) returned 0x0 [0104.137] SetWindowLongW (hWnd=0x5008c, nIndex=-8, dwNewLong=131792) returned 0 [0104.146] SendMessageW (hWnd=0x5008c, Msg=0x80, wParam=0x0, lParam=0x2702b5) returned 0x0 [0104.146] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0x80, wParam=0x0, lParam=0x2702b5) returned 0x0 [0104.146] SendMessageW (hWnd=0x5008c, Msg=0x80, wParam=0x1, lParam=0x4b0091) returned 0x0 [0104.146] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0x80, wParam=0x1, lParam=0x4b0091) returned 0x0 [0104.147] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x2702b5 [0104.273] GetSystemMenu (hWnd=0x5008c, bRevert=0) returned 0x640295 [0104.273] GetWindowPlacement (in: hWnd=0x5008c, lpwndpl=0x8fec6c | out: lpwndpl=0x8fec6c) returned 1 [0104.273] EnableMenuItem (hMenu=0x640295, uIDEnableItem=0xf020, uEnable=0x1) returned 0 [0104.273] EnableMenuItem (hMenu=0x640295, uIDEnableItem=0xf030, uEnable=0x1) returned 0 [0104.273] EnableMenuItem (hMenu=0x640295, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0104.274] EnableMenuItem (hMenu=0x640295, uIDEnableItem=0xf120, uEnable=0x0) returned 0 [0104.274] EnableMenuItem (hMenu=0x640295, uIDEnableItem=0xf000, uEnable=0x1) returned 0 [0104.274] SetWindowPos (hWnd=0x5008c, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1 [0104.274] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0x46, wParam=0x0, lParam=0x8feb7c) returned 0x0 [0104.277] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0104.285] GetWindowPlacement (in: hWnd=0x5008c, lpwndpl=0x8fe8a8 | out: lpwndpl=0x8fe8a8) returned 1 [0104.285] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0x47, wParam=0x0, lParam=0x8feb7c) returned 0x0 [0104.285] GetClientRect (in: hWnd=0x5008c, lpRect=0x8fe858 | out: lpRect=0x8fe858) returned 1 [0104.285] GetWindowRect (in: hWnd=0x5008c, lpRect=0x8fe858 | out: lpRect=0x8fe858) returned 1 [0104.286] SetWindowLongW (hWnd=0x5008c, nIndex=-8, dwNewLong=131792) returned 131792 [0104.287] SendMessageW (hWnd=0x202d0, Msg=0x80, wParam=0x1, lParam=0x4b0091) returned 0x0 [0104.287] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202d0, Msg=0x80, wParam=0x1, lParam=0x4b0091) returned 0x0 [0104.289] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0104.289] GetWindowLongW (hWnd=0x5008c, nIndex=-16) returned 919076864 [0104.289] GetWindowTextLengthW (hWnd=0x5008c) returned 8 [0104.289] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0104.289] GetSystemMetrics (nIndex=42) returned 0 [0104.289] GetWindowTextW (in: hWnd=0x5008c, lpString=0x8febac, nMaxCount=9 | out: lpString="Warning!") returned 8 [0104.289] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0xd, wParam=0x9, lParam=0x8febac) returned 0x8 [0104.289] GetWindowTextLengthW (hWnd=0x5008c) returned 8 [0104.289] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0104.289] GetSystemMetrics (nIndex=42) returned 0 [0104.289] GetWindowTextW (in: hWnd=0x5008c, lpString=0x8febac, nMaxCount=9 | out: lpString="Warning!") returned 8 [0104.289] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0xd, wParam=0x9, lParam=0x8febac) returned 0x8 [0104.290] AdjustWindowRectEx (in: lpRect=0x8febfc, dwStyle=0x12c80000, bMenu=0, dwExStyle=0x90000 | out: lpRect=0x8febfc) returned 1 [0104.290] GetWindowLongW (hWnd=0x5008c, nIndex=-16) returned 919076864 [0104.290] GetWindowLongW (hWnd=0x5008c, nIndex=-20) returned 590080 [0104.290] SetWindowLongW (hWnd=0x5008c, nIndex=-16, dwNewLong=851968000) returned 919076864 [0104.290] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0x7c, wParam=0xfffffff0, lParam=0x8fec0c) returned 0x0 [0104.290] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0x7d, wParam=0xfffffff0, lParam=0x8fec0c) returned 0x0 [0104.291] SetWindowLongW (hWnd=0x5008c, nIndex=-20, dwNewLong=589824) returned 590080 [0104.291] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0x7c, wParam=0xffffffec, lParam=0x8fec0c) returned 0x0 [0104.291] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0x7d, wParam=0xffffffec, lParam=0x8fec0c) returned 0x0 [0104.292] SetWindowPos (hWnd=0x5008c, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0104.292] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0x46, wParam=0x0, lParam=0x8fec24) returned 0x0 [0104.292] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0x83, wParam=0x1, lParam=0x8febfc) returned 0x0 [0104.296] GetWindowPlacement (in: hWnd=0x5008c, lpwndpl=0x8fe950 | out: lpwndpl=0x8fe950) returned 1 [0104.296] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0x47, wParam=0x0, lParam=0x8fec24) returned 0x0 [0104.296] GetClientRect (in: hWnd=0x5008c, lpRect=0x8fe900 | out: lpRect=0x8fe900) returned 1 [0104.296] GetWindowRect (in: hWnd=0x5008c, lpRect=0x8fe900 | out: lpRect=0x8fe900) returned 1 [0104.297] RedrawWindow (hWnd=0x5008c, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0104.297] GetSystemMenu (hWnd=0x5008c, bRevert=0) returned 0x640295 [0104.297] GetWindowPlacement (in: hWnd=0x5008c, lpwndpl=0x8fec5c | out: lpwndpl=0x8fec5c) returned 1 [0104.297] EnableMenuItem (hMenu=0x640295, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0104.297] EnableMenuItem (hMenu=0x640295, uIDEnableItem=0xf030, uEnable=0x1) returned 1 [0104.297] EnableMenuItem (hMenu=0x640295, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0104.297] EnableMenuItem (hMenu=0x640295, uIDEnableItem=0xf120, uEnable=0x0) returned 0 [0104.297] EnableMenuItem (hMenu=0x640295, uIDEnableItem=0xf000, uEnable=0x1) returned 1 [0104.297] SetParent (hWndChild=0x7002e, hWndNewParent=0x5008c) returned 0x300ec [0104.297] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7002e, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0104.298] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fec8c) returned 0x0 [0104.299] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7002e, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0104.299] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x8fec8c) returned 0x0 [0104.299] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7002e, Msg=0x3, wParam=0x0, lParam=0x16d0193) returned 0x0 [0104.299] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fe330 | out: lpRect=0x8fe330) returned 1 [0104.299] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fe330 | out: lpRect=0x8fe330) returned 1 [0104.299] GetParent (hWnd=0x7002e) returned 0x5008c [0104.299] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe330, cPoints=0x2 | out: lpPoints=0x8fe330) returned 2097184000 [0104.299] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fe988 | out: lpRect=0x8fe988) returned 1 [0104.299] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fe988 | out: lpRect=0x8fe988) returned 1 [0104.299] GetParent (hWnd=0x7002e) returned 0x5008c [0104.299] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe988, cPoints=0x2 | out: lpPoints=0x8fe988) returned 2097184000 [0104.299] GetParent (hWnd=0x7002e) returned 0x5008c [0104.299] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7002e, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0104.300] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fec8c) returned 0x0 [0104.301] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x8fec8c) returned 0x0 [0104.301] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fe988 | out: lpRect=0x8fe988) returned 1 [0104.301] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fe988 | out: lpRect=0x8fe988) returned 1 [0104.301] GetParent (hWnd=0x7002e) returned 0x5008c [0104.301] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe988, cPoints=0x2 | out: lpPoints=0x8fe988) returned 2097184000 [0104.301] GetParent (hWnd=0x7002e) returned 0x5008c [0104.301] GetWindow (hWnd=0x7002e, uCmd=0x3) returned 0x0 [0104.301] GetFocus () returned 0x0 [0104.301] GetParent (hWnd=0x7002e) returned 0x5008c [0104.301] GetWindowLongW (hWnd=0x7002e, nIndex=-20) returned 0 [0104.301] DestroyWindow (hWnd=0x7002e) returned 1 [0104.301] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7002e, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0104.301] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0x210, wParam=0x2e0002, lParam=0x7002e) returned 0x0 [0104.301] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7002e, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0104.301] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8feb7c) returned 0x0 [0104.303] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x8feb7c) returned 0x0 [0104.303] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fe878 | out: lpRect=0x8fe878) returned 1 [0104.303] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fe878 | out: lpRect=0x8fe878) returned 1 [0104.303] GetParent (hWnd=0x7002e) returned 0x5008c [0104.303] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe878, cPoints=0x2 | out: lpPoints=0x8fe878) returned 2097184000 [0104.303] GetParent (hWnd=0x7002e) returned 0x5008c [0104.303] GetWindowTextLengthW (hWnd=0x7002e) returned 0 [0104.303] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7002e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0104.303] GetSystemMetrics (nIndex=42) returned 0 [0104.303] GetWindowTextW (in: hWnd=0x7002e, lpString=0x8fe794, nMaxCount=1 | out: lpString="") returned 0 [0104.303] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7002e, Msg=0xd, wParam=0x1, lParam=0x8fe794) returned 0x0 [0104.303] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7002e, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0104.303] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7002e, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0104.304] GetCurrentActCtx (in: lphActCtx=0x8fec30 | out: lphActCtx=0x8fec30*=0x956b54) returned 1 [0104.305] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0104.305] GetModuleHandleW (lpModuleName=0x0) returned 0x450000 [0104.305] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", lpWindowName=0x0, dwStyle=0x56000000, X=403, Y=365, nWidth=148, nHeight=167, hWndParent=0x5008c, hMenu=0x0, hInstance=0x450000, lpParam=0x0) returned 0x8002e [0104.305] SetWindowLongW (hWnd=0x8002e, nIndex=-4, dwNewLong=1950089536) returned 79168998 [0104.305] GetWindowLongW (hWnd=0x8002e, nIndex=-4) returned 1950089536 [0104.306] SetWindowLongW (hWnd=0x8002e, nIndex=-4, dwNewLong=79182486) returned 1950089536 [0104.306] GetWindowLongW (hWnd=0x8002e, nIndex=-4) returned 79182486 [0104.306] GetWindowLongW (hWnd=0x8002e, nIndex=-16) returned 1174405120 [0104.306] GetWindowLongW (hWnd=0x8002e, nIndex=-12) returned 0 [0104.306] SetWindowLongW (hWnd=0x8002e, nIndex=-12, dwNewLong=524334) returned 0 [0104.306] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8002e, Msg=0x81, wParam=0x0, lParam=0x8fe650) returned 0x1 [0104.306] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8002e, Msg=0x83, wParam=0x0, lParam=0x8fe63c) returned 0x0 [0104.307] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8002e, Msg=0x1, wParam=0x0, lParam=0x8fe650) returned 0x0 [0104.307] GetWindow (hWnd=0x8002e, uCmd=0x3) returned 0x0 [0104.307] GetClientRect (in: hWnd=0x8002e, lpRect=0x8fe338 | out: lpRect=0x8fe338) returned 1 [0104.307] GetWindowRect (in: hWnd=0x8002e, lpRect=0x8fe338 | out: lpRect=0x8fe338) returned 1 [0104.307] GetParent (hWnd=0x8002e) returned 0x5008c [0104.307] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe338, cPoints=0x2 | out: lpPoints=0x8fe338) returned 2097184000 [0104.307] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8002e, Msg=0x5, wParam=0x0, lParam=0xa70094) returned 0x0 [0104.307] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8002e, Msg=0x3, wParam=0x0, lParam=0x16d0193) returned 0x0 [0104.307] GetClientRect (in: hWnd=0x8002e, lpRect=0x8fe390 | out: lpRect=0x8fe390) returned 1 [0104.307] GetWindowRect (in: hWnd=0x8002e, lpRect=0x8fe390 | out: lpRect=0x8fe390) returned 1 [0104.307] GetParent (hWnd=0x8002e) returned 0x5008c [0104.307] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe390, cPoints=0x2 | out: lpPoints=0x8fe390) returned 2097184000 [0104.308] SendMessageW (hWnd=0x8002e, Msg=0x2210, wParam=0x2e0001, lParam=0x8002e) returned 0x0 [0104.308] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8002e, Msg=0x2210, wParam=0x2e0001, lParam=0x8002e) returned 0x0 [0104.308] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8002e, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0104.308] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8002e, Msg=0x46, wParam=0x0, lParam=0x8fe664) returned 0x0 [0104.312] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8002e, Msg=0x47, wParam=0x0, lParam=0x8fe664) returned 0x0 [0104.312] GetClientRect (in: hWnd=0x8002e, lpRect=0x8fe360 | out: lpRect=0x8fe360) returned 1 [0104.312] GetWindowRect (in: hWnd=0x8002e, lpRect=0x8fe360 | out: lpRect=0x8fe360) returned 1 [0104.312] GetParent (hWnd=0x8002e) returned 0x5008c [0104.312] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe360, cPoints=0x2 | out: lpPoints=0x8fe360) returned 2097184000 [0104.312] GetParent (hWnd=0x8002e) returned 0x5008c [0104.312] GetParent (hWnd=0x8002e) returned 0x5008c [0104.312] SetParent (hWndChild=0x70036, hWndNewParent=0x5008c) returned 0x300ec [0104.312] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0104.312] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x46, wParam=0x0, lParam=0x8fec8c) returned 0x0 [0104.313] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0104.314] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x47, wParam=0x0, lParam=0x8fec8c) returned 0x0 [0104.314] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x3, wParam=0x0, lParam=0xfe28000a) returned 0x0 [0104.314] GetClientRect (in: hWnd=0x70036, lpRect=0x8fe21c | out: lpRect=0x8fe21c) returned 1 [0104.314] GetWindowRect (in: hWnd=0x70036, lpRect=0x8fe21c | out: lpRect=0x8fe21c) returned 1 [0104.314] GetParent (hWnd=0x70036) returned 0x5008c [0104.314] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe21c, cPoints=0x2 | out: lpPoints=0x8fe21c) returned 2097184000 [0104.314] GetClientRect (in: hWnd=0x70036, lpRect=0x8fe94c | out: lpRect=0x8fe94c) returned 1 [0104.314] GetWindowRect (in: hWnd=0x70036, lpRect=0x8fe94c | out: lpRect=0x8fe94c) returned 1 [0104.314] GetParent (hWnd=0x70036) returned 0x5008c [0104.314] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe94c, cPoints=0x2 | out: lpPoints=0x8fe94c) returned 2097184000 [0104.314] GetParent (hWnd=0x70036) returned 0x5008c [0104.314] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0104.314] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x46, wParam=0x0, lParam=0x8fec8c) returned 0x0 [0104.315] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x47, wParam=0x0, lParam=0x8fec8c) returned 0x0 [0104.315] GetClientRect (in: hWnd=0x70036, lpRect=0x8fe94c | out: lpRect=0x8fe94c) returned 1 [0104.315] GetWindowRect (in: hWnd=0x70036, lpRect=0x8fe94c | out: lpRect=0x8fe94c) returned 1 [0104.315] GetParent (hWnd=0x70036) returned 0x5008c [0104.315] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe94c, cPoints=0x2 | out: lpPoints=0x8fe94c) returned 2097184000 [0104.315] GetParent (hWnd=0x70036) returned 0x5008c [0104.316] GetWindow (hWnd=0x70036, uCmd=0x3) returned 0x0 [0104.316] SetWindowPos (hWnd=0x70036, hWndInsertAfter=0x8002e, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0104.316] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x46, wParam=0x0, lParam=0x8fec44) returned 0x0 [0104.317] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0104.317] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x47, wParam=0x0, lParam=0x8fec44) returned 0x0 [0104.317] GetClientRect (in: hWnd=0x70036, lpRect=0x8fe904 | out: lpRect=0x8fe904) returned 1 [0104.317] GetWindowRect (in: hWnd=0x70036, lpRect=0x8fe904 | out: lpRect=0x8fe904) returned 1 [0104.317] GetParent (hWnd=0x70036) returned 0x5008c [0104.317] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe904, cPoints=0x2 | out: lpPoints=0x8fe904) returned 2097184000 [0104.317] GetParent (hWnd=0x70036) returned 0x5008c [0104.317] GetWindow (hWnd=0x70036, uCmd=0x3) returned 0x8002e [0104.317] GetFocus () returned 0x0 [0104.317] GetParent (hWnd=0x70036) returned 0x5008c [0104.317] GetWindowLongW (hWnd=0x70036, nIndex=-20) returned 0 [0104.317] DestroyWindow (hWnd=0x70036) returned 1 [0104.317] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0104.317] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0x210, wParam=0x360002, lParam=0x70036) returned 0x0 [0104.318] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0104.318] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x46, wParam=0x0, lParam=0x8feb7c) returned 0x0 [0104.319] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x47, wParam=0x0, lParam=0x8feb7c) returned 0x0 [0104.319] GetClientRect (in: hWnd=0x70036, lpRect=0x8fe83c | out: lpRect=0x8fe83c) returned 1 [0104.319] GetWindowRect (in: hWnd=0x70036, lpRect=0x8fe83c | out: lpRect=0x8fe83c) returned 1 [0104.319] GetParent (hWnd=0x70036) returned 0x5008c [0104.319] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe83c, cPoints=0x2 | out: lpPoints=0x8fe83c) returned 2097184000 [0104.319] GetParent (hWnd=0x70036) returned 0x5008c [0104.319] GetWindowTextLengthW (hWnd=0x70036) returned 32 [0104.319] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x20 [0104.319] GetSystemMetrics (nIndex=42) returned 0 [0104.319] GetWindowTextW (in: hWnd=0x70036, lpString=0x8fe740, nMaxCount=33 | out: lpString="In order to recover your data...") returned 32 [0104.319] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0xd, wParam=0x21, lParam=0x8fe740) returned 0x20 [0104.319] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0104.319] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0104.321] GetCurrentActCtx (in: lphActCtx=0x8fec30 | out: lphActCtx=0x8fec30*=0x956b54) returned 1 [0104.321] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0104.321] GetModuleHandleW (lpModuleName=0x0) returned 0x450000 [0104.321] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r9_ad1", lpWindowName="In order to recover your data...", dwStyle=0x5600000d, X=10, Y=-472, nWidth=0, nHeight=87, hWndParent=0x5008c, hMenu=0x0, hInstance=0x450000, lpParam=0x0) returned 0x80036 [0104.322] SetWindowLongW (hWnd=0x80036, nIndex=-4, dwNewLong=1874504640) returned 79169966 [0104.322] GetWindowLongW (hWnd=0x80036, nIndex=-4) returned 1874504640 [0104.322] SetWindowLongW (hWnd=0x80036, nIndex=-4, dwNewLong=79182806) returned 1874504640 [0104.322] GetWindowLongW (hWnd=0x80036, nIndex=-4) returned 79182806 [0104.322] GetWindowLongW (hWnd=0x80036, nIndex=-16) returned 1174405133 [0104.322] GetWindowLongW (hWnd=0x80036, nIndex=-12) returned 0 [0104.322] SetWindowLongW (hWnd=0x80036, nIndex=-12, dwNewLong=524342) returned 0 [0104.322] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x80036, Msg=0x81, wParam=0x0, lParam=0x8fe650) returned 0x1 [0104.323] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x80036, Msg=0x83, wParam=0x0, lParam=0x8fe63c) returned 0x0 [0104.323] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x80036, Msg=0x1, wParam=0x0, lParam=0x8fe650) returned 0x0 [0104.324] GetWindow (hWnd=0x80036, uCmd=0x3) returned 0x8002e [0104.324] GetClientRect (in: hWnd=0x80036, lpRect=0x8fe2fc | out: lpRect=0x8fe2fc) returned 1 [0104.324] GetWindowRect (in: hWnd=0x80036, lpRect=0x8fe2fc | out: lpRect=0x8fe2fc) returned 1 [0104.324] GetParent (hWnd=0x80036) returned 0x5008c [0104.324] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe2fc, cPoints=0x2 | out: lpPoints=0x8fe2fc) returned 2097184000 [0104.324] SetWindowTextW (hWnd=0x80036, lpString="In order to recover your data...") returned 1 [0104.324] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x80036, Msg=0xc, wParam=0x0, lParam=0x26ce4dc) returned 0x1 [0104.328] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x80036, Msg=0x5, wParam=0x0, lParam=0x570000) returned 0x0 [0104.329] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x80036, Msg=0x3, wParam=0x0, lParam=0xfe28000a) returned 0x0 [0104.329] GetClientRect (in: hWnd=0x80036, lpRect=0x8fe354 | out: lpRect=0x8fe354) returned 1 [0104.329] GetWindowRect (in: hWnd=0x80036, lpRect=0x8fe354 | out: lpRect=0x8fe354) returned 1 [0104.329] GetParent (hWnd=0x80036) returned 0x5008c [0104.329] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe354, cPoints=0x2 | out: lpPoints=0x8fe354) returned 2097184000 [0104.329] SendMessageW (hWnd=0x80036, Msg=0x2210, wParam=0x360001, lParam=0x80036) returned 0x0 [0104.329] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x80036, Msg=0x2210, wParam=0x360001, lParam=0x80036) returned 0x0 [0104.329] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x80036, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0104.329] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x80036, Msg=0x46, wParam=0x0, lParam=0x8fe664) returned 0x0 [0104.330] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x80036, Msg=0x47, wParam=0x0, lParam=0x8fe664) returned 0x0 [0104.330] GetClientRect (in: hWnd=0x80036, lpRect=0x8fe324 | out: lpRect=0x8fe324) returned 1 [0104.330] GetWindowRect (in: hWnd=0x80036, lpRect=0x8fe324 | out: lpRect=0x8fe324) returned 1 [0104.330] GetParent (hWnd=0x80036) returned 0x5008c [0104.330] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe324, cPoints=0x2 | out: lpPoints=0x8fe324) returned 2097184000 [0104.330] GetParent (hWnd=0x80036) returned 0x5008c [0104.331] GetParent (hWnd=0x80036) returned 0x5008c [0104.331] SetParent (hWndChild=0x70030, hWndNewParent=0x5008c) returned 0x300ec [0104.331] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0104.331] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x46, wParam=0x0, lParam=0x8fec8c) returned 0x0 [0104.332] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0104.332] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x47, wParam=0x0, lParam=0x8fec8c) returned 0x0 [0104.332] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x3, wParam=0x0, lParam=0xff1afeb5) returned 0x0 [0104.333] GetClientRect (in: hWnd=0x70030, lpRect=0x8fe230 | out: lpRect=0x8fe230) returned 1 [0104.333] GetWindowRect (in: hWnd=0x70030, lpRect=0x8fe230 | out: lpRect=0x8fe230) returned 1 [0104.333] GetParent (hWnd=0x70030) returned 0x5008c [0104.333] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe230, cPoints=0x2 | out: lpPoints=0x8fe230) returned 2097184000 [0104.333] GetClientRect (in: hWnd=0x70030, lpRect=0x8fe960 | out: lpRect=0x8fe960) returned 1 [0104.333] GetWindowRect (in: hWnd=0x70030, lpRect=0x8fe960 | out: lpRect=0x8fe960) returned 1 [0104.333] GetParent (hWnd=0x70030) returned 0x5008c [0104.333] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe960, cPoints=0x2 | out: lpPoints=0x8fe960) returned 2097184000 [0104.333] GetParent (hWnd=0x70030) returned 0x5008c [0104.333] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0104.333] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x46, wParam=0x0, lParam=0x8fec8c) returned 0x0 [0104.334] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x47, wParam=0x0, lParam=0x8fec8c) returned 0x0 [0104.334] GetClientRect (in: hWnd=0x70030, lpRect=0x8fe960 | out: lpRect=0x8fe960) returned 1 [0104.334] GetWindowRect (in: hWnd=0x70030, lpRect=0x8fe960 | out: lpRect=0x8fe960) returned 1 [0104.334] GetParent (hWnd=0x70030) returned 0x5008c [0104.334] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe960, cPoints=0x2 | out: lpPoints=0x8fe960) returned 2097184000 [0104.334] GetParent (hWnd=0x70030) returned 0x5008c [0104.334] GetWindow (hWnd=0x70030, uCmd=0x3) returned 0x0 [0104.334] SetWindowPos (hWnd=0x70030, hWndInsertAfter=0x80036, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0104.334] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x46, wParam=0x0, lParam=0x8fec44) returned 0x0 [0104.336] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0104.336] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x47, wParam=0x0, lParam=0x8fec44) returned 0x0 [0104.336] GetClientRect (in: hWnd=0x70030, lpRect=0x8fe918 | out: lpRect=0x8fe918) returned 1 [0104.336] GetWindowRect (in: hWnd=0x70030, lpRect=0x8fe918 | out: lpRect=0x8fe918) returned 1 [0104.336] GetParent (hWnd=0x70030) returned 0x5008c [0104.336] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe918, cPoints=0x2 | out: lpPoints=0x8fe918) returned 2097184000 [0104.336] GetParent (hWnd=0x70030) returned 0x5008c [0104.336] GetWindow (hWnd=0x70030, uCmd=0x3) returned 0x80036 [0104.336] GetFocus () returned 0x0 [0104.336] GetParent (hWnd=0x70030) returned 0x5008c [0104.336] GetWindowLongW (hWnd=0x70030, nIndex=-20) returned 512 [0104.336] DestroyWindow (hWnd=0x70030) returned 1 [0104.336] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0104.336] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0x210, wParam=0x300002, lParam=0x70030) returned 0x0 [0104.336] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0104.337] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x46, wParam=0x0, lParam=0x8feb7c) returned 0x0 [0104.338] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x47, wParam=0x0, lParam=0x8feb7c) returned 0x0 [0104.338] GetClientRect (in: hWnd=0x70030, lpRect=0x8fe850 | out: lpRect=0x8fe850) returned 1 [0104.338] GetWindowRect (in: hWnd=0x70030, lpRect=0x8fe850 | out: lpRect=0x8fe850) returned 1 [0104.338] GetParent (hWnd=0x70030) returned 0x5008c [0104.338] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe850, cPoints=0x2 | out: lpPoints=0x8fe850) returned 2097184000 [0104.338] GetParent (hWnd=0x70030) returned 0x5008c [0104.338] SendMessageW (hWnd=0x70030, Msg=0xb8, wParam=0x0, lParam=0x0) returned 0x0 [0104.338] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0xb8, wParam=0x0, lParam=0x0) returned 0x0 [0104.338] SendMessageW (hWnd=0x70030, Msg=0xb0, wParam=0x268847c, lParam=0x8fe850) returned 0x0 [0104.338] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0xb0, wParam=0x268847c, lParam=0x8fe850) returned 0x0 [0104.338] GetWindowTextLengthW (hWnd=0x70030) returned 33 [0104.338] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x21 [0104.338] GetSystemMetrics (nIndex=42) returned 0 [0104.338] GetWindowTextW (in: hWnd=0x70030, lpString=0x8fe730, nMaxCount=34 | out: lpString="friendly.cyber.criminal@gmail.com") returned 33 [0104.338] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0xd, wParam=0x22, lParam=0x8fe730) returned 0x21 [0104.339] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x1 [0104.339] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0104.340] GetCurrentActCtx (in: lphActCtx=0x8fec0c | out: lphActCtx=0x8fec0c*=0x956b54) returned 1 [0104.340] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0104.345] GetModuleHandleW (lpModuleName=0x0) returned 0x450000 [0104.345] CreateWindowExW (dwExStyle=0x200, lpClassName="WindowsForms10.EDIT.app.0.141b42a_r9_ad1", lpWindowName="friendly.cyber.criminal@gmail.com", dwStyle=0x560108c1, X=-333, Y=-232, nWidth=677, nHeight=59, hWndParent=0x5008c, hMenu=0x0, hInstance=0x450000, lpParam=0x0) returned 0x80030 [0104.345] SetWindowLongW (hWnd=0x80030, nIndex=-4, dwNewLong=1874383968) returned 79170046 [0104.345] GetWindowLongW (hWnd=0x80030, nIndex=-4) returned 1874383968 [0104.346] SetWindowLongW (hWnd=0x80030, nIndex=-4, dwNewLong=79182846) returned 1874383968 [0104.346] GetWindowLongW (hWnd=0x80030, nIndex=-4) returned 79182846 [0104.346] GetWindowLongW (hWnd=0x80030, nIndex=-16) returned 1174472897 [0104.346] GetWindowLongW (hWnd=0x80030, nIndex=-12) returned 0 [0104.346] SetWindowLongW (hWnd=0x80030, nIndex=-12, dwNewLong=524336) returned 0 [0104.346] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0x81, wParam=0x0, lParam=0x8fe630) returned 0x1 [0104.347] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0x83, wParam=0x0, lParam=0x8fe61c) returned 0x0 [0104.347] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0x1, wParam=0x0, lParam=0x8fe630) returned 0x1 [0104.348] SendMessageW (hWnd=0x80030, Msg=0x2111, wParam=0x4000030, lParam=0x80030) returned 0x0 [0104.348] SendMessageW (hWnd=0x80030, Msg=0x2111, wParam=0x3000030, lParam=0x80030) returned 0x0 [0104.348] SendMessageW (hWnd=0x80030, Msg=0x2055, wParam=0x80030, lParam=0x3) returned 0x2 [0104.348] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x0 [0104.349] GetWindow (hWnd=0x80030, uCmd=0x3) returned 0x80036 [0104.349] GetClientRect (in: hWnd=0x80030, lpRect=0x8fe2f0 | out: lpRect=0x8fe2f0) returned 1 [0104.349] GetWindowRect (in: hWnd=0x80030, lpRect=0x8fe2f0 | out: lpRect=0x8fe2f0) returned 1 [0104.349] GetParent (hWnd=0x80030) returned 0x5008c [0104.349] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe2f0, cPoints=0x2 | out: lpPoints=0x8fe2f0) returned 2097184000 [0104.349] SendMessageW (hWnd=0x80030, Msg=0x30, wParam=0x1e0a07d9, lParam=0x0) returned 0x1 [0104.349] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0x30, wParam=0x1e0a07d9, lParam=0x0) returned 0x1 [0104.349] SendMessageW (hWnd=0x80030, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0 [0104.349] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0 [0104.349] SetWindowTextW (hWnd=0x80030, lpString="friendly.cyber.criminal@gmail.com") returned 1 [0104.349] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0xc, wParam=0x0, lParam=0x26ce874) returned 0x1 [0104.350] SendMessageW (hWnd=0x80030, Msg=0x2111, wParam=0x4000030, lParam=0x80030) returned 0x0 [0104.350] SendMessageW (hWnd=0x80030, Msg=0x2111, wParam=0x3000030, lParam=0x80030) returned 0x0 [0104.350] GetSystemMetrics (nIndex=5) returned 1 [0104.350] GetSystemMetrics (nIndex=6) returned 1 [0104.350] SendMessageW (hWnd=0x80030, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1 [0104.350] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1 [0104.350] GetWindowTextLengthW (hWnd=0x80030) returned 33 [0104.350] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x21 [0104.350] SendMessageW (hWnd=0x80030, Msg=0xb1, wParam=0x0, lParam=0x0) returned 0x1 [0104.350] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0xb1, wParam=0x0, lParam=0x0) returned 0x1 [0104.588] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0x5, wParam=0x0, lParam=0x3702a1) returned 0x0 [0104.589] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0x3, wParam=0x0, lParam=0xff1afeb5) returned 0x0 [0104.589] GetClientRect (in: hWnd=0x80030, lpRect=0x8fe348 | out: lpRect=0x8fe348) returned 1 [0104.589] GetWindowRect (in: hWnd=0x80030, lpRect=0x8fe348 | out: lpRect=0x8fe348) returned 1 [0104.589] GetParent (hWnd=0x80030) returned 0x5008c [0104.589] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe348, cPoints=0x2 | out: lpPoints=0x8fe348) returned 2097184000 [0104.589] SendMessageW (hWnd=0x80030, Msg=0x2210, wParam=0x300001, lParam=0x80030) returned 0x0 [0104.589] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0x2210, wParam=0x300001, lParam=0x80030) returned 0x0 [0104.589] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0104.589] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0x46, wParam=0x0, lParam=0x8fe644) returned 0x0 [0104.591] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0x47, wParam=0x0, lParam=0x8fe644) returned 0x0 [0104.591] GetClientRect (in: hWnd=0x80030, lpRect=0x8fe318 | out: lpRect=0x8fe318) returned 1 [0104.591] GetWindowRect (in: hWnd=0x80030, lpRect=0x8fe318 | out: lpRect=0x8fe318) returned 1 [0104.591] GetParent (hWnd=0x80030) returned 0x5008c [0104.591] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe318, cPoints=0x2 | out: lpPoints=0x8fe318) returned 2097184000 [0104.591] GetParent (hWnd=0x80030) returned 0x5008c [0104.591] GetParent (hWnd=0x80030) returned 0x5008c [0104.591] SetParent (hWndChild=0x502ba, hWndNewParent=0x5008c) returned 0x300ec [0104.591] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0104.592] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x46, wParam=0x0, lParam=0x8fec8c) returned 0x0 [0104.593] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0104.593] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x47, wParam=0x0, lParam=0x8fec8c) returned 0x0 [0104.593] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x3, wParam=0x0, lParam=0xfea9feb5) returned 0x0 [0104.593] GetClientRect (in: hWnd=0x502ba, lpRect=0x8fe230 | out: lpRect=0x8fe230) returned 1 [0104.593] GetWindowRect (in: hWnd=0x502ba, lpRect=0x8fe230 | out: lpRect=0x8fe230) returned 1 [0104.593] GetParent (hWnd=0x502ba) returned 0x5008c [0104.593] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe230, cPoints=0x2 | out: lpPoints=0x8fe230) returned 2097184000 [0104.593] GetClientRect (in: hWnd=0x502ba, lpRect=0x8fe960 | out: lpRect=0x8fe960) returned 1 [0104.593] GetWindowRect (in: hWnd=0x502ba, lpRect=0x8fe960 | out: lpRect=0x8fe960) returned 1 [0104.593] GetParent (hWnd=0x502ba) returned 0x5008c [0104.593] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe960, cPoints=0x2 | out: lpPoints=0x8fe960) returned 2097184000 [0104.593] GetParent (hWnd=0x502ba) returned 0x5008c [0104.593] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0104.594] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x46, wParam=0x0, lParam=0x8fec8c) returned 0x0 [0104.595] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x47, wParam=0x0, lParam=0x8fec8c) returned 0x0 [0104.595] GetClientRect (in: hWnd=0x502ba, lpRect=0x8fe960 | out: lpRect=0x8fe960) returned 1 [0104.595] GetWindowRect (in: hWnd=0x502ba, lpRect=0x8fe960 | out: lpRect=0x8fe960) returned 1 [0104.595] GetParent (hWnd=0x502ba) returned 0x5008c [0104.595] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe960, cPoints=0x2 | out: lpPoints=0x8fe960) returned 2097184000 [0104.595] GetParent (hWnd=0x502ba) returned 0x5008c [0104.595] GetWindow (hWnd=0x502ba, uCmd=0x3) returned 0x0 [0104.595] SetWindowPos (hWnd=0x502ba, hWndInsertAfter=0x80030, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0104.595] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x46, wParam=0x0, lParam=0x8fec44) returned 0x0 [0104.596] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0104.597] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x47, wParam=0x0, lParam=0x8fec44) returned 0x0 [0104.597] GetClientRect (in: hWnd=0x502ba, lpRect=0x8fe918 | out: lpRect=0x8fe918) returned 1 [0104.597] GetWindowRect (in: hWnd=0x502ba, lpRect=0x8fe918 | out: lpRect=0x8fe918) returned 1 [0104.597] GetParent (hWnd=0x502ba) returned 0x5008c [0104.597] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe918, cPoints=0x2 | out: lpPoints=0x8fe918) returned 2097184000 [0104.597] GetParent (hWnd=0x502ba) returned 0x5008c [0104.597] GetWindow (hWnd=0x502ba, uCmd=0x3) returned 0x80030 [0104.597] GetFocus () returned 0x0 [0104.597] GetParent (hWnd=0x502ba) returned 0x5008c [0104.597] GetWindowLongW (hWnd=0x502ba, nIndex=-20) returned 512 [0104.597] DestroyWindow (hWnd=0x502ba) returned 1 [0104.597] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0104.597] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0x210, wParam=0x2ba0002, lParam=0x502ba) returned 0x0 [0104.597] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0104.597] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x46, wParam=0x0, lParam=0x8feb7c) returned 0x0 [0104.599] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x47, wParam=0x0, lParam=0x8feb7c) returned 0x0 [0104.599] GetClientRect (in: hWnd=0x502ba, lpRect=0x8fe850 | out: lpRect=0x8fe850) returned 1 [0104.599] GetWindowRect (in: hWnd=0x502ba, lpRect=0x8fe850 | out: lpRect=0x8fe850) returned 1 [0104.599] GetParent (hWnd=0x502ba) returned 0x5008c [0104.599] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe850, cPoints=0x2 | out: lpPoints=0x8fe850) returned 2097184000 [0104.599] GetParent (hWnd=0x502ba) returned 0x5008c [0104.599] SendMessageW (hWnd=0x502ba, Msg=0xb8, wParam=0x0, lParam=0x0) returned 0x0 [0104.599] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0xb8, wParam=0x0, lParam=0x0) returned 0x0 [0104.599] SendMessageW (hWnd=0x502ba, Msg=0xb0, wParam=0x2687b1c, lParam=0x8fe850) returned 0x0 [0104.599] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0xb0, wParam=0x2687b1c, lParam=0x8fe850) returned 0x0 [0104.599] GetWindowTextLengthW (hWnd=0x502ba) returned 34 [0104.599] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x22 [0104.599] GetSystemMetrics (nIndex=42) returned 0 [0104.599] GetWindowTextW (in: hWnd=0x502ba, lpString=0x8fe72c, nMaxCount=35 | out: lpString="1BtUL5dhVXHwKLqSdhjyjK9Pe64Vc6CEH1") returned 34 [0104.599] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0xd, wParam=0x23, lParam=0x8fe72c) returned 0x22 [0104.599] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x1 [0104.599] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502ba, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0104.600] GetCurrentActCtx (in: lphActCtx=0x8fec0c | out: lphActCtx=0x8fec0c*=0x956b54) returned 1 [0104.601] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0104.601] GetModuleHandleW (lpModuleName=0x0) returned 0x450000 [0104.601] CreateWindowExW (dwExStyle=0x200, lpClassName="WindowsForms10.EDIT.app.0.141b42a_r9_ad1", lpWindowName="1BtUL5dhVXHwKLqSdhjyjK9Pe64Vc6CEH1", dwStyle=0x560108c1, X=-333, Y=-345, nWidth=677, nHeight=59, hWndParent=0x5008c, hMenu=0x0, hInstance=0x450000, lpParam=0x0) returned 0x602ba [0104.602] SetWindowLongW (hWnd=0x602ba, nIndex=-4, dwNewLong=1874383968) returned 79170046 [0104.602] GetWindowLongW (hWnd=0x602ba, nIndex=-4) returned 1874383968 [0104.602] SetWindowLongW (hWnd=0x602ba, nIndex=-4, dwNewLong=79183366) returned 1874383968 [0104.602] GetWindowLongW (hWnd=0x602ba, nIndex=-4) returned 79183366 [0104.602] GetWindowLongW (hWnd=0x602ba, nIndex=-16) returned 1174472897 [0104.602] GetWindowLongW (hWnd=0x602ba, nIndex=-12) returned 0 [0104.602] SetWindowLongW (hWnd=0x602ba, nIndex=-12, dwNewLong=393914) returned 0 [0104.602] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x602ba, Msg=0x81, wParam=0x0, lParam=0x8fe630) returned 0x1 [0104.604] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x602ba, Msg=0x83, wParam=0x0, lParam=0x8fe61c) returned 0x0 [0104.604] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x602ba, Msg=0x1, wParam=0x0, lParam=0x8fe630) returned 0x1 [0104.605] SendMessageW (hWnd=0x602ba, Msg=0x2111, wParam=0x40002ba, lParam=0x602ba) returned 0x0 [0104.605] SendMessageW (hWnd=0x602ba, Msg=0x2111, wParam=0x30002ba, lParam=0x602ba) returned 0x0 [0104.605] SendMessageW (hWnd=0x602ba, Msg=0x2055, wParam=0x602ba, lParam=0x3) returned 0x2 [0104.606] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x0 [0104.606] GetWindow (hWnd=0x602ba, uCmd=0x3) returned 0x80030 [0104.608] GetClientRect (in: hWnd=0x602ba, lpRect=0x8fe2f0 | out: lpRect=0x8fe2f0) returned 1 [0104.608] GetWindowRect (in: hWnd=0x602ba, lpRect=0x8fe2f0 | out: lpRect=0x8fe2f0) returned 1 [0104.608] GetParent (hWnd=0x602ba) returned 0x5008c [0104.608] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe2f0, cPoints=0x2 | out: lpPoints=0x8fe2f0) returned 2097184000 [0104.608] SendMessageW (hWnd=0x602ba, Msg=0x30, wParam=0x170a07eb, lParam=0x0) returned 0x1 [0104.609] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x602ba, Msg=0x30, wParam=0x170a07eb, lParam=0x0) returned 0x1 [0104.609] SendMessageW (hWnd=0x602ba, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0 [0104.609] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x602ba, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0 [0104.609] SetWindowTextW (hWnd=0x602ba, lpString="1BtUL5dhVXHwKLqSdhjyjK9Pe64Vc6CEH1") [0104.609] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x602ba, Msg=0xc, wParam=0x0, lParam=0x26cec14) [0104.610] SendMessageW (hWnd=0x602ba, Msg=0x2111, wParam=0x40002ba, lParam=0x602ba) returned 0x0 [0104.610] SendMessageW (hWnd=0x602ba, Msg=0x2111, wParam=0x30002ba, lParam=0x602ba) returned 0x0 [0104.610] GetSystemMetrics (nIndex=5) returned 1 [0104.610] GetSystemMetrics (nIndex=6) returned 1 [0104.610] SendMessageW (hWnd=0x602ba, Msg=0xc5, wParam=0x7fff, lParam=0x0) [0104.610] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x602ba, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1 [0104.610] GetWindowTextLengthW (hWnd=0x602ba) [0104.610] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x602ba, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x22 [0104.614] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x602ba, Msg=0x5, wParam=0x0, lParam=0x3702a1) returned 0x0 [0104.614] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x602ba, Msg=0x3, wParam=0x0, lParam=0xfea9feb5) returned 0x0 [0104.614] GetClientRect (in: hWnd=0x602ba, lpRect=0x8fe348 | out: lpRect=0x8fe348) returned 1 [0104.614] GetWindowRect (in: hWnd=0x602ba, lpRect=0x8fe348 | out: lpRect=0x8fe348) returned 1 [0104.614] GetParent (hWnd=0x602ba) returned 0x5008c [0104.614] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe348, cPoints=0x2 | out: lpPoints=0x8fe348) returned 2097184000 [0104.614] SendMessageW (hWnd=0x602ba, Msg=0x2210, wParam=0x2ba0001, lParam=0x602ba) [0104.615] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x602ba, Msg=0x2210, wParam=0x2ba0001, lParam=0x602ba) returned 0x0 [0104.615] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x602ba, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0104.615] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x602ba, Msg=0x46, wParam=0x0, lParam=0x8fe644) returned 0x0 [0104.617] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x602ba, Msg=0x47, wParam=0x0, lParam=0x8fe644) returned 0x0 [0104.617] GetClientRect (in: hWnd=0x602ba, lpRect=0x8fe318 | out: lpRect=0x8fe318) returned 1 [0104.617] GetWindowRect (in: hWnd=0x602ba, lpRect=0x8fe318 | out: lpRect=0x8fe318) returned 1 [0104.617] GetParent (hWnd=0x602ba) returned 0x5008c [0104.617] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe318, cPoints=0x2 | out: lpPoints=0x8fe318) returned 2097184000 [0104.617] GetParent (hWnd=0x602ba) returned 0x5008c [0104.617] GetParent (hWnd=0x602ba) returned 0x5008c [0104.617] SetParent (hWndChild=0x18001c, hWndNewParent=0x5008c) [0104.617] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0104.618] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x46, wParam=0x0, lParam=0x8fec8c) returned 0x0 [0104.619] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0104.619] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x47, wParam=0x0, lParam=0x8fec8c) [0104.619] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x3, wParam=0x0, lParam=0xfedd000a) returned 0x0 [0104.619] GetClientRect (in: hWnd=0x18001c, lpRect=0x8fe21c | out: lpRect=0x8fe21c) returned 1 [0104.619] GetWindowRect (in: hWnd=0x18001c, lpRect=0x8fe21c | out: lpRect=0x8fe21c) returned 1 [0104.619] GetParent (hWnd=0x18001c) returned 0x5008c [0104.619] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe21c, cPoints=0x2 | out: lpPoints=0x8fe21c) returned 2097184000 [0104.619] GetParent (hWnd=0x18001c) returned 0x5008c [0104.619] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe94c, cPoints=0x2 | out: lpPoints=0x8fe94c) returned 2097184000 [0104.619] GetParent (hWnd=0x18001c) returned 0x5008c [0104.620] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0104.620] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x46, wParam=0x0, lParam=0x8fec8c) returned 0x0 [0104.621] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x47, wParam=0x0, lParam=0x8fec8c) returned 0x0 [0104.621] GetClientRect (in: hWnd=0x18001c, lpRect=0x8fe94c | out: lpRect=0x8fe94c) returned 1 [0104.621] GetWindowRect (in: hWnd=0x18001c, lpRect=0x8fe94c | out: lpRect=0x8fe94c) returned 1 [0104.621] GetParent (hWnd=0x18001c) returned 0x5008c [0104.621] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe94c, cPoints=0x2 | out: lpPoints=0x8fe94c) returned 2097184000 [0104.621] GetParent (hWnd=0x18001c) returned 0x5008c [0104.621] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x46, wParam=0x0, lParam=0x8fec44) returned 0x0 [0104.623] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0104.623] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x47, wParam=0x0, lParam=0x8fec44) returned 0x0 [0104.623] GetClientRect (in: hWnd=0x18001c, lpRect=0x8fe904 | out: lpRect=0x8fe904) returned 1 [0104.623] GetWindowRect (in: hWnd=0x18001c, lpRect=0x8fe904 | out: lpRect=0x8fe904) returned 1 [0104.623] GetParent (hWnd=0x18001c) returned 0x5008c [0104.623] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe904, cPoints=0x2 | out: lpPoints=0x8fe904) returned 2097184000 [0104.623] GetParent (hWnd=0x18001c) returned 0x5008c [0104.623] GetWindow (hWnd=0x18001c, uCmd=0x3) returned 0x602ba [0104.623] GetFocus () returned 0x0 [0104.623] GetParent (hWnd=0x18001c) returned 0x5008c [0104.624] GetWindowLongW (hWnd=0x18001c, nIndex=-20) returned 0 [0104.624] DestroyWindow (hWnd=0x18001c) [0104.624] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0104.624] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x5008c, Msg=0x210, wParam=0x1c0002, lParam=0x18001c) returned 0x0 [0104.624] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0104.625] GetParent (hWnd=0x18001c) returned 0x5008c [0104.625] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x5008c, lpPoints=0x8fe83c, cPoints=0x2 | out: lpPoints=0x8fe83c) returned 2097184000 [0104.625] GetParent (hWnd=0x18001c) returned 0x5008c [0104.625] GetWindowTextLengthW (hWnd=0x18001c) [0104.626] GetWindowTextW (hWnd=0x18001c, lpString=0x8fe70c, nMaxCount=59) [0104.627] GetCurrentActCtx (in: lphActCtx=0x8fec30 | out: lphActCtx=0x8fec30*=0x956b54) returned 1 [0104.627] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0104.628] GetModuleHandleW (lpModuleName=0x0) returned 0x450000 [0104.628] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r9_ad1", lpWindowName="Next, E-mail your transaction ID to the following address:", dwStyle=0x5600000d, X=10, Y=-291, nWidth=0, nHeight=55, hWndParent=0x5008c, hMenu=0x0, hInstance=0x450000, lpParam=0x0) [0104.628] SetWindowLongW (hWnd=0x19001c, nIndex=-4, dwNewLong=1874504640) returned 79169966 [0104.628] GetWindowLongW (hWnd=0x19001c, nIndex=-4) returned 1874504640 [0104.628] SetWindowLongW (hWnd=0x19001c, nIndex=-4, dwNewLong=79183246) returned 1874504640 [0104.628] GetWindowLongW (hWnd=0x19001c, nIndex=-4) returned 79183246 [0104.629] GetWindowLongW (hWnd=0x19001c, nIndex=-16) returned 1174405133 [0104.629] GetWindowLongW (hWnd=0x19001c, nIndex=-12) returned 0 [0104.629] SetWindowLongW (hWnd=0x19001c, nIndex=-12, dwNewLong=1638428) returned 0 [0104.630] SetWindowTextW (hWnd=0x19001c, lpString="Next, E-mail your transaction ID to the following address:") [0104.631] SendMessageW (hWnd=0x19001c, Msg=0x2210, wParam=0x1c0001, lParam=0x19001c) [0104.633] GetParent (hWnd=0x19001c) returned 0x5008c [0104.633] SetParent (hWndChild=0x202cc, hWndNewParent=0x5008c) [0104.640] GetWindowTextLengthW (hWnd=0x202cc) [0104.642] GetCurrentActCtx (in: lphActCtx=0x8fec30 | out: lphActCtx=0x8fec30*=0x956b54) returned 1 [0104.642] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0104.642] GetModuleHandleW (lpModuleName=0x0) returned 0x450000 [0104.642] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r9_ad1", lpWindowName="Please send n Bitcoin(s) to the following BTC address:", dwStyle=0x5600000d, X=10, Y=-396, nWidth=0, nHeight=55, hWndParent=0x5008c, hMenu=0x0, hInstance=0x450000, lpParam=0x0) [0104.643] SetWindowLongW (hWnd=0x302cc, nIndex=-4, dwNewLong=1874504640) returned 79169966 [0104.643] GetWindowLongW (hWnd=0x302cc, nIndex=-4) returned 1874504640 [0104.643] SetWindowLongW (hWnd=0x302cc, nIndex=-4, dwNewLong=79183006) returned 1874504640 [0104.643] GetWindowLongW (hWnd=0x302cc, nIndex=-4) returned 79183006 [0104.643] GetWindowLongW (hWnd=0x302cc, nIndex=-16) returned 1174405133 [0104.643] GetWindowLongW (hWnd=0x302cc, nIndex=-12) returned 0 [0104.643] SetWindowLongW (hWnd=0x302cc, nIndex=-12, dwNewLong=197324) returned 0 [0104.645] SetWindowTextW (hWnd=0x302cc, lpString="Please send n Bitcoin(s) to the following BTC address:") [0104.646] SendMessageW (hWnd=0x302cc, Msg=0x2210, wParam=0x2cc0001, lParam=0x302cc) [0104.647] GetParent (hWnd=0x302cc) returned 0x5008c [0104.647] SetParent (hWndChild=0x302ac, hWndNewParent=0x5008c) [0104.685] GetWindowTextLengthW (hWnd=0x302ac) [0104.687] GetCurrentActCtx (in: lphActCtx=0x8fec30 | out: lphActCtx=0x8fec30*=0x956b54) returned 1 [0104.687] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0104.687] GetModuleHandleW (lpModuleName=0x0) returned 0x450000 [0104.687] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r9_ad1", lpWindowName="Your files (count: n) have been encrypted!", dwStyle=0x5600000d, X=10, Y=-527, nWidth=0, nHeight=55, hWndParent=0x5008c, hMenu=0x0, hInstance=0x450000, lpParam=0x0) [0104.688] SetWindowLongW (hWnd=0x402ac, nIndex=-4, dwNewLong=1874504640) returned 79169966 [0104.688] GetWindowLongW (hWnd=0x402ac, nIndex=-4) returned 1874504640 [0104.688] SetWindowLongW (hWnd=0x402ac, nIndex=-4, dwNewLong=79182446) returned 1874504640 [0104.688] GetWindowLongW (hWnd=0x402ac, nIndex=-4) returned 79182446 [0104.688] GetWindowLongW (hWnd=0x402ac, nIndex=-16) returned 1174405133 [0104.688] GetWindowLongW (hWnd=0x402ac, nIndex=-12) returned 0 [0104.688] SetWindowLongW (hWnd=0x402ac, nIndex=-12, dwNewLong=262828) returned 0 [0104.690] SetWindowTextW (hWnd=0x402ac, lpString="Your files (count: n) have been encrypted!") [0104.690] SendMessageW (hWnd=0x402ac, Msg=0x2210, wParam=0x2ac0001, lParam=0x402ac) [0104.692] GetParent (hWnd=0x402ac) returned 0x5008c [0104.692] GetParent (hWnd=0x8002e) returned 0x5008c [0104.692] GetParent (hWnd=0x80036) returned 0x5008c [0104.692] GetParent (hWnd=0x80030) returned 0x5008c [0104.692] GetParent (hWnd=0x602ba) returned 0x5008c [0104.692] GetParent (hWnd=0x19001c) returned 0x5008c [0104.692] GetParent (hWnd=0x302cc) returned 0x5008c [0104.692] GetParent (hWnd=0x402ac) returned 0x5008c [0104.692] SetWindowPlacement (hWnd=0x5008c, lpwndpl=0x8fedcc) returned 1 [0104.693] GetWindowTextLengthW (hWnd=0x302cc) [0104.693] GetWindowTextLengthW (hWnd=0x302cc) [0104.693] SetWindowTextW (hWnd=0x302cc, lpString="Please send 1 Bitcoin(s) to the following BTC address:") [0104.694] GetDlgItem (hDlg=0x5008c, nIDDlgItem=197324) returned 0x302cc [0104.694] SendMessageW (hWnd=0x302cc, Msg=0x202b, wParam=0x302cc, lParam=0x8fe834) [0104.695] InvalidateRect (hWnd=0x302cc, lpRect=0x0, bErase=1) returned 1 [0104.695] GetWindowTextLengthW (hWnd=0x602ba) [0104.695] GetWindowTextLengthW (hWnd=0x80030) [0104.695] GetWindowTextLengthW (hWnd=0x80030) [0104.695] GetWindowTextLengthW (hWnd=0x80030) [0104.695] GetWindowTextLengthW (hWnd=0x80030) [0104.695] SetWindowTextW (hWnd=0x80030, lpString="danielthai101514@gmail.com") [0104.696] IsWindowVisible (hWnd=0x302cc) returned 1 [0104.696] IsWindowEnabled (hWnd=0x302cc) returned 1 [0104.696] SetFocus (hWnd=0x302cc) returned 0x0 [0104.696] GetFocus () returned 0x0 [0104.696] GetFocus () returned 0x0 [0104.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed6c) returned 1 [0104.710] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x18 [0104.710] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x18, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0104.751] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\*", lpFindFileData=0x8fea94 | out: lpFindFileData=0x8fea94*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2cdd4c46, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0x2cdd4c46, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x960508 [0104.753] FindNextFileW (in: hFindFile=0x960508, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2cdd4c46, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0x2cdd4c46, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.754] FindNextFileW (in: hFindFile=0x960508, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa627fb10, ftCreationTime.dwHighDateTime=0x1d5eb40, ftLastAccessTime.dwLowDateTime=0x907366c0, ftLastAccessTime.dwHighDateTime=0x1d5ebf3, ftLastWriteTime.dwLowDateTime=0x907366c0, ftLastWriteTime.dwHighDateTime=0x1d5ebf3, nFileSizeHigh=0x0, nFileSizeLow=0x11149, dwReserved0=0x0, dwReserved1=0x0, cFileName="0l0j5qsF7nQzLnBN3lmf.swf", cAlternateFileName="0L0J5Q~1.SWF")) returned 1 [0104.754] FindNextFileW (in: hFindFile=0x960508, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbae4c2c0, ftCreationTime.dwHighDateTime=0x1d5e4b7, ftLastAccessTime.dwLowDateTime=0x259d2580, ftLastAccessTime.dwHighDateTime=0x1d5efc1, ftLastWriteTime.dwLowDateTime=0x259d2580, ftLastWriteTime.dwHighDateTime=0x1d5efc1, nFileSizeHigh=0x0, nFileSizeLow=0x629b, dwReserved0=0x0, dwReserved1=0x0, cFileName="0LJl9cqM.m4a", cAlternateFileName="")) returned 1 [0104.754] FindNextFileW (in: hFindFile=0x960508, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x178ab730, ftCreationTime.dwHighDateTime=0x1d5e7a3, ftLastAccessTime.dwLowDateTime=0x4e2d83d0, ftLastAccessTime.dwHighDateTime=0x1d5ec67, ftLastWriteTime.dwLowDateTime=0x4e2d83d0, ftLastWriteTime.dwHighDateTime=0x1d5ec67, nFileSizeHigh=0x0, nFileSizeLow=0xb6ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="0tx_B3ZtTjj9.mkv", cAlternateFileName="0TX_B3~1.MKV")) returned 1 [0104.754] FindNextFileW (in: hFindFile=0x960508, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb0c30, ftCreationTime.dwHighDateTime=0x1d5e7a6, ftLastAccessTime.dwLowDateTime=0xf9506af0, ftLastAccessTime.dwHighDateTime=0x1d5e773, ftLastWriteTime.dwLowDateTime=0xf9506af0, ftLastWriteTime.dwHighDateTime=0x1d5e773, nFileSizeHigh=0x0, nFileSizeLow=0x4075, dwReserved0=0x0, dwReserved1=0x0, cFileName="4mRn85VhgY.gif", cAlternateFileName="4MRN85~1.GIF")) returned 1 [0104.755] FindNextFileW (in: hFindFile=0x960508, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77ed9720, ftCreationTime.dwHighDateTime=0x1d5e5ad, ftLastAccessTime.dwLowDateTime=0x54fd0580, ftLastAccessTime.dwHighDateTime=0x1d5e791, ftLastWriteTime.dwLowDateTime=0x54fd0580, ftLastWriteTime.dwHighDateTime=0x1d5e791, nFileSizeHigh=0x0, nFileSizeLow=0x6d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="81ehNBmd9Z.gif", cAlternateFileName="81EHNB~1.GIF")) returned 1 [0104.755] FindNextFileW (in: hFindFile=0x960508, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8f75470, ftCreationTime.dwHighDateTime=0x1d5e92d, ftLastAccessTime.dwLowDateTime=0xc360b0a0, ftLastAccessTime.dwHighDateTime=0x1d5e69f, ftLastWriteTime.dwLowDateTime=0xc360b0a0, ftLastWriteTime.dwHighDateTime=0x1d5e69f, nFileSizeHigh=0x0, nFileSizeLow=0x12a6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="98v1-HRDDxHlpd.mp3", cAlternateFileName="98V1-H~1.MP3")) returned 1 [0104.755] FindNextFileW (in: hFindFile=0x960508, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4c19940, ftCreationTime.dwHighDateTime=0x1d5e8c0, ftLastAccessTime.dwLowDateTime=0xd9509560, ftLastAccessTime.dwHighDateTime=0x1d5e26c, ftLastWriteTime.dwLowDateTime=0xd9509560, ftLastWriteTime.dwHighDateTime=0x1d5e26c, nFileSizeHigh=0x0, nFileSizeLow=0x1ed8, dwReserved0=0x0, dwReserved1=0x0, cFileName="9NHojs4KGpHZ2tK_mr.wav", cAlternateFileName="9NHOJS~1.WAV")) returned 1 [0104.755] FindNextFileW (in: hFindFile=0x960508, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd15060f0, ftCreationTime.dwHighDateTime=0x1d5e647, ftLastAccessTime.dwLowDateTime=0x3ddbd8a0, ftLastAccessTime.dwHighDateTime=0x1d5f0e6, ftLastWriteTime.dwLowDateTime=0x3ddbd8a0, ftLastWriteTime.dwHighDateTime=0x1d5f0e6, nFileSizeHigh=0x0, nFileSizeLow=0x1614a, dwReserved0=0x0, dwReserved1=0x0, cFileName="B2wxCWV NeK.jpg", cAlternateFileName="B2WXCW~1.JPG")) returned 1 [0104.755] FindNextFileW (in: hFindFile=0x960508, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ae81750, ftCreationTime.dwHighDateTime=0x1d5e6fe, ftLastAccessTime.dwLowDateTime=0x641a81f0, ftLastAccessTime.dwHighDateTime=0x1d5f001, ftLastWriteTime.dwLowDateTime=0x641a81f0, ftLastWriteTime.dwHighDateTime=0x1d5f001, nFileSizeHigh=0x0, nFileSizeLow=0xdee5, dwReserved0=0x0, dwReserved1=0x0, cFileName="bexMIcYLR.mp4", cAlternateFileName="BEXMIC~1.MP4")) returned 1 [0104.756] FindNextFileW (in: hFindFile=0x960508, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3876420, ftCreationTime.dwHighDateTime=0x1d5e987, ftLastAccessTime.dwLowDateTime=0xbb50f5f0, ftLastAccessTime.dwHighDateTime=0x1d5e3a2, ftLastWriteTime.dwLowDateTime=0xbb50f5f0, ftLastWriteTime.dwHighDateTime=0x1d5e3a2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CQolCPeRR_Dq2", cAlternateFileName="CQOLCP~1")) returned 1 [0104.756] FindNextFileW (in: hFindFile=0x960508, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25e23af0, ftCreationTime.dwHighDateTime=0x1d5e754, ftLastAccessTime.dwLowDateTime=0x82a2b1a0, ftLastAccessTime.dwHighDateTime=0x1d5e3af, ftLastWriteTime.dwLowDateTime=0x82a2b1a0, ftLastWriteTime.dwHighDateTime=0x1d5e3af, nFileSizeHigh=0x0, nFileSizeLow=0x8cf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="deJdal_h-Ghz1S-rp.wav", cAlternateFileName="DEJDAL~1.WAV")) returned 1 [0104.757] FindNextFileW (in: hFindFile=0x960508, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0104.757] FindNextFileW (in: hFindFile=0x960508, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6e2ac0, ftCreationTime.dwHighDateTime=0x1d5e542, ftLastAccessTime.dwLowDateTime=0x97a810c0, ftLastAccessTime.dwHighDateTime=0x1d5e64a, ftLastWriteTime.dwLowDateTime=0x97a810c0, ftLastWriteTime.dwHighDateTime=0x1d5e64a, nFileSizeHigh=0x0, nFileSizeLow=0x165ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="GR3hVa_lqJKuzZUW.png", cAlternateFileName="GR3HVA~1.PNG")) returned 1 [0104.757] FindNextFileW (in: hFindFile=0x960508, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a7accf0, ftCreationTime.dwHighDateTime=0x1d5ec98, ftLastAccessTime.dwLowDateTime=0x727986a0, ftLastAccessTime.dwHighDateTime=0x1d5ee7c, ftLastWriteTime.dwLowDateTime=0x727986a0, ftLastWriteTime.dwHighDateTime=0x1d5ee7c, nFileSizeHigh=0x0, nFileSizeLow=0xc460, dwReserved0=0x0, dwReserved1=0x0, cFileName="H5QT5PzwoFrPt.mkv", cAlternateFileName="H5QT5P~1.MKV")) returned 1 [0104.757] FindNextFileW (in: hFindFile=0x960508, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe180c490, ftCreationTime.dwHighDateTime=0x1d5e612, ftLastAccessTime.dwLowDateTime=0x935ed3a0, ftLastAccessTime.dwHighDateTime=0x1d5ec03, ftLastWriteTime.dwLowDateTime=0x935ed3a0, ftLastWriteTime.dwHighDateTime=0x1d5ec03, nFileSizeHigh=0x0, nFileSizeLow=0x18248, dwReserved0=0x0, dwReserved1=0x0, cFileName="hnsTMu6MY8bIRoaE.odp", cAlternateFileName="HNSTMU~1.ODP")) returned 1 [0104.757] FindNextFileW (in: hFindFile=0x960508, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ecdc030, ftCreationTime.dwHighDateTime=0x1d5e618, ftLastAccessTime.dwLowDateTime=0x36b21b20, ftLastAccessTime.dwHighDateTime=0x1d5e146, ftLastWriteTime.dwLowDateTime=0x36b21b20, ftLastWriteTime.dwHighDateTime=0x1d5e146, nFileSizeHigh=0x0, nFileSizeLow=0x16e1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="iwt0UXy_6j83u_hYrR4k.mkv", cAlternateFileName="IWT0UX~1.MKV")) returned 1 [0104.757] FindNextFileW (in: hFindFile=0x960508, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaad72a50, ftCreationTime.dwHighDateTime=0x1d5e334, ftLastAccessTime.dwLowDateTime=0xf9c1b240, ftLastAccessTime.dwHighDateTime=0x1d5e521, ftLastWriteTime.dwLowDateTime=0xf9c1b240, ftLastWriteTime.dwHighDateTime=0x1d5e521, nFileSizeHigh=0x0, nFileSizeLow=0x30ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="mvD4wSfuIQXQzOdec.png", cAlternateFileName="MVD4WS~1.PNG")) returned 1 [0104.758] FindNextFileW (in: hFindFile=0x960508, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52ee390, ftCreationTime.dwHighDateTime=0x1d5e5e6, ftLastAccessTime.dwLowDateTime=0xce93fc10, ftLastAccessTime.dwHighDateTime=0x1d5eb55, ftLastWriteTime.dwLowDateTime=0xce93fc10, ftLastWriteTime.dwHighDateTime=0x1d5eb55, nFileSizeHigh=0x0, nFileSizeLow=0x12d41, dwReserved0=0x0, dwReserved1=0x0, cFileName="ovj WB7PmlGqC6pw.png", cAlternateFileName="OVJWB7~1.PNG")) returned 1 [0104.759] FindNextFileW (in: hFindFile=0x960508, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9be7ac0, ftCreationTime.dwHighDateTime=0x1d5e2ac, ftLastAccessTime.dwLowDateTime=0x97e50700, ftLastAccessTime.dwHighDateTime=0x1d5edcf, ftLastWriteTime.dwLowDateTime=0x97e50700, ftLastWriteTime.dwHighDateTime=0x1d5edcf, nFileSizeHigh=0x0, nFileSizeLow=0x18bac, dwReserved0=0x0, dwReserved1=0x0, cFileName="pc9Z7XSZsXrvfp8OiIsA.bmp", cAlternateFileName="PC9Z7X~1.BMP")) returned 1 [0104.759] FindNextFileW (in: hFindFile=0x960508, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfccb1920, ftCreationTime.dwHighDateTime=0x1d5eece, ftLastAccessTime.dwLowDateTime=0xa04f8720, ftLastAccessTime.dwHighDateTime=0x1d5f064, ftLastWriteTime.dwLowDateTime=0xa04f8720, ftLastWriteTime.dwHighDateTime=0x1d5f064, nFileSizeHigh=0x0, nFileSizeLow=0x1037b, dwReserved0=0x0, dwReserved1=0x0, cFileName="QZTvCz0FFAxSe0OXTZ.m4a", cAlternateFileName="QZTVCZ~1.M4A")) returned 1 [0104.759] FindNextFileW (in: hFindFile=0x960508, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe530db10, ftCreationTime.dwHighDateTime=0x1d5e811, ftLastAccessTime.dwLowDateTime=0xdb86a030, ftLastAccessTime.dwHighDateTime=0x1d5eb28, ftLastWriteTime.dwLowDateTime=0xdb86a030, ftLastWriteTime.dwHighDateTime=0x1d5eb28, nFileSizeHigh=0x0, nFileSizeLow=0xfdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sb23DHgVHWLDZ3K.bmp", cAlternateFileName="SB23DH~1.BMP")) returned 1 [0104.759] FindNextFileW (in: hFindFile=0x960508, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2e48ed0, ftCreationTime.dwHighDateTime=0x1d5eea7, ftLastAccessTime.dwLowDateTime=0x8dec0cf0, ftLastAccessTime.dwHighDateTime=0x1d5e40e, ftLastWriteTime.dwLowDateTime=0x8dec0cf0, ftLastWriteTime.dwHighDateTime=0x1d5e40e, nFileSizeHigh=0x0, nFileSizeLow=0x3399, dwReserved0=0x0, dwReserved1=0x0, cFileName="sJF6kRBQM.mkv", cAlternateFileName="SJF6KR~1.MKV")) returned 1 [0104.759] FindNextFileW (in: hFindFile=0x960508, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f5beaa0, ftCreationTime.dwHighDateTime=0x1d5ef74, ftLastAccessTime.dwLowDateTime=0xc08fadc0, ftLastAccessTime.dwHighDateTime=0x1d5e417, ftLastWriteTime.dwLowDateTime=0xc08fadc0, ftLastWriteTime.dwHighDateTime=0x1d5e417, nFileSizeHigh=0x0, nFileSizeLow=0x10b07, dwReserved0=0x0, dwReserved1=0x0, cFileName="sRzwd0uphFzOuRb.pps", cAlternateFileName="SRZWD0~1.PPS")) returned 1 [0104.760] FindNextFileW (in: hFindFile=0x960508, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50168740, ftCreationTime.dwHighDateTime=0x1d5e173, ftLastAccessTime.dwLowDateTime=0x6d0dc860, ftLastAccessTime.dwHighDateTime=0x1d5e6d5, ftLastWriteTime.dwLowDateTime=0x6d0dc860, ftLastWriteTime.dwHighDateTime=0x1d5e6d5, nFileSizeHigh=0x0, nFileSizeLow=0x51dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="SzAqbDkPqXeoz.mp3", cAlternateFileName="SZAQBD~1.MP3")) returned 1 [0104.760] FindNextFileW (in: hFindFile=0x960508, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe09e23f0, ftCreationTime.dwHighDateTime=0x1d5e69a, ftLastAccessTime.dwLowDateTime=0xf83e280, ftLastAccessTime.dwHighDateTime=0x1d5e1fb, ftLastWriteTime.dwLowDateTime=0xf83e280, ftLastWriteTime.dwHighDateTime=0x1d5e1fb, nFileSizeHigh=0x0, nFileSizeLow=0x26b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="T cE.m4a", cAlternateFileName="TCE~1.M4A")) returned 1 [0104.760] FindNextFileW (in: hFindFile=0x960508, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23a986e0, ftCreationTime.dwHighDateTime=0x1d5e8f2, ftLastAccessTime.dwLowDateTime=0xc7224e30, ftLastAccessTime.dwHighDateTime=0x1d5ea5d, ftLastWriteTime.dwLowDateTime=0xc7224e30, ftLastWriteTime.dwHighDateTime=0x1d5ea5d, nFileSizeHigh=0x0, nFileSizeLow=0xfca1, dwReserved0=0x0, dwReserved1=0x0, cFileName="tXLvK5sswGB-Igr7XE.mp3", cAlternateFileName="TXLVK5~1.MP3")) returned 1 [0104.760] FindNextFileW (in: hFindFile=0x960508, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x174b7500, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0x174b7500, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0x14e91b00, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x1ee00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsFormsApp1.exe", cAlternateFileName="WINDOW~1.EXE")) returned 1 [0104.760] FindNextFileW (in: hFindFile=0x960508, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc04934c0, ftCreationTime.dwHighDateTime=0x1d5e55d, ftLastAccessTime.dwLowDateTime=0x4bad71f0, ftLastAccessTime.dwHighDateTime=0x1d5ef83, ftLastWriteTime.dwLowDateTime=0x4bad71f0, ftLastWriteTime.dwHighDateTime=0x1d5ef83, nFileSizeHigh=0x0, nFileSizeLow=0x13ed7, dwReserved0=0x0, dwReserved1=0x0, cFileName="xUudj4YuV1u1wa7pXq1l.mp3", cAlternateFileName="XUUDJ4~1.MP3")) returned 1 [0104.760] FindNextFileW (in: hFindFile=0x960508, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd64a4250, ftCreationTime.dwHighDateTime=0x1d5e521, ftLastAccessTime.dwLowDateTime=0x9ba4b9e0, ftLastAccessTime.dwHighDateTime=0x1d5ecd9, ftLastWriteTime.dwLowDateTime=0x9ba4b9e0, ftLastWriteTime.dwHighDateTime=0x1d5ecd9, nFileSizeHigh=0x0, nFileSizeLow=0x180a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y30Kub.mp3", cAlternateFileName="")) returned 1 [0104.761] FindNextFileW (in: hFindFile=0x960508, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4974b800, ftCreationTime.dwHighDateTime=0x1d5ed6a, ftLastAccessTime.dwLowDateTime=0x800229f0, ftLastAccessTime.dwHighDateTime=0x1d5eee3, ftLastWriteTime.dwLowDateTime=0x800229f0, ftLastWriteTime.dwHighDateTime=0x1d5eee3, nFileSizeHigh=0x0, nFileSizeLow=0x16fd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="yeiEa.mp4", cAlternateFileName="")) returned 1 [0104.761] FindNextFileW (in: hFindFile=0x960508, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ffc0fa0, ftCreationTime.dwHighDateTime=0x1d5e481, ftLastAccessTime.dwLowDateTime=0x810bfe10, ftLastAccessTime.dwHighDateTime=0x1d5eb9c, ftLastWriteTime.dwLowDateTime=0x810bfe10, ftLastWriteTime.dwHighDateTime=0x1d5eb9c, nFileSizeHigh=0x0, nFileSizeLow=0x10cf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="YrsS9o4J_2Rwa.m4a", cAlternateFileName="YRSS9O~1.M4A")) returned 1 [0104.761] FindNextFileW (in: hFindFile=0x960508, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdf42e50, ftCreationTime.dwHighDateTime=0x1d5ef7b, ftLastAccessTime.dwLowDateTime=0x19fc6e70, ftLastAccessTime.dwHighDateTime=0x1d5e8eb, ftLastWriteTime.dwLowDateTime=0x19fc6e70, ftLastWriteTime.dwHighDateTime=0x1d5e8eb, nFileSizeHigh=0x0, nFileSizeLow=0x6121, dwReserved0=0x0, dwReserved1=0x0, cFileName="yucEe8pisTo.swf", cAlternateFileName="YUCEE8~1.SWF")) returned 1 [0104.761] FindNextFileW (in: hFindFile=0x960508, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0104.761] FindClose (in: hFindFile=0x960508 | out: hFindFile=0x960508) returned 1 [0104.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fed28) returned 1 [0104.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fed34) returned 1 [0104.764] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0105.874] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\0l0j5qsF7nQzLnBN3lmf.swf.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0105.875] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\0l0j5qsF7nQzLnBN3lmf.swf.locked", nBufferLength=0x38, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\0l0j5qsF7nQzLnBN3lmf.swf.locked", lpFilePart=0x0) returned 0x37 [0105.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0105.875] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\0l0j5qsF7nQzLnBN3lmf.swf.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\0l0j5qsf7nqzlnbn3lmf.swf.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0105.877] GetFileType (hFile=0x40c) returned 0x1 [0105.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0105.877] GetFileType (hFile=0x40c) returned 0x1 [0105.901] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x8fecd0 | out: pfEnabled=0x8fecd0) returned 0x0 [0112.149] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\0l0j5qsF7nQzLnBN3lmf.swf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0112.149] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\0l0j5qsF7nQzLnBN3lmf.swf", nBufferLength=0x31, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\0l0j5qsF7nQzLnBN3lmf.swf", lpFilePart=0x0) returned 0x30 [0112.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0112.150] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\0l0j5qsF7nQzLnBN3lmf.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\0l0j5qsf7nqzlnbn3lmf.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0112.152] GetFileType (hFile=0x37c) returned 0x1 [0112.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0112.152] GetFileType (hFile=0x37c) returned 0x1 [0112.156] ReadFile (in: hFile=0x37c, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0x11149, lpOverlapped=0x0) returned 1 [0112.377] WriteFile (in: hFile=0x40c, lpBuffer=0x27bcd2c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x27bcd2c*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0112.380] WriteFile (in: hFile=0x40c, lpBuffer=0x27c33d0*, nNumberOfBytesToWrite=0x10160, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x27c33d0*, lpNumberOfBytesWritten=0x8fec70*=0x10160, lpOverlapped=0x0) returned 1 [0112.381] ReadFile (in: hFile=0x37c, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0112.381] CloseHandle (hObject=0x37c) returned 1 [0112.382] WriteFile (in: hFile=0x40c, lpBuffer=0x27bcd2c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x27bcd2c*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0112.382] CloseHandle (hObject=0x40c) returned 1 [0112.386] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\0l0j5qsF7nQzLnBN3lmf.swf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0112.386] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\0l0j5qsF7nQzLnBN3lmf.swf", nBufferLength=0x31, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\0l0j5qsF7nQzLnBN3lmf.swf", lpFilePart=0x0) returned 0x30 [0112.386] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\0l0j5qsF7nQzLnBN3lmf.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\0l0j5qsf7nqzlnbn3lmf.swf")) returned 1 [0112.390] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\0LJl9cqM.m4a.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0112.390] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\0LJl9cqM.m4a.locked", nBufferLength=0x2c, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\0LJl9cqM.m4a.locked", lpFilePart=0x0) returned 0x2b [0112.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0112.390] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\0LJl9cqM.m4a.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\0ljl9cqm.m4a.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0112.391] GetFileType (hFile=0x40c) returned 0x1 [0112.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0112.391] GetFileType (hFile=0x40c) returned 0x1 [0116.646] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\0LJl9cqM.m4a", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0116.647] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\0LJl9cqM.m4a", nBufferLength=0x25, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\0LJl9cqM.m4a", lpFilePart=0x0) returned 0x24 [0116.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0116.731] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\0LJl9cqM.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\0ljl9cqm.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0116.734] GetFileType (hFile=0x37c) returned 0x1 [0116.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0116.735] GetFileType (hFile=0x37c) returned 0x1 [0116.739] ReadFile (in: hFile=0x37c, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec98*=0x629b, lpOverlapped=0x0) returned 1 [0116.760] WriteFile (in: hFile=0x40c, lpBuffer=0x26b9f30*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x26b9f30*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0116.764] WriteFile (in: hFile=0x40c, lpBuffer=0x26bc3fc*, nNumberOfBytesToWrite=0x52b0, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x26bc3fc*, lpNumberOfBytesWritten=0x8fec70*=0x52b0, lpOverlapped=0x0) returned 1 [0116.765] ReadFile (in: hFile=0x37c, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0116.765] CloseHandle (hObject=0x37c) returned 1 [0116.766] WriteFile (in: hFile=0x40c, lpBuffer=0x26b9f30*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x26b9f30*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0116.766] CloseHandle (hObject=0x40c) returned 1 [0116.821] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\0LJl9cqM.m4a", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0116.821] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\0LJl9cqM.m4a", nBufferLength=0x25, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\0LJl9cqM.m4a", lpFilePart=0x0) returned 0x24 [0116.821] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\0LJl9cqM.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\0ljl9cqm.m4a")) returned 1 [0116.918] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\0tx_B3ZtTjj9.mkv.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0116.918] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\0tx_B3ZtTjj9.mkv.locked", nBufferLength=0x30, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\0tx_B3ZtTjj9.mkv.locked", lpFilePart=0x0) returned 0x2f [0116.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0116.918] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\0tx_B3ZtTjj9.mkv.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\0tx_b3zttjj9.mkv.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0116.920] GetFileType (hFile=0x40c) returned 0x1 [0116.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0116.920] GetFileType (hFile=0x40c) returned 0x1 [0119.547] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\0tx_B3ZtTjj9.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0119.547] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\0tx_B3ZtTjj9.mkv", nBufferLength=0x29, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\0tx_B3ZtTjj9.mkv", lpFilePart=0x0) returned 0x28 [0119.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0119.547] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\0tx_B3ZtTjj9.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\0tx_b3zttjj9.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0119.548] GetFileType (hFile=0x37c) returned 0x1 [0119.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0119.548] GetFileType (hFile=0x37c) returned 0x1 [0119.551] ReadFile (in: hFile=0x37c, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8fec98*=0xb6ec, lpOverlapped=0x0) returned 1 [0119.575] WriteFile (in: hFile=0x40c, lpBuffer=0x27a3f40*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x27a3f40*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0119.578] WriteFile (in: hFile=0x40c, lpBuffer=0x27a6414*, nNumberOfBytesToWrite=0xa700, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x27a6414*, lpNumberOfBytesWritten=0x8fec70*=0xa700, lpOverlapped=0x0) returned 1 [0119.579] ReadFile (in: hFile=0x37c, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0119.579] CloseHandle (hObject=0x37c) returned 1 [0119.580] WriteFile (in: hFile=0x40c, lpBuffer=0x27a3f40*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x27a3f40*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0119.580] CloseHandle (hObject=0x40c) returned 1 [0119.582] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\0tx_B3ZtTjj9.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0119.582] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\0tx_B3ZtTjj9.mkv", nBufferLength=0x29, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\0tx_B3ZtTjj9.mkv", lpFilePart=0x0) returned 0x28 [0119.583] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\0tx_B3ZtTjj9.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\0tx_b3zttjj9.mkv")) returned 1 [0119.585] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\4mRn85VhgY.gif.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0119.585] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\4mRn85VhgY.gif.locked", nBufferLength=0x2e, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\4mRn85VhgY.gif.locked", lpFilePart=0x0) returned 0x2d [0119.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0119.585] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\4mRn85VhgY.gif.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\4mrn85vhgy.gif.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0119.586] GetFileType (hFile=0x40c) returned 0x1 [0119.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0119.586] GetFileType (hFile=0x40c) returned 0x1 [0122.144] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\4mRn85VhgY.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0122.144] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\4mRn85VhgY.gif", nBufferLength=0x27, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\4mRn85VhgY.gif", lpFilePart=0x0) returned 0x26 [0122.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0122.144] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\4mRn85VhgY.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\4mrn85vhgy.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0122.145] GetFileType (hFile=0x37c) returned 0x1 [0122.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0122.145] GetFileType (hFile=0x37c) returned 0x1 [0122.148] ReadFile (in: hFile=0x37c, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0x4075, lpOverlapped=0x0) returned 1 [0122.160] WriteFile (in: hFile=0x40c, lpBuffer=0x288ec08*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x288ec08*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0122.161] WriteFile (in: hFile=0x40c, lpBuffer=0x28910d8*, nNumberOfBytesToWrite=0x3090, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x28910d8*, lpNumberOfBytesWritten=0x8fec70*=0x3090, lpOverlapped=0x0) returned 1 [0122.162] ReadFile (in: hFile=0x37c, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0122.162] CloseHandle (hObject=0x37c) returned 1 [0122.162] WriteFile (in: hFile=0x40c, lpBuffer=0x288ec08*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x288ec08*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0122.162] CloseHandle (hObject=0x40c) returned 1 [0122.164] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\4mRn85VhgY.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0122.164] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\4mRn85VhgY.gif", nBufferLength=0x27, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\4mRn85VhgY.gif", lpFilePart=0x0) returned 0x26 [0122.164] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\4mRn85VhgY.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\4mrn85vhgy.gif")) returned 1 [0122.173] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\81ehNBmd9Z.gif.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0122.173] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\81ehNBmd9Z.gif.locked", nBufferLength=0x2e, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\81ehNBmd9Z.gif.locked", lpFilePart=0x0) returned 0x2d [0122.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0122.173] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\81ehNBmd9Z.gif.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\81ehnbmd9z.gif.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0122.173] GetFileType (hFile=0x40c) returned 0x1 [0122.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0122.174] GetFileType (hFile=0x40c) returned 0x1 [0124.030] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\81ehNBmd9Z.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0124.031] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\81ehNBmd9Z.gif", nBufferLength=0x27, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\81ehNBmd9Z.gif", lpFilePart=0x0) returned 0x26 [0124.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0124.031] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\81ehNBmd9Z.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\81ehnbmd9z.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0124.033] GetFileType (hFile=0x37c) returned 0x1 [0124.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0124.033] GetFileType (hFile=0x37c) returned 0x1 [0124.036] ReadFile (in: hFile=0x37c, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec98*=0x6d8f, lpOverlapped=0x0) returned 1 [0124.072] WriteFile (in: hFile=0x40c, lpBuffer=0x2776b64*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x2776b64*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0124.073] WriteFile (in: hFile=0x40c, lpBuffer=0x2779034*, nNumberOfBytesToWrite=0x5da0, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x2779034*, lpNumberOfBytesWritten=0x8fec70*=0x5da0, lpOverlapped=0x0) returned 1 [0124.074] ReadFile (in: hFile=0x37c, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0124.074] CloseHandle (hObject=0x37c) returned 1 [0124.074] WriteFile (in: hFile=0x40c, lpBuffer=0x2776b64*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x2776b64*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0124.075] CloseHandle (hObject=0x40c) returned 1 [0124.077] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\81ehNBmd9Z.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0124.077] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\81ehNBmd9Z.gif", nBufferLength=0x27, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\81ehNBmd9Z.gif", lpFilePart=0x0) returned 0x26 [0124.077] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\81ehNBmd9Z.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\81ehnbmd9z.gif")) returned 1 [0124.080] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\98v1-HRDDxHlpd.mp3.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0124.080] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\98v1-HRDDxHlpd.mp3.locked", nBufferLength=0x32, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\98v1-HRDDxHlpd.mp3.locked", lpFilePart=0x0) returned 0x31 [0124.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0124.081] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\98v1-HRDDxHlpd.mp3.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\98v1-hrddxhlpd.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0124.081] GetFileType (hFile=0x40c) returned 0x1 [0124.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0124.081] GetFileType (hFile=0x40c) returned 0x1 [0125.824] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\98v1-HRDDxHlpd.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0125.824] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\98v1-HRDDxHlpd.mp3", nBufferLength=0x2b, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\98v1-HRDDxHlpd.mp3", lpFilePart=0x0) returned 0x2a [0125.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0125.824] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\98v1-HRDDxHlpd.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\98v1-hrddxhlpd.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0125.824] GetFileType (hFile=0x37c) returned 0x1 [0125.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0125.824] GetFileType (hFile=0x37c) returned 0x1 [0125.828] ReadFile (in: hFile=0x37c, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8fec98*=0x12a6e, lpOverlapped=0x0) returned 1 [0125.908] WriteFile (in: hFile=0x40c, lpBuffer=0x2861830*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x2861830*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0125.910] WriteFile (in: hFile=0x40c, lpBuffer=0x2863d08*, nNumberOfBytesToWrite=0x11a80, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x2863d08*, lpNumberOfBytesWritten=0x8fec70*=0x11a80, lpOverlapped=0x0) returned 1 [0125.912] ReadFile (in: hFile=0x37c, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0125.912] CloseHandle (hObject=0x37c) returned 1 [0125.912] WriteFile (in: hFile=0x40c, lpBuffer=0x2861830*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x2861830*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0125.912] CloseHandle (hObject=0x40c) returned 1 [0125.922] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\98v1-HRDDxHlpd.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0125.922] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\98v1-HRDDxHlpd.mp3", nBufferLength=0x2b, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\98v1-HRDDxHlpd.mp3", lpFilePart=0x0) returned 0x2a [0125.922] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\98v1-HRDDxHlpd.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\98v1-hrddxhlpd.mp3")) returned 1 [0126.008] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\9NHojs4KGpHZ2tK_mr.wav.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0126.009] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\9NHojs4KGpHZ2tK_mr.wav.locked", nBufferLength=0x36, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\9NHojs4KGpHZ2tK_mr.wav.locked", lpFilePart=0x0) returned 0x35 [0126.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0126.009] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9NHojs4KGpHZ2tK_mr.wav.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\9nhojs4kgphz2tk_mr.wav.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0126.056] GetFileType (hFile=0x40c) returned 0x1 [0126.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0126.056] GetFileType (hFile=0x40c) returned 0x1 [0129.222] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\9NHojs4KGpHZ2tK_mr.wav", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0129.222] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\9NHojs4KGpHZ2tK_mr.wav", nBufferLength=0x2f, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\9NHojs4KGpHZ2tK_mr.wav", lpFilePart=0x0) returned 0x2e [0129.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0129.222] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9NHojs4KGpHZ2tK_mr.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\9nhojs4kgphz2tk_mr.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.223] GetFileType (hFile=0x37c) returned 0x1 [0129.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0129.223] GetFileType (hFile=0x37c) returned 0x1 [0129.227] ReadFile (in: hFile=0x37c, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0x1ed8, lpOverlapped=0x0) returned 1 [0129.315] WriteFile (in: hFile=0x40c, lpBuffer=0x2753650*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x2753650*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0129.318] ReadFile (in: hFile=0x37c, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0129.318] CloseHandle (hObject=0x37c) returned 1 [0129.318] WriteFile (in: hFile=0x40c, lpBuffer=0x2753650*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x2753650*, lpNumberOfBytesWritten=0x8fec38*=0xf00, lpOverlapped=0x0) returned 1 [0129.319] CloseHandle (hObject=0x40c) returned 1 [0129.414] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\9NHojs4KGpHZ2tK_mr.wav", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0129.414] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\9NHojs4KGpHZ2tK_mr.wav", nBufferLength=0x2f, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\9NHojs4KGpHZ2tK_mr.wav", lpFilePart=0x0) returned 0x2e [0129.414] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9NHojs4KGpHZ2tK_mr.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\9nhojs4kgphz2tk_mr.wav")) returned 1 [0129.456] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\B2wxCWV NeK.jpg.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0129.457] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\B2wxCWV NeK.jpg.locked", nBufferLength=0x2f, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\B2wxCWV NeK.jpg.locked", lpFilePart=0x0) returned 0x2e [0129.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0129.457] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\B2wxCWV NeK.jpg.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\b2wxcwv nek.jpg.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0129.503] GetFileType (hFile=0x40c) returned 0x1 [0129.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0129.503] GetFileType (hFile=0x40c) returned 0x1 [0132.710] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\B2wxCWV NeK.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0132.710] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\B2wxCWV NeK.jpg", nBufferLength=0x28, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\B2wxCWV NeK.jpg", lpFilePart=0x0) returned 0x27 [0132.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0132.710] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\B2wxCWV NeK.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\b2wxcwv nek.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0132.711] GetFileType (hFile=0x37c) returned 0x1 [0132.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0132.711] GetFileType (hFile=0x37c) returned 0x1 [0132.714] ReadFile (in: hFile=0x37c, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec98*=0x1614a, lpOverlapped=0x0) returned 1 [0132.734] WriteFile (in: hFile=0x40c, lpBuffer=0x28395c4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x28395c4*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0132.784] WriteFile (in: hFile=0x40c, lpBuffer=0x386a4e8*, nNumberOfBytesToWrite=0x15160, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x386a4e8*, lpNumberOfBytesWritten=0x8fec70*=0x15160, lpOverlapped=0x0) returned 1 [0132.786] ReadFile (in: hFile=0x37c, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0132.786] CloseHandle (hObject=0x37c) returned 1 [0132.787] WriteFile (in: hFile=0x40c, lpBuffer=0x28395c4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x28395c4*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0132.787] CloseHandle (hObject=0x40c) returned 1 [0132.877] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\B2wxCWV NeK.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0132.877] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\B2wxCWV NeK.jpg", nBufferLength=0x28, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\B2wxCWV NeK.jpg", lpFilePart=0x0) returned 0x27 [0132.877] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\B2wxCWV NeK.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\b2wxcwv nek.jpg")) returned 1 [0132.925] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\bexMIcYLR.mp4.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0132.925] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\bexMIcYLR.mp4.locked", nBufferLength=0x2d, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\bexMIcYLR.mp4.locked", lpFilePart=0x0) returned 0x2c [0132.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0132.926] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\bexMIcYLR.mp4.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\bexmicylr.mp4.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0132.926] GetFileType (hFile=0x40c) returned 0x1 [0132.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0132.926] GetFileType (hFile=0x40c) returned 0x1 [0136.073] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\bexMIcYLR.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0136.073] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\bexMIcYLR.mp4", nBufferLength=0x26, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\bexMIcYLR.mp4", lpFilePart=0x0) returned 0x25 [0136.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0136.073] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\bexMIcYLR.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\bexmicylr.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0136.075] GetFileType (hFile=0x37c) returned 0x1 [0136.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0136.075] GetFileType (hFile=0x37c) returned 0x1 [0136.078] ReadFile (in: hFile=0x37c, lpBuffer=0x387f668, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x387f668*, lpNumberOfBytesRead=0x8fec98*=0xdee5, lpOverlapped=0x0) returned 1 [0136.142] WriteFile (in: hFile=0x40c, lpBuffer=0x271d774*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x271d774*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0136.144] WriteFile (in: hFile=0x40c, lpBuffer=0x271fc40*, nNumberOfBytesToWrite=0xcf00, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x271fc40*, lpNumberOfBytesWritten=0x8fec70*=0xcf00, lpOverlapped=0x0) returned 1 [0136.145] ReadFile (in: hFile=0x37c, lpBuffer=0x387f668, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x387f668*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0136.146] CloseHandle (hObject=0x37c) returned 1 [0136.146] WriteFile (in: hFile=0x40c, lpBuffer=0x271d774*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x271d774*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0136.146] CloseHandle (hObject=0x40c) returned 1 [0136.194] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\bexMIcYLR.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0136.194] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\bexMIcYLR.mp4", nBufferLength=0x26, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\bexMIcYLR.mp4", lpFilePart=0x0) returned 0x25 [0136.194] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\bexMIcYLR.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\bexmicylr.mp4")) returned 1 [0136.246] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\deJdal_h-Ghz1S-rp.wav.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0136.246] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\deJdal_h-Ghz1S-rp.wav.locked", nBufferLength=0x35, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\deJdal_h-Ghz1S-rp.wav.locked", lpFilePart=0x0) returned 0x34 [0136.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0136.246] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\deJdal_h-Ghz1S-rp.wav.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\dejdal_h-ghz1s-rp.wav.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0136.288] GetFileType (hFile=0x40c) returned 0x1 [0136.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0136.288] GetFileType (hFile=0x40c) returned 0x1 [0140.178] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\deJdal_h-Ghz1S-rp.wav", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0140.179] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\deJdal_h-Ghz1S-rp.wav", nBufferLength=0x2e, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\deJdal_h-Ghz1S-rp.wav", lpFilePart=0x0) returned 0x2d [0140.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0140.179] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\deJdal_h-Ghz1S-rp.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\dejdal_h-ghz1s-rp.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0140.181] GetFileType (hFile=0x37c) returned 0x1 [0140.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0140.181] GetFileType (hFile=0x37c) returned 0x1 [0140.233] ReadFile (in: hFile=0x37c, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0x8cf5, lpOverlapped=0x0) returned 1 [0140.248] WriteFile (in: hFile=0x40c, lpBuffer=0x280a848*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x280a848*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0140.250] WriteFile (in: hFile=0x40c, lpBuffer=0x280cd24*, nNumberOfBytesToWrite=0x7d10, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x280cd24*, lpNumberOfBytesWritten=0x8fec70*=0x7d10, lpOverlapped=0x0) returned 1 [0140.250] ReadFile (in: hFile=0x37c, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0140.251] CloseHandle (hObject=0x37c) returned 1 [0140.251] WriteFile (in: hFile=0x40c, lpBuffer=0x280a848*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x280a848*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0140.251] CloseHandle (hObject=0x40c) returned 1 [0140.373] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\deJdal_h-Ghz1S-rp.wav", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0140.402] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\deJdal_h-Ghz1S-rp.wav", nBufferLength=0x2e, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\deJdal_h-Ghz1S-rp.wav", lpFilePart=0x0) returned 0x2d [0140.402] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\deJdal_h-Ghz1S-rp.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\dejdal_h-ghz1s-rp.wav")) returned 1 [0140.795] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0140.795] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini.locked", nBufferLength=0x2b, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\desktop.ini.locked", lpFilePart=0x0) returned 0x2a [0140.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0140.795] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.ini.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0140.796] GetFileType (hFile=0x40c) returned 0x1 [0140.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0140.796] GetFileType (hFile=0x40c) returned 0x1 [0144.569] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0144.569] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", nBufferLength=0x24, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", lpFilePart=0x0) returned 0x23 [0144.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0144.569] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0144.570] GetFileType (hFile=0x37c) returned 0x1 [0144.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0144.570] GetFileType (hFile=0x37c) returned 0x1 [0144.573] ReadFile (in: hFile=0x37c, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec98*=0x11a, lpOverlapped=0x0) returned 1 [0144.728] ReadFile (in: hFile=0x37c, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0144.729] CloseHandle (hObject=0x37c) returned 1 [0144.730] WriteFile (in: hFile=0x40c, lpBuffer=0x26f77f8*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x26f77f8*, lpNumberOfBytesWritten=0x8fec38*=0x140, lpOverlapped=0x0) returned 1 [0144.732] CloseHandle (hObject=0x40c) returned 1 [0144.892] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0144.892] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", nBufferLength=0x24, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", lpFilePart=0x0) returned 0x23 [0144.892] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.ini")) returned 1 [0144.940] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GR3hVa_lqJKuzZUW.png.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0144.940] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GR3hVa_lqJKuzZUW.png.locked", nBufferLength=0x34, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\GR3hVa_lqJKuzZUW.png.locked", lpFilePart=0x0) returned 0x33 [0144.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0144.940] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\GR3hVa_lqJKuzZUW.png.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\gr3hva_lqjkuzzuw.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0144.985] GetFileType (hFile=0x40c) returned 0x1 [0144.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0144.986] GetFileType (hFile=0x40c) returned 0x1 [0148.309] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GR3hVa_lqJKuzZUW.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0148.309] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GR3hVa_lqJKuzZUW.png", nBufferLength=0x2d, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\GR3hVa_lqJKuzZUW.png", lpFilePart=0x0) returned 0x2c [0148.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0148.309] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\GR3hVa_lqJKuzZUW.png" (normalized: "c:\\users\\fd1hvy\\desktop\\gr3hva_lqjkuzzuw.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0148.311] GetFileType (hFile=0x37c) returned 0x1 [0148.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0148.311] GetFileType (hFile=0x37c) returned 0x1 [0148.314] ReadFile (in: hFile=0x37c, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8fec98*=0x165ec, lpOverlapped=0x0) returned 1 [0148.401] WriteFile (in: hFile=0x40c, lpBuffer=0x269d1b8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x269d1b8*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0148.404] WriteFile (in: hFile=0x40c, lpBuffer=0x366a4a8*, nNumberOfBytesToWrite=0x15600, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x366a4a8*, lpNumberOfBytesWritten=0x8fec70*=0x15600, lpOverlapped=0x0) returned 1 [0148.407] ReadFile (in: hFile=0x37c, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0148.407] CloseHandle (hObject=0x37c) returned 1 [0148.407] WriteFile (in: hFile=0x40c, lpBuffer=0x269d1b8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x269d1b8*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0148.408] CloseHandle (hObject=0x40c) returned 1 [0148.413] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GR3hVa_lqJKuzZUW.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0148.413] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GR3hVa_lqJKuzZUW.png", nBufferLength=0x2d, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\GR3hVa_lqJKuzZUW.png", lpFilePart=0x0) returned 0x2c [0148.413] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\GR3hVa_lqJKuzZUW.png" (normalized: "c:\\users\\fd1hvy\\desktop\\gr3hva_lqjkuzzuw.png")) returned 1 [0148.418] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\H5QT5PzwoFrPt.mkv.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0148.418] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\H5QT5PzwoFrPt.mkv.locked", nBufferLength=0x31, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\H5QT5PzwoFrPt.mkv.locked", lpFilePart=0x0) returned 0x30 [0148.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0148.418] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\H5QT5PzwoFrPt.mkv.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\h5qt5pzwofrpt.mkv.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0148.419] GetFileType (hFile=0x40c) returned 0x1 [0148.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0148.419] GetFileType (hFile=0x40c) returned 0x1 [0152.327] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\H5QT5PzwoFrPt.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0152.327] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\H5QT5PzwoFrPt.mkv", nBufferLength=0x2a, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\H5QT5PzwoFrPt.mkv", lpFilePart=0x0) returned 0x29 [0152.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0152.327] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\H5QT5PzwoFrPt.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\h5qt5pzwofrpt.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0152.330] GetFileType (hFile=0x37c) returned 0x1 [0152.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0152.330] GetFileType (hFile=0x37c) returned 0x1 [0152.334] ReadFile (in: hFile=0x37c, lpBuffer=0x367fac8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x367fac8*, lpNumberOfBytesRead=0x8fec98*=0xc460, lpOverlapped=0x0) returned 1 [0152.338] WriteFile (in: hFile=0x40c, lpBuffer=0x27803f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x27803f0*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0152.366] WriteFile (in: hFile=0x40c, lpBuffer=0x27828c4*, nNumberOfBytesToWrite=0xb480, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x27828c4*, lpNumberOfBytesWritten=0x8fec70*=0xb480, lpOverlapped=0x0) returned 1 [0152.367] ReadFile (in: hFile=0x37c, lpBuffer=0x367fac8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x367fac8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0152.368] CloseHandle (hObject=0x37c) returned 1 [0152.368] WriteFile (in: hFile=0x40c, lpBuffer=0x27803f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x27803f0*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0152.368] CloseHandle (hObject=0x40c) returned 1 [0152.373] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\H5QT5PzwoFrPt.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0152.373] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\H5QT5PzwoFrPt.mkv", nBufferLength=0x2a, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\H5QT5PzwoFrPt.mkv", lpFilePart=0x0) returned 0x29 [0152.374] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\H5QT5PzwoFrPt.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\h5qt5pzwofrpt.mkv")) returned 1 [0152.499] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hnsTMu6MY8bIRoaE.odp.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0152.500] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hnsTMu6MY8bIRoaE.odp.locked", nBufferLength=0x34, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\hnsTMu6MY8bIRoaE.odp.locked", lpFilePart=0x0) returned 0x33 [0152.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0152.500] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\hnsTMu6MY8bIRoaE.odp.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\hnstmu6my8biroae.odp.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0152.501] GetFileType (hFile=0x40c) returned 0x1 [0152.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0152.501] GetFileType (hFile=0x40c) returned 0x1 [0155.695] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hnsTMu6MY8bIRoaE.odp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0155.695] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hnsTMu6MY8bIRoaE.odp", nBufferLength=0x2d, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\hnsTMu6MY8bIRoaE.odp", lpFilePart=0x0) returned 0x2c [0155.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0155.695] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\hnsTMu6MY8bIRoaE.odp" (normalized: "c:\\users\\fd1hvy\\desktop\\hnstmu6my8biroae.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0155.696] GetFileType (hFile=0x37c) returned 0x1 [0155.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0155.697] GetFileType (hFile=0x37c) returned 0x1 [0155.700] ReadFile (in: hFile=0x37c, lpBuffer=0x3969528, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3969528*, lpNumberOfBytesRead=0x8fec98*=0x18248, lpOverlapped=0x0) returned 1 [0155.718] WriteFile (in: hFile=0x40c, lpBuffer=0x2870d30*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x2870d30*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0155.786] WriteFile (in: hFile=0x40c, lpBuffer=0x3780ac8*, nNumberOfBytesToWrite=0x17260, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x3780ac8*, lpNumberOfBytesWritten=0x8fec70*=0x17260, lpOverlapped=0x0) returned 1 [0155.788] ReadFile (in: hFile=0x37c, lpBuffer=0x3969528, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3969528*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0155.788] CloseHandle (hObject=0x37c) returned 1 [0155.788] WriteFile (in: hFile=0x40c, lpBuffer=0x2870d30*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x2870d30*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0155.789] CloseHandle (hObject=0x40c) returned 1 [0155.845] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hnsTMu6MY8bIRoaE.odp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0155.845] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hnsTMu6MY8bIRoaE.odp", nBufferLength=0x2d, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\hnsTMu6MY8bIRoaE.odp", lpFilePart=0x0) returned 0x2c [0155.845] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\hnsTMu6MY8bIRoaE.odp" (normalized: "c:\\users\\fd1hvy\\desktop\\hnstmu6my8biroae.odp")) returned 1 [0156.102] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\iwt0UXy_6j83u_hYrR4k.mkv.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0156.102] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\iwt0UXy_6j83u_hYrR4k.mkv.locked", nBufferLength=0x38, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\iwt0UXy_6j83u_hYrR4k.mkv.locked", lpFilePart=0x0) returned 0x37 [0156.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0156.102] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\iwt0UXy_6j83u_hYrR4k.mkv.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\iwt0uxy_6j83u_hyrr4k.mkv.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0156.153] GetFileType (hFile=0x40c) returned 0x1 [0156.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0156.153] GetFileType (hFile=0x40c) returned 0x1 [0159.678] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\iwt0UXy_6j83u_hYrR4k.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0159.678] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\iwt0UXy_6j83u_hYrR4k.mkv", nBufferLength=0x31, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\iwt0UXy_6j83u_hYrR4k.mkv", lpFilePart=0x0) returned 0x30 [0159.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0159.678] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\iwt0UXy_6j83u_hYrR4k.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\iwt0uxy_6j83u_hyrr4k.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0159.679] GetFileType (hFile=0x37c) returned 0x1 [0159.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0159.679] GetFileType (hFile=0x37c) returned 0x1 [0159.682] ReadFile (in: hFile=0x37c, lpBuffer=0x3a69548, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3a69548*, lpNumberOfBytesRead=0x8fec98*=0x16e1b, lpOverlapped=0x0) returned 1 [0159.838] WriteFile (in: hFile=0x40c, lpBuffer=0x27514f4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x27514f4*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0159.840] WriteFile (in: hFile=0x40c, lpBuffer=0x3798d28*, nNumberOfBytesToWrite=0x15e30, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x3798d28*, lpNumberOfBytesWritten=0x8fec70*=0x15e30, lpOverlapped=0x0) returned 1 [0159.842] ReadFile (in: hFile=0x37c, lpBuffer=0x3a69548, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3a69548*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0159.842] CloseHandle (hObject=0x37c) returned 1 [0159.842] WriteFile (in: hFile=0x40c, lpBuffer=0x27514f4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x27514f4*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0159.843] CloseHandle (hObject=0x40c) returned 1 [0159.846] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\iwt0UXy_6j83u_hYrR4k.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0159.846] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\iwt0UXy_6j83u_hYrR4k.mkv", nBufferLength=0x31, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\iwt0UXy_6j83u_hYrR4k.mkv", lpFilePart=0x0) returned 0x30 [0159.846] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\iwt0UXy_6j83u_hYrR4k.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\iwt0uxy_6j83u_hyrr4k.mkv")) returned 1 [0159.850] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mvD4wSfuIQXQzOdec.png.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0159.850] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mvD4wSfuIQXQzOdec.png.locked", nBufferLength=0x35, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\mvD4wSfuIQXQzOdec.png.locked", lpFilePart=0x0) returned 0x34 [0159.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0159.850] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\mvD4wSfuIQXQzOdec.png.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\mvd4wsfuiqxqzodec.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0159.851] GetFileType (hFile=0x40c) returned 0x1 [0159.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0159.851] GetFileType (hFile=0x40c) returned 0x1 [0163.359] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mvD4wSfuIQXQzOdec.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0163.359] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mvD4wSfuIQXQzOdec.png", nBufferLength=0x2e, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\mvD4wSfuIQXQzOdec.png", lpFilePart=0x0) returned 0x2d [0163.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0163.361] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\mvD4wSfuIQXQzOdec.png" (normalized: "c:\\users\\fd1hvy\\desktop\\mvd4wsfuiqxqzodec.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0163.363] GetFileType (hFile=0x37c) returned 0x1 [0163.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0163.363] GetFileType (hFile=0x37c) returned 0x1 [0163.370] ReadFile (in: hFile=0x37c, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0x30ea, lpOverlapped=0x0) returned 1 [0163.372] WriteFile (in: hFile=0x40c, lpBuffer=0x2835184*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x2835184*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0164.541] WriteFile (in: hFile=0x40c, lpBuffer=0x2837660*, nNumberOfBytesToWrite=0x2100, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x2837660*, lpNumberOfBytesWritten=0x8fec70*=0x2100, lpOverlapped=0x0) returned 1 [0164.542] ReadFile (in: hFile=0x37c, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0164.543] CloseHandle (hObject=0x37c) returned 1 [0164.543] WriteFile (in: hFile=0x40c, lpBuffer=0x2835184*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x2835184*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0164.543] CloseHandle (hObject=0x40c) returned 1 [0164.650] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mvD4wSfuIQXQzOdec.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0164.650] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mvD4wSfuIQXQzOdec.png", nBufferLength=0x2e, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\mvD4wSfuIQXQzOdec.png", lpFilePart=0x0) returned 0x2d [0164.650] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\mvD4wSfuIQXQzOdec.png" (normalized: "c:\\users\\fd1hvy\\desktop\\mvd4wsfuiqxqzodec.png")) returned 1 [0164.654] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ovj WB7PmlGqC6pw.png.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0164.654] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ovj WB7PmlGqC6pw.png.locked", nBufferLength=0x34, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ovj WB7PmlGqC6pw.png.locked", lpFilePart=0x0) returned 0x33 [0164.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0164.654] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ovj WB7PmlGqC6pw.png.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\ovj wb7pmlgqc6pw.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0164.655] GetFileType (hFile=0x40c) returned 0x1 [0164.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0164.655] GetFileType (hFile=0x40c) returned 0x1 [0168.259] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ovj WB7PmlGqC6pw.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0168.260] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ovj WB7PmlGqC6pw.png", nBufferLength=0x2d, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ovj WB7PmlGqC6pw.png", lpFilePart=0x0) returned 0x2c [0168.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0168.260] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ovj WB7PmlGqC6pw.png" (normalized: "c:\\users\\fd1hvy\\desktop\\ovj wb7pmlgqc6pw.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0168.261] GetFileType (hFile=0x37c) returned 0x1 [0168.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0168.261] GetFileType (hFile=0x37c) returned 0x1 [0168.267] ReadFile (in: hFile=0x37c, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec98*=0x12d41, lpOverlapped=0x0) returned 1 [0168.272] WriteFile (in: hFile=0x40c, lpBuffer=0x271c878*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x271c878*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0168.274] WriteFile (in: hFile=0x40c, lpBuffer=0x271ed54*, nNumberOfBytesToWrite=0x11d60, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x271ed54*, lpNumberOfBytesWritten=0x8fec70*=0x11d60, lpOverlapped=0x0) returned 1 [0168.275] ReadFile (in: hFile=0x37c, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0168.275] CloseHandle (hObject=0x37c) returned 1 [0168.276] WriteFile (in: hFile=0x40c, lpBuffer=0x271c878*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x271c878*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0168.276] CloseHandle (hObject=0x40c) returned 1 [0168.329] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ovj WB7PmlGqC6pw.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0168.329] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ovj WB7PmlGqC6pw.png", nBufferLength=0x2d, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ovj WB7PmlGqC6pw.png", lpFilePart=0x0) returned 0x2c [0168.329] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ovj WB7PmlGqC6pw.png" (normalized: "c:\\users\\fd1hvy\\desktop\\ovj wb7pmlgqc6pw.png")) returned 1 [0168.381] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\pc9Z7XSZsXrvfp8OiIsA.bmp.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0168.381] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\pc9Z7XSZsXrvfp8OiIsA.bmp.locked", nBufferLength=0x38, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\pc9Z7XSZsXrvfp8OiIsA.bmp.locked", lpFilePart=0x0) returned 0x37 [0168.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0168.381] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\pc9Z7XSZsXrvfp8OiIsA.bmp.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\pc9z7xszsxrvfp8oiisa.bmp.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0168.473] GetFileType (hFile=0x40c) returned 0x1 [0168.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0168.473] GetFileType (hFile=0x40c) returned 0x1 [0170.335] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\pc9Z7XSZsXrvfp8OiIsA.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0170.335] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\pc9Z7XSZsXrvfp8OiIsA.bmp", nBufferLength=0x31, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\pc9Z7XSZsXrvfp8OiIsA.bmp", lpFilePart=0x0) returned 0x30 [0170.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0170.335] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\pc9Z7XSZsXrvfp8OiIsA.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\pc9z7xszsxrvfp8oiisa.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0170.336] GetFileType (hFile=0x37c) returned 0x1 [0170.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0170.336] GetFileType (hFile=0x37c) returned 0x1 [0170.341] ReadFile (in: hFile=0x37c, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8fec98*=0x18bac, lpOverlapped=0x0) returned 1 [0170.441] WriteFile (in: hFile=0x40c, lpBuffer=0x280e97c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x280e97c*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0170.454] WriteFile (in: hFile=0x40c, lpBuffer=0x366a4a8*, nNumberOfBytesToWrite=0x17bc0, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x366a4a8*, lpNumberOfBytesWritten=0x8fec70*=0x17bc0, lpOverlapped=0x0) returned 1 [0170.489] ReadFile (in: hFile=0x37c, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0170.492] CloseHandle (hObject=0x37c) returned 1 [0170.492] WriteFile (in: hFile=0x40c, lpBuffer=0x280e97c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x280e97c*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0170.492] CloseHandle (hObject=0x40c) returned 1 [0170.496] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\pc9Z7XSZsXrvfp8OiIsA.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0170.496] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\pc9Z7XSZsXrvfp8OiIsA.bmp", nBufferLength=0x31, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\pc9Z7XSZsXrvfp8OiIsA.bmp", lpFilePart=0x0) returned 0x30 [0170.497] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\pc9Z7XSZsXrvfp8OiIsA.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\pc9z7xszsxrvfp8oiisa.bmp")) returned 1 [0170.501] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\QZTvCz0FFAxSe0OXTZ.m4a.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0170.501] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\QZTvCz0FFAxSe0OXTZ.m4a.locked", nBufferLength=0x36, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\QZTvCz0FFAxSe0OXTZ.m4a.locked", lpFilePart=0x0) returned 0x35 [0170.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0170.501] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\QZTvCz0FFAxSe0OXTZ.m4a.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\qztvcz0ffaxse0oxtz.m4a.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0170.502] GetFileType (hFile=0x40c) returned 0x1 [0170.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0170.502] GetFileType (hFile=0x40c) returned 0x1 [0172.786] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\QZTvCz0FFAxSe0OXTZ.m4a", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0172.786] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\QZTvCz0FFAxSe0OXTZ.m4a", nBufferLength=0x2f, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\QZTvCz0FFAxSe0OXTZ.m4a", lpFilePart=0x0) returned 0x2e [0172.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0172.786] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\QZTvCz0FFAxSe0OXTZ.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\qztvcz0ffaxse0oxtz.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0172.830] GetFileType (hFile=0x37c) returned 0x1 [0172.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0172.830] GetFileType (hFile=0x37c) returned 0x1 [0172.861] ReadFile (in: hFile=0x37c, lpBuffer=0x3682088, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3682088*, lpNumberOfBytesRead=0x8fec98*=0x1037b, lpOverlapped=0x0) returned 1 [0172.912] WriteFile (in: hFile=0x40c, lpBuffer=0x26f5014*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x26f5014*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0172.913] WriteFile (in: hFile=0x40c, lpBuffer=0x26f74f4*, nNumberOfBytesToWrite=0xf390, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x26f74f4*, lpNumberOfBytesWritten=0x8fec70*=0xf390, lpOverlapped=0x0) returned 1 [0172.915] ReadFile (in: hFile=0x37c, lpBuffer=0x3682088, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3682088*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0172.915] CloseHandle (hObject=0x37c) returned 1 [0172.916] WriteFile (in: hFile=0x40c, lpBuffer=0x26f5014*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x26f5014*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0172.916] CloseHandle (hObject=0x40c) returned 1 [0172.920] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\QZTvCz0FFAxSe0OXTZ.m4a", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0172.920] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\QZTvCz0FFAxSe0OXTZ.m4a", nBufferLength=0x2f, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\QZTvCz0FFAxSe0OXTZ.m4a", lpFilePart=0x0) returned 0x2e [0172.920] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\QZTvCz0FFAxSe0OXTZ.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\qztvcz0ffaxse0oxtz.m4a")) returned 1 [0172.925] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Sb23DHgVHWLDZ3K.bmp.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0172.925] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Sb23DHgVHWLDZ3K.bmp.locked", nBufferLength=0x33, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Sb23DHgVHWLDZ3K.bmp.locked", lpFilePart=0x0) returned 0x32 [0172.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0172.925] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Sb23DHgVHWLDZ3K.bmp.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\sb23dhgvhwldz3k.bmp.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0172.926] GetFileType (hFile=0x40c) returned 0x1 [0172.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0172.926] GetFileType (hFile=0x40c) returned 0x1 [0174.280] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Sb23DHgVHWLDZ3K.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0174.280] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Sb23DHgVHWLDZ3K.bmp", nBufferLength=0x2c, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Sb23DHgVHWLDZ3K.bmp", lpFilePart=0x0) returned 0x2b [0174.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0174.280] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Sb23DHgVHWLDZ3K.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\sb23dhgvhwldz3k.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0174.281] GetFileType (hFile=0x37c) returned 0x1 [0174.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0174.281] GetFileType (hFile=0x37c) returned 0x1 [0174.284] ReadFile (in: hFile=0x37c, lpBuffer=0x3969528, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3969528*, lpNumberOfBytesRead=0x8fec98*=0xfdf, lpOverlapped=0x0) returned 1 [0174.297] ReadFile (in: hFile=0x37c, lpBuffer=0x3969528, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3969528*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0174.297] CloseHandle (hObject=0x37c) returned 1 [0174.297] WriteFile (in: hFile=0x40c, lpBuffer=0x27e9cd4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x27e9cd4*, lpNumberOfBytesWritten=0x8fec38*=0x1000, lpOverlapped=0x0) returned 1 [0174.298] CloseHandle (hObject=0x40c) returned 1 [0174.299] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Sb23DHgVHWLDZ3K.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0174.299] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Sb23DHgVHWLDZ3K.bmp", nBufferLength=0x2c, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Sb23DHgVHWLDZ3K.bmp", lpFilePart=0x0) returned 0x2b [0174.300] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Sb23DHgVHWLDZ3K.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\sb23dhgvhwldz3k.bmp")) returned 1 [0174.337] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\sJF6kRBQM.mkv.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0174.337] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\sJF6kRBQM.mkv.locked", nBufferLength=0x2d, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\sJF6kRBQM.mkv.locked", lpFilePart=0x0) returned 0x2c [0174.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0174.337] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\sJF6kRBQM.mkv.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\sjf6krbqm.mkv.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0174.338] GetFileType (hFile=0x40c) returned 0x1 [0174.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0174.338] GetFileType (hFile=0x40c) returned 0x1 [0176.605] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\sJF6kRBQM.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0176.605] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\sJF6kRBQM.mkv", nBufferLength=0x26, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\sJF6kRBQM.mkv", lpFilePart=0x0) returned 0x25 [0176.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0176.605] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\sJF6kRBQM.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\sjf6krbqm.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0176.606] GetFileType (hFile=0x37c) returned 0x1 [0176.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0176.606] GetFileType (hFile=0x37c) returned 0x1 [0176.609] ReadFile (in: hFile=0x37c, lpBuffer=0x3a69548, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3a69548*, lpNumberOfBytesRead=0x8fec98*=0x3399, lpOverlapped=0x0) returned 1 [0176.622] WriteFile (in: hFile=0x40c, lpBuffer=0x26cf6a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x26cf6a8*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0176.623] WriteFile (in: hFile=0x40c, lpBuffer=0x26d1b74*, nNumberOfBytesToWrite=0x23b0, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x26d1b74*, lpNumberOfBytesWritten=0x8fec70*=0x23b0, lpOverlapped=0x0) returned 1 [0176.623] ReadFile (in: hFile=0x37c, lpBuffer=0x3a69548, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3a69548*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0176.624] CloseHandle (hObject=0x37c) returned 1 [0176.624] WriteFile (in: hFile=0x40c, lpBuffer=0x26cf6a8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x26cf6a8*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0176.624] CloseHandle (hObject=0x40c) returned 1 [0176.633] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\sJF6kRBQM.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0176.633] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\sJF6kRBQM.mkv", nBufferLength=0x26, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\sJF6kRBQM.mkv", lpFilePart=0x0) returned 0x25 [0176.633] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\sJF6kRBQM.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\sjf6krbqm.mkv")) returned 1 [0176.639] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\sRzwd0uphFzOuRb.pps.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0176.639] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\sRzwd0uphFzOuRb.pps.locked", nBufferLength=0x33, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\sRzwd0uphFzOuRb.pps.locked", lpFilePart=0x0) returned 0x32 [0176.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0176.639] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\sRzwd0uphFzOuRb.pps.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\srzwd0uphfzourb.pps.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0176.639] GetFileType (hFile=0x40c) returned 0x1 [0176.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0176.639] GetFileType (hFile=0x40c) returned 0x1 [0178.490] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\sRzwd0uphFzOuRb.pps", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0178.490] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\sRzwd0uphFzOuRb.pps", nBufferLength=0x2c, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\sRzwd0uphFzOuRb.pps", lpFilePart=0x0) returned 0x2b [0178.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0178.490] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\sRzwd0uphFzOuRb.pps" (normalized: "c:\\users\\fd1hvy\\desktop\\srzwd0uphfzourb.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0178.491] GetFileType (hFile=0x37c) returned 0x1 [0178.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0178.491] GetFileType (hFile=0x37c) returned 0x1 [0178.503] ReadFile (in: hFile=0x37c, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0x10b07, lpOverlapped=0x0) returned 1 [0178.517] WriteFile (in: hFile=0x40c, lpBuffer=0x27b82c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x27b82c0*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0178.520] WriteFile (in: hFile=0x40c, lpBuffer=0x27ba798*, nNumberOfBytesToWrite=0xfb20, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x27ba798*, lpNumberOfBytesWritten=0x8fec70*=0xfb20, lpOverlapped=0x0) returned 1 [0178.521] ReadFile (in: hFile=0x37c, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0178.521] CloseHandle (hObject=0x37c) returned 1 [0178.521] WriteFile (in: hFile=0x40c, lpBuffer=0x27b82c0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x27b82c0*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0178.521] CloseHandle (hObject=0x40c) returned 1 [0178.524] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\sRzwd0uphFzOuRb.pps", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0178.524] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\sRzwd0uphFzOuRb.pps", nBufferLength=0x2c, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\sRzwd0uphFzOuRb.pps", lpFilePart=0x0) returned 0x2b [0178.524] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\sRzwd0uphFzOuRb.pps" (normalized: "c:\\users\\fd1hvy\\desktop\\srzwd0uphfzourb.pps")) returned 1 [0178.540] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\SzAqbDkPqXeoz.mp3.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0178.540] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\SzAqbDkPqXeoz.mp3.locked", nBufferLength=0x31, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\SzAqbDkPqXeoz.mp3.locked", lpFilePart=0x0) returned 0x30 [0178.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0178.540] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\SzAqbDkPqXeoz.mp3.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\szaqbdkpqxeoz.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0178.541] GetFileType (hFile=0x40c) returned 0x1 [0178.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0178.541] GetFileType (hFile=0x40c) returned 0x1 [0181.020] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\SzAqbDkPqXeoz.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0181.020] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\SzAqbDkPqXeoz.mp3", nBufferLength=0x2a, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\SzAqbDkPqXeoz.mp3", lpFilePart=0x0) returned 0x29 [0181.020] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0181.020] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\SzAqbDkPqXeoz.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\szaqbdkpqxeoz.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0181.021] GetFileType (hFile=0x37c) returned 0x1 [0181.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0181.022] GetFileType (hFile=0x37c) returned 0x1 [0181.025] ReadFile (in: hFile=0x37c, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec98*=0x51dd, lpOverlapped=0x0) returned 1 [0181.046] WriteFile (in: hFile=0x40c, lpBuffer=0x26ab908*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x26ab908*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0181.047] WriteFile (in: hFile=0x40c, lpBuffer=0x26adddc*, nNumberOfBytesToWrite=0x41f0, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x26adddc*, lpNumberOfBytesWritten=0x8fec70*=0x41f0, lpOverlapped=0x0) returned 1 [0181.048] ReadFile (in: hFile=0x37c, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0181.048] CloseHandle (hObject=0x37c) returned 1 [0181.048] WriteFile (in: hFile=0x40c, lpBuffer=0x26ab908*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x26ab908*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0181.049] CloseHandle (hObject=0x40c) returned 1 [0181.052] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\SzAqbDkPqXeoz.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0181.052] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\SzAqbDkPqXeoz.mp3", nBufferLength=0x2a, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\SzAqbDkPqXeoz.mp3", lpFilePart=0x0) returned 0x29 [0181.052] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\SzAqbDkPqXeoz.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\szaqbdkpqxeoz.mp3")) returned 1 [0181.063] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\T cE.m4a.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0181.064] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\T cE.m4a.locked", nBufferLength=0x28, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\T cE.m4a.locked", lpFilePart=0x0) returned 0x27 [0181.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0181.064] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\T cE.m4a.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\t ce.m4a.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0181.064] GetFileType (hFile=0x40c) returned 0x1 [0181.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0181.064] GetFileType (hFile=0x40c) returned 0x1 [0182.352] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\T cE.m4a", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x21 [0182.352] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\T cE.m4a", nBufferLength=0x21, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\T cE.m4a", lpFilePart=0x0) returned 0x20 [0182.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0182.352] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\T cE.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\t ce.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0182.353] GetFileType (hFile=0x37c) returned 0x1 [0182.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0182.353] GetFileType (hFile=0x37c) returned 0x1 [0182.356] ReadFile (in: hFile=0x37c, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8fec98*=0x26b9, lpOverlapped=0x0) returned 1 [0182.411] WriteFile (in: hFile=0x40c, lpBuffer=0x279366c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x279366c*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0182.413] WriteFile (in: hFile=0x40c, lpBuffer=0x2795b30*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x2795b30*, lpNumberOfBytesWritten=0x8fec70*=0x16d0, lpOverlapped=0x0) returned 1 [0182.414] ReadFile (in: hFile=0x37c, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0182.414] CloseHandle (hObject=0x37c) returned 1 [0182.414] WriteFile (in: hFile=0x40c, lpBuffer=0x279366c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x279366c*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0182.414] CloseHandle (hObject=0x40c) returned 1 [0182.416] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\T cE.m4a", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x21 [0182.416] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\T cE.m4a", nBufferLength=0x21, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\T cE.m4a", lpFilePart=0x0) returned 0x20 [0182.416] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\T cE.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\t ce.m4a")) returned 1 [0182.495] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tXLvK5sswGB-Igr7XE.mp3.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0182.495] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tXLvK5sswGB-Igr7XE.mp3.locked", nBufferLength=0x36, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tXLvK5sswGB-Igr7XE.mp3.locked", lpFilePart=0x0) returned 0x35 [0182.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0182.495] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tXLvK5sswGB-Igr7XE.mp3.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\txlvk5sswgb-igr7xe.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0182.495] GetFileType (hFile=0x40c) returned 0x1 [0182.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0182.496] GetFileType (hFile=0x40c) returned 0x1 [0184.809] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tXLvK5sswGB-Igr7XE.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0184.809] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tXLvK5sswGB-Igr7XE.mp3", nBufferLength=0x2f, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tXLvK5sswGB-Igr7XE.mp3", lpFilePart=0x0) returned 0x2e [0184.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0184.810] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tXLvK5sswGB-Igr7XE.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\txlvk5sswgb-igr7xe.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0184.810] GetFileType (hFile=0x37c) returned 0x1 [0184.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0184.810] GetFileType (hFile=0x37c) returned 0x1 [0184.813] ReadFile (in: hFile=0x37c, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0xfca1, lpOverlapped=0x0) returned 1 [0184.827] WriteFile (in: hFile=0x40c, lpBuffer=0x2870e1c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x2870e1c*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0184.828] WriteFile (in: hFile=0x40c, lpBuffer=0x28732fc*, nNumberOfBytesToWrite=0xecc0, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x28732fc*, lpNumberOfBytesWritten=0x8fec70*=0xecc0, lpOverlapped=0x0) returned 1 [0184.829] ReadFile (in: hFile=0x37c, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0184.829] CloseHandle (hObject=0x37c) returned 1 [0184.829] WriteFile (in: hFile=0x40c, lpBuffer=0x2870e1c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x2870e1c*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0184.830] CloseHandle (hObject=0x40c) returned 1 [0184.833] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tXLvK5sswGB-Igr7XE.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0184.833] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tXLvK5sswGB-Igr7XE.mp3", nBufferLength=0x2f, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tXLvK5sswGB-Igr7XE.mp3", lpFilePart=0x0) returned 0x2e [0184.833] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tXLvK5sswGB-Igr7XE.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\txlvk5sswgb-igr7xe.mp3")) returned 1 [0184.844] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\WindowsFormsApp1.exe.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0184.844] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\WindowsFormsApp1.exe.locked", nBufferLength=0x34, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\WindowsFormsApp1.exe.locked", lpFilePart=0x0) returned 0x33 [0184.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0184.844] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\WindowsFormsApp1.exe.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\windowsformsapp1.exe.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0184.845] GetFileType (hFile=0x40c) returned 0x1 [0184.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0184.845] GetFileType (hFile=0x40c) returned 0x1 [0186.305] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\WindowsFormsApp1.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0186.305] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\WindowsFormsApp1.exe", nBufferLength=0x2d, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\WindowsFormsApp1.exe", lpFilePart=0x0) returned 0x2c [0186.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0186.305] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\WindowsFormsApp1.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\windowsformsapp1.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0186.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fcf80) returned 1 [0186.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed6c) returned 1 [0186.453] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0186.453] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", nBufferLength=0x19, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures", lpFilePart=0x0) returned 0x18 [0186.453] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\*", lpFindFileData=0x8fea94 | out: lpFindFileData=0x8fea94*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe7505446, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe7505446, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9609c8 [0186.454] FindNextFileW (in: hFindFile=0x9609c8, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe7505446, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe7505446, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.454] FindNextFileW (in: hFindFile=0x9609c8, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x108d6b70, ftCreationTime.dwHighDateTime=0x1d5e439, ftLastAccessTime.dwLowDateTime=0x6c1a29c0, ftLastAccessTime.dwHighDateTime=0x1d5ed9d, ftLastWriteTime.dwLowDateTime=0x6c1a29c0, ftLastWriteTime.dwHighDateTime=0x1d5ed9d, nFileSizeHigh=0x0, nFileSizeLow=0xb65c, dwReserved0=0x0, dwReserved1=0x0, cFileName="09z5.gif", cAlternateFileName="")) returned 1 [0186.454] FindNextFileW (in: hFindFile=0x9609c8, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf3d8b0, ftCreationTime.dwHighDateTime=0x1d5e0ae, ftLastAccessTime.dwLowDateTime=0xd6c73ad0, ftLastAccessTime.dwHighDateTime=0x1d5e3be, ftLastWriteTime.dwLowDateTime=0xd6c73ad0, ftLastWriteTime.dwHighDateTime=0x1d5e3be, nFileSizeHigh=0x0, nFileSizeLow=0xf8b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7ClJZ0nxJQii.png", cAlternateFileName="7CLJZ0~1.PNG")) returned 1 [0186.454] FindNextFileW (in: hFindFile=0x9609c8, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0186.454] FindNextFileW (in: hFindFile=0x9609c8, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb75398f0, ftCreationTime.dwHighDateTime=0x1d5e5b8, ftLastAccessTime.dwLowDateTime=0x84f96e10, ftLastAccessTime.dwHighDateTime=0x1d5e19a, ftLastWriteTime.dwLowDateTime=0x84f96e10, ftLastWriteTime.dwHighDateTime=0x1d5e19a, nFileSizeHigh=0x0, nFileSizeLow=0xbba5, dwReserved0=0x0, dwReserved1=0x0, cFileName="D GyVgEwhaiN3vw7bFZ.bmp", cAlternateFileName="DGYVGE~1.BMP")) returned 1 [0186.454] FindNextFileW (in: hFindFile=0x9609c8, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44053085, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44053085, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0186.454] FindNextFileW (in: hFindFile=0x9609c8, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb899f990, ftCreationTime.dwHighDateTime=0x1d5ede5, ftLastAccessTime.dwLowDateTime=0xfd93cd60, ftLastAccessTime.dwHighDateTime=0x1d5e899, ftLastWriteTime.dwLowDateTime=0xfd93cd60, ftLastWriteTime.dwHighDateTime=0x1d5e899, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dHwEefAsn7xqd-", cAlternateFileName="DHWEEF~1")) returned 1 [0186.455] FindNextFileW (in: hFindFile=0x9609c8, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x879b4970, ftCreationTime.dwHighDateTime=0x1d5eb5b, ftLastAccessTime.dwLowDateTime=0x62428b90, ftLastAccessTime.dwHighDateTime=0x1d5ebf9, ftLastWriteTime.dwLowDateTime=0x62428b90, ftLastWriteTime.dwHighDateTime=0x1d5ebf9, nFileSizeHigh=0x0, nFileSizeLow=0x12d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gOdut.png", cAlternateFileName="")) returned 1 [0186.455] FindNextFileW (in: hFindFile=0x9609c8, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x137ff3e0, ftCreationTime.dwHighDateTime=0x1d5e4af, ftLastAccessTime.dwLowDateTime=0x29dbfec0, ftLastAccessTime.dwHighDateTime=0x1d5e59c, ftLastWriteTime.dwLowDateTime=0x29dbfec0, ftLastWriteTime.dwHighDateTime=0x1d5e59c, nFileSizeHigh=0x0, nFileSizeLow=0x3684, dwReserved0=0x0, dwReserved1=0x0, cFileName="JLcZQgq5.png", cAlternateFileName="")) returned 1 [0186.455] FindNextFileW (in: hFindFile=0x9609c8, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x341f3450, ftCreationTime.dwHighDateTime=0x1d5ea93, ftLastAccessTime.dwLowDateTime=0x4becc9f0, ftLastAccessTime.dwHighDateTime=0x1d5ec17, ftLastWriteTime.dwLowDateTime=0x4becc9f0, ftLastWriteTime.dwHighDateTime=0x1d5ec17, nFileSizeHigh=0x0, nFileSizeLow=0xd12, dwReserved0=0x0, dwReserved1=0x0, cFileName="JYS2lay-.png", cAlternateFileName="")) returned 1 [0186.455] FindNextFileW (in: hFindFile=0x9609c8, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa773c890, ftCreationTime.dwHighDateTime=0x1d5e7a9, ftLastAccessTime.dwLowDateTime=0x5a2d0bf0, ftLastAccessTime.dwHighDateTime=0x1d5e835, ftLastWriteTime.dwLowDateTime=0x5a2d0bf0, ftLastWriteTime.dwHighDateTime=0x1d5e835, nFileSizeHigh=0x0, nFileSizeLow=0xc1dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="NPX2Axr.png", cAlternateFileName="")) returned 1 [0186.466] FindNextFileW (in: hFindFile=0x9609c8, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cae5a40, ftCreationTime.dwHighDateTime=0x1d5ea45, ftLastAccessTime.dwLowDateTime=0x9d6afd20, ftLastAccessTime.dwHighDateTime=0x1d5ea77, ftLastWriteTime.dwLowDateTime=0x9d6afd20, ftLastWriteTime.dwHighDateTime=0x1d5ea77, nFileSizeHigh=0x0, nFileSizeLow=0xaade, dwReserved0=0x0, dwReserved1=0x0, cFileName="nrF1xa7I2tAH0TN6.png", cAlternateFileName="NRF1XA~1.PNG")) returned 1 [0186.466] FindNextFileW (in: hFindFile=0x9609c8, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0186.466] FindNextFileW (in: hFindFile=0x9609c8, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe320c0f0, ftCreationTime.dwHighDateTime=0x1d5ef7e, ftLastAccessTime.dwLowDateTime=0xb024b0e0, ftLastAccessTime.dwHighDateTime=0x1d5e767, ftLastWriteTime.dwLowDateTime=0xb024b0e0, ftLastWriteTime.dwHighDateTime=0x1d5e767, nFileSizeHigh=0x0, nFileSizeLow=0x1882b, dwReserved0=0x0, dwReserved1=0x0, cFileName="UZgVJPD-cJpA_4Gf.png", cAlternateFileName="UZGVJP~1.PNG")) returned 1 [0186.467] FindNextFileW (in: hFindFile=0x9609c8, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf84f9820, ftCreationTime.dwHighDateTime=0x1d5e583, ftLastAccessTime.dwLowDateTime=0xf21caca0, ftLastAccessTime.dwHighDateTime=0x1d5f090, ftLastWriteTime.dwLowDateTime=0xf21caca0, ftLastWriteTime.dwHighDateTime=0x1d5f090, nFileSizeHigh=0x0, nFileSizeLow=0xe2a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="VP-Vv.gif", cAlternateFileName="")) returned 1 [0186.467] FindNextFileW (in: hFindFile=0x9609c8, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0186.467] FindClose (in: hFindFile=0x9609c8 | out: hFindFile=0x9609c8) returned 1 [0186.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fed28) returned 1 [0186.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fed34) returned 1 [0186.468] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\09z5.gif.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0186.468] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\09z5.gif.locked", nBufferLength=0x29, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\09z5.gif.locked", lpFilePart=0x0) returned 0x28 [0186.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0186.468] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\09z5.gif.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\09z5.gif.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0186.470] GetFileType (hFile=0x37c) returned 0x1 [0186.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0186.470] GetFileType (hFile=0x37c) returned 0x1 [0187.764] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\09z5.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x22 [0187.764] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\09z5.gif", nBufferLength=0x22, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\09z5.gif", lpFilePart=0x0) returned 0x21 [0187.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0187.764] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\09z5.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\09z5.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x368 [0187.765] GetFileType (hFile=0x368) returned 0x1 [0187.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0187.765] GetFileType (hFile=0x368) returned 0x1 [0187.767] ReadFile (in: hFile=0x368, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec98*=0xb65c, lpOverlapped=0x0) returned 1 [0187.784] WriteFile (in: hFile=0x37c, lpBuffer=0x284e0b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x284e0b0*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0187.785] WriteFile (in: hFile=0x37c, lpBuffer=0x2850574*, nNumberOfBytesToWrite=0xa670, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x2850574*, lpNumberOfBytesWritten=0x8fec70*=0xa670, lpOverlapped=0x0) returned 1 [0187.786] ReadFile (in: hFile=0x368, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0187.787] CloseHandle (hObject=0x368) returned 1 [0187.787] WriteFile (in: hFile=0x37c, lpBuffer=0x284e0b0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x284e0b0*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0187.787] CloseHandle (hObject=0x37c) returned 1 [0187.789] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\09z5.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x22 [0187.789] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\09z5.gif", nBufferLength=0x22, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\09z5.gif", lpFilePart=0x0) returned 0x21 [0187.789] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\09z5.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\09z5.gif")) returned 1 [0187.803] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\7ClJZ0nxJQii.png.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0187.803] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\7ClJZ0nxJQii.png.locked", nBufferLength=0x31, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\7ClJZ0nxJQii.png.locked", lpFilePart=0x0) returned 0x30 [0187.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0187.803] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\7ClJZ0nxJQii.png.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\7cljz0nxjqii.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0187.804] GetFileType (hFile=0x37c) returned 0x1 [0187.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0187.804] GetFileType (hFile=0x37c) returned 0x1 [0189.247] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\7ClJZ0nxJQii.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0189.247] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\7ClJZ0nxJQii.png", nBufferLength=0x2a, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\7ClJZ0nxJQii.png", lpFilePart=0x0) returned 0x29 [0189.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0189.247] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\7ClJZ0nxJQii.png" (normalized: "c:\\users\\fd1hvy\\pictures\\7cljz0nxjqii.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x368 [0189.248] GetFileType (hFile=0x368) returned 0x1 [0189.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0189.248] GetFileType (hFile=0x368) returned 0x1 [0189.251] ReadFile (in: hFile=0x368, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8fec98*=0xf8b0, lpOverlapped=0x0) returned 1 [0189.266] WriteFile (in: hFile=0x37c, lpBuffer=0x273e4e0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x273e4e0*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0189.267] WriteFile (in: hFile=0x37c, lpBuffer=0x27409b4*, nNumberOfBytesToWrite=0xe8d0, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x27409b4*, lpNumberOfBytesWritten=0x8fec70*=0xe8d0, lpOverlapped=0x0) returned 1 [0189.268] ReadFile (in: hFile=0x368, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0189.268] CloseHandle (hObject=0x368) returned 1 [0189.272] WriteFile (in: hFile=0x37c, lpBuffer=0x273e4e0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x273e4e0*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0189.272] CloseHandle (hObject=0x37c) returned 1 [0189.275] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\7ClJZ0nxJQii.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0189.275] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\7ClJZ0nxJQii.png", nBufferLength=0x2a, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\7ClJZ0nxJQii.png", lpFilePart=0x0) returned 0x29 [0189.275] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\7ClJZ0nxJQii.png" (normalized: "c:\\users\\fd1hvy\\pictures\\7cljz0nxjqii.png")) returned 1 [0189.288] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\D GyVgEwhaiN3vw7bFZ.bmp.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0189.289] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\D GyVgEwhaiN3vw7bFZ.bmp.locked", nBufferLength=0x38, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\D GyVgEwhaiN3vw7bFZ.bmp.locked", lpFilePart=0x0) returned 0x37 [0189.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0189.289] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D GyVgEwhaiN3vw7bFZ.bmp.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\d gyvgewhain3vw7bfz.bmp.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0189.290] GetFileType (hFile=0x37c) returned 0x1 [0189.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0189.290] GetFileType (hFile=0x37c) returned 0x1 [0190.912] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\D GyVgEwhaiN3vw7bFZ.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0190.912] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\D GyVgEwhaiN3vw7bFZ.bmp", nBufferLength=0x31, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\D GyVgEwhaiN3vw7bFZ.bmp", lpFilePart=0x0) returned 0x30 [0190.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0190.912] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D GyVgEwhaiN3vw7bFZ.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\d gyvgewhain3vw7bfz.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0190.913] GetFileType (hFile=0x40c) returned 0x1 [0190.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0190.913] GetFileType (hFile=0x40c) returned 0x1 [0190.916] ReadFile (in: hFile=0x40c, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0xbba5, lpOverlapped=0x0) returned 1 [0190.929] WriteFile (in: hFile=0x37c, lpBuffer=0x282b57c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x282b57c*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0190.930] WriteFile (in: hFile=0x37c, lpBuffer=0x282da5c*, nNumberOfBytesToWrite=0xabc0, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x282da5c*, lpNumberOfBytesWritten=0x8fec70*=0xabc0, lpOverlapped=0x0) returned 1 [0190.931] ReadFile (in: hFile=0x40c, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0190.932] CloseHandle (hObject=0x40c) returned 1 [0190.932] WriteFile (in: hFile=0x37c, lpBuffer=0x282b57c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x282b57c*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0190.932] CloseHandle (hObject=0x37c) returned 1 [0190.934] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\D GyVgEwhaiN3vw7bFZ.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0190.934] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\D GyVgEwhaiN3vw7bFZ.bmp", nBufferLength=0x31, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\D GyVgEwhaiN3vw7bFZ.bmp", lpFilePart=0x0) returned 0x30 [0190.934] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D GyVgEwhaiN3vw7bFZ.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\d gyvgewhain3vw7bfz.bmp")) returned 1 [0190.977] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0190.977] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini.locked", nBufferLength=0x2c, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\desktop.ini.locked", lpFilePart=0x0) returned 0x2b [0190.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0190.977] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\desktop.ini.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0190.978] GetFileType (hFile=0x37c) returned 0x1 [0190.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0190.978] GetFileType (hFile=0x37c) returned 0x1 [0192.958] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0192.958] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", nBufferLength=0x25, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", lpFilePart=0x0) returned 0x24 [0192.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0192.958] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0192.959] GetFileType (hFile=0x40c) returned 0x1 [0192.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0192.959] GetFileType (hFile=0x40c) returned 0x1 [0192.963] ReadFile (in: hFile=0x40c, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec98*=0x1f8, lpOverlapped=0x0) returned 1 [0192.978] ReadFile (in: hFile=0x40c, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0192.978] CloseHandle (hObject=0x40c) returned 1 [0192.979] WriteFile (in: hFile=0x37c, lpBuffer=0x271c014*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x271c014*, lpNumberOfBytesWritten=0x8fec38*=0x220, lpOverlapped=0x0) returned 1 [0192.981] CloseHandle (hObject=0x37c) returned 1 [0193.019] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0193.019] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", nBufferLength=0x25, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", lpFilePart=0x0) returned 0x24 [0193.019] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\desktop.ini")) returned 1 [0193.022] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\gOdut.png.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0193.022] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\gOdut.png.locked", nBufferLength=0x2a, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\gOdut.png.locked", lpFilePart=0x0) returned 0x29 [0193.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0193.022] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\gOdut.png.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\godut.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0193.023] GetFileType (hFile=0x37c) returned 0x1 [0193.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0193.023] GetFileType (hFile=0x37c) returned 0x1 [0194.339] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\gOdut.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x23 [0194.339] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\gOdut.png", nBufferLength=0x23, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\gOdut.png", lpFilePart=0x0) returned 0x22 [0194.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0194.340] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\gOdut.png" (normalized: "c:\\users\\fd1hvy\\pictures\\godut.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0194.340] GetFileType (hFile=0x40c) returned 0x1 [0194.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0194.340] GetFileType (hFile=0x40c) returned 0x1 [0194.343] ReadFile (in: hFile=0x40c, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8fec98*=0x12d0, lpOverlapped=0x0) returned 1 [0194.358] WriteFile (in: hFile=0x37c, lpBuffer=0x280112c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x280112c*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0194.359] ReadFile (in: hFile=0x40c, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0194.359] CloseHandle (hObject=0x40c) returned 1 [0194.359] WriteFile (in: hFile=0x37c, lpBuffer=0x280112c*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x280112c*, lpNumberOfBytesWritten=0x8fec38*=0x300, lpOverlapped=0x0) returned 1 [0194.359] CloseHandle (hObject=0x37c) returned 1 [0194.361] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\gOdut.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x23 [0194.361] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\gOdut.png", nBufferLength=0x23, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\gOdut.png", lpFilePart=0x0) returned 0x22 [0194.361] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\gOdut.png" (normalized: "c:\\users\\fd1hvy\\pictures\\godut.png")) returned 1 [0194.370] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\JLcZQgq5.png.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0194.370] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\JLcZQgq5.png.locked", nBufferLength=0x2d, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\JLcZQgq5.png.locked", lpFilePart=0x0) returned 0x2c [0194.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0194.370] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\JLcZQgq5.png.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\jlczqgq5.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0194.371] GetFileType (hFile=0x37c) returned 0x1 [0194.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0194.371] GetFileType (hFile=0x37c) returned 0x1 [0196.176] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\JLcZQgq5.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0196.176] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\JLcZQgq5.png", nBufferLength=0x26, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\JLcZQgq5.png", lpFilePart=0x0) returned 0x25 [0196.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0196.176] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\JLcZQgq5.png" (normalized: "c:\\users\\fd1hvy\\pictures\\jlczqgq5.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0196.178] GetFileType (hFile=0x40c) returned 0x1 [0196.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0196.178] GetFileType (hFile=0x40c) returned 0x1 [0196.181] ReadFile (in: hFile=0x40c, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0x3684, lpOverlapped=0x0) returned 1 [0196.195] WriteFile (in: hFile=0x37c, lpBuffer=0x26dfe44*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x26dfe44*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0196.197] WriteFile (in: hFile=0x37c, lpBuffer=0x26e2310*, nNumberOfBytesToWrite=0x26a0, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x26e2310*, lpNumberOfBytesWritten=0x8fec70*=0x26a0, lpOverlapped=0x0) returned 1 [0196.198] ReadFile (in: hFile=0x40c, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0196.198] CloseHandle (hObject=0x40c) returned 1 [0196.198] WriteFile (in: hFile=0x37c, lpBuffer=0x26dfe44*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x26dfe44*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0196.198] CloseHandle (hObject=0x37c) returned 1 [0196.203] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\JLcZQgq5.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0196.203] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\JLcZQgq5.png", nBufferLength=0x26, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\JLcZQgq5.png", lpFilePart=0x0) returned 0x25 [0196.203] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\JLcZQgq5.png" (normalized: "c:\\users\\fd1hvy\\pictures\\jlczqgq5.png")) returned 1 [0196.300] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\JYS2lay-.png.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0196.300] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\JYS2lay-.png.locked", nBufferLength=0x2d, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\JYS2lay-.png.locked", lpFilePart=0x0) returned 0x2c [0196.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0196.300] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\JYS2lay-.png.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\jys2lay-.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0196.300] GetFileType (hFile=0x37c) returned 0x1 [0196.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0196.300] GetFileType (hFile=0x37c) returned 0x1 [0198.957] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\JYS2lay-.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0198.957] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\JYS2lay-.png", nBufferLength=0x26, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\JYS2lay-.png", lpFilePart=0x0) returned 0x25 [0198.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0198.957] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\JYS2lay-.png" (normalized: "c:\\users\\fd1hvy\\pictures\\jys2lay-.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0198.958] GetFileType (hFile=0x378) returned 0x1 [0198.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0198.958] GetFileType (hFile=0x378) returned 0x1 [0198.961] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec98*=0xd12, lpOverlapped=0x0) returned 1 [0198.977] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0198.977] CloseHandle (hObject=0x378) returned 1 [0198.977] WriteFile (in: hFile=0x37c, lpBuffer=0x27c8548*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x27c8548*, lpNumberOfBytesWritten=0x8fec38*=0xd40, lpOverlapped=0x0) returned 1 [0198.979] CloseHandle (hObject=0x37c) returned 1 [0198.980] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\JYS2lay-.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0198.980] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\JYS2lay-.png", nBufferLength=0x26, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\JYS2lay-.png", lpFilePart=0x0) returned 0x25 [0198.980] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\JYS2lay-.png" (normalized: "c:\\users\\fd1hvy\\pictures\\jys2lay-.png")) returned 1 [0199.032] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\NPX2Axr.png.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0199.032] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\NPX2Axr.png.locked", nBufferLength=0x2c, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\NPX2Axr.png.locked", lpFilePart=0x0) returned 0x2b [0199.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0199.032] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\NPX2Axr.png.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\npx2axr.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0199.032] GetFileType (hFile=0x37c) returned 0x1 [0199.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0199.032] GetFileType (hFile=0x37c) returned 0x1 [0201.020] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\NPX2Axr.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0201.020] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\NPX2Axr.png", nBufferLength=0x25, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\NPX2Axr.png", lpFilePart=0x0) returned 0x24 [0201.020] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0201.020] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\NPX2Axr.png" (normalized: "c:\\users\\fd1hvy\\pictures\\npx2axr.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0201.021] GetFileType (hFile=0x378) returned 0x1 [0201.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0201.021] GetFileType (hFile=0x378) returned 0x1 [0201.024] ReadFile (in: hFile=0x378, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8fec98*=0xc1dd, lpOverlapped=0x0) returned 1 [0201.041] WriteFile (in: hFile=0x37c, lpBuffer=0x26ae390*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x26ae390*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0201.042] WriteFile (in: hFile=0x37c, lpBuffer=0x26b0858*, nNumberOfBytesToWrite=0xb1f0, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x26b0858*, lpNumberOfBytesWritten=0x8fec70*=0xb1f0, lpOverlapped=0x0) returned 1 [0201.043] ReadFile (in: hFile=0x378, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0201.044] CloseHandle (hObject=0x378) returned 1 [0201.044] WriteFile (in: hFile=0x37c, lpBuffer=0x26ae390*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x26ae390*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0201.044] CloseHandle (hObject=0x37c) returned 1 [0201.047] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\NPX2Axr.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0201.047] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\NPX2Axr.png", nBufferLength=0x25, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\NPX2Axr.png", lpFilePart=0x0) returned 0x24 [0201.047] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\NPX2Axr.png" (normalized: "c:\\users\\fd1hvy\\pictures\\npx2axr.png")) returned 1 [0201.094] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\nrF1xa7I2tAH0TN6.png.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0201.094] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\nrF1xa7I2tAH0TN6.png.locked", nBufferLength=0x35, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\nrF1xa7I2tAH0TN6.png.locked", lpFilePart=0x0) returned 0x34 [0201.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0201.094] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\nrF1xa7I2tAH0TN6.png.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\nrf1xa7i2tah0tn6.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0201.095] GetFileType (hFile=0x37c) returned 0x1 [0201.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0201.095] GetFileType (hFile=0x37c) returned 0x1 [0202.943] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\nrF1xa7I2tAH0TN6.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0202.943] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\nrF1xa7I2tAH0TN6.png", nBufferLength=0x2e, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\nrF1xa7I2tAH0TN6.png", lpFilePart=0x0) returned 0x2d [0202.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0202.943] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\nrF1xa7I2tAH0TN6.png" (normalized: "c:\\users\\fd1hvy\\pictures\\nrf1xa7i2tah0tn6.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0202.944] GetFileType (hFile=0x378) returned 0x1 [0202.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0202.944] GetFileType (hFile=0x378) returned 0x1 [0202.947] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0xaade, lpOverlapped=0x0) returned 1 [0202.964] WriteFile (in: hFile=0x37c, lpBuffer=0x2798f7c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x2798f7c*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0202.966] WriteFile (in: hFile=0x37c, lpBuffer=0x279b458*, nNumberOfBytesToWrite=0x9af0, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x279b458*, lpNumberOfBytesWritten=0x8fec70*=0x9af0, lpOverlapped=0x0) returned 1 [0202.967] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0202.967] CloseHandle (hObject=0x378) returned 1 [0202.967] WriteFile (in: hFile=0x37c, lpBuffer=0x2798f7c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x2798f7c*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0202.967] CloseHandle (hObject=0x37c) returned 1 [0202.969] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\nrF1xa7I2tAH0TN6.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0202.969] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\nrF1xa7I2tAH0TN6.png", nBufferLength=0x2e, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\nrF1xa7I2tAH0TN6.png", lpFilePart=0x0) returned 0x2d [0202.969] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\nrF1xa7I2tAH0TN6.png" (normalized: "c:\\users\\fd1hvy\\pictures\\nrf1xa7i2tah0tn6.png")) returned 1 [0202.984] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\UZgVJPD-cJpA_4Gf.png.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0202.984] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\UZgVJPD-cJpA_4Gf.png.locked", nBufferLength=0x35, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\UZgVJPD-cJpA_4Gf.png.locked", lpFilePart=0x0) returned 0x34 [0202.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0202.984] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\UZgVJPD-cJpA_4Gf.png.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\uzgvjpd-cjpa_4gf.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0202.985] GetFileType (hFile=0x37c) returned 0x1 [0202.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0202.985] GetFileType (hFile=0x37c) returned 0x1 [0204.869] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\UZgVJPD-cJpA_4Gf.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0204.869] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\UZgVJPD-cJpA_4Gf.png", nBufferLength=0x2e, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\UZgVJPD-cJpA_4Gf.png", lpFilePart=0x0) returned 0x2d [0204.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0204.869] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\UZgVJPD-cJpA_4Gf.png" (normalized: "c:\\users\\fd1hvy\\pictures\\uzgvjpd-cjpa_4gf.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0204.869] GetFileType (hFile=0x378) returned 0x1 [0204.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0204.869] GetFileType (hFile=0x378) returned 0x1 [0204.872] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec98*=0x1882b, lpOverlapped=0x0) returned 1 [0204.892] WriteFile (in: hFile=0x37c, lpBuffer=0x2888d0c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x2888d0c*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0204.893] WriteFile (in: hFile=0x37c, lpBuffer=0x386a4e8*, nNumberOfBytesToWrite=0x17840, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x386a4e8*, lpNumberOfBytesWritten=0x8fec70*=0x17840, lpOverlapped=0x0) returned 1 [0204.895] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0204.895] CloseHandle (hObject=0x378) returned 1 [0204.895] WriteFile (in: hFile=0x37c, lpBuffer=0x2888d0c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x2888d0c*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0204.896] CloseHandle (hObject=0x37c) returned 1 [0204.899] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\UZgVJPD-cJpA_4Gf.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0204.899] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\UZgVJPD-cJpA_4Gf.png", nBufferLength=0x2e, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\UZgVJPD-cJpA_4Gf.png", lpFilePart=0x0) returned 0x2d [0204.899] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\UZgVJPD-cJpA_4Gf.png" (normalized: "c:\\users\\fd1hvy\\pictures\\uzgvjpd-cjpa_4gf.png")) returned 1 [0204.901] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\VP-Vv.gif.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0204.901] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\VP-Vv.gif.locked", nBufferLength=0x2a, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\VP-Vv.gif.locked", lpFilePart=0x0) returned 0x29 [0204.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0204.901] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\VP-Vv.gif.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\vp-vv.gif.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0204.902] GetFileType (hFile=0x37c) returned 0x1 [0204.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0204.902] GetFileType (hFile=0x37c) returned 0x1 [0206.798] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\VP-Vv.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x23 [0206.798] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\VP-Vv.gif", nBufferLength=0x23, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\VP-Vv.gif", lpFilePart=0x0) returned 0x22 [0206.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0206.798] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\VP-Vv.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\vp-vv.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0206.799] GetFileType (hFile=0x378) returned 0x1 [0206.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0206.799] GetFileType (hFile=0x378) returned 0x1 [0206.802] ReadFile (in: hFile=0x378, lpBuffer=0x3881d48, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3881d48*, lpNumberOfBytesRead=0x8fec98*=0xe2a8, lpOverlapped=0x0) returned 1 [0206.865] WriteFile (in: hFile=0x37c, lpBuffer=0x276e070*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x276e070*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0206.866] WriteFile (in: hFile=0x37c, lpBuffer=0x2770534*, nNumberOfBytesToWrite=0xd2c0, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x2770534*, lpNumberOfBytesWritten=0x8fec70*=0xd2c0, lpOverlapped=0x0) returned 1 [0206.868] ReadFile (in: hFile=0x378, lpBuffer=0x3881d48, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3881d48*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0206.868] CloseHandle (hObject=0x378) returned 1 [0206.868] WriteFile (in: hFile=0x37c, lpBuffer=0x276e070*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x276e070*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0206.868] CloseHandle (hObject=0x37c) returned 1 [0206.870] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\VP-Vv.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x23 [0206.870] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\VP-Vv.gif", nBufferLength=0x23, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\VP-Vv.gif", lpFilePart=0x0) returned 0x22 [0206.870] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\VP-Vv.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\vp-vv.gif")) returned 1 [0206.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed6c) returned 1 [0206.917] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0206.917] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", nBufferLength=0x19, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures", lpFilePart=0x0) returned 0x18 [0206.917] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\*", lpFindFileData=0x8fea94 | out: lpFindFileData=0x8fea94*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe7505446, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x940e03ad, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x960a08 [0206.918] FindNextFileW (in: hFindFile=0x960a08, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe7505446, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x940e03ad, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.919] FindNextFileW (in: hFindFile=0x960a08, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87dd7c47, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0x87dd7c47, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0x88a850e1, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xb680, dwReserved0=0x0, dwReserved1=0x0, cFileName="09z5.gif.locked", cAlternateFileName="09Z5GI~1.LOC")) returned 1 [0206.919] FindNextFileW (in: hFindFile=0x960a08, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88aab223, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0x88aab223, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0x898ad22d, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xf8e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7ClJZ0nxJQii.png.locked", cAlternateFileName="7CLJZ0~1.LOC")) returned 1 [0206.919] FindNextFileW (in: hFindFile=0x960a08, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0206.919] FindNextFileW (in: hFindFile=0x960a08, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x898d3196, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0x898d3196, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0x8a878995, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xbbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="D GyVgEwhaiN3vw7bFZ.bmp.locked", cAlternateFileName="DGYVGE~1.LOC")) returned 1 [0206.919] FindNextFileW (in: hFindFile=0x960a08, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a8eb061, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0x8a8eb061, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0x8bc5b80f, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x220, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.locked", cAlternateFileName="DESKTO~1.LOC")) returned 1 [0206.919] FindNextFileW (in: hFindFile=0x960a08, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb899f990, ftCreationTime.dwHighDateTime=0x1d5ede5, ftLastAccessTime.dwLowDateTime=0xfd93cd60, ftLastAccessTime.dwHighDateTime=0x1d5e899, ftLastWriteTime.dwLowDateTime=0xfd93cd60, ftLastWriteTime.dwHighDateTime=0x1d5e899, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dHwEefAsn7xqd-", cAlternateFileName="DHWEEF~1")) returned 1 [0206.919] FindNextFileW (in: hFindFile=0x960a08, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bc5b80f, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0x8bc5b80f, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0x8c93b36b, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x1300, dwReserved0=0x0, dwReserved1=0x0, cFileName="gOdut.png.locked", cAlternateFileName="GODUTP~1.LOC")) returned 1 [0206.920] FindNextFileW (in: hFindFile=0x960a08, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c93b36b, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0x8c93b36b, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0x8daa9d72, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x36b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JLcZQgq5.png.locked", cAlternateFileName="JLCZQG~1.LOC")) returned 1 [0206.920] FindNextFileW (in: hFindFile=0x960a08, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dbb4d4a, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0x8dbb4d4a, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0x8f528ca9, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xd40, dwReserved0=0x0, dwReserved1=0x0, cFileName="JYS2lay-.png.locked", cAlternateFileName="JYS2LA~1.LOC")) returned 1 [0206.920] FindNextFileW (in: hFindFile=0x960a08, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f5c1449, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0x8f5c1449, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0x908fa633, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x0, dwReserved1=0x0, cFileName="NPX2Axr.png.locked", cAlternateFileName="NPX2AX~1.LOC")) returned 1 [0206.920] FindNextFileW (in: hFindFile=0x960a08, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9096cb02, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0x9096cb02, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0x91b4d046, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xab00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nrF1xa7I2tAH0TN6.png.locked", cAlternateFileName="NRF1XA~1.LOC")) returned 1 [0206.920] FindNextFileW (in: hFindFile=0x960a08, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0206.920] FindNextFileW (in: hFindFile=0x960a08, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91b732db, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0x91b732db, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0x92da7650, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x18850, dwReserved0=0x0, dwReserved1=0x0, cFileName="UZgVJPD-cJpA_4Gf.png.locked", cAlternateFileName="UZGVJP~1.LOC")) returned 1 [0206.920] FindNextFileW (in: hFindFile=0x960a08, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92da7650, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0x92da7650, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0x9406df2d, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xe2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VP-Vv.gif.locked", cAlternateFileName="VP-VVG~1.LOC")) returned 1 [0206.921] FindNextFileW (in: hFindFile=0x960a08, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92da7650, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0x92da7650, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0x9406df2d, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xe2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VP-Vv.gif.locked", cAlternateFileName="VP-VVG~1.LOC")) returned 0 [0206.921] FindClose (in: hFindFile=0x960a08 | out: hFindFile=0x960a08) returned 1 [0206.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fed28) returned 1 [0206.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fed34) returned 1 [0206.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed08) returned 1 [0206.921] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0206.921] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", nBufferLength=0x25, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", lpFilePart=0x0) returned 0x24 [0206.921] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*", lpFindFileData=0x8fea30 | out: lpFindFileData=0x8fea30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x960b88 [0206.924] FindNextFileW (in: hFindFile=0x960b88, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.924] FindNextFileW (in: hFindFile=0x960b88, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0206.924] FindNextFileW (in: hFindFile=0x960b88, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0206.924] FindClose (in: hFindFile=0x960b88 | out: hFindFile=0x960b88) returned 1 [0206.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecc4) returned 1 [0206.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd0) returned 1 [0206.925] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0206.925] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini.locked", nBufferLength=0x38, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini.locked", lpFilePart=0x0) returned 0x37 [0206.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb80) returned 1 [0206.926] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\desktop.ini.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0206.926] GetFileType (hFile=0x37c) returned 0x1 [0206.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb7c) returned 1 [0206.926] GetFileType (hFile=0x37c) returned 0x1 [0209.152] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0209.153] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", nBufferLength=0x31, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", lpFilePart=0x0) returned 0x30 [0209.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb80) returned 1 [0209.153] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0209.156] GetFileType (hFile=0x378) returned 0x1 [0209.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb7c) returned 1 [0209.156] GetFileType (hFile=0x378) returned 0x1 [0209.160] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec34, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec34*=0xbe, lpOverlapped=0x0) returned 1 [0209.207] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec34, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec34*=0x0, lpOverlapped=0x0) returned 1 [0209.207] CloseHandle (hObject=0x378) returned 1 [0209.208] WriteFile (in: hFile=0x37c, lpBuffer=0x285cb98*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x8febd4, lpOverlapped=0x0 | out: lpBuffer=0x285cb98*, lpNumberOfBytesWritten=0x8febd4*=0xe0, lpOverlapped=0x0) returned 1 [0209.209] CloseHandle (hObject=0x37c) returned 1 [0209.211] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0209.211] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", nBufferLength=0x31, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", lpFilePart=0x0) returned 0x30 [0209.211] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\desktop.ini")) returned 1 [0209.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed08) returned 1 [0209.212] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0209.212] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", nBufferLength=0x25, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", lpFilePart=0x0) returned 0x24 [0209.213] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*", lpFindFileData=0x8fea30 | out: lpFindFileData=0x8fea30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x956ce7f4, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x960988 [0209.213] FindNextFileW (in: hFindFile=0x960988, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x956ce7f4, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.213] FindNextFileW (in: hFindFile=0x960988, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94106635, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0x94106635, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0x956ce7f4, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.locked", cAlternateFileName="DESKTO~1.LOC")) returned 1 [0209.214] FindNextFileW (in: hFindFile=0x960988, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94106635, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0x94106635, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0x956ce7f4, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.locked", cAlternateFileName="DESKTO~1.LOC")) returned 0 [0209.214] FindClose (in: hFindFile=0x960988 | out: hFindFile=0x960988) returned 1 [0209.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecc4) returned 1 [0209.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd0) returned 1 [0209.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed08) returned 1 [0209.214] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0209.214] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-", nBufferLength=0x28, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-", lpFilePart=0x0) returned 0x27 [0209.214] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\*", lpFindFileData=0x8fea30 | out: lpFindFileData=0x8fea30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb899f990, ftCreationTime.dwHighDateTime=0x1d5ede5, ftLastAccessTime.dwLowDateTime=0xfd93cd60, ftLastAccessTime.dwHighDateTime=0x1d5e899, ftLastWriteTime.dwLowDateTime=0xfd93cd60, ftLastWriteTime.dwHighDateTime=0x1d5e899, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x960848 [0209.214] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb899f990, ftCreationTime.dwHighDateTime=0x1d5ede5, ftLastAccessTime.dwLowDateTime=0xfd93cd60, ftLastAccessTime.dwHighDateTime=0x1d5e899, ftLastWriteTime.dwLowDateTime=0xfd93cd60, ftLastWriteTime.dwHighDateTime=0x1d5e899, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.215] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe16fa910, ftCreationTime.dwHighDateTime=0x1d5eecf, ftLastAccessTime.dwLowDateTime=0xdeaa7320, ftLastAccessTime.dwHighDateTime=0x1d5eca1, ftLastWriteTime.dwLowDateTime=0xdeaa7320, ftLastWriteTime.dwHighDateTime=0x1d5eca1, nFileSizeHigh=0x0, nFileSizeLow=0x11c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="-I-vQylmw8Ifl.jpg", cAlternateFileName="-I-VQY~1.JPG")) returned 1 [0209.215] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe36af510, ftCreationTime.dwHighDateTime=0x1d5e5d5, ftLastAccessTime.dwLowDateTime=0xf4541a50, ftLastAccessTime.dwHighDateTime=0x1d5e6b1, ftLastWriteTime.dwLowDateTime=0xf4541a50, ftLastWriteTime.dwHighDateTime=0x1d5e6b1, nFileSizeHigh=0x0, nFileSizeLow=0xc5c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="36sUlNDBK_1qZR_kbQ5A.bmp", cAlternateFileName="36SULN~1.BMP")) returned 1 [0209.215] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bfccf50, ftCreationTime.dwHighDateTime=0x1d5ee15, ftLastAccessTime.dwLowDateTime=0xdf8d1410, ftLastAccessTime.dwHighDateTime=0x1d5e845, ftLastWriteTime.dwLowDateTime=0xdf8d1410, ftLastWriteTime.dwHighDateTime=0x1d5e845, nFileSizeHigh=0x0, nFileSizeLow=0x11e6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGIsPmhqq7 0v6w1Q.png", cAlternateFileName="CGISPM~1.PNG")) returned 1 [0209.215] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x285b4af0, ftCreationTime.dwHighDateTime=0x1d5e1a6, ftLastAccessTime.dwLowDateTime=0xfd4ec400, ftLastAccessTime.dwHighDateTime=0x1d5e86b, ftLastWriteTime.dwLowDateTime=0xfd4ec400, ftLastWriteTime.dwHighDateTime=0x1d5e86b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CZUf tqlcPkMdYYqO", cAlternateFileName="CZUFTQ~1")) returned 1 [0209.215] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7928e70, ftCreationTime.dwHighDateTime=0x1d5ef88, ftLastAccessTime.dwLowDateTime=0x3b33f2f0, ftLastAccessTime.dwHighDateTime=0x1d5e90b, ftLastWriteTime.dwLowDateTime=0x3b33f2f0, ftLastWriteTime.dwHighDateTime=0x1d5e90b, nFileSizeHigh=0x0, nFileSizeLow=0xc8da, dwReserved0=0x0, dwReserved1=0x0, cFileName="Inux dk8bmT4or7wBr.png", cAlternateFileName="INUXDK~1.PNG")) returned 1 [0209.215] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ab3e8d0, ftCreationTime.dwHighDateTime=0x1d5ea9e, ftLastAccessTime.dwLowDateTime=0x6ab944f0, ftLastAccessTime.dwHighDateTime=0x1d5e8e1, ftLastWriteTime.dwLowDateTime=0x6ab944f0, ftLastWriteTime.dwHighDateTime=0x1d5e8e1, nFileSizeHigh=0x0, nFileSizeLow=0x1081e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ivuRLbIQ1akqO6uxG5ko.gif", cAlternateFileName="IVURLB~1.GIF")) returned 1 [0209.216] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c508d50, ftCreationTime.dwHighDateTime=0x1d5ee3e, ftLastAccessTime.dwLowDateTime=0xcff32a50, ftLastAccessTime.dwHighDateTime=0x1d5ea0a, ftLastWriteTime.dwLowDateTime=0xcff32a50, ftLastWriteTime.dwHighDateTime=0x1d5ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1b29, dwReserved0=0x0, dwReserved1=0x0, cFileName="jvvEVXOvwgvX.bmp", cAlternateFileName="JVVEVX~1.BMP")) returned 1 [0209.216] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59da4e20, ftCreationTime.dwHighDateTime=0x1d5ecc1, ftLastAccessTime.dwLowDateTime=0x4a5f47d0, ftLastAccessTime.dwHighDateTime=0x1d5e653, ftLastWriteTime.dwLowDateTime=0x4a5f47d0, ftLastWriteTime.dwHighDateTime=0x1d5e653, nFileSizeHigh=0x0, nFileSizeLow=0xa808, dwReserved0=0x0, dwReserved1=0x0, cFileName="l5IYWWMz.png", cAlternateFileName="")) returned 1 [0209.216] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaaf9f850, ftCreationTime.dwHighDateTime=0x1d5efdc, ftLastAccessTime.dwLowDateTime=0x4a7e0230, ftLastAccessTime.dwHighDateTime=0x1d5ea6b, ftLastWriteTime.dwLowDateTime=0x4a7e0230, ftLastWriteTime.dwHighDateTime=0x1d5ea6b, nFileSizeHigh=0x0, nFileSizeLow=0x75d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="QkOqp.png", cAlternateFileName="")) returned 1 [0209.216] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cd2db20, ftCreationTime.dwHighDateTime=0x1d5f024, ftLastAccessTime.dwLowDateTime=0xf1603b60, ftLastAccessTime.dwHighDateTime=0x1d5eed8, ftLastWriteTime.dwLowDateTime=0xf1603b60, ftLastWriteTime.dwHighDateTime=0x1d5eed8, nFileSizeHigh=0x0, nFileSizeLow=0x18c78, dwReserved0=0x0, dwReserved1=0x0, cFileName="S1WHxrs Dm-PA7m.png", cAlternateFileName="S1WHXR~1.PNG")) returned 1 [0209.216] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd89a270, ftCreationTime.dwHighDateTime=0x1d5e9f9, ftLastAccessTime.dwLowDateTime=0xf99ad6c0, ftLastAccessTime.dwHighDateTime=0x1d5e418, ftLastWriteTime.dwLowDateTime=0xf99ad6c0, ftLastWriteTime.dwHighDateTime=0x1d5e418, nFileSizeHigh=0x0, nFileSizeLow=0x186dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="XVnVVs4dA7ikVtE9V.bmp", cAlternateFileName="XVNVVS~1.BMP")) returned 1 [0209.216] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.217] FindClose (in: hFindFile=0x960848 | out: hFindFile=0x960848) returned 1 [0209.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecc4) returned 1 [0209.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd0) returned 1 [0209.218] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\-I-vQylmw8Ifl.jpg.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0209.218] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\-I-vQylmw8Ifl.jpg.locked", nBufferLength=0x41, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\-I-vQylmw8Ifl.jpg.locked", lpFilePart=0x0) returned 0x40 [0209.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb80) returned 1 [0209.218] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\-I-vQylmw8Ifl.jpg.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\-i-vqylmw8ifl.jpg.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0209.218] GetFileType (hFile=0x37c) returned 0x1 [0209.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb7c) returned 1 [0209.218] GetFileType (hFile=0x37c) returned 0x1 [0211.053] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\-I-vQylmw8Ifl.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0211.054] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\-I-vQylmw8Ifl.jpg", nBufferLength=0x3a, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\-I-vQylmw8Ifl.jpg", lpFilePart=0x0) returned 0x39 [0211.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb80) returned 1 [0211.054] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\-I-vQylmw8Ifl.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\-i-vqylmw8ifl.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0211.054] GetFileType (hFile=0x378) returned 0x1 [0211.054] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb7c) returned 1 [0211.054] GetFileType (hFile=0x378) returned 0x1 [0211.057] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec34, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec34*=0x11c00, lpOverlapped=0x0) returned 1 [0211.074] WriteFile (in: hFile=0x37c, lpBuffer=0x27445b4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec0c, lpOverlapped=0x0 | out: lpBuffer=0x27445b4*, lpNumberOfBytesWritten=0x8fec0c*=0x1000, lpOverlapped=0x0) returned 1 [0211.075] WriteFile (in: hFile=0x37c, lpBuffer=0x2746a88*, nNumberOfBytesToWrite=0x10c20, lpNumberOfBytesWritten=0x8fec0c, lpOverlapped=0x0 | out: lpBuffer=0x2746a88*, lpNumberOfBytesWritten=0x8fec0c*=0x10c20, lpOverlapped=0x0) returned 1 [0211.077] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec34, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec34*=0x0, lpOverlapped=0x0) returned 1 [0211.077] CloseHandle (hObject=0x378) returned 1 [0211.077] WriteFile (in: hFile=0x37c, lpBuffer=0x27445b4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8febd4, lpOverlapped=0x0 | out: lpBuffer=0x27445b4*, lpNumberOfBytesWritten=0x8febd4*=0x10, lpOverlapped=0x0) returned 1 [0211.077] CloseHandle (hObject=0x37c) returned 1 [0211.080] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\-I-vQylmw8Ifl.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0211.080] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\-I-vQylmw8Ifl.jpg", nBufferLength=0x3a, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\-I-vQylmw8Ifl.jpg", lpFilePart=0x0) returned 0x39 [0211.080] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\-I-vQylmw8Ifl.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\-i-vqylmw8ifl.jpg")) returned 1 [0211.141] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\36sUlNDBK_1qZR_kbQ5A.bmp.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x48 [0211.142] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\36sUlNDBK_1qZR_kbQ5A.bmp.locked", nBufferLength=0x48, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\36sUlNDBK_1qZR_kbQ5A.bmp.locked", lpFilePart=0x0) returned 0x47 [0211.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb80) returned 1 [0211.142] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\36sUlNDBK_1qZR_kbQ5A.bmp.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\36sulndbk_1qzr_kbq5a.bmp.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0211.142] GetFileType (hFile=0x37c) returned 0x1 [0211.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb7c) returned 1 [0211.142] GetFileType (hFile=0x37c) returned 0x1 [0213.364] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\36sUlNDBK_1qZR_kbQ5A.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0213.364] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\36sUlNDBK_1qZR_kbQ5A.bmp", nBufferLength=0x41, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\36sUlNDBK_1qZR_kbQ5A.bmp", lpFilePart=0x0) returned 0x40 [0213.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb80) returned 1 [0213.364] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\36sUlNDBK_1qZR_kbQ5A.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\36sulndbk_1qzr_kbq5a.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0213.365] GetFileType (hFile=0x378) returned 0x1 [0213.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb7c) returned 1 [0213.365] GetFileType (hFile=0x378) returned 0x1 [0213.367] ReadFile (in: hFile=0x378, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec34, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8fec34*=0xc5c7, lpOverlapped=0x0) returned 1 [0213.431] WriteFile (in: hFile=0x37c, lpBuffer=0x283b7f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec0c, lpOverlapped=0x0 | out: lpBuffer=0x283b7f8*, lpNumberOfBytesWritten=0x8fec0c*=0x1000, lpOverlapped=0x0) returned 1 [0213.432] WriteFile (in: hFile=0x37c, lpBuffer=0x283dcdc*, nNumberOfBytesToWrite=0xb5e0, lpNumberOfBytesWritten=0x8fec0c, lpOverlapped=0x0 | out: lpBuffer=0x283dcdc*, lpNumberOfBytesWritten=0x8fec0c*=0xb5e0, lpOverlapped=0x0) returned 1 [0213.433] ReadFile (in: hFile=0x378, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec34, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8fec34*=0x0, lpOverlapped=0x0) returned 1 [0213.433] CloseHandle (hObject=0x378) returned 1 [0213.433] WriteFile (in: hFile=0x37c, lpBuffer=0x283b7f8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8febd4, lpOverlapped=0x0 | out: lpBuffer=0x283b7f8*, lpNumberOfBytesWritten=0x8febd4*=0x10, lpOverlapped=0x0) returned 1 [0213.434] CloseHandle (hObject=0x37c) returned 1 [0213.436] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\36sUlNDBK_1qZR_kbQ5A.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0213.436] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\36sUlNDBK_1qZR_kbQ5A.bmp", nBufferLength=0x41, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\36sUlNDBK_1qZR_kbQ5A.bmp", lpFilePart=0x0) returned 0x40 [0213.436] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\36sUlNDBK_1qZR_kbQ5A.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\36sulndbk_1qzr_kbq5a.bmp")) returned 1 [0213.489] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CGIsPmhqq7 0v6w1Q.png.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x45 [0213.489] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CGIsPmhqq7 0v6w1Q.png.locked", nBufferLength=0x45, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CGIsPmhqq7 0v6w1Q.png.locked", lpFilePart=0x0) returned 0x44 [0213.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb80) returned 1 [0213.489] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CGIsPmhqq7 0v6w1Q.png.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\cgispmhqq7 0v6w1q.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0213.489] GetFileType (hFile=0x37c) returned 0x1 [0213.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb7c) returned 1 [0213.489] GetFileType (hFile=0x37c) returned 0x1 [0215.747] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CGIsPmhqq7 0v6w1Q.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0215.747] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CGIsPmhqq7 0v6w1Q.png", nBufferLength=0x3e, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CGIsPmhqq7 0v6w1Q.png", lpFilePart=0x0) returned 0x3d [0215.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb80) returned 1 [0215.747] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CGIsPmhqq7 0v6w1Q.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\cgispmhqq7 0v6w1q.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0215.748] GetFileType (hFile=0x378) returned 0x1 [0215.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb7c) returned 1 [0215.748] GetFileType (hFile=0x378) returned 0x1 [0215.750] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec34, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec34*=0x11e6c, lpOverlapped=0x0) returned 1 [0215.766] WriteFile (in: hFile=0x37c, lpBuffer=0x272667c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec0c, lpOverlapped=0x0 | out: lpBuffer=0x272667c*, lpNumberOfBytesWritten=0x8fec0c*=0x1000, lpOverlapped=0x0) returned 1 [0215.767] WriteFile (in: hFile=0x37c, lpBuffer=0x2728b58*, nNumberOfBytesToWrite=0x10e80, lpNumberOfBytesWritten=0x8fec0c, lpOverlapped=0x0 | out: lpBuffer=0x2728b58*, lpNumberOfBytesWritten=0x8fec0c*=0x10e80, lpOverlapped=0x0) returned 1 [0215.769] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec34, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec34*=0x0, lpOverlapped=0x0) returned 1 [0215.769] CloseHandle (hObject=0x378) returned 1 [0215.769] WriteFile (in: hFile=0x37c, lpBuffer=0x272667c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8febd4, lpOverlapped=0x0 | out: lpBuffer=0x272667c*, lpNumberOfBytesWritten=0x8febd4*=0x10, lpOverlapped=0x0) returned 1 [0215.769] CloseHandle (hObject=0x37c) returned 1 [0215.771] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CGIsPmhqq7 0v6w1Q.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0215.771] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CGIsPmhqq7 0v6w1Q.png", nBufferLength=0x3e, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CGIsPmhqq7 0v6w1Q.png", lpFilePart=0x0) returned 0x3d [0215.771] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CGIsPmhqq7 0v6w1Q.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\cgispmhqq7 0v6w1q.png")) returned 1 [0215.821] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\Inux dk8bmT4or7wBr.png.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0215.821] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\Inux dk8bmT4or7wBr.png.locked", nBufferLength=0x46, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\Inux dk8bmT4or7wBr.png.locked", lpFilePart=0x0) returned 0x45 [0215.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb80) returned 1 [0215.821] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\Inux dk8bmT4or7wBr.png.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\inux dk8bmt4or7wbr.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0215.822] GetFileType (hFile=0x37c) returned 0x1 [0215.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb7c) returned 1 [0215.822] GetFileType (hFile=0x37c) returned 0x1 [0217.249] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\Inux dk8bmT4or7wBr.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0217.249] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\Inux dk8bmT4or7wBr.png", nBufferLength=0x3f, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\Inux dk8bmT4or7wBr.png", lpFilePart=0x0) returned 0x3e [0217.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb80) returned 1 [0217.249] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\Inux dk8bmT4or7wBr.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\inux dk8bmt4or7wbr.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0217.249] GetFileType (hFile=0x378) returned 0x1 [0217.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb7c) returned 1 [0217.250] GetFileType (hFile=0x378) returned 0x1 [0217.257] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec34, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec34*=0xc8da, lpOverlapped=0x0) returned 1 [0217.275] WriteFile (in: hFile=0x37c, lpBuffer=0x281dd4c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec0c, lpOverlapped=0x0 | out: lpBuffer=0x281dd4c*, lpNumberOfBytesWritten=0x8fec0c*=0x1000, lpOverlapped=0x0) returned 1 [0217.277] WriteFile (in: hFile=0x37c, lpBuffer=0x282022c*, nNumberOfBytesToWrite=0xb8f0, lpNumberOfBytesWritten=0x8fec0c, lpOverlapped=0x0 | out: lpBuffer=0x282022c*, lpNumberOfBytesWritten=0x8fec0c*=0xb8f0, lpOverlapped=0x0) returned 1 [0217.278] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec34, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec34*=0x0, lpOverlapped=0x0) returned 1 [0217.278] CloseHandle (hObject=0x378) returned 1 [0217.279] WriteFile (in: hFile=0x37c, lpBuffer=0x281dd4c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8febd4, lpOverlapped=0x0 | out: lpBuffer=0x281dd4c*, lpNumberOfBytesWritten=0x8febd4*=0x10, lpOverlapped=0x0) returned 1 [0217.279] CloseHandle (hObject=0x37c) returned 1 [0217.281] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\Inux dk8bmT4or7wBr.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0217.281] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\Inux dk8bmT4or7wBr.png", nBufferLength=0x3f, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\Inux dk8bmT4or7wBr.png", lpFilePart=0x0) returned 0x3e [0217.281] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\Inux dk8bmT4or7wBr.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\inux dk8bmt4or7wbr.png")) returned 1 [0217.287] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\ivuRLbIQ1akqO6uxG5ko.gif.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x48 [0217.287] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\ivuRLbIQ1akqO6uxG5ko.gif.locked", nBufferLength=0x48, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\ivuRLbIQ1akqO6uxG5ko.gif.locked", lpFilePart=0x0) returned 0x47 [0217.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb80) returned 1 [0217.287] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\ivuRLbIQ1akqO6uxG5ko.gif.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\ivurlbiq1akqo6uxg5ko.gif.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0217.288] GetFileType (hFile=0x37c) returned 0x1 [0217.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb7c) returned 1 [0217.288] GetFileType (hFile=0x37c) returned 0x1 [0219.495] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\ivuRLbIQ1akqO6uxG5ko.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0219.495] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\ivuRLbIQ1akqO6uxG5ko.gif", nBufferLength=0x41, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\ivuRLbIQ1akqO6uxG5ko.gif", lpFilePart=0x0) returned 0x40 [0219.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb80) returned 1 [0219.495] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\ivuRLbIQ1akqO6uxG5ko.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\ivurlbiq1akqo6uxg5ko.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0219.496] GetFileType (hFile=0x378) returned 0x1 [0219.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb7c) returned 1 [0219.496] GetFileType (hFile=0x378) returned 0x1 [0219.498] ReadFile (in: hFile=0x378, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec34, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8fec34*=0x1081e, lpOverlapped=0x0) returned 1 [0219.563] WriteFile (in: hFile=0x37c, lpBuffer=0x270ffe4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec0c, lpOverlapped=0x0 | out: lpBuffer=0x270ffe4*, lpNumberOfBytesWritten=0x8fec0c*=0x1000, lpOverlapped=0x0) returned 1 [0219.564] WriteFile (in: hFile=0x37c, lpBuffer=0x27124c8*, nNumberOfBytesToWrite=0xf830, lpNumberOfBytesWritten=0x8fec0c, lpOverlapped=0x0 | out: lpBuffer=0x27124c8*, lpNumberOfBytesWritten=0x8fec0c*=0xf830, lpOverlapped=0x0) returned 1 [0219.566] ReadFile (in: hFile=0x378, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec34, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8fec34*=0x0, lpOverlapped=0x0) returned 1 [0219.566] CloseHandle (hObject=0x378) returned 1 [0219.566] WriteFile (in: hFile=0x37c, lpBuffer=0x270ffe4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8febd4, lpOverlapped=0x0 | out: lpBuffer=0x270ffe4*, lpNumberOfBytesWritten=0x8febd4*=0x10, lpOverlapped=0x0) returned 1 [0219.642] CloseHandle (hObject=0x37c) returned 1 [0219.645] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\ivuRLbIQ1akqO6uxG5ko.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0219.645] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\ivuRLbIQ1akqO6uxG5ko.gif", nBufferLength=0x41, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\ivuRLbIQ1akqO6uxG5ko.gif", lpFilePart=0x0) returned 0x40 [0219.645] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\ivuRLbIQ1akqO6uxG5ko.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\ivurlbiq1akqo6uxg5ko.gif")) returned 1 [0219.696] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\jvvEVXOvwgvX.bmp.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0219.696] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\jvvEVXOvwgvX.bmp.locked", nBufferLength=0x40, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\jvvEVXOvwgvX.bmp.locked", lpFilePart=0x0) returned 0x3f [0219.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb80) returned 1 [0219.696] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\jvvEVXOvwgvX.bmp.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\jvvevxovwgvx.bmp.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0219.697] GetFileType (hFile=0x37c) returned 0x1 [0219.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb7c) returned 1 [0219.697] GetFileType (hFile=0x37c) returned 0x1 [0221.548] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\jvvEVXOvwgvX.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0221.549] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\jvvEVXOvwgvX.bmp", nBufferLength=0x39, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\jvvEVXOvwgvX.bmp", lpFilePart=0x0) returned 0x38 [0221.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb80) returned 1 [0221.549] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\jvvEVXOvwgvX.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\jvvevxovwgvx.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0221.549] GetFileType (hFile=0x378) returned 0x1 [0221.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb7c) returned 1 [0221.549] GetFileType (hFile=0x378) returned 0x1 [0221.552] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec34, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec34*=0x1b29, lpOverlapped=0x0) returned 1 [0221.564] WriteFile (in: hFile=0x37c, lpBuffer=0x27feeb8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec0c, lpOverlapped=0x0 | out: lpBuffer=0x27feeb8*, lpNumberOfBytesWritten=0x8fec0c*=0x1000, lpOverlapped=0x0) returned 1 [0221.565] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec34, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec34*=0x0, lpOverlapped=0x0) returned 1 [0221.565] CloseHandle (hObject=0x378) returned 1 [0221.566] WriteFile (in: hFile=0x37c, lpBuffer=0x27feeb8*, nNumberOfBytesToWrite=0xb50, lpNumberOfBytesWritten=0x8febd4, lpOverlapped=0x0 | out: lpBuffer=0x27feeb8*, lpNumberOfBytesWritten=0x8febd4*=0xb50, lpOverlapped=0x0) returned 1 [0221.566] CloseHandle (hObject=0x37c) returned 1 [0221.644] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\jvvEVXOvwgvX.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0221.644] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\jvvEVXOvwgvX.bmp", nBufferLength=0x39, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\jvvEVXOvwgvX.bmp", lpFilePart=0x0) returned 0x38 [0221.644] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\jvvEVXOvwgvX.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\jvvevxovwgvx.bmp")) returned 1 [0221.662] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\l5IYWWMz.png.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0221.662] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\l5IYWWMz.png.locked", nBufferLength=0x3c, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\l5IYWWMz.png.locked", lpFilePart=0x0) returned 0x3b [0221.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb80) returned 1 [0221.662] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\l5IYWWMz.png.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\l5iywwmz.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0221.662] GetFileType (hFile=0x37c) returned 0x1 [0221.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb7c) returned 1 [0221.662] GetFileType (hFile=0x37c) returned 0x1 [0222.954] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\l5IYWWMz.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0222.954] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\l5IYWWMz.png", nBufferLength=0x35, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\l5IYWWMz.png", lpFilePart=0x0) returned 0x34 [0222.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb80) returned 1 [0222.954] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\l5IYWWMz.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\l5iywwmz.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0222.955] GetFileType (hFile=0x378) returned 0x1 [0222.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb7c) returned 1 [0222.955] GetFileType (hFile=0x378) returned 0x1 [0222.958] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec34, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec34*=0xa808, lpOverlapped=0x0) returned 1 [0222.998] WriteFile (in: hFile=0x37c, lpBuffer=0x26e64f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec0c, lpOverlapped=0x0 | out: lpBuffer=0x26e64f0*, lpNumberOfBytesWritten=0x8fec0c*=0x1000, lpOverlapped=0x0) returned 1 [0222.999] WriteFile (in: hFile=0x37c, lpBuffer=0x26e89bc*, nNumberOfBytesToWrite=0x9820, lpNumberOfBytesWritten=0x8fec0c, lpOverlapped=0x0 | out: lpBuffer=0x26e89bc*, lpNumberOfBytesWritten=0x8fec0c*=0x9820, lpOverlapped=0x0) returned 1 [0223.000] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec34, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec34*=0x0, lpOverlapped=0x0) returned 1 [0223.000] CloseHandle (hObject=0x378) returned 1 [0223.000] WriteFile (in: hFile=0x37c, lpBuffer=0x26e64f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8febd4, lpOverlapped=0x0 | out: lpBuffer=0x26e64f0*, lpNumberOfBytesWritten=0x8febd4*=0x10, lpOverlapped=0x0) returned 1 [0223.000] CloseHandle (hObject=0x37c) returned 1 [0223.003] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\l5IYWWMz.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0223.003] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\l5IYWWMz.png", nBufferLength=0x35, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\l5IYWWMz.png", lpFilePart=0x0) returned 0x34 [0223.003] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\l5IYWWMz.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\l5iywwmz.png")) returned 1 [0223.006] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\QkOqp.png.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0223.006] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\QkOqp.png.locked", nBufferLength=0x39, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\QkOqp.png.locked", lpFilePart=0x0) returned 0x38 [0223.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb80) returned 1 [0223.006] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\QkOqp.png.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\qkoqp.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0223.007] GetFileType (hFile=0x37c) returned 0x1 [0223.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb7c) returned 1 [0223.007] GetFileType (hFile=0x37c) returned 0x1 [0224.778] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\QkOqp.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0224.778] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\QkOqp.png", nBufferLength=0x32, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\QkOqp.png", lpFilePart=0x0) returned 0x31 [0224.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb80) returned 1 [0224.778] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\QkOqp.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\qkoqp.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0224.779] GetFileType (hFile=0x378) returned 0x1 [0224.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb7c) returned 1 [0224.779] GetFileType (hFile=0x378) returned 0x1 [0224.782] ReadFile (in: hFile=0x378, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec34, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8fec34*=0x75d2, lpOverlapped=0x0) returned 1 [0224.794] WriteFile (in: hFile=0x37c, lpBuffer=0x27d687c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec0c, lpOverlapped=0x0 | out: lpBuffer=0x27d687c*, lpNumberOfBytesWritten=0x8fec0c*=0x1000, lpOverlapped=0x0) returned 1 [0224.796] WriteFile (in: hFile=0x37c, lpBuffer=0x27d8d40*, nNumberOfBytesToWrite=0x65f0, lpNumberOfBytesWritten=0x8fec0c, lpOverlapped=0x0 | out: lpBuffer=0x27d8d40*, lpNumberOfBytesWritten=0x8fec0c*=0x65f0, lpOverlapped=0x0) returned 1 [0224.796] ReadFile (in: hFile=0x378, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec34, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8fec34*=0x0, lpOverlapped=0x0) returned 1 [0224.796] CloseHandle (hObject=0x378) returned 1 [0224.799] WriteFile (in: hFile=0x37c, lpBuffer=0x27d687c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8febd4, lpOverlapped=0x0 | out: lpBuffer=0x27d687c*, lpNumberOfBytesWritten=0x8febd4*=0x10, lpOverlapped=0x0) returned 1 [0224.799] CloseHandle (hObject=0x37c) returned 1 [0224.801] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\QkOqp.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0224.801] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\QkOqp.png", nBufferLength=0x32, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\QkOqp.png", lpFilePart=0x0) returned 0x31 [0224.801] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\QkOqp.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\qkoqp.png")) returned 1 [0224.810] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\S1WHxrs Dm-PA7m.png.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0224.810] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\S1WHxrs Dm-PA7m.png.locked", nBufferLength=0x43, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\S1WHxrs Dm-PA7m.png.locked", lpFilePart=0x0) returned 0x42 [0224.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb80) returned 1 [0224.810] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\S1WHxrs Dm-PA7m.png.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\s1whxrs dm-pa7m.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0224.811] GetFileType (hFile=0x37c) returned 0x1 [0224.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb7c) returned 1 [0224.811] GetFileType (hFile=0x37c) returned 0x1 [0225.990] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\S1WHxrs Dm-PA7m.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0225.990] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\S1WHxrs Dm-PA7m.png", nBufferLength=0x3c, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\S1WHxrs Dm-PA7m.png", lpFilePart=0x0) returned 0x3b [0225.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb80) returned 1 [0225.990] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\S1WHxrs Dm-PA7m.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\s1whxrs dm-pa7m.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0225.990] GetFileType (hFile=0x378) returned 0x1 [0225.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb7c) returned 1 [0225.990] GetFileType (hFile=0x378) returned 0x1 [0225.993] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec34, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec34*=0x18c78, lpOverlapped=0x0) returned 1 [0226.010] WriteFile (in: hFile=0x37c, lpBuffer=0x26bc4a0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec0c, lpOverlapped=0x0 | out: lpBuffer=0x26bc4a0*, lpNumberOfBytesWritten=0x8fec0c*=0x1000, lpOverlapped=0x0) returned 1 [0226.011] WriteFile (in: hFile=0x37c, lpBuffer=0x376a4c8*, nNumberOfBytesToWrite=0x17c90, lpNumberOfBytesWritten=0x8fec0c, lpOverlapped=0x0 | out: lpBuffer=0x376a4c8*, lpNumberOfBytesWritten=0x8fec0c*=0x17c90, lpOverlapped=0x0) returned 1 [0226.013] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec34, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec34*=0x0, lpOverlapped=0x0) returned 1 [0226.013] CloseHandle (hObject=0x378) returned 1 [0226.013] WriteFile (in: hFile=0x37c, lpBuffer=0x26bc4a0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8febd4, lpOverlapped=0x0 | out: lpBuffer=0x26bc4a0*, lpNumberOfBytesWritten=0x8febd4*=0x10, lpOverlapped=0x0) returned 1 [0226.013] CloseHandle (hObject=0x37c) returned 1 [0226.016] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\S1WHxrs Dm-PA7m.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0226.016] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\S1WHxrs Dm-PA7m.png", nBufferLength=0x3c, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\S1WHxrs Dm-PA7m.png", lpFilePart=0x0) returned 0x3b [0226.017] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\S1WHxrs Dm-PA7m.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\s1whxrs dm-pa7m.png")) returned 1 [0226.065] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\XVnVVs4dA7ikVtE9V.bmp.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x45 [0226.065] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\XVnVVs4dA7ikVtE9V.bmp.locked", nBufferLength=0x45, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\XVnVVs4dA7ikVtE9V.bmp.locked", lpFilePart=0x0) returned 0x44 [0226.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb80) returned 1 [0226.066] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\XVnVVs4dA7ikVtE9V.bmp.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\xvnvvs4da7ikvte9v.bmp.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0226.066] GetFileType (hFile=0x37c) returned 0x1 [0226.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb7c) returned 1 [0226.066] GetFileType (hFile=0x37c) returned 0x1 [0227.091] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\XVnVVs4dA7ikVtE9V.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0227.091] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\XVnVVs4dA7ikVtE9V.bmp", nBufferLength=0x3e, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\XVnVVs4dA7ikVtE9V.bmp", lpFilePart=0x0) returned 0x3d [0227.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb80) returned 1 [0227.092] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\XVnVVs4dA7ikVtE9V.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\xvnvvs4da7ikvte9v.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0227.092] GetFileType (hFile=0x378) returned 0x1 [0227.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb7c) returned 1 [0227.092] GetFileType (hFile=0x378) returned 0x1 [0227.095] ReadFile (in: hFile=0x378, lpBuffer=0x3782178, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec34, lpOverlapped=0x0 | out: lpBuffer=0x3782178*, lpNumberOfBytesRead=0x8fec34*=0x186dd, lpOverlapped=0x0) returned 1 [0227.143] WriteFile (in: hFile=0x37c, lpBuffer=0x27a2240*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec0c, lpOverlapped=0x0 | out: lpBuffer=0x27a2240*, lpNumberOfBytesWritten=0x8fec0c*=0x1000, lpOverlapped=0x0) returned 1 [0227.144] WriteFile (in: hFile=0x37c, lpBuffer=0x3883178*, nNumberOfBytesToWrite=0x176f0, lpNumberOfBytesWritten=0x8fec0c, lpOverlapped=0x0 | out: lpBuffer=0x3883178*, lpNumberOfBytesWritten=0x8fec0c*=0x176f0, lpOverlapped=0x0) returned 1 [0227.146] ReadFile (in: hFile=0x378, lpBuffer=0x3782178, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec34, lpOverlapped=0x0 | out: lpBuffer=0x3782178*, lpNumberOfBytesRead=0x8fec34*=0x0, lpOverlapped=0x0) returned 1 [0227.146] CloseHandle (hObject=0x378) returned 1 [0227.146] WriteFile (in: hFile=0x37c, lpBuffer=0x27a2240*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8febd4, lpOverlapped=0x0 | out: lpBuffer=0x27a2240*, lpNumberOfBytesWritten=0x8febd4*=0x10, lpOverlapped=0x0) returned 1 [0227.146] CloseHandle (hObject=0x37c) returned 1 [0227.149] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\XVnVVs4dA7ikVtE9V.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0227.149] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\XVnVVs4dA7ikVtE9V.bmp", nBufferLength=0x3e, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\XVnVVs4dA7ikVtE9V.bmp", lpFilePart=0x0) returned 0x3d [0227.150] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\XVnVVs4dA7ikVtE9V.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\xvnvvs4da7ikvte9v.bmp")) returned 1 [0227.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed08) returned 1 [0227.151] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0227.151] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-", nBufferLength=0x28, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-", lpFilePart=0x0) returned 0x27 [0227.152] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\*", lpFindFileData=0x8fea30 | out: lpFindFileData=0x8fea30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb899f990, ftCreationTime.dwHighDateTime=0x1d5ede5, ftLastAccessTime.dwLowDateTime=0xfd93cd60, ftLastAccessTime.dwHighDateTime=0x1d5e899, ftLastWriteTime.dwLowDateTime=0xa01d9035, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9609c8 [0227.152] FindNextFileW (in: hFindFile=0x9609c8, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb899f990, ftCreationTime.dwHighDateTime=0x1d5ede5, ftLastAccessTime.dwLowDateTime=0xfd93cd60, ftLastAccessTime.dwHighDateTime=0x1d5e899, ftLastWriteTime.dwLowDateTime=0xa01d9035, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.153] FindNextFileW (in: hFindFile=0x9609c8, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956ce7f4, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0x956ce7f4, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0x9688a137, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x11c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="-I-vQylmw8Ifl.jpg.locked", cAlternateFileName="-I-VQY~1.LOC")) returned 1 [0227.153] FindNextFileW (in: hFindFile=0x9609c8, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x969228d3, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0x969228d3, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0x97f01f4f, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xc5f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="36sUlNDBK_1qZR_kbQ5A.bmp.locked", cAlternateFileName="36SULN~1.LOC")) returned 1 [0227.153] FindNextFileW (in: hFindFile=0x9609c8, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97f9a6de, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0x97f9a6de, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0x9955fb41, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x11e90, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGIsPmhqq7 0v6w1Q.png.locked", cAlternateFileName="CGISPM~1.LOC")) returned 1 [0227.153] FindNextFileW (in: hFindFile=0x9609c8, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x285b4af0, ftCreationTime.dwHighDateTime=0x1d5e1a6, ftLastAccessTime.dwLowDateTime=0xfd4ec400, ftLastAccessTime.dwHighDateTime=0x1d5e86b, ftLastWriteTime.dwLowDateTime=0xfd4ec400, ftLastWriteTime.dwHighDateTime=0x1d5e86b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CZUf tqlcPkMdYYqO", cAlternateFileName="CZUFTQ~1")) returned 1 [0227.153] FindNextFileW (in: hFindFile=0x9609c8, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x995d2579, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0x995d2579, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0x9a3adda2, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xc900, dwReserved0=0x0, dwReserved1=0x0, cFileName="Inux dk8bmT4or7wBr.png.locked", cAlternateFileName="INUXDK~1.LOC")) returned 1 [0227.153] FindNextFileW (in: hFindFile=0x9609c8, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a3d3f4e, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0x9a3d3f4e, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0x9ba36189, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x10840, dwReserved0=0x0, dwReserved1=0x0, cFileName="ivuRLbIQ1akqO6uxG5ko.gif.locked", cAlternateFileName="IVURLB~1.LOC")) returned 1 [0227.154] FindNextFileW (in: hFindFile=0x9609c8, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9baceb59, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0x9baceb59, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0x9cd48f11, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x1b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="jvvEVXOvwgvX.bmp.locked", cAlternateFileName="JVVEVX~1.LOC")) returned 1 [0227.154] FindNextFileW (in: hFindFile=0x9609c8, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cd9533d, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0x9cd9533d, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0x9da516ed, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xa830, dwReserved0=0x0, dwReserved1=0x0, cFileName="l5IYWWMz.png.locked", cAlternateFileName="L5IYWW~1.LOC")) returned 1 [0227.154] FindNextFileW (in: hFindFile=0x9609c8, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9da516ed, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0x9da516ed, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0x9eb7f00b, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x7600, dwReserved0=0x0, dwReserved1=0x0, cFileName="QkOqp.png.locked", cAlternateFileName="QKOQPP~1.LOC")) returned 1 [0227.154] FindNextFileW (in: hFindFile=0x9609c8, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9eb7f00b, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0x9eb7f00b, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0x9f71f0a2, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x18ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S1WHxrs Dm-PA7m.png.locked", cAlternateFileName="S1WHXR~1.LOC")) returned 1 [0227.154] FindNextFileW (in: hFindFile=0x9609c8, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f790d7d, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0x9f790d7d, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xa01d9035, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x18700, dwReserved0=0x0, dwReserved1=0x0, cFileName="XVnVVs4dA7ikVtE9V.bmp.locked", cAlternateFileName="XVNVVS~1.LOC")) returned 1 [0227.154] FindNextFileW (in: hFindFile=0x9609c8, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f790d7d, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0x9f790d7d, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xa01d9035, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x18700, dwReserved0=0x0, dwReserved1=0x0, cFileName="XVnVVs4dA7ikVtE9V.bmp.locked", cAlternateFileName="XVNVVS~1.LOC")) returned 0 [0227.154] FindClose (in: hFindFile=0x9609c8 | out: hFindFile=0x9609c8) returned 1 [0227.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecc4) returned 1 [0227.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd0) returned 1 [0227.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feca4) returned 1 [0227.155] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0227.155] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO", nBufferLength=0x3a, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO", lpFilePart=0x0) returned 0x39 [0227.155] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\*", lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x285b4af0, ftCreationTime.dwHighDateTime=0x1d5e1a6, ftLastAccessTime.dwLowDateTime=0xfd4ec400, ftLastAccessTime.dwHighDateTime=0x1d5e86b, ftLastWriteTime.dwLowDateTime=0xfd4ec400, ftLastWriteTime.dwHighDateTime=0x1d5e86b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x960748 [0227.155] FindNextFileW (in: hFindFile=0x960748, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x285b4af0, ftCreationTime.dwHighDateTime=0x1d5e1a6, ftLastAccessTime.dwLowDateTime=0xfd4ec400, ftLastAccessTime.dwHighDateTime=0x1d5e86b, ftLastWriteTime.dwLowDateTime=0xfd4ec400, ftLastWriteTime.dwHighDateTime=0x1d5e86b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.156] FindNextFileW (in: hFindFile=0x960748, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45196810, ftCreationTime.dwHighDateTime=0x1d5e341, ftLastAccessTime.dwLowDateTime=0x27c6efe0, ftLastAccessTime.dwHighDateTime=0x1d5e106, ftLastWriteTime.dwLowDateTime=0x27c6efe0, ftLastWriteTime.dwHighDateTime=0x1d5e106, nFileSizeHigh=0x0, nFileSizeLow=0x15835, dwReserved0=0x0, dwReserved1=0x0, cFileName="6-RjFIuJLJh.jpg", cAlternateFileName="6-RJFI~1.JPG")) returned 1 [0227.156] FindNextFileW (in: hFindFile=0x960748, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ca040d0, ftCreationTime.dwHighDateTime=0x1d5ee4d, ftLastAccessTime.dwLowDateTime=0xad73ca90, ftLastAccessTime.dwHighDateTime=0x1d5e61b, ftLastWriteTime.dwLowDateTime=0xad73ca90, ftLastWriteTime.dwHighDateTime=0x1d5e61b, nFileSizeHigh=0x0, nFileSizeLow=0x1ed7, dwReserved0=0x0, dwReserved1=0x0, cFileName="7d3Y6juDmbs.png", cAlternateFileName="7D3Y6J~1.PNG")) returned 1 [0227.156] FindNextFileW (in: hFindFile=0x960748, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x311f7540, ftCreationTime.dwHighDateTime=0x1d5ebb9, ftLastAccessTime.dwLowDateTime=0x5b3cc170, ftLastAccessTime.dwHighDateTime=0x1d5eb5a, ftLastWriteTime.dwLowDateTime=0x5b3cc170, ftLastWriteTime.dwHighDateTime=0x1d5eb5a, nFileSizeHigh=0x0, nFileSizeLow=0x8a59, dwReserved0=0x0, dwReserved1=0x0, cFileName="8xxtQxGDlp.gif", cAlternateFileName="8XXTQX~1.GIF")) returned 1 [0227.156] FindNextFileW (in: hFindFile=0x960748, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaecd220, ftCreationTime.dwHighDateTime=0x1d5e6d8, ftLastAccessTime.dwLowDateTime=0x206688a0, ftLastAccessTime.dwHighDateTime=0x1d5e296, ftLastWriteTime.dwLowDateTime=0x206688a0, ftLastWriteTime.dwHighDateTime=0x1d5e296, nFileSizeHigh=0x0, nFileSizeLow=0x1724b, dwReserved0=0x0, dwReserved1=0x0, cFileName="c-yT.bmp", cAlternateFileName="")) returned 1 [0227.156] FindNextFileW (in: hFindFile=0x960748, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae7efa00, ftCreationTime.dwHighDateTime=0x1d5e12e, ftLastAccessTime.dwLowDateTime=0x713f2590, ftLastAccessTime.dwHighDateTime=0x1d5e910, ftLastWriteTime.dwLowDateTime=0x713f2590, ftLastWriteTime.dwHighDateTime=0x1d5e910, nFileSizeHigh=0x0, nFileSizeLow=0x11bf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHYDLYWbYsGpbVD.gif", cAlternateFileName="CHYDLY~1.GIF")) returned 1 [0227.157] FindNextFileW (in: hFindFile=0x960748, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf81590, ftCreationTime.dwHighDateTime=0x1d5f054, ftLastAccessTime.dwLowDateTime=0xa72689a0, ftLastAccessTime.dwHighDateTime=0x1d5e6fe, ftLastWriteTime.dwLowDateTime=0xa72689a0, ftLastWriteTime.dwHighDateTime=0x1d5e6fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DNqI0M", cAlternateFileName="")) returned 1 [0227.157] FindNextFileW (in: hFindFile=0x960748, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3f25100, ftCreationTime.dwHighDateTime=0x1d5e931, ftLastAccessTime.dwLowDateTime=0xa0cbd7e0, ftLastAccessTime.dwHighDateTime=0x1d5ee47, ftLastWriteTime.dwLowDateTime=0xa0cbd7e0, ftLastWriteTime.dwHighDateTime=0x1d5ee47, nFileSizeHigh=0x0, nFileSizeLow=0xc91b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gg8 5lLeHHAOjbU.png", cAlternateFileName="GG85LL~1.PNG")) returned 1 [0227.157] FindNextFileW (in: hFindFile=0x960748, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x346f6b40, ftCreationTime.dwHighDateTime=0x1d5e300, ftLastAccessTime.dwLowDateTime=0xe87b3480, ftLastAccessTime.dwHighDateTime=0x1d5ee3a, ftLastWriteTime.dwLowDateTime=0xe87b3480, ftLastWriteTime.dwHighDateTime=0x1d5ee3a, nFileSizeHigh=0x0, nFileSizeLow=0x16ef2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ghQmrENna-.gif", cAlternateFileName="GHQMRE~1.GIF")) returned 1 [0227.157] FindNextFileW (in: hFindFile=0x960748, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x393e04c0, ftCreationTime.dwHighDateTime=0x1d5e2c8, ftLastAccessTime.dwLowDateTime=0xb3abf1d0, ftLastAccessTime.dwHighDateTime=0x1d5e193, ftLastWriteTime.dwLowDateTime=0xb3abf1d0, ftLastWriteTime.dwHighDateTime=0x1d5e193, nFileSizeHigh=0x0, nFileSizeLow=0x12657, dwReserved0=0x0, dwReserved1=0x0, cFileName="lZ7uxeal.png", cAlternateFileName="")) returned 1 [0227.157] FindNextFileW (in: hFindFile=0x960748, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28c22f0, ftCreationTime.dwHighDateTime=0x1d5e9f7, ftLastAccessTime.dwLowDateTime=0x8b8a9170, ftLastAccessTime.dwHighDateTime=0x1d5e57b, ftLastWriteTime.dwLowDateTime=0x8b8a9170, ftLastWriteTime.dwHighDateTime=0x1d5e57b, nFileSizeHigh=0x0, nFileSizeLow=0x5ce9, dwReserved0=0x0, dwReserved1=0x0, cFileName="nJmd8TPS_Nws_Rync.jpg", cAlternateFileName="NJMD8T~1.JPG")) returned 1 [0227.157] FindNextFileW (in: hFindFile=0x960748, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa207120, ftCreationTime.dwHighDateTime=0x1d5eb0e, ftLastAccessTime.dwLowDateTime=0x4ba339e0, ftLastAccessTime.dwHighDateTime=0x1d5f061, ftLastWriteTime.dwLowDateTime=0x4ba339e0, ftLastWriteTime.dwHighDateTime=0x1d5f061, nFileSizeHigh=0x0, nFileSizeLow=0x105ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yw9swM0ZUxGA.bmp", cAlternateFileName="YW9SWM~1.BMP")) returned 1 [0227.157] FindNextFileW (in: hFindFile=0x960748, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0227.158] FindClose (in: hFindFile=0x960748 | out: hFindFile=0x960748) returned 1 [0227.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0227.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec6c) returned 1 [0227.159] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\6-RjFIuJLJh.jpg.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0227.159] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\6-RjFIuJLJh.jpg.locked", nBufferLength=0x51, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\6-RjFIuJLJh.jpg.locked", lpFilePart=0x0) returned 0x50 [0227.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb1c) returned 1 [0227.159] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\6-RjFIuJLJh.jpg.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\6-rjfiujljh.jpg.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0227.159] GetFileType (hFile=0x37c) returned 0x1 [0227.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb18) returned 1 [0227.159] GetFileType (hFile=0x37c) returned 0x1 [0229.024] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\6-RjFIuJLJh.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0229.024] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\6-RjFIuJLJh.jpg", nBufferLength=0x4a, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\6-RjFIuJLJh.jpg", lpFilePart=0x0) returned 0x49 [0229.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb1c) returned 1 [0229.024] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\6-RjFIuJLJh.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\6-rjfiujljh.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0229.025] GetFileType (hFile=0x378) returned 0x1 [0229.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb18) returned 1 [0229.025] GetFileType (hFile=0x378) returned 0x1 [0229.027] ReadFile (in: hFile=0x378, lpBuffer=0x389a888, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8febd0, lpOverlapped=0x0 | out: lpBuffer=0x389a888*, lpNumberOfBytesRead=0x8febd0*=0x15835, lpOverlapped=0x0) returned 1 [0229.094] WriteFile (in: hFile=0x37c, lpBuffer=0x269f620*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feba8, lpOverlapped=0x0 | out: lpBuffer=0x269f620*, lpNumberOfBytesWritten=0x8feba8*=0x1000, lpOverlapped=0x0) returned 1 [0229.095] WriteFile (in: hFile=0x37c, lpBuffer=0x366a4a8*, nNumberOfBytesToWrite=0x14850, lpNumberOfBytesWritten=0x8feba8, lpOverlapped=0x0 | out: lpBuffer=0x366a4a8*, lpNumberOfBytesWritten=0x8feba8*=0x14850, lpOverlapped=0x0) returned 1 [0229.097] ReadFile (in: hFile=0x378, lpBuffer=0x389a888, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8febd0, lpOverlapped=0x0 | out: lpBuffer=0x389a888*, lpNumberOfBytesRead=0x8febd0*=0x0, lpOverlapped=0x0) returned 1 [0229.097] CloseHandle (hObject=0x378) returned 1 [0229.097] WriteFile (in: hFile=0x37c, lpBuffer=0x269f620*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8feb70, lpOverlapped=0x0 | out: lpBuffer=0x269f620*, lpNumberOfBytesWritten=0x8feb70*=0x10, lpOverlapped=0x0) returned 1 [0229.097] CloseHandle (hObject=0x37c) returned 1 [0229.100] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\6-RjFIuJLJh.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0229.100] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\6-RjFIuJLJh.jpg", nBufferLength=0x4a, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\6-RjFIuJLJh.jpg", lpFilePart=0x0) returned 0x49 [0229.100] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\6-RjFIuJLJh.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\6-rjfiujljh.jpg")) returned 1 [0229.252] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\7d3Y6juDmbs.png.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0229.252] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\7d3Y6juDmbs.png.locked", nBufferLength=0x51, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\7d3Y6juDmbs.png.locked", lpFilePart=0x0) returned 0x50 [0229.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb1c) returned 1 [0229.253] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\7d3Y6juDmbs.png.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\7d3y6judmbs.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0229.253] GetFileType (hFile=0x37c) returned 0x1 [0229.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb18) returned 1 [0229.253] GetFileType (hFile=0x37c) returned 0x1 [0230.469] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\7d3Y6juDmbs.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0230.469] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\7d3Y6juDmbs.png", nBufferLength=0x4a, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\7d3Y6juDmbs.png", lpFilePart=0x0) returned 0x49 [0230.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb1c) returned 1 [0230.469] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\7d3Y6juDmbs.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\7d3y6judmbs.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0230.470] GetFileType (hFile=0x378) returned 0x1 [0230.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb18) returned 1 [0230.470] GetFileType (hFile=0x378) returned 0x1 [0230.471] ReadFile (in: hFile=0x378, lpBuffer=0x367ed18, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8febd0, lpOverlapped=0x0 | out: lpBuffer=0x367ed18*, lpNumberOfBytesRead=0x8febd0*=0x1ed7, lpOverlapped=0x0) returned 1 [0230.472] WriteFile (in: hFile=0x37c, lpBuffer=0x2784498*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feba8, lpOverlapped=0x0 | out: lpBuffer=0x2784498*, lpNumberOfBytesWritten=0x8feba8*=0x1000, lpOverlapped=0x0) returned 1 [0230.473] ReadFile (in: hFile=0x378, lpBuffer=0x367ed18, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8febd0, lpOverlapped=0x0 | out: lpBuffer=0x367ed18*, lpNumberOfBytesRead=0x8febd0*=0x0, lpOverlapped=0x0) returned 1 [0230.473] CloseHandle (hObject=0x378) returned 1 [0230.473] WriteFile (in: hFile=0x37c, lpBuffer=0x2784498*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x8feb70, lpOverlapped=0x0 | out: lpBuffer=0x2784498*, lpNumberOfBytesWritten=0x8feb70*=0xf00, lpOverlapped=0x0) returned 1 [0230.474] CloseHandle (hObject=0x37c) returned 1 [0230.475] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\7d3Y6juDmbs.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0230.475] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\7d3Y6juDmbs.png", nBufferLength=0x4a, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\7d3Y6juDmbs.png", lpFilePart=0x0) returned 0x49 [0230.475] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\7d3Y6juDmbs.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\7d3y6judmbs.png")) returned 1 [0230.514] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\8xxtQxGDlp.gif.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0230.514] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\8xxtQxGDlp.gif.locked", nBufferLength=0x50, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\8xxtQxGDlp.gif.locked", lpFilePart=0x0) returned 0x4f [0230.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb1c) returned 1 [0230.514] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\8xxtQxGDlp.gif.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\8xxtqxgdlp.gif.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0230.515] GetFileType (hFile=0x37c) returned 0x1 [0230.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb18) returned 1 [0230.515] GetFileType (hFile=0x37c) returned 0x1 [0231.794] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\8xxtQxGDlp.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0231.794] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\8xxtQxGDlp.gif", nBufferLength=0x49, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\8xxtQxGDlp.gif", lpFilePart=0x0) returned 0x48 [0231.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb1c) returned 1 [0231.794] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\8xxtQxGDlp.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\8xxtqxgdlp.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0231.795] GetFileType (hFile=0x378) returned 0x1 [0231.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb18) returned 1 [0231.795] GetFileType (hFile=0x378) returned 0x1 [0231.795] ReadFile (in: hFile=0x378, lpBuffer=0x377ed38, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8febd0, lpOverlapped=0x0 | out: lpBuffer=0x377ed38*, lpNumberOfBytesRead=0x8febd0*=0x8a59, lpOverlapped=0x0) returned 1 [0231.797] WriteFile (in: hFile=0x37c, lpBuffer=0x286c4dc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feba8, lpOverlapped=0x0 | out: lpBuffer=0x286c4dc*, lpNumberOfBytesWritten=0x8feba8*=0x1000, lpOverlapped=0x0) returned 1 [0231.799] WriteFile (in: hFile=0x37c, lpBuffer=0x286e9ac*, nNumberOfBytesToWrite=0x7a70, lpNumberOfBytesWritten=0x8feba8, lpOverlapped=0x0 | out: lpBuffer=0x286e9ac*, lpNumberOfBytesWritten=0x8feba8*=0x7a70, lpOverlapped=0x0) returned 1 [0231.799] ReadFile (in: hFile=0x378, lpBuffer=0x377ed38, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8febd0, lpOverlapped=0x0 | out: lpBuffer=0x377ed38*, lpNumberOfBytesRead=0x8febd0*=0x0, lpOverlapped=0x0) returned 1 [0231.799] CloseHandle (hObject=0x378) returned 1 [0231.800] WriteFile (in: hFile=0x37c, lpBuffer=0x286c4dc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8feb70, lpOverlapped=0x0 | out: lpBuffer=0x286c4dc*, lpNumberOfBytesWritten=0x8feb70*=0x10, lpOverlapped=0x0) returned 1 [0231.800] CloseHandle (hObject=0x37c) returned 1 [0231.802] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\8xxtQxGDlp.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0231.802] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\8xxtQxGDlp.gif", nBufferLength=0x49, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\8xxtQxGDlp.gif", lpFilePart=0x0) returned 0x48 [0231.802] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\8xxtQxGDlp.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\8xxtqxgdlp.gif")) returned 1 [0231.815] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\c-yT.bmp.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0231.815] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\c-yT.bmp.locked", nBufferLength=0x4a, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\c-yT.bmp.locked", lpFilePart=0x0) returned 0x49 [0231.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb1c) returned 1 [0231.815] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\c-yT.bmp.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\c-yt.bmp.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0231.816] GetFileType (hFile=0x37c) returned 0x1 [0231.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb18) returned 1 [0231.816] GetFileType (hFile=0x37c) returned 0x1 [0232.861] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\c-yT.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0232.861] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\c-yT.bmp", nBufferLength=0x43, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\c-yT.bmp", lpFilePart=0x0) returned 0x42 [0232.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb1c) returned 1 [0232.861] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\c-yT.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\c-yt.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0232.862] GetFileType (hFile=0x378) returned 0x1 [0232.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb18) returned 1 [0232.862] GetFileType (hFile=0x378) returned 0x1 [0232.865] ReadFile (in: hFile=0x378, lpBuffer=0x399a8a8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8febd0, lpOverlapped=0x0 | out: lpBuffer=0x399a8a8*, lpNumberOfBytesRead=0x8febd0*=0x1724b, lpOverlapped=0x0) returned 1 [0232.896] WriteFile (in: hFile=0x37c, lpBuffer=0x275b1d4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feba8, lpOverlapped=0x0 | out: lpBuffer=0x275b1d4*, lpNumberOfBytesWritten=0x8feba8*=0x1000, lpOverlapped=0x0) returned 1 [0232.898] WriteFile (in: hFile=0x37c, lpBuffer=0x387fd38*, nNumberOfBytesToWrite=0x16260, lpNumberOfBytesWritten=0x8feba8, lpOverlapped=0x0 | out: lpBuffer=0x387fd38*, lpNumberOfBytesWritten=0x8feba8*=0x16260, lpOverlapped=0x0) returned 1 [0232.900] ReadFile (in: hFile=0x378, lpBuffer=0x399a8a8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8febd0, lpOverlapped=0x0 | out: lpBuffer=0x399a8a8*, lpNumberOfBytesRead=0x8febd0*=0x0, lpOverlapped=0x0) returned 1 [0232.900] CloseHandle (hObject=0x378) returned 1 [0232.900] WriteFile (in: hFile=0x37c, lpBuffer=0x275b1d4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8feb70, lpOverlapped=0x0 | out: lpBuffer=0x275b1d4*, lpNumberOfBytesWritten=0x8feb70*=0x10, lpOverlapped=0x0) returned 1 [0232.900] CloseHandle (hObject=0x37c) returned 1 [0232.903] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\c-yT.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0232.904] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\c-yT.bmp", nBufferLength=0x43, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\c-yT.bmp", lpFilePart=0x0) returned 0x42 [0232.904] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\c-yT.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\c-yt.bmp")) returned 1 [0232.956] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\CHYDLYWbYsGpbVD.gif.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0232.956] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\CHYDLYWbYsGpbVD.gif.locked", nBufferLength=0x55, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\CHYDLYWbYsGpbVD.gif.locked", lpFilePart=0x0) returned 0x54 [0232.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb1c) returned 1 [0232.956] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\CHYDLYWbYsGpbVD.gif.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\chydlywbysgpbvd.gif.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0232.957] GetFileType (hFile=0x37c) returned 0x1 [0232.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb18) returned 1 [0232.957] GetFileType (hFile=0x37c) returned 0x1 [0234.056] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\CHYDLYWbYsGpbVD.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0234.056] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\CHYDLYWbYsGpbVD.gif", nBufferLength=0x4e, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\CHYDLYWbYsGpbVD.gif", lpFilePart=0x0) returned 0x4d [0234.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb1c) returned 1 [0234.056] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\CHYDLYWbYsGpbVD.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\chydlywbysgpbvd.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0234.056] GetFileType (hFile=0x378) returned 0x1 [0234.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb18) returned 1 [0234.056] GetFileType (hFile=0x378) returned 0x1 [0234.060] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8febd0, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8febd0*=0x11bf1, lpOverlapped=0x0) returned 1 [0234.064] WriteFile (in: hFile=0x37c, lpBuffer=0x28409ec*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feba8, lpOverlapped=0x0 | out: lpBuffer=0x28409ec*, lpNumberOfBytesWritten=0x8feba8*=0x1000, lpOverlapped=0x0) returned 1 [0234.065] WriteFile (in: hFile=0x37c, lpBuffer=0x2842ec4*, nNumberOfBytesToWrite=0x10c10, lpNumberOfBytesWritten=0x8feba8, lpOverlapped=0x0 | out: lpBuffer=0x2842ec4*, lpNumberOfBytesWritten=0x8feba8*=0x10c10, lpOverlapped=0x0) returned 1 [0234.066] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8febd0, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8febd0*=0x0, lpOverlapped=0x0) returned 1 [0234.066] CloseHandle (hObject=0x378) returned 1 [0234.066] WriteFile (in: hFile=0x37c, lpBuffer=0x28409ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8feb70, lpOverlapped=0x0 | out: lpBuffer=0x28409ec*, lpNumberOfBytesWritten=0x8feb70*=0x10, lpOverlapped=0x0) returned 1 [0234.066] CloseHandle (hObject=0x37c) returned 1 [0234.069] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\CHYDLYWbYsGpbVD.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0234.069] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\CHYDLYWbYsGpbVD.gif", nBufferLength=0x4e, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\CHYDLYWbYsGpbVD.gif", lpFilePart=0x0) returned 0x4d [0234.069] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\CHYDLYWbYsGpbVD.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\chydlywbysgpbvd.gif")) returned 1 [0234.073] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\Gg8 5lLeHHAOjbU.png.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0234.073] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\Gg8 5lLeHHAOjbU.png.locked", nBufferLength=0x55, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\Gg8 5lLeHHAOjbU.png.locked", lpFilePart=0x0) returned 0x54 [0234.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb1c) returned 1 [0234.073] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\Gg8 5lLeHHAOjbU.png.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\gg8 5llehhaojbu.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0234.074] GetFileType (hFile=0x37c) returned 0x1 [0234.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb18) returned 1 [0234.074] GetFileType (hFile=0x37c) returned 0x1 [0235.005] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\Gg8 5lLeHHAOjbU.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0235.005] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\Gg8 5lLeHHAOjbU.png", nBufferLength=0x4e, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\Gg8 5lLeHHAOjbU.png", lpFilePart=0x0) returned 0x4d [0235.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb1c) returned 1 [0235.006] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\Gg8 5lLeHHAOjbU.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\gg8 5llehhaojbu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0235.006] GetFileType (hFile=0x378) returned 0x1 [0235.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb18) returned 1 [0235.006] GetFileType (hFile=0x378) returned 0x1 [0235.009] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8febd0, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8febd0*=0xc91b, lpOverlapped=0x0) returned 1 [0235.012] WriteFile (in: hFile=0x37c, lpBuffer=0x2735e44*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feba8, lpOverlapped=0x0 | out: lpBuffer=0x2735e44*, lpNumberOfBytesWritten=0x8feba8*=0x1000, lpOverlapped=0x0) returned 1 [0235.014] WriteFile (in: hFile=0x37c, lpBuffer=0x273831c*, nNumberOfBytesToWrite=0xb930, lpNumberOfBytesWritten=0x8feba8, lpOverlapped=0x0 | out: lpBuffer=0x273831c*, lpNumberOfBytesWritten=0x8feba8*=0xb930, lpOverlapped=0x0) returned 1 [0235.014] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8febd0, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8febd0*=0x0, lpOverlapped=0x0) returned 1 [0235.014] CloseHandle (hObject=0x378) returned 1 [0235.015] WriteFile (in: hFile=0x37c, lpBuffer=0x2735e44*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8feb70, lpOverlapped=0x0 | out: lpBuffer=0x2735e44*, lpNumberOfBytesWritten=0x8feb70*=0x10, lpOverlapped=0x0) returned 1 [0235.015] CloseHandle (hObject=0x37c) returned 1 [0235.017] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\Gg8 5lLeHHAOjbU.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0235.017] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\Gg8 5lLeHHAOjbU.png", nBufferLength=0x4e, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\Gg8 5lLeHHAOjbU.png", lpFilePart=0x0) returned 0x4d [0235.017] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\Gg8 5lLeHHAOjbU.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\gg8 5llehhaojbu.png")) returned 1 [0235.019] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\ghQmrENna-.gif.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0235.019] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\ghQmrENna-.gif.locked", nBufferLength=0x50, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\ghQmrENna-.gif.locked", lpFilePart=0x0) returned 0x4f [0235.019] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb1c) returned 1 [0235.020] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\ghQmrENna-.gif.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\ghqmrenna-.gif.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0235.020] GetFileType (hFile=0x37c) returned 0x1 [0235.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb18) returned 1 [0235.020] GetFileType (hFile=0x37c) returned 0x1 [0236.762] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\ghQmrENna-.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0236.762] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\ghQmrENna-.gif", nBufferLength=0x49, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\ghQmrENna-.gif", lpFilePart=0x0) returned 0x48 [0236.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb1c) returned 1 [0236.762] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\ghQmrENna-.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\ghqmrenna-.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0236.762] GetFileType (hFile=0x378) returned 0x1 [0236.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb18) returned 1 [0236.762] GetFileType (hFile=0x378) returned 0x1 [0236.765] ReadFile (in: hFile=0x378, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8febd0, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8febd0*=0x16ef2, lpOverlapped=0x0) returned 1 [0236.925] WriteFile (in: hFile=0x37c, lpBuffer=0x2827950*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feba8, lpOverlapped=0x0 | out: lpBuffer=0x2827950*, lpNumberOfBytesWritten=0x8feba8*=0x1000, lpOverlapped=0x0) returned 1 [0236.927] WriteFile (in: hFile=0x37c, lpBuffer=0x366a4a8*, nNumberOfBytesToWrite=0x15f10, lpNumberOfBytesWritten=0x8feba8, lpOverlapped=0x0 | out: lpBuffer=0x366a4a8*, lpNumberOfBytesWritten=0x8feba8*=0x15f10, lpOverlapped=0x0) returned 1 [0236.928] ReadFile (in: hFile=0x378, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8febd0, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8febd0*=0x0, lpOverlapped=0x0) returned 1 [0236.930] CloseHandle (hObject=0x378) returned 1 [0236.931] WriteFile (in: hFile=0x37c, lpBuffer=0x2827950*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8feb70, lpOverlapped=0x0 | out: lpBuffer=0x2827950*, lpNumberOfBytesWritten=0x8feb70*=0x10, lpOverlapped=0x0) returned 1 [0236.931] CloseHandle (hObject=0x37c) returned 1 [0236.933] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\ghQmrENna-.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0236.933] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\ghQmrENna-.gif", nBufferLength=0x49, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\ghQmrENna-.gif", lpFilePart=0x0) returned 0x48 [0236.934] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\ghQmrENna-.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\ghqmrenna-.gif")) returned 1 [0236.998] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\lZ7uxeal.png.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0236.998] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\lZ7uxeal.png.locked", nBufferLength=0x4e, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\lZ7uxeal.png.locked", lpFilePart=0x0) returned 0x4d [0236.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb1c) returned 1 [0236.998] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\lZ7uxeal.png.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\lz7uxeal.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0236.999] GetFileType (hFile=0x37c) returned 0x1 [0236.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb18) returned 1 [0236.999] GetFileType (hFile=0x37c) returned 0x1 [0238.509] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\lZ7uxeal.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0238.509] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\lZ7uxeal.png", nBufferLength=0x47, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\lZ7uxeal.png", lpFilePart=0x0) returned 0x46 [0238.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb1c) returned 1 [0238.509] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\lZ7uxeal.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\lz7uxeal.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0238.510] GetFileType (hFile=0x378) returned 0x1 [0238.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb18) returned 1 [0238.510] GetFileType (hFile=0x378) returned 0x1 [0238.513] ReadFile (in: hFile=0x378, lpBuffer=0x36803d8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8febd0, lpOverlapped=0x0 | out: lpBuffer=0x36803d8*, lpNumberOfBytesRead=0x8febd0*=0x12657, lpOverlapped=0x0) returned 1 [0238.517] WriteFile (in: hFile=0x37c, lpBuffer=0x270b760*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feba8, lpOverlapped=0x0 | out: lpBuffer=0x270b760*, lpNumberOfBytesWritten=0x8feba8*=0x1000, lpOverlapped=0x0) returned 1 [0238.521] WriteFile (in: hFile=0x37c, lpBuffer=0x270dc2c*, nNumberOfBytesToWrite=0x11670, lpNumberOfBytesWritten=0x8feba8, lpOverlapped=0x0 | out: lpBuffer=0x270dc2c*, lpNumberOfBytesWritten=0x8feba8*=0x11670, lpOverlapped=0x0) returned 1 [0238.522] ReadFile (in: hFile=0x378, lpBuffer=0x36803d8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8febd0, lpOverlapped=0x0 | out: lpBuffer=0x36803d8*, lpNumberOfBytesRead=0x8febd0*=0x0, lpOverlapped=0x0) returned 1 [0238.522] CloseHandle (hObject=0x378) returned 1 [0238.522] WriteFile (in: hFile=0x37c, lpBuffer=0x270b760*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8feb70, lpOverlapped=0x0 | out: lpBuffer=0x270b760*, lpNumberOfBytesWritten=0x8feb70*=0x10, lpOverlapped=0x0) returned 1 [0238.522] CloseHandle (hObject=0x37c) returned 1 [0238.525] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\lZ7uxeal.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0238.525] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\lZ7uxeal.png", nBufferLength=0x47, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\lZ7uxeal.png", lpFilePart=0x0) returned 0x46 [0238.525] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\lZ7uxeal.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\lz7uxeal.png")) returned 1 [0238.534] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\nJmd8TPS_Nws_Rync.jpg.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x57 [0238.534] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\nJmd8TPS_Nws_Rync.jpg.locked", nBufferLength=0x57, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\nJmd8TPS_Nws_Rync.jpg.locked", lpFilePart=0x0) returned 0x56 [0238.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb1c) returned 1 [0238.534] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\nJmd8TPS_Nws_Rync.jpg.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\njmd8tps_nws_rync.jpg.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0238.534] GetFileType (hFile=0x37c) returned 0x1 [0238.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb18) returned 1 [0238.535] GetFileType (hFile=0x37c) returned 0x1 [0239.645] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\nJmd8TPS_Nws_Rync.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0239.645] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\nJmd8TPS_Nws_Rync.jpg", nBufferLength=0x50, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\nJmd8TPS_Nws_Rync.jpg", lpFilePart=0x0) returned 0x4f [0239.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb1c) returned 1 [0239.645] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\nJmd8TPS_Nws_Rync.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\njmd8tps_nws_rync.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0239.645] GetFileType (hFile=0x378) returned 0x1 [0239.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb18) returned 1 [0239.645] GetFileType (hFile=0x378) returned 0x1 [0239.649] ReadFile (in: hFile=0x378, lpBuffer=0x3969528, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8febd0, lpOverlapped=0x0 | out: lpBuffer=0x3969528*, lpNumberOfBytesRead=0x8febd0*=0x5ce9, lpOverlapped=0x0) returned 1 [0239.690] WriteFile (in: hFile=0x37c, lpBuffer=0x28017f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feba8, lpOverlapped=0x0 | out: lpBuffer=0x28017f0*, lpNumberOfBytesWritten=0x8feba8*=0x1000, lpOverlapped=0x0) returned 1 [0239.691] WriteFile (in: hFile=0x37c, lpBuffer=0x2803ccc*, nNumberOfBytesToWrite=0x4d00, lpNumberOfBytesWritten=0x8feba8, lpOverlapped=0x0 | out: lpBuffer=0x2803ccc*, lpNumberOfBytesWritten=0x8feba8*=0x4d00, lpOverlapped=0x0) returned 1 [0239.691] ReadFile (in: hFile=0x378, lpBuffer=0x3969528, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8febd0, lpOverlapped=0x0 | out: lpBuffer=0x3969528*, lpNumberOfBytesRead=0x8febd0*=0x0, lpOverlapped=0x0) returned 1 [0239.691] CloseHandle (hObject=0x378) returned 1 [0239.692] WriteFile (in: hFile=0x37c, lpBuffer=0x28017f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8feb70, lpOverlapped=0x0 | out: lpBuffer=0x28017f0*, lpNumberOfBytesWritten=0x8feb70*=0x10, lpOverlapped=0x0) returned 1 [0239.692] CloseHandle (hObject=0x37c) returned 1 [0239.693] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\nJmd8TPS_Nws_Rync.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0239.693] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\nJmd8TPS_Nws_Rync.jpg", nBufferLength=0x50, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\nJmd8TPS_Nws_Rync.jpg", lpFilePart=0x0) returned 0x4f [0239.693] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\nJmd8TPS_Nws_Rync.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\njmd8tps_nws_rync.jpg")) returned 1 [0239.714] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\Yw9swM0ZUxGA.bmp.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0239.714] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\Yw9swM0ZUxGA.bmp.locked", nBufferLength=0x52, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\Yw9swM0ZUxGA.bmp.locked", lpFilePart=0x0) returned 0x51 [0239.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb1c) returned 1 [0239.714] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\Yw9swM0ZUxGA.bmp.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\yw9swm0zuxga.bmp.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0239.714] GetFileType (hFile=0x37c) returned 0x1 [0239.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb18) returned 1 [0239.715] GetFileType (hFile=0x37c) returned 0x1 [0240.806] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\Yw9swM0ZUxGA.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4b [0240.807] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\Yw9swM0ZUxGA.bmp", nBufferLength=0x4b, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\Yw9swM0ZUxGA.bmp", lpFilePart=0x0) returned 0x4a [0240.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb1c) returned 1 [0240.807] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\Yw9swM0ZUxGA.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\yw9swm0zuxga.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0240.807] GetFileType (hFile=0x378) returned 0x1 [0240.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb18) returned 1 [0240.807] GetFileType (hFile=0x378) returned 0x1 [0240.810] ReadFile (in: hFile=0x378, lpBuffer=0x3a69548, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8febd0, lpOverlapped=0x0 | out: lpBuffer=0x3a69548*, lpNumberOfBytesRead=0x8febd0*=0x105ae, lpOverlapped=0x0) returned 1 [0240.824] WriteFile (in: hFile=0x37c, lpBuffer=0x26ede5c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feba8, lpOverlapped=0x0 | out: lpBuffer=0x26ede5c*, lpNumberOfBytesWritten=0x8feba8*=0x1000, lpOverlapped=0x0) returned 1 [0240.825] WriteFile (in: hFile=0x37c, lpBuffer=0x26f0330*, nNumberOfBytesToWrite=0xf5c0, lpNumberOfBytesWritten=0x8feba8, lpOverlapped=0x0 | out: lpBuffer=0x26f0330*, lpNumberOfBytesWritten=0x8feba8*=0xf5c0, lpOverlapped=0x0) returned 1 [0240.826] ReadFile (in: hFile=0x378, lpBuffer=0x3a69548, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8febd0, lpOverlapped=0x0 | out: lpBuffer=0x3a69548*, lpNumberOfBytesRead=0x8febd0*=0x0, lpOverlapped=0x0) returned 1 [0240.826] CloseHandle (hObject=0x378) returned 1 [0240.826] WriteFile (in: hFile=0x37c, lpBuffer=0x26ede5c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8feb70, lpOverlapped=0x0 | out: lpBuffer=0x26ede5c*, lpNumberOfBytesWritten=0x8feb70*=0x10, lpOverlapped=0x0) returned 1 [0240.826] CloseHandle (hObject=0x37c) returned 1 [0240.828] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\Yw9swM0ZUxGA.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4b [0240.828] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\Yw9swM0ZUxGA.bmp", nBufferLength=0x4b, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\Yw9swM0ZUxGA.bmp", lpFilePart=0x0) returned 0x4a [0240.828] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\Yw9swM0ZUxGA.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\yw9swm0zuxga.bmp")) returned 1 [0240.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feca4) returned 1 [0240.831] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0240.831] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO", nBufferLength=0x3a, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO", lpFilePart=0x0) returned 0x39 [0240.831] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\*", lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x285b4af0, ftCreationTime.dwHighDateTime=0x1d5e1a6, ftLastAccessTime.dwLowDateTime=0xa5fba321, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xa8465f49, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x960a48 [0240.832] FindNextFileW (in: hFindFile=0x960a48, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x285b4af0, ftCreationTime.dwHighDateTime=0x1d5e1a6, ftLastAccessTime.dwLowDateTime=0xa5fba321, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xa8465f49, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0240.832] FindNextFileW (in: hFindFile=0x960a48, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa01ff333, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xa01ff333, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xa147c028, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x15860, dwReserved0=0x0, dwReserved1=0x0, cFileName="6-RjFIuJLJh.jpg.locked", cAlternateFileName="6-RJFI~1.LOC")) returned 1 [0240.832] FindNextFileW (in: hFindFile=0x960a48, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa15f9816, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xa15f9816, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xa219a7e4, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x1f00, dwReserved0=0x0, dwReserved1=0x0, cFileName="7d3Y6juDmbs.png.locked", cAlternateFileName="7D3Y6J~1.LOC")) returned 1 [0240.832] FindNextFileW (in: hFindFile=0x960a48, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa21e53ec, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xa21e53ec, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xa2e435c9, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x8a80, dwReserved0=0x0, dwReserved1=0x0, cFileName="8xxtQxGDlp.gif.locked", cAlternateFileName="8XXTQX~1.LOC")) returned 1 [0240.833] FindNextFileW (in: hFindFile=0x960a48, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2e69d64, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xa2e69d64, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xa38cb706, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x17270, dwReserved0=0x0, dwReserved1=0x0, cFileName="c-yT.bmp.locked", cAlternateFileName="C-YTBM~1.LOC")) returned 1 [0240.833] FindNextFileW (in: hFindFile=0x960a48, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa393ddb6, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xa393ddb6, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xa43dcc77, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x11c20, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHYDLYWbYsGpbVD.gif.locked", cAlternateFileName="CHYDLY~1.LOC")) returned 1 [0240.833] FindNextFileW (in: hFindFile=0x960a48, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf81590, ftCreationTime.dwHighDateTime=0x1d5f054, ftLastAccessTime.dwLowDateTime=0xa72689a0, ftLastAccessTime.dwHighDateTime=0x1d5e6fe, ftLastWriteTime.dwLowDateTime=0xa72689a0, ftLastWriteTime.dwHighDateTime=0x1d5e6fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DNqI0M", cAlternateFileName="")) returned 1 [0240.833] FindNextFileW (in: hFindFile=0x960a48, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa43dcc77, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xa43dcc77, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xa4cf3a92, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xc940, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gg8 5lLeHHAOjbU.png.locked", cAlternateFileName="GG85LL~1.LOC")) returned 1 [0240.833] FindNextFileW (in: hFindFile=0x960a48, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4cf3a92, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xa4cf3a92, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xa5f22190, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x16f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="ghQmrENna-.gif.locked", cAlternateFileName="GHQMRE~1.LOC")) returned 1 [0240.833] FindNextFileW (in: hFindFile=0x960a48, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5fba321, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xa5fba321, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xa6e58586, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x12680, dwReserved0=0x0, dwReserved1=0x0, cFileName="lZ7uxeal.png.locked", cAlternateFileName="LZ7UXE~1.LOC")) returned 1 [0240.833] FindNextFileW (in: hFindFile=0x960a48, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6e7e8b9, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xa6e7e8b9, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xa79852b7, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x5d10, dwReserved0=0x0, dwReserved1=0x0, cFileName="nJmd8TPS_Nws_Rync.jpg.locked", cAlternateFileName="NJMD8T~1.LOC")) returned 1 [0240.834] FindNextFileW (in: hFindFile=0x960a48, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa79ab5ed, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xa79ab5ed, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xa843fd2e, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x105d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yw9swM0ZUxGA.bmp.locked", cAlternateFileName="YW9SWM~1.LOC")) returned 1 [0240.834] FindNextFileW (in: hFindFile=0x960a48, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa79ab5ed, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xa79ab5ed, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xa843fd2e, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x105d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yw9swM0ZUxGA.bmp.locked", cAlternateFileName="YW9SWM~1.LOC")) returned 0 [0240.834] FindClose (in: hFindFile=0x960a48 | out: hFindFile=0x960a48) returned 1 [0240.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0240.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec6c) returned 1 [0240.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec40) returned 1 [0240.834] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0240.834] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M", nBufferLength=0x41, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M", lpFilePart=0x0) returned 0x40 [0240.834] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\*", lpFindFileData=0x8fe968 | out: lpFindFileData=0x8fe968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf81590, ftCreationTime.dwHighDateTime=0x1d5f054, ftLastAccessTime.dwLowDateTime=0xa72689a0, ftLastAccessTime.dwHighDateTime=0x1d5e6fe, ftLastWriteTime.dwLowDateTime=0xa72689a0, ftLastWriteTime.dwHighDateTime=0x1d5e6fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x960a48 [0240.835] FindNextFileW (in: hFindFile=0x960a48, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf81590, ftCreationTime.dwHighDateTime=0x1d5f054, ftLastAccessTime.dwLowDateTime=0xa72689a0, ftLastAccessTime.dwHighDateTime=0x1d5e6fe, ftLastWriteTime.dwLowDateTime=0xa72689a0, ftLastWriteTime.dwHighDateTime=0x1d5e6fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0240.835] FindNextFileW (in: hFindFile=0x960a48, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c7640e0, ftCreationTime.dwHighDateTime=0x1d5ef2d, ftLastAccessTime.dwLowDateTime=0x578714b0, ftLastAccessTime.dwHighDateTime=0x1d5ecd4, ftLastWriteTime.dwLowDateTime=0x578714b0, ftLastWriteTime.dwHighDateTime=0x1d5ecd4, nFileSizeHigh=0x0, nFileSizeLow=0x15705, dwReserved0=0x0, dwReserved1=0x0, cFileName="9-TnJ3.bmp", cAlternateFileName="")) returned 1 [0240.835] FindNextFileW (in: hFindFile=0x960a48, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5aed500, ftCreationTime.dwHighDateTime=0x1d5f122, ftLastAccessTime.dwLowDateTime=0x206e6ad0, ftLastAccessTime.dwHighDateTime=0x1d5e8cb, ftLastWriteTime.dwLowDateTime=0x206e6ad0, ftLastWriteTime.dwHighDateTime=0x1d5e8cb, nFileSizeHigh=0x0, nFileSizeLow=0x32be, dwReserved0=0x0, dwReserved1=0x0, cFileName="b4fE6EgCqzdwvP95kfh.gif", cAlternateFileName="B4FE6E~1.GIF")) returned 1 [0240.835] FindNextFileW (in: hFindFile=0x960a48, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa63bdcc0, ftCreationTime.dwHighDateTime=0x1d5f018, ftLastAccessTime.dwLowDateTime=0xa71c680, ftLastAccessTime.dwHighDateTime=0x1d5eb2a, ftLastWriteTime.dwLowDateTime=0xa71c680, ftLastWriteTime.dwHighDateTime=0x1d5eb2a, nFileSizeHigh=0x0, nFileSizeLow=0x13bd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiCiaX TFUu0.gif", cAlternateFileName="DICIAX~1.GIF")) returned 1 [0240.835] FindNextFileW (in: hFindFile=0x960a48, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40a15410, ftCreationTime.dwHighDateTime=0x1d5e78c, ftLastAccessTime.dwLowDateTime=0x28d0cba0, ftLastAccessTime.dwHighDateTime=0x1d5e1ff, ftLastWriteTime.dwLowDateTime=0x28d0cba0, ftLastWriteTime.dwHighDateTime=0x1d5e1ff, nFileSizeHigh=0x0, nFileSizeLow=0x10147, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPtlkPPe.jpg", cAlternateFileName="")) returned 1 [0240.835] FindNextFileW (in: hFindFile=0x960a48, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a2356d0, ftCreationTime.dwHighDateTime=0x1d5eb3b, ftLastAccessTime.dwLowDateTime=0xf6c56320, ftLastAccessTime.dwHighDateTime=0x1d5eabc, ftLastWriteTime.dwLowDateTime=0xf6c56320, ftLastWriteTime.dwHighDateTime=0x1d5eabc, nFileSizeHigh=0x0, nFileSizeLow=0x91f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="lwLNZ9L2.png", cAlternateFileName="")) returned 1 [0240.835] FindNextFileW (in: hFindFile=0x960a48, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd73af150, ftCreationTime.dwHighDateTime=0x1d5eb6b, ftLastAccessTime.dwLowDateTime=0x2773afd0, ftLastAccessTime.dwHighDateTime=0x1d5ebc7, ftLastWriteTime.dwLowDateTime=0x2773afd0, ftLastWriteTime.dwHighDateTime=0x1d5ebc7, nFileSizeHigh=0x0, nFileSizeLow=0x167c, dwReserved0=0x0, dwReserved1=0x0, cFileName="mzLNeGD.png", cAlternateFileName="")) returned 1 [0240.835] FindNextFileW (in: hFindFile=0x960a48, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce531fb0, ftCreationTime.dwHighDateTime=0x1d5e92a, ftLastAccessTime.dwLowDateTime=0xaa142370, ftLastAccessTime.dwHighDateTime=0x1d5e0fa, ftLastWriteTime.dwLowDateTime=0xaa142370, ftLastWriteTime.dwHighDateTime=0x1d5e0fa, nFileSizeHigh=0x0, nFileSizeLow=0x882c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SK 6diP9tzBJ.png", cAlternateFileName="SK6DIP~1.PNG")) returned 1 [0240.836] FindNextFileW (in: hFindFile=0x960a48, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8070a530, ftCreationTime.dwHighDateTime=0x1d5e9eb, ftLastAccessTime.dwLowDateTime=0xf30a6010, ftLastAccessTime.dwHighDateTime=0x1d5edb3, ftLastWriteTime.dwLowDateTime=0xf30a6010, ftLastWriteTime.dwHighDateTime=0x1d5edb3, nFileSizeHigh=0x0, nFileSizeLow=0x8833, dwReserved0=0x0, dwReserved1=0x0, cFileName="ulIX3r3287MRKv L.png", cAlternateFileName="ULIX3R~1.PNG")) returned 1 [0240.836] FindNextFileW (in: hFindFile=0x960a48, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12608f60, ftCreationTime.dwHighDateTime=0x1d5e329, ftLastAccessTime.dwLowDateTime=0xdf954830, ftLastAccessTime.dwHighDateTime=0x1d5ebb8, ftLastWriteTime.dwLowDateTime=0xdf954830, ftLastWriteTime.dwHighDateTime=0x1d5ebb8, nFileSizeHigh=0x0, nFileSizeLow=0x43bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="vVA42vUIN.gif", cAlternateFileName="VVA42V~1.GIF")) returned 1 [0240.836] FindNextFileW (in: hFindFile=0x960a48, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2a71550, ftCreationTime.dwHighDateTime=0x1d5edb0, ftLastAccessTime.dwLowDateTime=0xdf01ff30, ftLastAccessTime.dwHighDateTime=0x1d5efa5, ftLastWriteTime.dwLowDateTime=0xdf01ff30, ftLastWriteTime.dwHighDateTime=0x1d5efa5, nFileSizeHigh=0x0, nFileSizeLow=0x172d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="zWNJgu_E3ZG6MTJSo.png", cAlternateFileName="ZWNJGU~1.PNG")) returned 1 [0240.836] FindNextFileW (in: hFindFile=0x960a48, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0240.836] FindClose (in: hFindFile=0x960a48 | out: hFindFile=0x960a48) returned 1 [0240.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febfc) returned 1 [0240.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec08) returned 1 [0240.837] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\9-TnJ3.bmp.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0240.837] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\9-TnJ3.bmp.locked", nBufferLength=0x53, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\9-TnJ3.bmp.locked", lpFilePart=0x0) returned 0x52 [0240.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0240.837] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\9-TnJ3.bmp.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\dnqi0m\\9-tnj3.bmp.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0240.837] GetFileType (hFile=0x37c) returned 0x1 [0240.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0240.838] GetFileType (hFile=0x37c) returned 0x1 [0241.910] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\9-TnJ3.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4c [0241.910] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\9-TnJ3.bmp", nBufferLength=0x4c, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\9-TnJ3.bmp", lpFilePart=0x0) returned 0x4b [0241.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0241.910] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\9-TnJ3.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\dnqi0m\\9-tnj3.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0241.911] GetFileType (hFile=0x378) returned 0x1 [0241.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0241.911] GetFileType (hFile=0x378) returned 0x1 [0241.914] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8feb6c*=0x15705, lpOverlapped=0x0) returned 1 [0241.931] WriteFile (in: hFile=0x37c, lpBuffer=0x27e901c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x27e901c*, lpNumberOfBytesWritten=0x8feb44*=0x1000, lpOverlapped=0x0) returned 1 [0241.932] WriteFile (in: hFile=0x37c, lpBuffer=0x376a4c8*, nNumberOfBytesToWrite=0x14720, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x376a4c8*, lpNumberOfBytesWritten=0x8feb44*=0x14720, lpOverlapped=0x0) returned 1 [0241.933] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8feb6c*=0x0, lpOverlapped=0x0) returned 1 [0241.933] CloseHandle (hObject=0x378) returned 1 [0241.934] WriteFile (in: hFile=0x37c, lpBuffer=0x27e901c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8feb0c, lpOverlapped=0x0 | out: lpBuffer=0x27e901c*, lpNumberOfBytesWritten=0x8feb0c*=0x10, lpOverlapped=0x0) returned 1 [0241.934] CloseHandle (hObject=0x37c) returned 1 [0241.937] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\9-TnJ3.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4c [0241.937] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\9-TnJ3.bmp", nBufferLength=0x4c, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\9-TnJ3.bmp", lpFilePart=0x0) returned 0x4b [0241.937] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\9-TnJ3.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\dnqi0m\\9-tnj3.bmp")) returned 1 [0241.941] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\b4fE6EgCqzdwvP95kfh.gif.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x60 [0241.941] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\b4fE6EgCqzdwvP95kfh.gif.locked", nBufferLength=0x60, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\b4fE6EgCqzdwvP95kfh.gif.locked", lpFilePart=0x0) returned 0x5f [0241.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0241.941] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\b4fE6EgCqzdwvP95kfh.gif.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\dnqi0m\\b4fe6egcqzdwvp95kfh.gif.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0241.945] GetFileType (hFile=0x37c) returned 0x1 [0241.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0241.945] GetFileType (hFile=0x37c) returned 0x1 [0242.912] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\b4fE6EgCqzdwvP95kfh.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x59 [0242.912] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\b4fE6EgCqzdwvP95kfh.gif", nBufferLength=0x59, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\b4fE6EgCqzdwvP95kfh.gif", lpFilePart=0x0) returned 0x58 [0242.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0242.912] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\b4fE6EgCqzdwvP95kfh.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\dnqi0m\\b4fe6egcqzdwvp95kfh.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0242.912] GetFileType (hFile=0x378) returned 0x1 [0242.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0242.912] GetFileType (hFile=0x378) returned 0x1 [0242.915] ReadFile (in: hFile=0x378, lpBuffer=0x377ec08, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x377ec08*, lpNumberOfBytesRead=0x8feb6c*=0x32be, lpOverlapped=0x0) returned 1 [0242.930] WriteFile (in: hFile=0x37c, lpBuffer=0x26ccd48*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x26ccd48*, lpNumberOfBytesWritten=0x8feb44*=0x1000, lpOverlapped=0x0) returned 1 [0242.931] WriteFile (in: hFile=0x37c, lpBuffer=0x26cf228*, nNumberOfBytesToWrite=0x22d0, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x26cf228*, lpNumberOfBytesWritten=0x8feb44*=0x22d0, lpOverlapped=0x0) returned 1 [0242.932] ReadFile (in: hFile=0x378, lpBuffer=0x377ec08, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x377ec08*, lpNumberOfBytesRead=0x8feb6c*=0x0, lpOverlapped=0x0) returned 1 [0242.932] CloseHandle (hObject=0x378) returned 1 [0242.932] WriteFile (in: hFile=0x37c, lpBuffer=0x26ccd48*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8feb0c, lpOverlapped=0x0 | out: lpBuffer=0x26ccd48*, lpNumberOfBytesWritten=0x8feb0c*=0x10, lpOverlapped=0x0) returned 1 [0242.932] CloseHandle (hObject=0x37c) returned 1 [0242.933] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\b4fE6EgCqzdwvP95kfh.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x59 [0242.941] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\b4fE6EgCqzdwvP95kfh.gif", nBufferLength=0x59, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\b4fE6EgCqzdwvP95kfh.gif", lpFilePart=0x0) returned 0x58 [0242.941] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\b4fE6EgCqzdwvP95kfh.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\dnqi0m\\b4fe6egcqzdwvp95kfh.gif")) returned 1 [0242.944] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\DiCiaX TFUu0.gif.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x59 [0242.944] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\DiCiaX TFUu0.gif.locked", nBufferLength=0x59, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\DiCiaX TFUu0.gif.locked", lpFilePart=0x0) returned 0x58 [0242.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0242.945] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\DiCiaX TFUu0.gif.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\dnqi0m\\diciax tfuu0.gif.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0242.945] GetFileType (hFile=0x37c) returned 0x1 [0242.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0242.945] GetFileType (hFile=0x37c) returned 0x1 [0243.995] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\DiCiaX TFUu0.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0243.995] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\DiCiaX TFUu0.gif", nBufferLength=0x52, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\DiCiaX TFUu0.gif", lpFilePart=0x0) returned 0x51 [0243.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0243.995] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\DiCiaX TFUu0.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\dnqi0m\\diciax tfuu0.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0243.996] GetFileType (hFile=0x378) returned 0x1 [0243.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0243.996] GetFileType (hFile=0x378) returned 0x1 [0243.998] ReadFile (in: hFile=0x378, lpBuffer=0x387ec28, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x387ec28*, lpNumberOfBytesRead=0x8feb6c*=0x13bd0, lpOverlapped=0x0) returned 1 [0244.014] WriteFile (in: hFile=0x37c, lpBuffer=0x27b6a0c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x27b6a0c*, lpNumberOfBytesWritten=0x8feb44*=0x1000, lpOverlapped=0x0) returned 1 [0244.015] WriteFile (in: hFile=0x37c, lpBuffer=0x27b8ee0*, nNumberOfBytesToWrite=0x12bf0, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x27b8ee0*, lpNumberOfBytesWritten=0x8feb44*=0x12bf0, lpOverlapped=0x0) returned 1 [0244.017] ReadFile (in: hFile=0x378, lpBuffer=0x387ec28, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x387ec28*, lpNumberOfBytesRead=0x8feb6c*=0x0, lpOverlapped=0x0) returned 1 [0244.018] CloseHandle (hObject=0x378) returned 1 [0244.018] WriteFile (in: hFile=0x37c, lpBuffer=0x27b6a0c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8feb0c, lpOverlapped=0x0 | out: lpBuffer=0x27b6a0c*, lpNumberOfBytesWritten=0x8feb0c*=0x10, lpOverlapped=0x0) returned 1 [0244.018] CloseHandle (hObject=0x37c) returned 1 [0244.020] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\DiCiaX TFUu0.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0244.020] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\DiCiaX TFUu0.gif", nBufferLength=0x52, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\DiCiaX TFUu0.gif", lpFilePart=0x0) returned 0x51 [0244.020] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\DiCiaX TFUu0.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\dnqi0m\\diciax tfuu0.gif")) returned 1 [0244.024] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\JPtlkPPe.jpg.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0244.024] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\JPtlkPPe.jpg.locked", nBufferLength=0x55, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\JPtlkPPe.jpg.locked", lpFilePart=0x0) returned 0x54 [0244.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0244.024] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\JPtlkPPe.jpg.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\dnqi0m\\jptlkppe.jpg.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0244.024] GetFileType (hFile=0x37c) returned 0x1 [0244.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0244.024] GetFileType (hFile=0x37c) returned 0x1 [0244.939] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\JPtlkPPe.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0244.940] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\JPtlkPPe.jpg", nBufferLength=0x4e, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\JPtlkPPe.jpg", lpFilePart=0x0) returned 0x4d [0244.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0244.940] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\JPtlkPPe.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\dnqi0m\\jptlkppe.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0244.940] GetFileType (hFile=0x378) returned 0x1 [0244.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0244.940] GetFileType (hFile=0x378) returned 0x1 [0244.943] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8feb6c*=0x10147, lpOverlapped=0x0) returned 1 [0244.956] WriteFile (in: hFile=0x37c, lpBuffer=0x289c988*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x289c988*, lpNumberOfBytesWritten=0x8feb44*=0x1000, lpOverlapped=0x0) returned 1 [0244.958] WriteFile (in: hFile=0x37c, lpBuffer=0x289ee54*, nNumberOfBytesToWrite=0xf160, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x289ee54*, lpNumberOfBytesWritten=0x8feb44*=0xf160, lpOverlapped=0x0) returned 1 [0244.959] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8feb6c*=0x0, lpOverlapped=0x0) returned 1 [0244.959] CloseHandle (hObject=0x378) returned 1 [0244.961] WriteFile (in: hFile=0x37c, lpBuffer=0x26a0a18*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8feb0c, lpOverlapped=0x0 | out: lpBuffer=0x26a0a18*, lpNumberOfBytesWritten=0x8feb0c*=0x10, lpOverlapped=0x0) returned 1 [0244.961] CloseHandle (hObject=0x37c) returned 1 [0244.963] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\JPtlkPPe.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0244.963] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\JPtlkPPe.jpg", nBufferLength=0x4e, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\JPtlkPPe.jpg", lpFilePart=0x0) returned 0x4d [0244.963] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\JPtlkPPe.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\dnqi0m\\jptlkppe.jpg")) returned 1 [0244.967] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\lwLNZ9L2.png.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0244.967] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\lwLNZ9L2.png.locked", nBufferLength=0x55, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\lwLNZ9L2.png.locked", lpFilePart=0x0) returned 0x54 [0244.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0244.967] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\lwLNZ9L2.png.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\dnqi0m\\lwlnz9l2.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0244.967] GetFileType (hFile=0x37c) returned 0x1 [0244.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0244.968] GetFileType (hFile=0x37c) returned 0x1 [0245.927] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\lwLNZ9L2.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0245.928] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\lwLNZ9L2.png", nBufferLength=0x4e, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\lwLNZ9L2.png", lpFilePart=0x0) returned 0x4d [0245.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0245.928] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\lwLNZ9L2.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\dnqi0m\\lwlnz9l2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0245.928] GetFileType (hFile=0x378) returned 0x1 [0245.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0245.928] GetFileType (hFile=0x378) returned 0x1 [0245.931] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8feb6c*=0x91f5, lpOverlapped=0x0) returned 1 [0245.945] WriteFile (in: hFile=0x37c, lpBuffer=0x2786870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x2786870*, lpNumberOfBytesWritten=0x8feb44*=0x1000, lpOverlapped=0x0) returned 1 [0245.946] WriteFile (in: hFile=0x37c, lpBuffer=0x2788d3c*, nNumberOfBytesToWrite=0x8210, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x2788d3c*, lpNumberOfBytesWritten=0x8feb44*=0x8210, lpOverlapped=0x0) returned 1 [0245.947] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8feb6c*=0x0, lpOverlapped=0x0) returned 1 [0245.947] CloseHandle (hObject=0x378) returned 1 [0245.947] WriteFile (in: hFile=0x37c, lpBuffer=0x2786870*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8feb0c, lpOverlapped=0x0 | out: lpBuffer=0x2786870*, lpNumberOfBytesWritten=0x8feb0c*=0x10, lpOverlapped=0x0) returned 1 [0245.947] CloseHandle (hObject=0x37c) returned 1 [0245.949] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\lwLNZ9L2.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0245.949] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\lwLNZ9L2.png", nBufferLength=0x4e, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\lwLNZ9L2.png", lpFilePart=0x0) returned 0x4d [0245.949] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\lwLNZ9L2.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\dnqi0m\\lwlnz9l2.png")) returned 1 [0245.953] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\mzLNeGD.png.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0245.953] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\mzLNeGD.png.locked", nBufferLength=0x54, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\mzLNeGD.png.locked", lpFilePart=0x0) returned 0x53 [0245.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0245.953] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\mzLNeGD.png.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\dnqi0m\\mzlnegd.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0245.954] GetFileType (hFile=0x37c) returned 0x1 [0245.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0245.954] GetFileType (hFile=0x37c) returned 0x1 [0246.838] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\mzLNeGD.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0246.838] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\mzLNeGD.png", nBufferLength=0x4d, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\mzLNeGD.png", lpFilePart=0x0) returned 0x4c [0246.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0246.839] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\mzLNeGD.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\dnqi0m\\mzlnegd.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0246.839] GetFileType (hFile=0x378) returned 0x1 [0246.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0246.839] GetFileType (hFile=0x378) returned 0x1 [0246.842] ReadFile (in: hFile=0x378, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8feb6c*=0x167c, lpOverlapped=0x0) returned 1 [0246.855] WriteFile (in: hFile=0x37c, lpBuffer=0x2876b68*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x2876b68*, lpNumberOfBytesWritten=0x8feb44*=0x1000, lpOverlapped=0x0) returned 1 [0246.856] ReadFile (in: hFile=0x378, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8feb6c*=0x0, lpOverlapped=0x0) returned 1 [0246.856] CloseHandle (hObject=0x378) returned 1 [0246.856] WriteFile (in: hFile=0x37c, lpBuffer=0x2876b68*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x8feb0c, lpOverlapped=0x0 | out: lpBuffer=0x2876b68*, lpNumberOfBytesWritten=0x8feb0c*=0x6a0, lpOverlapped=0x0) returned 1 [0246.857] CloseHandle (hObject=0x37c) returned 1 [0246.858] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\mzLNeGD.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0246.858] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\mzLNeGD.png", nBufferLength=0x4d, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\mzLNeGD.png", lpFilePart=0x0) returned 0x4c [0246.858] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\mzLNeGD.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\dnqi0m\\mzlnegd.png")) returned 1 [0246.862] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\SK 6diP9tzBJ.png.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x59 [0246.862] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\SK 6diP9tzBJ.png.locked", nBufferLength=0x59, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\SK 6diP9tzBJ.png.locked", lpFilePart=0x0) returned 0x58 [0246.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0246.862] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\SK 6diP9tzBJ.png.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\dnqi0m\\sk 6dip9tzbj.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0246.863] GetFileType (hFile=0x37c) returned 0x1 [0246.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0246.863] GetFileType (hFile=0x37c) returned 0x1 [0247.911] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\SK 6diP9tzBJ.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0247.911] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\SK 6diP9tzBJ.png", nBufferLength=0x52, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\SK 6diP9tzBJ.png", lpFilePart=0x0) returned 0x51 [0247.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0247.911] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\SK 6diP9tzBJ.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\dnqi0m\\sk 6dip9tzbj.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0247.911] GetFileType (hFile=0x378) returned 0x1 [0247.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0247.911] GetFileType (hFile=0x378) returned 0x1 [0247.914] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8feb6c*=0x882c, lpOverlapped=0x0) returned 1 [0247.928] WriteFile (in: hFile=0x37c, lpBuffer=0x2755b08*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x2755b08*, lpNumberOfBytesWritten=0x8feb44*=0x1000, lpOverlapped=0x0) returned 1 [0247.929] WriteFile (in: hFile=0x37c, lpBuffer=0x2757fdc*, nNumberOfBytesToWrite=0x7840, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x2757fdc*, lpNumberOfBytesWritten=0x8feb44*=0x7840, lpOverlapped=0x0) returned 1 [0247.930] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8feb6c*=0x0, lpOverlapped=0x0) returned 1 [0247.930] CloseHandle (hObject=0x378) returned 1 [0247.930] WriteFile (in: hFile=0x37c, lpBuffer=0x2755b08*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8feb0c, lpOverlapped=0x0 | out: lpBuffer=0x2755b08*, lpNumberOfBytesWritten=0x8feb0c*=0x10, lpOverlapped=0x0) returned 1 [0247.930] CloseHandle (hObject=0x37c) returned 1 [0247.932] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\SK 6diP9tzBJ.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0247.932] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\SK 6diP9tzBJ.png", nBufferLength=0x52, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\SK 6diP9tzBJ.png", lpFilePart=0x0) returned 0x51 [0247.932] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\SK 6diP9tzBJ.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\dnqi0m\\sk 6dip9tzbj.png")) returned 1 [0247.937] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\ulIX3r3287MRKv L.png.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5d [0247.937] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\ulIX3r3287MRKv L.png.locked", nBufferLength=0x5d, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\ulIX3r3287MRKv L.png.locked", lpFilePart=0x0) returned 0x5c [0247.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0247.937] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\ulIX3r3287MRKv L.png.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\dnqi0m\\ulix3r3287mrkv l.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0247.938] GetFileType (hFile=0x37c) returned 0x1 [0247.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0247.938] GetFileType (hFile=0x37c) returned 0x1 [0248.871] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\ulIX3r3287MRKv L.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x56 [0248.871] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\ulIX3r3287MRKv L.png", nBufferLength=0x56, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\ulIX3r3287MRKv L.png", lpFilePart=0x0) returned 0x55 [0248.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0248.871] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\ulIX3r3287MRKv L.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\dnqi0m\\ulix3r3287mrkv l.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0248.872] GetFileType (hFile=0x378) returned 0x1 [0248.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0248.872] GetFileType (hFile=0x378) returned 0x1 [0248.874] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8feb6c*=0x8833, lpOverlapped=0x0) returned 1 [0248.888] WriteFile (in: hFile=0x37c, lpBuffer=0x284572c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x284572c*, lpNumberOfBytesWritten=0x8feb44*=0x1000, lpOverlapped=0x0) returned 1 [0248.889] WriteFile (in: hFile=0x37c, lpBuffer=0x2847c08*, nNumberOfBytesToWrite=0x7850, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x2847c08*, lpNumberOfBytesWritten=0x8feb44*=0x7850, lpOverlapped=0x0) returned 1 [0248.890] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8feb6c*=0x0, lpOverlapped=0x0) returned 1 [0248.890] CloseHandle (hObject=0x378) returned 1 [0248.890] WriteFile (in: hFile=0x37c, lpBuffer=0x284572c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8feb0c, lpOverlapped=0x0 | out: lpBuffer=0x284572c*, lpNumberOfBytesWritten=0x8feb0c*=0x10, lpOverlapped=0x0) returned 1 [0248.890] CloseHandle (hObject=0x37c) returned 1 [0248.892] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\ulIX3r3287MRKv L.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x56 [0248.892] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\ulIX3r3287MRKv L.png", nBufferLength=0x56, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\ulIX3r3287MRKv L.png", lpFilePart=0x0) returned 0x55 [0248.892] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\ulIX3r3287MRKv L.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\dnqi0m\\ulix3r3287mrkv l.png")) returned 1 [0248.896] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\vVA42vUIN.gif.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x56 [0248.896] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\vVA42vUIN.gif.locked", nBufferLength=0x56, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\vVA42vUIN.gif.locked", lpFilePart=0x0) returned 0x55 [0248.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0248.896] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\vVA42vUIN.gif.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\dnqi0m\\vva42vuin.gif.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0248.897] GetFileType (hFile=0x37c) returned 0x1 [0248.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0248.897] GetFileType (hFile=0x37c) returned 0x1 [0249.910] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\vVA42vUIN.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0249.910] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\vVA42vUIN.gif", nBufferLength=0x4f, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\vVA42vUIN.gif", lpFilePart=0x0) returned 0x4e [0249.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0249.910] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\vVA42vUIN.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\dnqi0m\\vva42vuin.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0249.911] GetFileType (hFile=0x378) returned 0x1 [0249.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0249.911] GetFileType (hFile=0x378) returned 0x1 [0249.913] ReadFile (in: hFile=0x378, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8feb6c*=0x43bc, lpOverlapped=0x0) returned 1 [0249.930] WriteFile (in: hFile=0x37c, lpBuffer=0x27354b4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x27354b4*, lpNumberOfBytesWritten=0x8feb44*=0x1000, lpOverlapped=0x0) returned 1 [0249.931] WriteFile (in: hFile=0x37c, lpBuffer=0x2737980*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x2737980*, lpNumberOfBytesWritten=0x8feb44*=0x33d0, lpOverlapped=0x0) returned 1 [0249.932] ReadFile (in: hFile=0x378, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8feb6c*=0x0, lpOverlapped=0x0) returned 1 [0249.932] CloseHandle (hObject=0x378) returned 1 [0249.932] WriteFile (in: hFile=0x37c, lpBuffer=0x27354b4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8feb0c, lpOverlapped=0x0 | out: lpBuffer=0x27354b4*, lpNumberOfBytesWritten=0x8feb0c*=0x10, lpOverlapped=0x0) returned 1 [0249.932] CloseHandle (hObject=0x37c) returned 1 [0249.934] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\vVA42vUIN.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0249.934] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\vVA42vUIN.gif", nBufferLength=0x4f, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\vVA42vUIN.gif", lpFilePart=0x0) returned 0x4e [0249.934] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\vVA42vUIN.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\dnqi0m\\vva42vuin.gif")) returned 1 [0249.938] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\zWNJgu_E3ZG6MTJSo.png.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5e [0249.938] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\zWNJgu_E3ZG6MTJSo.png.locked", nBufferLength=0x5e, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\zWNJgu_E3ZG6MTJSo.png.locked", lpFilePart=0x0) returned 0x5d [0249.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0249.938] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\zWNJgu_E3ZG6MTJSo.png.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\dnqi0m\\zwnjgu_e3zg6mtjso.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0249.939] GetFileType (hFile=0x37c) returned 0x1 [0249.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0249.939] GetFileType (hFile=0x37c) returned 0x1 [0250.893] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\zWNJgu_E3ZG6MTJSo.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x57 [0250.893] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\zWNJgu_E3ZG6MTJSo.png", nBufferLength=0x57, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\zWNJgu_E3ZG6MTJSo.png", lpFilePart=0x0) returned 0x56 [0250.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0250.893] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\zWNJgu_E3ZG6MTJSo.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\dnqi0m\\zwnjgu_e3zg6mtjso.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0250.894] GetFileType (hFile=0x378) returned 0x1 [0250.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0250.894] GetFileType (hFile=0x378) returned 0x1 [0250.896] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8feb6c*=0x172d6, lpOverlapped=0x0) returned 1 [0250.912] WriteFile (in: hFile=0x37c, lpBuffer=0x2817284*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x2817284*, lpNumberOfBytesWritten=0x8feb44*=0x1000, lpOverlapped=0x0) returned 1 [0250.913] WriteFile (in: hFile=0x37c, lpBuffer=0x376a4c8*, nNumberOfBytesToWrite=0x162f0, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x376a4c8*, lpNumberOfBytesWritten=0x8feb44*=0x162f0, lpOverlapped=0x0) returned 1 [0250.914] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8feb6c*=0x0, lpOverlapped=0x0) returned 1 [0250.914] CloseHandle (hObject=0x378) returned 1 [0250.914] WriteFile (in: hFile=0x37c, lpBuffer=0x2817284*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8feb0c, lpOverlapped=0x0 | out: lpBuffer=0x2817284*, lpNumberOfBytesWritten=0x8feb0c*=0x10, lpOverlapped=0x0) returned 1 [0250.915] CloseHandle (hObject=0x37c) returned 1 [0250.917] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\zWNJgu_E3ZG6MTJSo.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x57 [0250.917] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\zWNJgu_E3ZG6MTJSo.png", nBufferLength=0x57, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\zWNJgu_E3ZG6MTJSo.png", lpFilePart=0x0) returned 0x56 [0250.917] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\zWNJgu_E3ZG6MTJSo.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dhweefasn7xqd-\\czuf tqlcpkmdyyqo\\dnqi0m\\zwnjgu_e3zg6mtjso.png")) returned 1 [0250.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec40) returned 1 [0250.919] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0250.919] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M", nBufferLength=0x41, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M", lpFilePart=0x0) returned 0x40 [0250.919] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\dHwEefAsn7xqd-\\CZUf tqlcPkMdYYqO\\DNqI0M\\*", lpFindFileData=0x8fe968 | out: lpFindFileData=0x8fe968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf81590, ftCreationTime.dwHighDateTime=0x1d5f054, ftLastAccessTime.dwLowDateTime=0xa72689a0, ftLastAccessTime.dwHighDateTime=0x1d5e6fe, ftLastWriteTime.dwLowDateTime=0xae483854, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x960708 [0250.920] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf81590, ftCreationTime.dwHighDateTime=0x1d5f054, ftLastAccessTime.dwLowDateTime=0xa72689a0, ftLastAccessTime.dwHighDateTime=0x1d5e6fe, ftLastWriteTime.dwLowDateTime=0xae483854, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.920] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8465f49, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xa8465f49, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xa8ed4480, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x15730, dwReserved0=0x0, dwReserved1=0x0, cFileName="9-TnJ3.bmp.locked", cAlternateFileName="9-TNJ3~1.LOC")) returned 1 [0250.920] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8efa6a4, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xa8efa6a4, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xa98507bd, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x32e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="b4fE6EgCqzdwvP95kfh.gif.locked", cAlternateFileName="B4FE6E~1.LOC")) returned 1 [0250.920] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9876b73, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xa9876b73, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xaa2c9929, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x13c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiCiaX TFUu0.gif.locked", cAlternateFileName="DICIAX~1.LOC")) returned 1 [0250.920] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa2c9929, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xaa2c9929, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xaabba86b, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x10170, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPtlkPPe.jpg.locked", cAlternateFileName="JPTLKP~1.LOC")) returned 1 [0250.920] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaabba86b, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xaabba86b, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xab51dba0, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x9220, dwReserved0=0x0, dwReserved1=0x0, cFileName="lwLNZ9L2.png.locked", cAlternateFileName="LWLNZ9~1.LOC")) returned 1 [0250.921] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab51dba0, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xab51dba0, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xabdc21be, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x16a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mzLNeGD.png.locked", cAlternateFileName="MZLNEG~1.LOC")) returned 1 [0250.921] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabde850a, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xabde850a, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xac80d63d, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x8850, dwReserved0=0x0, dwReserved1=0x0, cFileName="SK 6diP9tzBJ.png.locked", cAlternateFileName="SK6DIP~1.LOC")) returned 1 [0250.921] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac80d63d, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xac80d63d, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xad12444f, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x8860, dwReserved0=0x0, dwReserved1=0x0, cFileName="ulIX3r3287MRKv L.png.locked", cAlternateFileName="ULIX3R~1.LOC")) returned 1 [0250.921] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad14a74c, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xad14a74c, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xadb201be, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x43e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vVA42vUIN.gif.locked", cAlternateFileName="VVA42V~1.LOC")) returned 1 [0250.921] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadb201be, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xadb201be, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xae483854, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x17300, dwReserved0=0x0, dwReserved1=0x0, cFileName="zWNJgu_E3ZG6MTJSo.png.locked", cAlternateFileName="ZWNJGU~1.LOC")) returned 1 [0250.921] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadb201be, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xadb201be, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xae483854, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x17300, dwReserved0=0x0, dwReserved1=0x0, cFileName="zWNJgu_E3ZG6MTJSo.png.locked", cAlternateFileName="ZWNJGU~1.LOC")) returned 0 [0250.921] FindClose (in: hFindFile=0x960708 | out: hFindFile=0x960708) returned 1 [0250.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febfc) returned 1 [0250.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec08) returned 1 [0250.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed08) returned 1 [0250.922] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0250.922] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", nBufferLength=0x28, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", lpFilePart=0x0) returned 0x27 [0250.922] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*", lpFindFileData=0x8fea30 | out: lpFindFileData=0x8fea30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x960848 [0250.923] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.923] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0250.923] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0250.923] FindClose (in: hFindFile=0x960848 | out: hFindFile=0x960848) returned 1 [0250.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecc4) returned 1 [0250.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd0) returned 1 [0250.926] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0250.926] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini.locked", nBufferLength=0x3b, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini.locked", lpFilePart=0x0) returned 0x3a [0250.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb80) returned 1 [0250.927] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini.locked" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\desktop.ini.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0250.927] GetFileType (hFile=0x37c) returned 0x1 [0250.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb7c) returned 1 [0250.927] GetFileType (hFile=0x37c) returned 0x1 [0251.857] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0251.857] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", nBufferLength=0x34, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", lpFilePart=0x0) returned 0x33 [0251.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb80) returned 1 [0251.857] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0251.858] GetFileType (hFile=0x378) returned 0x1 [0251.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb7c) returned 1 [0251.858] GetFileType (hFile=0x378) returned 0x1 [0251.861] ReadFile (in: hFile=0x378, lpBuffer=0x37807d8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec34, lpOverlapped=0x0 | out: lpBuffer=0x37807d8*, lpNumberOfBytesRead=0x8fec34*=0xbe, lpOverlapped=0x0) returned 1 [0251.875] ReadFile (in: hFile=0x378, lpBuffer=0x37807d8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec34, lpOverlapped=0x0 | out: lpBuffer=0x37807d8*, lpNumberOfBytesRead=0x8fec34*=0x0, lpOverlapped=0x0) returned 1 [0251.875] CloseHandle (hObject=0x378) returned 1 [0251.875] WriteFile (in: hFile=0x37c, lpBuffer=0x2700b24*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x8febd4, lpOverlapped=0x0 | out: lpBuffer=0x2700b24*, lpNumberOfBytesWritten=0x8febd4*=0xe0, lpOverlapped=0x0) returned 1 [0251.881] CloseHandle (hObject=0x37c) returned 1 [0251.882] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0251.882] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", nBufferLength=0x34, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", lpFilePart=0x0) returned 0x33 [0251.882] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\desktop.ini")) returned 1 [0251.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed08) returned 1 [0251.883] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0251.883] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", nBufferLength=0x28, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", lpFilePart=0x0) returned 0x27 [0251.884] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*", lpFindFileData=0x8fea30 | out: lpFindFileData=0x8fea30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaedc083d, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x960848 [0251.884] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaedc083d, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.884] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4a997a, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xae4a997a, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xaedc083d, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.locked", cAlternateFileName="DESKTO~1.LOC")) returned 1 [0251.884] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4a997a, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xae4a997a, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xaedc083d, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.locked", cAlternateFileName="DESKTO~1.LOC")) returned 0 [0251.884] FindClose (in: hFindFile=0x960848 | out: hFindFile=0x960848) returned 1 [0251.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecc4) returned 1 [0251.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd0) returned 1 [0251.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed6c) returned 1 [0251.885] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1a [0251.885] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x1a, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0251.885] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x8fea94 | out: lpFindFileData=0x8fea94*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe5f00273, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe5f00273, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x960848 [0251.885] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe5f00273, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe5f00273, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.885] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ae4f50, ftCreationTime.dwHighDateTime=0x1d5a960, ftLastAccessTime.dwLowDateTime=0x6652b8d0, ftLastAccessTime.dwHighDateTime=0x1d59e2a, ftLastWriteTime.dwLowDateTime=0x6652b8d0, ftLastWriteTime.dwHighDateTime=0x1d59e2a, nFileSizeHigh=0x0, nFileSizeLow=0x997, dwReserved0=0x0, dwReserved1=0x0, cFileName="-Uhoch.xlsx", cAlternateFileName="-UHOCH~1.XLS")) returned 1 [0251.885] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf1950, ftCreationTime.dwHighDateTime=0x1d5e43a, ftLastAccessTime.dwLowDateTime=0x5b3e66f0, ftLastAccessTime.dwHighDateTime=0x1d5e1c9, ftLastWriteTime.dwLowDateTime=0x5b3e66f0, ftLastWriteTime.dwHighDateTime=0x1d5e1c9, nFileSizeHigh=0x0, nFileSizeLow=0x6f89, dwReserved0=0x0, dwReserved1=0x0, cFileName="0tHoUSG2-9zGg R.doc", cAlternateFileName="0THOUS~1.DOC")) returned 1 [0251.886] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75160da0, ftCreationTime.dwHighDateTime=0x1d57de5, ftLastAccessTime.dwLowDateTime=0x16a78ae0, ftLastAccessTime.dwHighDateTime=0x1d5b987, ftLastWriteTime.dwLowDateTime=0x16a78ae0, ftLastWriteTime.dwHighDateTime=0x1d5b987, nFileSizeHigh=0x0, nFileSizeLow=0x18ca3, dwReserved0=0x0, dwReserved1=0x0, cFileName="4M4RPyy.pptx", cAlternateFileName="4M4RPY~1.PPT")) returned 1 [0251.886] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe5eae40, ftCreationTime.dwHighDateTime=0x1d5e295, ftLastAccessTime.dwLowDateTime=0x8446f210, ftLastAccessTime.dwHighDateTime=0x1d5e47b, ftLastWriteTime.dwLowDateTime=0x8446f210, ftLastWriteTime.dwHighDateTime=0x1d5e47b, nFileSizeHigh=0x0, nFileSizeLow=0x7590, dwReserved0=0x0, dwReserved1=0x0, cFileName="8aclWgLFdg-E.csv", cAlternateFileName="8ACLWG~1.CSV")) returned 1 [0251.886] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ce2e50, ftCreationTime.dwHighDateTime=0x1d592fd, ftLastAccessTime.dwLowDateTime=0xd861b820, ftLastAccessTime.dwHighDateTime=0x1d5e125, ftLastWriteTime.dwLowDateTime=0xd861b820, ftLastWriteTime.dwHighDateTime=0x1d5e125, nFileSizeHigh=0x0, nFileSizeLow=0xadeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BfYdEnt0aL.pptx", cAlternateFileName="BFYDEN~1.PPT")) returned 1 [0251.886] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd2df5c0, ftCreationTime.dwHighDateTime=0x1d5eb01, ftLastAccessTime.dwLowDateTime=0x844ddb0, ftLastAccessTime.dwHighDateTime=0x1d5e6f3, ftLastWriteTime.dwLowDateTime=0x844ddb0, ftLastWriteTime.dwHighDateTime=0x1d5e6f3, nFileSizeHigh=0x0, nFileSizeLow=0x86f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="cucyL.odt", cAlternateFileName="")) returned 1 [0251.886] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaa378f0, ftCreationTime.dwHighDateTime=0x1d5d9ab, ftLastAccessTime.dwLowDateTime=0x5a3e4fd0, ftLastAccessTime.dwHighDateTime=0x1d594cc, ftLastWriteTime.dwLowDateTime=0x5a3e4fd0, ftLastWriteTime.dwHighDateTime=0x1d594cc, nFileSizeHigh=0x0, nFileSizeLow=0x1157f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CUFv0Ude.docx", cAlternateFileName="CUFV0U~1.DOC")) returned 1 [0251.886] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x9daec75b, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x55000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb", cAlternateFileName="DATABA~1.ACC")) returned 1 [0251.886] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440c5760, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440c5760, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0251.887] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82a374f0, ftCreationTime.dwHighDateTime=0x1d58207, ftLastAccessTime.dwLowDateTime=0x876d33d0, ftLastAccessTime.dwHighDateTime=0x1d59a36, ftLastWriteTime.dwLowDateTime=0x876d33d0, ftLastWriteTime.dwHighDateTime=0x1d59a36, nFileSizeHigh=0x0, nFileSizeLow=0x122d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="dVddonu6g4Q69vQTOhi.xlsx", cAlternateFileName="DVDDON~1.XLS")) returned 1 [0251.887] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a66d80, ftCreationTime.dwHighDateTime=0x1d5b900, ftLastAccessTime.dwLowDateTime=0x99763880, ftLastAccessTime.dwHighDateTime=0x1d5dc6f, ftLastWriteTime.dwLowDateTime=0x99763880, ftLastWriteTime.dwHighDateTime=0x1d5dc6f, nFileSizeHigh=0x0, nFileSizeLow=0x5d13, dwReserved0=0x0, dwReserved1=0x0, cFileName="e-cJYfWW7d.pptx", cAlternateFileName="E-CJYF~1.PPT")) returned 1 [0251.887] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69e3bf80, ftCreationTime.dwHighDateTime=0x1d5e48e, ftLastAccessTime.dwLowDateTime=0x6d2a9b30, ftLastAccessTime.dwHighDateTime=0x1d5ebe3, ftLastWriteTime.dwLowDateTime=0x6d2a9b30, ftLastWriteTime.dwHighDateTime=0x1d5ebe3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="edP6exS5", cAlternateFileName="")) returned 1 [0251.887] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fda6ed0, ftCreationTime.dwHighDateTime=0x1d5ed3d, ftLastAccessTime.dwLowDateTime=0x5fce8ba0, ftLastAccessTime.dwHighDateTime=0x1d59be7, ftLastWriteTime.dwLowDateTime=0x5fce8ba0, ftLastWriteTime.dwHighDateTime=0x1d59be7, nFileSizeHigh=0x0, nFileSizeLow=0x16b9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="EfPzrjGucHVIG4aB.docx", cAlternateFileName="EFPZRJ~1.DOC")) returned 1 [0251.887] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7aa8ff90, ftCreationTime.dwHighDateTime=0x1d5f0cf, ftLastAccessTime.dwLowDateTime=0x12c7ff0, ftLastAccessTime.dwHighDateTime=0x1d5e104, ftLastWriteTime.dwLowDateTime=0x12c7ff0, ftLastWriteTime.dwHighDateTime=0x1d5e104, nFileSizeHigh=0x0, nFileSizeLow=0xa6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="evxrwLajfekQ0MYh.odt", cAlternateFileName="EVXRWL~1.ODT")) returned 1 [0251.887] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef86d0a0, ftCreationTime.dwHighDateTime=0x1d59dbc, ftLastAccessTime.dwLowDateTime=0x63097960, ftLastAccessTime.dwHighDateTime=0x1d5e8a9, ftLastWriteTime.dwLowDateTime=0x63097960, ftLastWriteTime.dwHighDateTime=0x1d5e8a9, nFileSizeHigh=0x0, nFileSizeLow=0xb7d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fw_.pptx", cAlternateFileName="FW_~1.PPT")) returned 1 [0251.887] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4524ac0, ftCreationTime.dwHighDateTime=0x1d5c953, ftLastAccessTime.dwLowDateTime=0x60f14ed0, ftLastAccessTime.dwHighDateTime=0x1d59978, ftLastWriteTime.dwLowDateTime=0x60f14ed0, ftLastWriteTime.dwHighDateTime=0x1d59978, nFileSizeHigh=0x0, nFileSizeLow=0xeada, dwReserved0=0x0, dwReserved1=0x0, cFileName="HN-eE.xlsx", cAlternateFileName="HN-EE~1.XLS")) returned 1 [0251.888] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12f07eb0, ftCreationTime.dwHighDateTime=0x1d5ecbe, ftLastAccessTime.dwLowDateTime=0xc41ef810, ftLastAccessTime.dwHighDateTime=0x1d5666d, ftLastWriteTime.dwLowDateTime=0xc41ef810, ftLastWriteTime.dwHighDateTime=0x1d5666d, nFileSizeHigh=0x0, nFileSizeLow=0x15a30, dwReserved0=0x0, dwReserved1=0x0, cFileName="JAZPWfinV.docx", cAlternateFileName="JAZPWF~1.DOC")) returned 1 [0251.888] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f3cd0, ftCreationTime.dwHighDateTime=0x1d5e55b, ftLastAccessTime.dwLowDateTime=0xfc270b0, ftLastAccessTime.dwHighDateTime=0x1d5e280, ftLastWriteTime.dwLowDateTime=0xfc270b0, ftLastWriteTime.dwHighDateTime=0x1d5e280, nFileSizeHigh=0x0, nFileSizeLow=0x139ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="mbqXSaY.pptx", cAlternateFileName="MBQXSA~1.PPT")) returned 1 [0251.888] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a471240, ftCreationTime.dwHighDateTime=0x1d5eaf0, ftLastAccessTime.dwLowDateTime=0xb12858e0, ftLastAccessTime.dwHighDateTime=0x1d5e2bf, ftLastWriteTime.dwLowDateTime=0xb12858e0, ftLastWriteTime.dwHighDateTime=0x1d5e2bf, nFileSizeHigh=0x0, nFileSizeLow=0x86e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="mfGUeqia2d4NY4DZsqxe.pps", cAlternateFileName="MFGUEQ~1.PPS")) returned 1 [0251.888] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12416f10, ftCreationTime.dwHighDateTime=0x1d5ec73, ftLastAccessTime.dwLowDateTime=0xb7c27070, ftLastAccessTime.dwHighDateTime=0x1d5e5f1, ftLastWriteTime.dwLowDateTime=0xb7c27070, ftLastWriteTime.dwHighDateTime=0x1d5e5f1, nFileSizeHigh=0x0, nFileSizeLow=0x11994, dwReserved0=0x0, dwReserved1=0x0, cFileName="MGm2RtZaI.xls", cAlternateFileName="MGM2RT~1.XLS")) returned 1 [0251.888] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0251.888] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0251.889] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0251.889] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0251.889] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4c477a0, ftCreationTime.dwHighDateTime=0x1d5e964, ftLastAccessTime.dwLowDateTime=0x42f3b690, ftLastAccessTime.dwHighDateTime=0x1d5ed81, ftLastWriteTime.dwLowDateTime=0x42f3b690, ftLastWriteTime.dwHighDateTime=0x1d5ed81, nFileSizeHigh=0x0, nFileSizeLow=0x15887, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="oIHTAL.ots", cAlternateFileName="")) returned 1 [0251.889] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x5ee892ad, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0251.889] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d6d86a0, ftCreationTime.dwHighDateTime=0x1d5cc93, ftLastAccessTime.dwLowDateTime=0xbf6a670, ftLastAccessTime.dwHighDateTime=0x1d57dc9, ftLastWriteTime.dwLowDateTime=0xbf6a670, ftLastWriteTime.dwHighDateTime=0x1d57dc9, nFileSizeHigh=0x0, nFileSizeLow=0x9868, dwReserved0=0x0, dwReserved1=0x0, cFileName="P0yAA1UNt_AeGs.xlsx", cAlternateFileName="P0YAA1~1.XLS")) returned 1 [0251.889] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbacacb50, ftCreationTime.dwHighDateTime=0x1d5ec7c, ftLastAccessTime.dwLowDateTime=0x715b08b0, ftLastAccessTime.dwHighDateTime=0x1d5e112, ftLastWriteTime.dwLowDateTime=0x715b08b0, ftLastWriteTime.dwHighDateTime=0x1d5e112, nFileSizeHigh=0x0, nFileSizeLow=0xbbd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="R0o03ux1o.docx", cAlternateFileName="R0O03U~1.DOC")) returned 1 [0251.889] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1be509f0, ftCreationTime.dwHighDateTime=0x1d58003, ftLastAccessTime.dwLowDateTime=0xbccc5dc0, ftLastAccessTime.dwHighDateTime=0x1d56fa3, ftLastWriteTime.dwLowDateTime=0xbccc5dc0, ftLastWriteTime.dwHighDateTime=0x1d56fa3, nFileSizeHigh=0x0, nFileSizeLow=0x7987, dwReserved0=0x0, dwReserved1=0x0, cFileName="rbf3wxxAvTJg.pptx", cAlternateFileName="RBF3WX~1.PPT")) returned 1 [0251.890] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2958da00, ftCreationTime.dwHighDateTime=0x1d5e997, ftLastAccessTime.dwLowDateTime=0x2e91b00, ftLastAccessTime.dwHighDateTime=0x1d5e97e, ftLastWriteTime.dwLowDateTime=0x2e91b00, ftLastWriteTime.dwHighDateTime=0x1d5e97e, nFileSizeHigh=0x0, nFileSizeLow=0x62b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="RfOZfwQP oYTWlHa.ods", cAlternateFileName="RFOZFW~1.ODS")) returned 1 [0251.890] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5529f970, ftCreationTime.dwHighDateTime=0x1d5ee56, ftLastAccessTime.dwLowDateTime=0x23c60440, ftLastAccessTime.dwHighDateTime=0x1d5e37b, ftLastWriteTime.dwLowDateTime=0x23c60440, ftLastWriteTime.dwHighDateTime=0x1d5e37b, nFileSizeHigh=0x0, nFileSizeLow=0xb548, dwReserved0=0x0, dwReserved1=0x0, cFileName="RPBREJYDP8jN2.odt", cAlternateFileName="RPBREJ~1.ODT")) returned 1 [0251.890] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3389770, ftCreationTime.dwHighDateTime=0x1d5d52e, ftLastAccessTime.dwLowDateTime=0xbb26740, ftLastAccessTime.dwHighDateTime=0x1d5e560, ftLastWriteTime.dwLowDateTime=0xbb26740, ftLastWriteTime.dwHighDateTime=0x1d5e560, nFileSizeHigh=0x0, nFileSizeLow=0xa9f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="v cbuLol-Xgmqz_W.xlsx", cAlternateFileName="VCBULO~1.XLS")) returned 1 [0251.890] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x626d53a0, ftCreationTime.dwHighDateTime=0x1d5c72f, ftLastAccessTime.dwLowDateTime=0x60294380, ftLastAccessTime.dwHighDateTime=0x1d5ca02, ftLastWriteTime.dwLowDateTime=0x60294380, ftLastWriteTime.dwHighDateTime=0x1d5ca02, nFileSizeHigh=0x0, nFileSizeLow=0x11ddd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WsbU.docx", cAlternateFileName="WSBU~1.DOC")) returned 1 [0251.890] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fe54660, ftCreationTime.dwHighDateTime=0x1d56aaf, ftLastAccessTime.dwLowDateTime=0x7c245bd0, ftLastAccessTime.dwHighDateTime=0x1d5c889, ftLastWriteTime.dwLowDateTime=0x7c245bd0, ftLastWriteTime.dwHighDateTime=0x1d5c889, nFileSizeHigh=0x0, nFileSizeLow=0xb9cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ykBv0s0N.docx", cAlternateFileName="YKBV0S~1.DOC")) returned 1 [0251.890] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa15199b0, ftCreationTime.dwHighDateTime=0x1d5eef7, ftLastAccessTime.dwLowDateTime=0x73731d60, ftLastAccessTime.dwHighDateTime=0x1d5e18d, ftLastWriteTime.dwLowDateTime=0x73731d60, ftLastWriteTime.dwHighDateTime=0x1d5e18d, nFileSizeHigh=0x0, nFileSizeLow=0xf2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="z8KGKougj.ots", cAlternateFileName="Z8KGKO~1.OTS")) returned 1 [0251.890] FindNextFileW (in: hFindFile=0x960848, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0251.891] FindClose (in: hFindFile=0x960848 | out: hFindFile=0x960848) returned 1 [0251.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fed28) returned 1 [0251.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fed34) returned 1 [0251.892] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\-Uhoch.xlsx.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0251.892] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\-Uhoch.xlsx.locked", nBufferLength=0x2d, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\-Uhoch.xlsx.locked", lpFilePart=0x0) returned 0x2c [0251.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0251.892] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\-Uhoch.xlsx.locked" (normalized: "c:\\users\\fd1hvy\\documents\\-uhoch.xlsx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0251.894] GetFileType (hFile=0x37c) returned 0x1 [0251.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0251.894] GetFileType (hFile=0x37c) returned 0x1 [0252.760] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\-Uhoch.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0252.760] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\-Uhoch.xlsx", nBufferLength=0x26, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\-Uhoch.xlsx", lpFilePart=0x0) returned 0x25 [0252.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0252.760] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\-Uhoch.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\-uhoch.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0252.760] GetFileType (hFile=0x378) returned 0x1 [0252.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0252.760] GetFileType (hFile=0x378) returned 0x1 [0252.763] ReadFile (in: hFile=0x378, lpBuffer=0x38807f8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x38807f8*, lpNumberOfBytesRead=0x8fec98*=0x997, lpOverlapped=0x0) returned 1 [0252.778] ReadFile (in: hFile=0x378, lpBuffer=0x38807f8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x38807f8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0252.778] CloseHandle (hObject=0x378) returned 1 [0252.778] WriteFile (in: hFile=0x37c, lpBuffer=0x27ec880*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x27ec880*, lpNumberOfBytesWritten=0x8fec38*=0x9c0, lpOverlapped=0x0) returned 1 [0252.779] CloseHandle (hObject=0x37c) returned 1 [0252.780] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\-Uhoch.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0252.780] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\-Uhoch.xlsx", nBufferLength=0x26, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\-Uhoch.xlsx", lpFilePart=0x0) returned 0x25 [0252.780] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\-Uhoch.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\-uhoch.xlsx")) returned 1 [0252.783] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\0tHoUSG2-9zGg R.doc.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0252.783] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\0tHoUSG2-9zGg R.doc.locked", nBufferLength=0x35, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\0tHoUSG2-9zGg R.doc.locked", lpFilePart=0x0) returned 0x34 [0252.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0252.783] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\0tHoUSG2-9zGg R.doc.locked" (normalized: "c:\\users\\fd1hvy\\documents\\0thousg2-9zgg r.doc.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0252.783] GetFileType (hFile=0x37c) returned 0x1 [0252.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0252.783] GetFileType (hFile=0x37c) returned 0x1 [0253.715] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\0tHoUSG2-9zGg R.doc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0253.716] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\0tHoUSG2-9zGg R.doc", nBufferLength=0x2e, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\0tHoUSG2-9zGg R.doc", lpFilePart=0x0) returned 0x2d [0253.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0253.716] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\0tHoUSG2-9zGg R.doc" (normalized: "c:\\users\\fd1hvy\\documents\\0thousg2-9zgg r.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0253.717] GetFileType (hFile=0x378) returned 0x1 [0253.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0253.717] GetFileType (hFile=0x378) returned 0x1 [0253.719] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0x6f89, lpOverlapped=0x0) returned 1 [0253.733] WriteFile (in: hFile=0x37c, lpBuffer=0x26c8db8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x26c8db8*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0253.735] WriteFile (in: hFile=0x37c, lpBuffer=0x26cb290*, nNumberOfBytesToWrite=0x5fa0, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x26cb290*, lpNumberOfBytesWritten=0x8fec70*=0x5fa0, lpOverlapped=0x0) returned 1 [0253.736] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0253.736] CloseHandle (hObject=0x378) returned 1 [0253.736] WriteFile (in: hFile=0x37c, lpBuffer=0x26c8db8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x26c8db8*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0253.736] CloseHandle (hObject=0x37c) returned 1 [0253.739] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\0tHoUSG2-9zGg R.doc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0253.739] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\0tHoUSG2-9zGg R.doc", nBufferLength=0x2e, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\0tHoUSG2-9zGg R.doc", lpFilePart=0x0) returned 0x2d [0253.739] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\0tHoUSG2-9zGg R.doc" (normalized: "c:\\users\\fd1hvy\\documents\\0thousg2-9zgg r.doc")) returned 1 [0253.743] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\4M4RPyy.pptx.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0253.743] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\4M4RPyy.pptx.locked", nBufferLength=0x2e, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\4M4RPyy.pptx.locked", lpFilePart=0x0) returned 0x2d [0253.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0253.744] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\4M4RPyy.pptx.locked" (normalized: "c:\\users\\fd1hvy\\documents\\4m4rpyy.pptx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0253.744] GetFileType (hFile=0x37c) returned 0x1 [0253.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0253.744] GetFileType (hFile=0x37c) returned 0x1 [0254.805] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\4M4RPyy.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0254.806] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\4M4RPyy.pptx", nBufferLength=0x27, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\4M4RPyy.pptx", lpFilePart=0x0) returned 0x26 [0254.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0254.806] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\4M4RPyy.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\4m4rpyy.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0254.806] GetFileType (hFile=0x378) returned 0x1 [0254.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0254.806] GetFileType (hFile=0x378) returned 0x1 [0254.809] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec98*=0x18ca3, lpOverlapped=0x0) returned 1 [0254.825] WriteFile (in: hFile=0x37c, lpBuffer=0x27b7570*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x27b7570*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0254.826] WriteFile (in: hFile=0x37c, lpBuffer=0x386a4e8*, nNumberOfBytesToWrite=0x17cc0, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x386a4e8*, lpNumberOfBytesWritten=0x8fec70*=0x17cc0, lpOverlapped=0x0) returned 1 [0254.828] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0254.828] CloseHandle (hObject=0x378) returned 1 [0254.828] WriteFile (in: hFile=0x37c, lpBuffer=0x27b7570*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x27b7570*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0254.828] CloseHandle (hObject=0x37c) returned 1 [0254.832] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\4M4RPyy.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0254.832] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\4M4RPyy.pptx", nBufferLength=0x27, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\4M4RPyy.pptx", lpFilePart=0x0) returned 0x26 [0254.832] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\4M4RPyy.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\4m4rpyy.pptx")) returned 1 [0254.836] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\8aclWgLFdg-E.csv.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0254.836] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\8aclWgLFdg-E.csv.locked", nBufferLength=0x32, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\8aclWgLFdg-E.csv.locked", lpFilePart=0x0) returned 0x31 [0254.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0254.836] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\8aclWgLFdg-E.csv.locked" (normalized: "c:\\users\\fd1hvy\\documents\\8aclwglfdg-e.csv.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0254.836] GetFileType (hFile=0x37c) returned 0x1 [0254.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0254.836] GetFileType (hFile=0x37c) returned 0x1 [0255.765] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\8aclWgLFdg-E.csv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0255.765] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\8aclWgLFdg-E.csv", nBufferLength=0x2b, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\8aclWgLFdg-E.csv", lpFilePart=0x0) returned 0x2a [0255.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0255.765] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\8aclWgLFdg-E.csv" (normalized: "c:\\users\\fd1hvy\\documents\\8aclwglfdg-e.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0255.766] GetFileType (hFile=0x378) returned 0x1 [0255.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0255.766] GetFileType (hFile=0x378) returned 0x1 [0255.769] ReadFile (in: hFile=0x378, lpBuffer=0x38821c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x38821c8*, lpNumberOfBytesRead=0x8fec98*=0x7590, lpOverlapped=0x0) returned 1 [0255.781] WriteFile (in: hFile=0x37c, lpBuffer=0x289ee24*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x289ee24*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0255.783] WriteFile (in: hFile=0x37c, lpBuffer=0x28a12f8*, nNumberOfBytesToWrite=0x65b0, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x28a12f8*, lpNumberOfBytesWritten=0x8fec70*=0x65b0, lpOverlapped=0x0) returned 1 [0255.783] ReadFile (in: hFile=0x378, lpBuffer=0x38821c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x38821c8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0255.783] CloseHandle (hObject=0x378) returned 1 [0255.787] WriteFile (in: hFile=0x37c, lpBuffer=0x269fbb8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x269fbb8*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0255.787] CloseHandle (hObject=0x37c) returned 1 [0255.788] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\8aclWgLFdg-E.csv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0255.788] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\8aclWgLFdg-E.csv", nBufferLength=0x2b, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\8aclWgLFdg-E.csv", lpFilePart=0x0) returned 0x2a [0255.788] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\8aclWgLFdg-E.csv" (normalized: "c:\\users\\fd1hvy\\documents\\8aclwglfdg-e.csv")) returned 1 [0255.791] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BfYdEnt0aL.pptx.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0255.791] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BfYdEnt0aL.pptx.locked", nBufferLength=0x31, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BfYdEnt0aL.pptx.locked", lpFilePart=0x0) returned 0x30 [0255.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0255.792] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BfYdEnt0aL.pptx.locked" (normalized: "c:\\users\\fd1hvy\\documents\\bfydent0al.pptx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0255.792] GetFileType (hFile=0x37c) returned 0x1 [0255.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0255.792] GetFileType (hFile=0x37c) returned 0x1 [0256.697] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BfYdEnt0aL.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0256.697] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BfYdEnt0aL.pptx", nBufferLength=0x2a, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BfYdEnt0aL.pptx", lpFilePart=0x0) returned 0x29 [0256.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0256.698] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BfYdEnt0aL.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\bfydent0al.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0256.698] GetFileType (hFile=0x378) returned 0x1 [0256.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0256.698] GetFileType (hFile=0x378) returned 0x1 [0256.699] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0xadeb, lpOverlapped=0x0) returned 1 [0256.701] WriteFile (in: hFile=0x37c, lpBuffer=0x2786384*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x2786384*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0256.702] WriteFile (in: hFile=0x37c, lpBuffer=0x2788854*, nNumberOfBytesToWrite=0x9e00, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x2788854*, lpNumberOfBytesWritten=0x8fec70*=0x9e00, lpOverlapped=0x0) returned 1 [0256.703] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0256.703] CloseHandle (hObject=0x378) returned 1 [0256.703] WriteFile (in: hFile=0x37c, lpBuffer=0x2786384*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x2786384*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0256.703] CloseHandle (hObject=0x37c) returned 1 [0256.706] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BfYdEnt0aL.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0256.706] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BfYdEnt0aL.pptx", nBufferLength=0x2a, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BfYdEnt0aL.pptx", lpFilePart=0x0) returned 0x29 [0256.706] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BfYdEnt0aL.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\bfydent0al.pptx")) returned 1 [0256.747] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\cucyL.odt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0256.747] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\cucyL.odt.locked", nBufferLength=0x2b, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\cucyL.odt.locked", lpFilePart=0x0) returned 0x2a [0256.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0256.747] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\cucyL.odt.locked" (normalized: "c:\\users\\fd1hvy\\documents\\cucyl.odt.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0256.747] GetFileType (hFile=0x37c) returned 0x1 [0256.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0256.747] GetFileType (hFile=0x37c) returned 0x1 [0257.577] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\cucyL.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0257.577] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\cucyL.odt", nBufferLength=0x24, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\cucyL.odt", lpFilePart=0x0) returned 0x23 [0257.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0257.577] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\cucyL.odt" (normalized: "c:\\users\\fd1hvy\\documents\\cucyl.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0257.578] GetFileType (hFile=0x378) returned 0x1 [0257.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0257.578] GetFileType (hFile=0x378) returned 0x1 [0257.579] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec98*=0x86f2, lpOverlapped=0x0) returned 1 [0257.580] WriteFile (in: hFile=0x37c, lpBuffer=0x2878b60*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x2878b60*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0257.582] WriteFile (in: hFile=0x37c, lpBuffer=0x287b024*, nNumberOfBytesToWrite=0x7710, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x287b024*, lpNumberOfBytesWritten=0x8fec70*=0x7710, lpOverlapped=0x0) returned 1 [0257.582] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0257.582] CloseHandle (hObject=0x378) returned 1 [0257.582] WriteFile (in: hFile=0x37c, lpBuffer=0x2878b60*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x2878b60*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0257.582] CloseHandle (hObject=0x37c) returned 1 [0257.584] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\cucyL.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0257.584] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\cucyL.odt", nBufferLength=0x24, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\cucyL.odt", lpFilePart=0x0) returned 0x23 [0257.584] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\cucyL.odt" (normalized: "c:\\users\\fd1hvy\\documents\\cucyl.odt")) returned 1 [0257.587] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\CUFv0Ude.docx.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0257.587] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\CUFv0Ude.docx.locked", nBufferLength=0x2f, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\CUFv0Ude.docx.locked", lpFilePart=0x0) returned 0x2e [0257.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0257.588] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\CUFv0Ude.docx.locked" (normalized: "c:\\users\\fd1hvy\\documents\\cufv0ude.docx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0257.588] GetFileType (hFile=0x37c) returned 0x1 [0257.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0257.588] GetFileType (hFile=0x37c) returned 0x1 [0258.509] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\CUFv0Ude.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0258.509] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\CUFv0Ude.docx", nBufferLength=0x28, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\CUFv0Ude.docx", lpFilePart=0x0) returned 0x27 [0258.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0258.509] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\CUFv0Ude.docx" (normalized: "c:\\users\\fd1hvy\\documents\\cufv0ude.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0258.510] GetFileType (hFile=0x378) returned 0x1 [0258.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0258.510] GetFileType (hFile=0x378) returned 0x1 [0258.513] ReadFile (in: hFile=0x378, lpBuffer=0x39821e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x39821e8*, lpNumberOfBytesRead=0x8fec98*=0x1157f, lpOverlapped=0x0) returned 1 [0258.529] WriteFile (in: hFile=0x37c, lpBuffer=0x2768d7c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x2768d7c*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0258.530] WriteFile (in: hFile=0x37c, lpBuffer=0x276b248*, nNumberOfBytesToWrite=0x10590, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x276b248*, lpNumberOfBytesWritten=0x8fec70*=0x10590, lpOverlapped=0x0) returned 1 [0258.531] ReadFile (in: hFile=0x378, lpBuffer=0x39821e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x39821e8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0258.531] CloseHandle (hObject=0x378) returned 1 [0258.532] WriteFile (in: hFile=0x37c, lpBuffer=0x2768d7c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x2768d7c*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0258.532] CloseHandle (hObject=0x37c) returned 1 [0258.535] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\CUFv0Ude.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0258.535] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\CUFv0Ude.docx", nBufferLength=0x28, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\CUFv0Ude.docx", lpFilePart=0x0) returned 0x27 [0258.535] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\CUFv0Ude.docx" (normalized: "c:\\users\\fd1hvy\\documents\\cufv0ude.docx")) returned 1 [0258.539] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0258.539] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.locked", nBufferLength=0x31, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.locked", lpFilePart=0x0) returned 0x30 [0258.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0258.539] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.locked" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0258.539] GetFileType (hFile=0x37c) returned 0x1 [0258.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0258.539] GetFileType (hFile=0x37c) returned 0x1 [0259.495] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0259.495] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", nBufferLength=0x2a, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", lpFilePart=0x0) returned 0x29 [0259.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0259.495] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0259.495] GetFileType (hFile=0x378) returned 0x1 [0259.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0259.496] GetFileType (hFile=0x378) returned 0x1 [0259.498] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0x55000, lpOverlapped=0x0) returned 1 [0259.555] WriteFile (in: hFile=0x37c, lpBuffer=0x2862720*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x2862720*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0259.556] WriteFile (in: hFile=0x37c, lpBuffer=0x376a4c8*, nNumberOfBytesToWrite=0x54020, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x376a4c8*, lpNumberOfBytesWritten=0x8fec70*=0x54020, lpOverlapped=0x0) returned 1 [0259.563] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0259.563] CloseHandle (hObject=0x378) returned 1 [0259.564] WriteFile (in: hFile=0x37c, lpBuffer=0x2862720*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x2862720*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0259.564] CloseHandle (hObject=0x37c) returned 1 [0259.573] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0259.573] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", nBufferLength=0x2a, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", lpFilePart=0x0) returned 0x29 [0259.573] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb")) returned 1 [0259.599] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0259.599] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini.locked", nBufferLength=0x2d, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\desktop.ini.locked", lpFilePart=0x0) returned 0x2c [0259.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0259.599] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini.locked" (normalized: "c:\\users\\fd1hvy\\documents\\desktop.ini.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0259.599] GetFileType (hFile=0x37c) returned 0x1 [0259.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0259.599] GetFileType (hFile=0x37c) returned 0x1 [0260.570] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0260.570] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini", nBufferLength=0x26, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\desktop.ini", lpFilePart=0x0) returned 0x25 [0260.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0260.570] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0260.571] GetFileType (hFile=0x378) returned 0x1 [0260.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0260.571] GetFileType (hFile=0x378) returned 0x1 [0260.574] ReadFile (in: hFile=0x378, lpBuffer=0x37be508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x37be508*, lpNumberOfBytesRead=0x8fec98*=0x192, lpOverlapped=0x0) returned 1 [0260.589] ReadFile (in: hFile=0x378, lpBuffer=0x37be508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x37be508*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0260.589] CloseHandle (hObject=0x378) returned 1 [0260.589] WriteFile (in: hFile=0x37c, lpBuffer=0x2746ae0*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x2746ae0*, lpNumberOfBytesWritten=0x8fec38*=0x1c0, lpOverlapped=0x0) returned 1 [0260.590] CloseHandle (hObject=0x37c) returned 1 [0260.594] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0260.594] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini", nBufferLength=0x26, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\desktop.ini", lpFilePart=0x0) returned 0x25 [0260.594] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\desktop.ini")) returned 1 [0260.597] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\dVddonu6g4Q69vQTOhi.xlsx.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0260.597] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\dVddonu6g4Q69vQTOhi.xlsx.locked", nBufferLength=0x3a, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\dVddonu6g4Q69vQTOhi.xlsx.locked", lpFilePart=0x0) returned 0x39 [0260.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0260.597] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\dVddonu6g4Q69vQTOhi.xlsx.locked" (normalized: "c:\\users\\fd1hvy\\documents\\dvddonu6g4q69vqtohi.xlsx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0260.598] GetFileType (hFile=0x37c) returned 0x1 [0260.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0260.598] GetFileType (hFile=0x37c) returned 0x1 [0261.489] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\dVddonu6g4Q69vQTOhi.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0261.489] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\dVddonu6g4Q69vQTOhi.xlsx", nBufferLength=0x33, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\dVddonu6g4Q69vQTOhi.xlsx", lpFilePart=0x0) returned 0x32 [0261.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0261.489] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\dVddonu6g4Q69vQTOhi.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\dvddonu6g4q69vqtohi.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0261.489] GetFileType (hFile=0x378) returned 0x1 [0261.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0261.489] GetFileType (hFile=0x378) returned 0x1 [0261.492] ReadFile (in: hFile=0x378, lpBuffer=0x38be528, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x38be528*, lpNumberOfBytesRead=0x8fec98*=0x122d4, lpOverlapped=0x0) returned 1 [0261.508] WriteFile (in: hFile=0x37c, lpBuffer=0x282b104*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x282b104*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0261.509] WriteFile (in: hFile=0x37c, lpBuffer=0x282d5e8*, nNumberOfBytesToWrite=0x112f0, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x282d5e8*, lpNumberOfBytesWritten=0x8fec70*=0x112f0, lpOverlapped=0x0) returned 1 [0261.510] ReadFile (in: hFile=0x378, lpBuffer=0x38be528, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x38be528*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0261.510] CloseHandle (hObject=0x378) returned 1 [0261.511] WriteFile (in: hFile=0x37c, lpBuffer=0x282b104*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x282b104*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0261.511] CloseHandle (hObject=0x37c) returned 1 [0261.513] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\dVddonu6g4Q69vQTOhi.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0261.513] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\dVddonu6g4Q69vQTOhi.xlsx", nBufferLength=0x33, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\dVddonu6g4Q69vQTOhi.xlsx", lpFilePart=0x0) returned 0x32 [0261.513] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\dVddonu6g4Q69vQTOhi.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\dvddonu6g4q69vqtohi.xlsx")) returned 1 [0261.516] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\e-cJYfWW7d.pptx.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0261.517] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\e-cJYfWW7d.pptx.locked", nBufferLength=0x31, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\e-cJYfWW7d.pptx.locked", lpFilePart=0x0) returned 0x30 [0261.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0261.517] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\e-cJYfWW7d.pptx.locked" (normalized: "c:\\users\\fd1hvy\\documents\\e-cjyfww7d.pptx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0261.517] GetFileType (hFile=0x37c) returned 0x1 [0261.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0261.517] GetFileType (hFile=0x37c) returned 0x1 [0262.401] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\e-cJYfWW7d.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0262.401] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\e-cJYfWW7d.pptx", nBufferLength=0x2a, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\e-cJYfWW7d.pptx", lpFilePart=0x0) returned 0x29 [0262.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0262.401] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\e-cJYfWW7d.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\e-cjyfww7d.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0262.401] GetFileType (hFile=0x378) returned 0x1 [0262.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0262.402] GetFileType (hFile=0x378) returned 0x1 [0262.404] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0x5d13, lpOverlapped=0x0) returned 1 [0262.415] WriteFile (in: hFile=0x37c, lpBuffer=0x27140c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x27140c0*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0262.417] WriteFile (in: hFile=0x37c, lpBuffer=0x2716590*, nNumberOfBytesToWrite=0x4d30, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x2716590*, lpNumberOfBytesWritten=0x8fec70*=0x4d30, lpOverlapped=0x0) returned 1 [0262.417] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0262.417] CloseHandle (hObject=0x378) returned 1 [0262.417] WriteFile (in: hFile=0x37c, lpBuffer=0x27140c0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x27140c0*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0262.417] CloseHandle (hObject=0x37c) returned 1 [0262.419] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\e-cJYfWW7d.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0262.419] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\e-cJYfWW7d.pptx", nBufferLength=0x2a, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\e-cJYfWW7d.pptx", lpFilePart=0x0) returned 0x29 [0262.419] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\e-cJYfWW7d.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\e-cjyfww7d.pptx")) returned 1 [0262.423] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\EfPzrjGucHVIG4aB.docx.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0262.424] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\EfPzrjGucHVIG4aB.docx.locked", nBufferLength=0x37, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\EfPzrjGucHVIG4aB.docx.locked", lpFilePart=0x0) returned 0x36 [0262.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0262.424] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\EfPzrjGucHVIG4aB.docx.locked" (normalized: "c:\\users\\fd1hvy\\documents\\efpzrjguchvig4ab.docx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0262.424] GetFileType (hFile=0x37c) returned 0x1 [0262.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0262.424] GetFileType (hFile=0x37c) returned 0x1 [0263.305] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\EfPzrjGucHVIG4aB.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0263.305] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\EfPzrjGucHVIG4aB.docx", nBufferLength=0x30, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\EfPzrjGucHVIG4aB.docx", lpFilePart=0x0) returned 0x2f [0263.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0263.305] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\EfPzrjGucHVIG4aB.docx" (normalized: "c:\\users\\fd1hvy\\documents\\efpzrjguchvig4ab.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0263.305] GetFileType (hFile=0x378) returned 0x1 [0263.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0263.305] GetFileType (hFile=0x378) returned 0x1 [0263.308] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec98*=0x16b9b, lpOverlapped=0x0) returned 1 [0263.324] WriteFile (in: hFile=0x37c, lpBuffer=0x2801c64*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x2801c64*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0263.325] WriteFile (in: hFile=0x37c, lpBuffer=0x386a4e8*, nNumberOfBytesToWrite=0x15bb0, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x386a4e8*, lpNumberOfBytesWritten=0x8fec70*=0x15bb0, lpOverlapped=0x0) returned 1 [0263.327] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0263.327] CloseHandle (hObject=0x378) returned 1 [0263.327] WriteFile (in: hFile=0x37c, lpBuffer=0x2801c64*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x2801c64*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0263.327] CloseHandle (hObject=0x37c) returned 1 [0263.330] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\EfPzrjGucHVIG4aB.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0263.330] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\EfPzrjGucHVIG4aB.docx", nBufferLength=0x30, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\EfPzrjGucHVIG4aB.docx", lpFilePart=0x0) returned 0x2f [0263.330] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\EfPzrjGucHVIG4aB.docx" (normalized: "c:\\users\\fd1hvy\\documents\\efpzrjguchvig4ab.docx")) returned 1 [0263.387] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\evxrwLajfekQ0MYh.odt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0263.387] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\evxrwLajfekQ0MYh.odt.locked", nBufferLength=0x36, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\evxrwLajfekQ0MYh.odt.locked", lpFilePart=0x0) returned 0x35 [0263.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0263.387] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\evxrwLajfekQ0MYh.odt.locked" (normalized: "c:\\users\\fd1hvy\\documents\\evxrwlajfekq0myh.odt.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0263.387] GetFileType (hFile=0x37c) returned 0x1 [0263.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0263.387] GetFileType (hFile=0x37c) returned 0x1 [0264.319] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\evxrwLajfekQ0MYh.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0264.319] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\evxrwLajfekQ0MYh.odt", nBufferLength=0x2f, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\evxrwLajfekQ0MYh.odt", lpFilePart=0x0) returned 0x2e [0264.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0264.319] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\evxrwLajfekQ0MYh.odt" (normalized: "c:\\users\\fd1hvy\\documents\\evxrwlajfekq0myh.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0264.320] GetFileType (hFile=0x378) returned 0x1 [0264.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0264.320] GetFileType (hFile=0x378) returned 0x1 [0264.322] ReadFile (in: hFile=0x378, lpBuffer=0x38800b8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x38800b8*, lpNumberOfBytesRead=0x8fec98*=0xa6b, lpOverlapped=0x0) returned 1 [0264.335] ReadFile (in: hFile=0x378, lpBuffer=0x38800b8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x38800b8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0264.335] CloseHandle (hObject=0x378) returned 1 [0264.335] WriteFile (in: hFile=0x37c, lpBuffer=0x26e9be4*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x26e9be4*, lpNumberOfBytesWritten=0x8fec38*=0xa90, lpOverlapped=0x0) returned 1 [0264.337] CloseHandle (hObject=0x37c) returned 1 [0264.338] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\evxrwLajfekQ0MYh.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0264.338] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\evxrwLajfekQ0MYh.odt", nBufferLength=0x2f, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\evxrwLajfekQ0MYh.odt", lpFilePart=0x0) returned 0x2e [0264.338] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\evxrwLajfekQ0MYh.odt" (normalized: "c:\\users\\fd1hvy\\documents\\evxrwlajfekq0myh.odt")) returned 1 [0264.343] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Fw_.pptx.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0264.343] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Fw_.pptx.locked", nBufferLength=0x2a, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Fw_.pptx.locked", lpFilePart=0x0) returned 0x29 [0264.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0264.343] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Fw_.pptx.locked" (normalized: "c:\\users\\fd1hvy\\documents\\fw_.pptx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0264.344] GetFileType (hFile=0x37c) returned 0x1 [0264.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0264.344] GetFileType (hFile=0x37c) returned 0x1 [0265.201] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Fw_.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x23 [0265.202] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Fw_.pptx", nBufferLength=0x23, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Fw_.pptx", lpFilePart=0x0) returned 0x22 [0265.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0265.202] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Fw_.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\fw_.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0265.202] GetFileType (hFile=0x378) returned 0x1 [0265.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0265.202] GetFileType (hFile=0x378) returned 0x1 [0265.205] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0xb7d0, lpOverlapped=0x0) returned 1 [0265.217] WriteFile (in: hFile=0x37c, lpBuffer=0x27c7908*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x27c7908*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0265.218] WriteFile (in: hFile=0x37c, lpBuffer=0x27c9dcc*, nNumberOfBytesToWrite=0xa7f0, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x27c9dcc*, lpNumberOfBytesWritten=0x8fec70*=0xa7f0, lpOverlapped=0x0) returned 1 [0265.219] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0265.219] CloseHandle (hObject=0x378) returned 1 [0265.219] WriteFile (in: hFile=0x37c, lpBuffer=0x27c7908*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x27c7908*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0265.221] CloseHandle (hObject=0x37c) returned 1 [0265.222] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Fw_.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x23 [0265.222] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Fw_.pptx", nBufferLength=0x23, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Fw_.pptx", lpFilePart=0x0) returned 0x22 [0265.223] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Fw_.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\fw_.pptx")) returned 1 [0265.226] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\HN-eE.xlsx.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0265.226] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\HN-eE.xlsx.locked", nBufferLength=0x2c, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\HN-eE.xlsx.locked", lpFilePart=0x0) returned 0x2b [0265.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0265.226] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\HN-eE.xlsx.locked" (normalized: "c:\\users\\fd1hvy\\documents\\hn-ee.xlsx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0265.227] GetFileType (hFile=0x37c) returned 0x1 [0265.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0265.227] GetFileType (hFile=0x37c) returned 0x1 [0266.135] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\HN-eE.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0266.135] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\HN-eE.xlsx", nBufferLength=0x25, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\HN-eE.xlsx", lpFilePart=0x0) returned 0x24 [0266.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0266.135] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\HN-eE.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\hn-ee.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0266.135] GetFileType (hFile=0x378) returned 0x1 [0266.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0266.135] GetFileType (hFile=0x378) returned 0x1 [0266.138] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec98*=0xeada, lpOverlapped=0x0) returned 1 [0266.151] WriteFile (in: hFile=0x37c, lpBuffer=0x26bb0f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x26bb0f8*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0266.152] WriteFile (in: hFile=0x37c, lpBuffer=0x26bd5c0*, nNumberOfBytesToWrite=0xdaf0, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x26bd5c0*, lpNumberOfBytesWritten=0x8fec70*=0xdaf0, lpOverlapped=0x0) returned 1 [0266.153] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0266.153] CloseHandle (hObject=0x378) returned 1 [0266.154] WriteFile (in: hFile=0x37c, lpBuffer=0x26bb0f8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x26bb0f8*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0266.154] CloseHandle (hObject=0x37c) returned 1 [0266.156] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\HN-eE.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0266.156] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\HN-eE.xlsx", nBufferLength=0x25, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\HN-eE.xlsx", lpFilePart=0x0) returned 0x24 [0266.156] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\HN-eE.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\hn-ee.xlsx")) returned 1 [0266.160] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\JAZPWfinV.docx.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0266.160] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\JAZPWfinV.docx.locked", nBufferLength=0x30, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\JAZPWfinV.docx.locked", lpFilePart=0x0) returned 0x2f [0266.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0266.160] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\JAZPWfinV.docx.locked" (normalized: "c:\\users\\fd1hvy\\documents\\jazpwfinv.docx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0266.161] GetFileType (hFile=0x37c) returned 0x1 [0266.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0266.161] GetFileType (hFile=0x37c) returned 0x1 [0267.034] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\JAZPWfinV.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0267.034] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\JAZPWfinV.docx", nBufferLength=0x29, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\JAZPWfinV.docx", lpFilePart=0x0) returned 0x28 [0267.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0267.034] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\JAZPWfinV.docx" (normalized: "c:\\users\\fd1hvy\\documents\\jazpwfinv.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0267.034] GetFileType (hFile=0x378) returned 0x1 [0267.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0267.034] GetFileType (hFile=0x378) returned 0x1 [0267.037] ReadFile (in: hFile=0x378, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8fec98*=0x15a30, lpOverlapped=0x0) returned 1 [0267.057] WriteFile (in: hFile=0x37c, lpBuffer=0x269ff98*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x269ff98*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0267.058] WriteFile (in: hFile=0x37c, lpBuffer=0x366a4a8*, nNumberOfBytesToWrite=0x14a50, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x366a4a8*, lpNumberOfBytesWritten=0x8fec70*=0x14a50, lpOverlapped=0x0) returned 1 [0267.060] ReadFile (in: hFile=0x378, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0267.060] CloseHandle (hObject=0x378) returned 1 [0267.060] WriteFile (in: hFile=0x37c, lpBuffer=0x269ff98*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x269ff98*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0267.060] CloseHandle (hObject=0x37c) returned 1 [0267.062] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\JAZPWfinV.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0267.062] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\JAZPWfinV.docx", nBufferLength=0x29, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\JAZPWfinV.docx", lpFilePart=0x0) returned 0x28 [0267.063] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\JAZPWfinV.docx" (normalized: "c:\\users\\fd1hvy\\documents\\jazpwfinv.docx")) returned 1 [0267.066] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\mbqXSaY.pptx.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0267.066] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\mbqXSaY.pptx.locked", nBufferLength=0x2e, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\mbqXSaY.pptx.locked", lpFilePart=0x0) returned 0x2d [0267.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0267.067] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\mbqXSaY.pptx.locked" (normalized: "c:\\users\\fd1hvy\\documents\\mbqxsay.pptx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0267.068] GetFileType (hFile=0x37c) returned 0x1 [0267.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0267.068] GetFileType (hFile=0x37c) returned 0x1 [0267.972] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\mbqXSaY.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0267.972] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\mbqXSaY.pptx", nBufferLength=0x27, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\mbqXSaY.pptx", lpFilePart=0x0) returned 0x26 [0267.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0267.972] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\mbqXSaY.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\mbqxsay.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0267.972] GetFileType (hFile=0x378) returned 0x1 [0267.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0267.972] GetFileType (hFile=0x378) returned 0x1 [0267.973] ReadFile (in: hFile=0x378, lpBuffer=0x367ef18, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x367ef18*, lpNumberOfBytesRead=0x8fec98*=0x139ba, lpOverlapped=0x0) returned 1 [0267.977] WriteFile (in: hFile=0x37c, lpBuffer=0x2786f3c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x2786f3c*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0267.978] WriteFile (in: hFile=0x37c, lpBuffer=0x2789408*, nNumberOfBytesToWrite=0x129d0, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x2789408*, lpNumberOfBytesWritten=0x8fec70*=0x129d0, lpOverlapped=0x0) returned 1 [0267.979] ReadFile (in: hFile=0x378, lpBuffer=0x367ef18, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x367ef18*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0267.979] CloseHandle (hObject=0x378) returned 1 [0267.979] WriteFile (in: hFile=0x37c, lpBuffer=0x2786f3c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x2786f3c*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0267.979] CloseHandle (hObject=0x37c) returned 1 [0267.982] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\mbqXSaY.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0267.982] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\mbqXSaY.pptx", nBufferLength=0x27, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\mbqXSaY.pptx", lpFilePart=0x0) returned 0x26 [0267.982] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\mbqXSaY.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\mbqxsay.pptx")) returned 1 [0267.987] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\mfGUeqia2d4NY4DZsqxe.pps.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0267.987] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\mfGUeqia2d4NY4DZsqxe.pps.locked", nBufferLength=0x3a, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\mfGUeqia2d4NY4DZsqxe.pps.locked", lpFilePart=0x0) returned 0x39 [0267.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0267.987] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\mfGUeqia2d4NY4DZsqxe.pps.locked" (normalized: "c:\\users\\fd1hvy\\documents\\mfgueqia2d4ny4dzsqxe.pps.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0267.988] GetFileType (hFile=0x37c) returned 0x1 [0267.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0267.988] GetFileType (hFile=0x37c) returned 0x1 [0268.929] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\mfGUeqia2d4NY4DZsqxe.pps", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0268.929] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\mfGUeqia2d4NY4DZsqxe.pps", nBufferLength=0x33, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\mfGUeqia2d4NY4DZsqxe.pps", lpFilePart=0x0) returned 0x32 [0268.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0268.929] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\mfGUeqia2d4NY4DZsqxe.pps" (normalized: "c:\\users\\fd1hvy\\documents\\mfgueqia2d4ny4dzsqxe.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0268.930] GetFileType (hFile=0x378) returned 0x1 [0268.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0268.930] GetFileType (hFile=0x378) returned 0x1 [0268.933] ReadFile (in: hFile=0x378, lpBuffer=0x3969528, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3969528*, lpNumberOfBytesRead=0x8fec98*=0x86e1, lpOverlapped=0x0) returned 1 [0268.950] WriteFile (in: hFile=0x37c, lpBuffer=0x2882b38*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x2882b38*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0268.952] WriteFile (in: hFile=0x37c, lpBuffer=0x288501c*, nNumberOfBytesToWrite=0x7700, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x288501c*, lpNumberOfBytesWritten=0x8fec70*=0x7700, lpOverlapped=0x0) returned 1 [0268.952] ReadFile (in: hFile=0x378, lpBuffer=0x3969528, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3969528*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0268.952] CloseHandle (hObject=0x378) returned 1 [0268.953] WriteFile (in: hFile=0x37c, lpBuffer=0x2882b38*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x2882b38*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0268.953] CloseHandle (hObject=0x37c) returned 1 [0268.955] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\mfGUeqia2d4NY4DZsqxe.pps", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0268.955] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\mfGUeqia2d4NY4DZsqxe.pps", nBufferLength=0x33, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\mfGUeqia2d4NY4DZsqxe.pps", lpFilePart=0x0) returned 0x32 [0268.955] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\mfGUeqia2d4NY4DZsqxe.pps" (normalized: "c:\\users\\fd1hvy\\documents\\mfgueqia2d4ny4dzsqxe.pps")) returned 1 [0268.958] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\MGm2RtZaI.xls.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0268.958] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\MGm2RtZaI.xls.locked", nBufferLength=0x2f, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\MGm2RtZaI.xls.locked", lpFilePart=0x0) returned 0x2e [0268.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0268.958] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\MGm2RtZaI.xls.locked" (normalized: "c:\\users\\fd1hvy\\documents\\mgm2rtzai.xls.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0268.959] GetFileType (hFile=0x37c) returned 0x1 [0268.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0268.959] GetFileType (hFile=0x37c) returned 0x1 [0269.890] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\MGm2RtZaI.xls", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0269.890] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\MGm2RtZaI.xls", nBufferLength=0x28, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\MGm2RtZaI.xls", lpFilePart=0x0) returned 0x27 [0269.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0269.891] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\MGm2RtZaI.xls" (normalized: "c:\\users\\fd1hvy\\documents\\mgm2rtzai.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0269.891] GetFileType (hFile=0x378) returned 0x1 [0269.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0269.891] GetFileType (hFile=0x378) returned 0x1 [0269.894] ReadFile (in: hFile=0x378, lpBuffer=0x3a69548, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3a69548*, lpNumberOfBytesRead=0x8fec98*=0x11994, lpOverlapped=0x0) returned 1 [0269.909] WriteFile (in: hFile=0x37c, lpBuffer=0x2773564*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x2773564*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0269.910] WriteFile (in: hFile=0x37c, lpBuffer=0x2775a30*, nNumberOfBytesToWrite=0x109b0, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x2775a30*, lpNumberOfBytesWritten=0x8fec70*=0x109b0, lpOverlapped=0x0) returned 1 [0269.912] ReadFile (in: hFile=0x378, lpBuffer=0x3a69548, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3a69548*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0269.912] CloseHandle (hObject=0x378) returned 1 [0269.912] WriteFile (in: hFile=0x37c, lpBuffer=0x2773564*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x2773564*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0269.912] CloseHandle (hObject=0x37c) returned 1 [0269.915] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\MGm2RtZaI.xls", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0269.915] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\MGm2RtZaI.xls", nBufferLength=0x28, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\MGm2RtZaI.xls", lpFilePart=0x0) returned 0x27 [0269.915] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\MGm2RtZaI.xls" (normalized: "c:\\users\\fd1hvy\\documents\\mgm2rtzai.xls")) returned 1 [0269.918] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\oIHTAL.ots.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0269.918] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\oIHTAL.ots.locked", nBufferLength=0x2c, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\oIHTAL.ots.locked", lpFilePart=0x0) returned 0x2b [0269.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0269.918] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\oIHTAL.ots.locked" (normalized: "c:\\users\\fd1hvy\\documents\\oihtal.ots.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0269.919] GetFileType (hFile=0x37c) returned 0x1 [0269.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0269.919] GetFileType (hFile=0x37c) returned 0x1 [0270.813] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\oIHTAL.ots", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0270.813] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\oIHTAL.ots", nBufferLength=0x25, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\oIHTAL.ots", lpFilePart=0x0) returned 0x24 [0270.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0270.813] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\oIHTAL.ots" (normalized: "c:\\users\\fd1hvy\\documents\\oihtal.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0270.813] GetFileType (hFile=0x378) returned 0x1 [0270.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0270.814] GetFileType (hFile=0x378) returned 0x1 [0270.817] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0x15887, lpOverlapped=0x0) returned 1 [0270.834] WriteFile (in: hFile=0x37c, lpBuffer=0x286e374*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x286e374*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0270.835] WriteFile (in: hFile=0x37c, lpBuffer=0x376a4c8*, nNumberOfBytesToWrite=0x148a0, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x376a4c8*, lpNumberOfBytesWritten=0x8fec70*=0x148a0, lpOverlapped=0x0) returned 1 [0270.837] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0270.837] CloseHandle (hObject=0x378) returned 1 [0270.837] WriteFile (in: hFile=0x37c, lpBuffer=0x286e374*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x286e374*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0270.837] CloseHandle (hObject=0x37c) returned 1 [0270.839] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\oIHTAL.ots", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0270.840] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\oIHTAL.ots", nBufferLength=0x25, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\oIHTAL.ots", lpFilePart=0x0) returned 0x24 [0270.840] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\oIHTAL.ots" (normalized: "c:\\users\\fd1hvy\\documents\\oihtal.ots")) returned 1 [0270.844] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\P0yAA1UNt_AeGs.xlsx.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0270.844] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\P0yAA1UNt_AeGs.xlsx.locked", nBufferLength=0x35, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\P0yAA1UNt_AeGs.xlsx.locked", lpFilePart=0x0) returned 0x34 [0270.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0270.844] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\P0yAA1UNt_AeGs.xlsx.locked" (normalized: "c:\\users\\fd1hvy\\documents\\p0yaa1unt_aegs.xlsx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0270.845] GetFileType (hFile=0x37c) returned 0x1 [0270.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0270.845] GetFileType (hFile=0x37c) returned 0x1 [0271.688] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\P0yAA1UNt_AeGs.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0271.688] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\P0yAA1UNt_AeGs.xlsx", nBufferLength=0x2e, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\P0yAA1UNt_AeGs.xlsx", lpFilePart=0x0) returned 0x2d [0271.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0271.688] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\P0yAA1UNt_AeGs.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\p0yaa1unt_aegs.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0271.689] GetFileType (hFile=0x378) returned 0x1 [0271.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0271.689] GetFileType (hFile=0x378) returned 0x1 [0271.692] ReadFile (in: hFile=0x378, lpBuffer=0x377ed88, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x377ed88*, lpNumberOfBytesRead=0x8fec98*=0x9868, lpOverlapped=0x0) returned 1 [0271.705] WriteFile (in: hFile=0x37c, lpBuffer=0x2752b58*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x2752b58*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0271.709] WriteFile (in: hFile=0x37c, lpBuffer=0x2755030*, nNumberOfBytesToWrite=0x8880, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x2755030*, lpNumberOfBytesWritten=0x8fec70*=0x8880, lpOverlapped=0x0) returned 1 [0271.709] ReadFile (in: hFile=0x378, lpBuffer=0x377ed88, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x377ed88*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0271.710] CloseHandle (hObject=0x378) returned 1 [0271.710] WriteFile (in: hFile=0x37c, lpBuffer=0x2752b58*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x2752b58*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0271.710] CloseHandle (hObject=0x37c) returned 1 [0271.713] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\P0yAA1UNt_AeGs.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0271.713] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\P0yAA1UNt_AeGs.xlsx", nBufferLength=0x2e, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\P0yAA1UNt_AeGs.xlsx", lpFilePart=0x0) returned 0x2d [0271.713] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\P0yAA1UNt_AeGs.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\p0yaa1unt_aegs.xlsx")) returned 1 [0271.717] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\R0o03ux1o.docx.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0271.717] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\R0o03ux1o.docx.locked", nBufferLength=0x30, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\R0o03ux1o.docx.locked", lpFilePart=0x0) returned 0x2f [0271.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0271.717] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\R0o03ux1o.docx.locked" (normalized: "c:\\users\\fd1hvy\\documents\\r0o03ux1o.docx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0271.718] GetFileType (hFile=0x37c) returned 0x1 [0271.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0271.718] GetFileType (hFile=0x37c) returned 0x1 [0272.626] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\R0o03ux1o.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0272.626] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\R0o03ux1o.docx", nBufferLength=0x29, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\R0o03ux1o.docx", lpFilePart=0x0) returned 0x28 [0272.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0272.626] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\R0o03ux1o.docx" (normalized: "c:\\users\\fd1hvy\\documents\\r0o03ux1o.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0272.627] GetFileType (hFile=0x378) returned 0x1 [0272.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0272.627] GetFileType (hFile=0x378) returned 0x1 [0272.629] ReadFile (in: hFile=0x378, lpBuffer=0x387eda8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x387eda8*, lpNumberOfBytesRead=0x8fec98*=0xbbd2, lpOverlapped=0x0) returned 1 [0272.655] WriteFile (in: hFile=0x37c, lpBuffer=0x2840bf0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x2840bf0*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0272.656] WriteFile (in: hFile=0x37c, lpBuffer=0x28430c0*, nNumberOfBytesToWrite=0xabf0, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x28430c0*, lpNumberOfBytesWritten=0x8fec70*=0xabf0, lpOverlapped=0x0) returned 1 [0272.657] ReadFile (in: hFile=0x378, lpBuffer=0x387eda8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x387eda8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0272.657] CloseHandle (hObject=0x378) returned 1 [0272.657] WriteFile (in: hFile=0x37c, lpBuffer=0x2840bf0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x2840bf0*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0272.657] CloseHandle (hObject=0x37c) returned 1 [0272.659] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\R0o03ux1o.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0272.659] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\R0o03ux1o.docx", nBufferLength=0x29, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\R0o03ux1o.docx", lpFilePart=0x0) returned 0x28 [0272.659] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\R0o03ux1o.docx" (normalized: "c:\\users\\fd1hvy\\documents\\r0o03ux1o.docx")) returned 1 [0272.663] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\rbf3wxxAvTJg.pptx.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0272.663] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\rbf3wxxAvTJg.pptx.locked", nBufferLength=0x33, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\rbf3wxxAvTJg.pptx.locked", lpFilePart=0x0) returned 0x32 [0272.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0272.663] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\rbf3wxxAvTJg.pptx.locked" (normalized: "c:\\users\\fd1hvy\\documents\\rbf3wxxavtjg.pptx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0272.663] GetFileType (hFile=0x37c) returned 0x1 [0272.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0272.663] GetFileType (hFile=0x37c) returned 0x1 [0273.576] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\rbf3wxxAvTJg.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0273.576] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\rbf3wxxAvTJg.pptx", nBufferLength=0x2c, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\rbf3wxxAvTJg.pptx", lpFilePart=0x0) returned 0x2b [0273.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0273.577] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\rbf3wxxAvTJg.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rbf3wxxavtjg.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0273.577] GetFileType (hFile=0x378) returned 0x1 [0273.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0273.577] GetFileType (hFile=0x378) returned 0x1 [0273.580] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0x7987, lpOverlapped=0x0) returned 1 [0273.593] WriteFile (in: hFile=0x37c, lpBuffer=0x27228a0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x27228a0*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0273.594] WriteFile (in: hFile=0x37c, lpBuffer=0x2724d74*, nNumberOfBytesToWrite=0x69a0, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x2724d74*, lpNumberOfBytesWritten=0x8fec70*=0x69a0, lpOverlapped=0x0) returned 1 [0273.595] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0273.595] CloseHandle (hObject=0x378) returned 1 [0273.595] WriteFile (in: hFile=0x37c, lpBuffer=0x27228a0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x27228a0*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0273.595] CloseHandle (hObject=0x37c) returned 1 [0273.600] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\rbf3wxxAvTJg.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0273.601] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\rbf3wxxAvTJg.pptx", nBufferLength=0x2c, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\rbf3wxxAvTJg.pptx", lpFilePart=0x0) returned 0x2b [0273.601] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\rbf3wxxAvTJg.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rbf3wxxavtjg.pptx")) returned 1 [0273.604] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\RfOZfwQP oYTWlHa.ods.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0273.604] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\RfOZfwQP oYTWlHa.ods.locked", nBufferLength=0x36, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\RfOZfwQP oYTWlHa.ods.locked", lpFilePart=0x0) returned 0x35 [0273.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0273.605] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\RfOZfwQP oYTWlHa.ods.locked" (normalized: "c:\\users\\fd1hvy\\documents\\rfozfwqp oytwlha.ods.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0273.605] GetFileType (hFile=0x37c) returned 0x1 [0273.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0273.605] GetFileType (hFile=0x37c) returned 0x1 [0274.500] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\RfOZfwQP oYTWlHa.ods", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0274.501] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\RfOZfwQP oYTWlHa.ods", nBufferLength=0x2f, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\RfOZfwQP oYTWlHa.ods", lpFilePart=0x0) returned 0x2e [0274.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0274.501] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\RfOZfwQP oYTWlHa.ods" (normalized: "c:\\users\\fd1hvy\\documents\\rfozfwqp oytwlha.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0274.501] GetFileType (hFile=0x378) returned 0x1 [0274.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0274.501] GetFileType (hFile=0x378) returned 0x1 [0274.504] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec98*=0x62b4, lpOverlapped=0x0) returned 1 [0274.518] WriteFile (in: hFile=0x37c, lpBuffer=0x2812854*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x2812854*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0274.519] WriteFile (in: hFile=0x37c, lpBuffer=0x2814d30*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x2814d30*, lpNumberOfBytesWritten=0x8fec70*=0x52d0, lpOverlapped=0x0) returned 1 [0274.520] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0274.520] CloseHandle (hObject=0x378) returned 1 [0274.520] WriteFile (in: hFile=0x37c, lpBuffer=0x2812854*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x2812854*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0274.520] CloseHandle (hObject=0x37c) returned 1 [0274.522] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\RfOZfwQP oYTWlHa.ods", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0274.522] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\RfOZfwQP oYTWlHa.ods", nBufferLength=0x2f, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\RfOZfwQP oYTWlHa.ods", lpFilePart=0x0) returned 0x2e [0274.522] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\RfOZfwQP oYTWlHa.ods" (normalized: "c:\\users\\fd1hvy\\documents\\rfozfwqp oytwlha.ods")) returned 1 [0274.525] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\RPBREJYDP8jN2.odt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0274.525] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\RPBREJYDP8jN2.odt.locked", nBufferLength=0x33, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\RPBREJYDP8jN2.odt.locked", lpFilePart=0x0) returned 0x32 [0274.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0274.525] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\RPBREJYDP8jN2.odt.locked" (normalized: "c:\\users\\fd1hvy\\documents\\rpbrejydp8jn2.odt.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0274.525] GetFileType (hFile=0x37c) returned 0x1 [0274.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0274.525] GetFileType (hFile=0x37c) returned 0x1 [0275.368] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\RPBREJYDP8jN2.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0275.369] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\RPBREJYDP8jN2.odt", nBufferLength=0x2c, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\RPBREJYDP8jN2.odt", lpFilePart=0x0) returned 0x2b [0275.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0275.369] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\RPBREJYDP8jN2.odt" (normalized: "c:\\users\\fd1hvy\\documents\\rpbrejydp8jn2.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0275.369] GetFileType (hFile=0x378) returned 0x1 [0275.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0275.369] GetFileType (hFile=0x378) returned 0x1 [0275.372] ReadFile (in: hFile=0x378, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8fec98*=0xb548, lpOverlapped=0x0) returned 1 [0275.385] WriteFile (in: hFile=0x37c, lpBuffer=0x270126c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x270126c*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0275.386] WriteFile (in: hFile=0x37c, lpBuffer=0x2703740*, nNumberOfBytesToWrite=0xa560, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x2703740*, lpNumberOfBytesWritten=0x8fec70*=0xa560, lpOverlapped=0x0) returned 1 [0275.387] ReadFile (in: hFile=0x378, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0275.387] CloseHandle (hObject=0x378) returned 1 [0275.387] WriteFile (in: hFile=0x37c, lpBuffer=0x270126c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x270126c*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0275.387] CloseHandle (hObject=0x37c) returned 1 [0275.389] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\RPBREJYDP8jN2.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0275.389] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\RPBREJYDP8jN2.odt", nBufferLength=0x2c, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\RPBREJYDP8jN2.odt", lpFilePart=0x0) returned 0x2b [0275.389] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\RPBREJYDP8jN2.odt" (normalized: "c:\\users\\fd1hvy\\documents\\rpbrejydp8jn2.odt")) returned 1 [0275.392] CryptGenRandom (in: hProv=0x963c50, dwLen=0x20, pbBuffer=0x99f850 | out: pbBuffer=0x99f850) returned 1 [0275.393] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\v cbuLol-Xgmqz_W.xlsx.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0275.393] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\v cbuLol-Xgmqz_W.xlsx.locked", nBufferLength=0x37, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\v cbuLol-Xgmqz_W.xlsx.locked", lpFilePart=0x0) returned 0x36 [0275.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0275.393] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\v cbuLol-Xgmqz_W.xlsx.locked" (normalized: "c:\\users\\fd1hvy\\documents\\v cbulol-xgmqz_w.xlsx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0275.393] GetFileType (hFile=0x37c) returned 0x1 [0275.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0275.393] GetFileType (hFile=0x37c) returned 0x1 [0276.240] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\v cbuLol-Xgmqz_W.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0276.240] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\v cbuLol-Xgmqz_W.xlsx", nBufferLength=0x30, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\v cbuLol-Xgmqz_W.xlsx", lpFilePart=0x0) returned 0x2f [0276.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0276.240] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\v cbuLol-Xgmqz_W.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\v cbulol-xgmqz_w.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0276.241] GetFileType (hFile=0x378) returned 0x1 [0276.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0276.241] GetFileType (hFile=0x378) returned 0x1 [0276.243] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0xa9f5, lpOverlapped=0x0) returned 1 [0276.285] WriteFile (in: hFile=0x37c, lpBuffer=0x27e9714*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x27e9714*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0276.287] WriteFile (in: hFile=0x37c, lpBuffer=0x27ebbf0*, nNumberOfBytesToWrite=0x9a10, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x27ebbf0*, lpNumberOfBytesWritten=0x8fec70*=0x9a10, lpOverlapped=0x0) returned 1 [0276.287] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0276.287] CloseHandle (hObject=0x378) returned 1 [0276.288] WriteFile (in: hFile=0x37c, lpBuffer=0x27e9714*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x27e9714*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0276.288] CloseHandle (hObject=0x37c) returned 1 [0276.290] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\v cbuLol-Xgmqz_W.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0276.290] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\v cbuLol-Xgmqz_W.xlsx", nBufferLength=0x30, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\v cbuLol-Xgmqz_W.xlsx", lpFilePart=0x0) returned 0x2f [0276.290] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\v cbuLol-Xgmqz_W.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\v cbulol-xgmqz_w.xlsx")) returned 1 [0276.294] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\WsbU.docx.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0276.294] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\WsbU.docx.locked", nBufferLength=0x2b, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\WsbU.docx.locked", lpFilePart=0x0) returned 0x2a [0276.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0276.294] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\WsbU.docx.locked" (normalized: "c:\\users\\fd1hvy\\documents\\wsbu.docx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0276.295] GetFileType (hFile=0x37c) returned 0x1 [0276.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0276.295] GetFileType (hFile=0x37c) returned 0x1 [0277.159] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\WsbU.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0277.159] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\WsbU.docx", nBufferLength=0x24, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\WsbU.docx", lpFilePart=0x0) returned 0x23 [0277.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0277.159] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\WsbU.docx" (normalized: "c:\\users\\fd1hvy\\documents\\wsbu.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0277.160] GetFileType (hFile=0x378) returned 0x1 [0277.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0277.160] GetFileType (hFile=0x378) returned 0x1 [0277.162] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec98*=0x11ddd, lpOverlapped=0x0) returned 1 [0277.177] WriteFile (in: hFile=0x37c, lpBuffer=0x26dc944*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x26dc944*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0277.178] WriteFile (in: hFile=0x37c, lpBuffer=0x26dee08*, nNumberOfBytesToWrite=0x10df0, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x26dee08*, lpNumberOfBytesWritten=0x8fec70*=0x10df0, lpOverlapped=0x0) returned 1 [0277.179] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0277.180] CloseHandle (hObject=0x378) returned 1 [0277.180] WriteFile (in: hFile=0x37c, lpBuffer=0x26dc944*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x26dc944*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0277.180] CloseHandle (hObject=0x37c) returned 1 [0277.182] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\WsbU.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0277.182] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\WsbU.docx", nBufferLength=0x24, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\WsbU.docx", lpFilePart=0x0) returned 0x23 [0277.182] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\WsbU.docx" (normalized: "c:\\users\\fd1hvy\\documents\\wsbu.docx")) returned 1 [0277.187] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ykBv0s0N.docx.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0277.187] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ykBv0s0N.docx.locked", nBufferLength=0x2f, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\ykBv0s0N.docx.locked", lpFilePart=0x0) returned 0x2e [0277.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0277.187] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ykBv0s0N.docx.locked" (normalized: "c:\\users\\fd1hvy\\documents\\ykbv0s0n.docx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0277.187] GetFileType (hFile=0x37c) returned 0x1 [0277.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0277.187] GetFileType (hFile=0x37c) returned 0x1 [0278.247] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ykBv0s0N.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0278.247] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ykBv0s0N.docx", nBufferLength=0x28, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\ykBv0s0N.docx", lpFilePart=0x0) returned 0x27 [0278.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0278.247] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ykBv0s0N.docx" (normalized: "c:\\users\\fd1hvy\\documents\\ykbv0s0n.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0278.247] GetFileType (hFile=0x378) returned 0x1 [0278.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0278.247] GetFileType (hFile=0x378) returned 0x1 [0278.250] ReadFile (in: hFile=0x378, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8fec98*=0xb9cc, lpOverlapped=0x0) returned 1 [0278.265] WriteFile (in: hFile=0x37c, lpBuffer=0x27d6f90*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x27d6f90*, lpNumberOfBytesWritten=0x8fec70*=0x1000, lpOverlapped=0x0) returned 1 [0278.266] WriteFile (in: hFile=0x37c, lpBuffer=0x27d945c*, nNumberOfBytesToWrite=0xa9e0, lpNumberOfBytesWritten=0x8fec70, lpOverlapped=0x0 | out: lpBuffer=0x27d945c*, lpNumberOfBytesWritten=0x8fec70*=0xa9e0, lpOverlapped=0x0) returned 1 [0278.267] ReadFile (in: hFile=0x378, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0278.267] CloseHandle (hObject=0x378) returned 1 [0278.268] WriteFile (in: hFile=0x37c, lpBuffer=0x27d6f90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x27d6f90*, lpNumberOfBytesWritten=0x8fec38*=0x10, lpOverlapped=0x0) returned 1 [0278.268] CloseHandle (hObject=0x37c) returned 1 [0278.300] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ykBv0s0N.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0278.300] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ykBv0s0N.docx", nBufferLength=0x28, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\ykBv0s0N.docx", lpFilePart=0x0) returned 0x27 [0278.300] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ykBv0s0N.docx" (normalized: "c:\\users\\fd1hvy\\documents\\ykbv0s0n.docx")) returned 1 [0278.478] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\z8KGKougj.ots.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0278.478] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\z8KGKougj.ots.locked", nBufferLength=0x2f, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\z8KGKougj.ots.locked", lpFilePart=0x0) returned 0x2e [0278.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0278.478] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\z8KGKougj.ots.locked" (normalized: "c:\\users\\fd1hvy\\documents\\z8kgkougj.ots.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0278.479] GetFileType (hFile=0x37c) returned 0x1 [0278.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0278.479] GetFileType (hFile=0x37c) returned 0x1 [0279.410] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\z8KGKougj.ots", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0279.410] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\z8KGKougj.ots", nBufferLength=0x28, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\z8KGKougj.ots", lpFilePart=0x0) returned 0x27 [0279.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febe4) returned 1 [0279.411] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\z8KGKougj.ots" (normalized: "c:\\users\\fd1hvy\\documents\\z8kgkougj.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0279.411] GetFileType (hFile=0x378) returned 0x1 [0279.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe0) returned 1 [0279.411] GetFileType (hFile=0x378) returned 0x1 [0279.413] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0xf2b, lpOverlapped=0x0) returned 1 [0279.424] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec98, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8fec98*=0x0, lpOverlapped=0x0) returned 1 [0279.425] CloseHandle (hObject=0x378) returned 1 [0279.426] WriteFile (in: hFile=0x37c, lpBuffer=0x26bf82c*, nNumberOfBytesToWrite=0xf50, lpNumberOfBytesWritten=0x8fec38, lpOverlapped=0x0 | out: lpBuffer=0x26bf82c*, lpNumberOfBytesWritten=0x8fec38*=0xf50, lpOverlapped=0x0) returned 1 [0279.427] CloseHandle (hObject=0x37c) returned 1 [0279.428] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\z8KGKougj.ots", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0279.428] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\z8KGKougj.ots", nBufferLength=0x28, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\z8KGKougj.ots", lpFilePart=0x0) returned 0x27 [0279.428] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\z8KGKougj.ots" (normalized: "c:\\users\\fd1hvy\\documents\\z8kgkougj.ots")) returned 1 [0279.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed6c) returned 1 [0279.432] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1a [0279.432] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x1a, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0279.433] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x8fea94 | out: lpFindFileData=0x8fea94*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb5231daf, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xbf477498, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x960708 [0279.433] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb5231daf, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xbf477498, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0279.434] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaede6ab8, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xaede6ab8, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xaf65396e, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x9c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="-Uhoch.xlsx.locked", cAlternateFileName="-UHOCH~1.LOC")) returned 1 [0279.434] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf65396e, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xaf65396e, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xaff6ab0e, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x6fb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0tHoUSG2-9zGg R.doc.locked", cAlternateFileName="0THOUS~1.LOC")) returned 1 [0279.434] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaff6ab0e, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xaff6ab0e, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xb09e8a73, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x18cd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4M4RPyy.pptx.locked", cAlternateFileName="4M4RPY~1.LOC")) returned 1 [0279.434] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09e8a73, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xb09e8a73, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xb12ff897, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x75c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8aclWgLFdg-E.csv.locked", cAlternateFileName="8ACLWG~1.LOC")) returned 1 [0279.434] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb12ff897, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xb12ff897, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xb1bcbe9a, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xae10, dwReserved0=0x0, dwReserved1=0x0, cFileName="BfYdEnt0aL.pptx.locked", cAlternateFileName="BFYDEN~1.LOC")) returned 1 [0279.434] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c167c4, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xb1c167c4, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xb2426676, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x8720, dwReserved0=0x0, dwReserved1=0x0, cFileName="cucyL.odt.locked", cAlternateFileName="CUCYLO~1.LOC")) returned 1 [0279.434] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2426676, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xb2426676, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xb2d3d6b2, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x115a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CUFv0Ude.docx.locked", cAlternateFileName="CUFV0U~1.LOC")) returned 1 [0279.435] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2d3d6b2, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xb2d3d6b2, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xb371708a, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x55030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.locked", cAlternateFileName="DATABA~1.LOC")) returned 1 [0279.435] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb375f498, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xb375f498, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xb40c28d8, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x1c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.locked", cAlternateFileName="DESKTO~1.LOC")) returned 1 [0279.435] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb40e8c38, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xb40e8c38, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xb498d368, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x12300, dwReserved0=0x0, dwReserved1=0x0, cFileName="dVddonu6g4Q69vQTOhi.xlsx.locked", cAlternateFileName="DVDDON~1.LOC")) returned 1 [0279.435] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb498d368, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xb498d368, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xb5231daf, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x5d40, dwReserved0=0x0, dwReserved1=0x0, cFileName="e-cJYfWW7d.pptx.locked", cAlternateFileName="E-CJYF~1.LOC")) returned 1 [0279.435] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69e3bf80, ftCreationTime.dwHighDateTime=0x1d5e48e, ftLastAccessTime.dwLowDateTime=0x6d2a9b30, ftLastAccessTime.dwHighDateTime=0x1d5ebe3, ftLastWriteTime.dwLowDateTime=0x6d2a9b30, ftLastWriteTime.dwHighDateTime=0x1d5ebe3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="edP6exS5", cAlternateFileName="")) returned 1 [0279.435] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5231daf, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xb5231daf, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xb5ae9857, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x16bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EfPzrjGucHVIG4aB.docx.locked", cAlternateFileName="EFPZRJ~1.LOC")) returned 1 [0279.435] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b8212f, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xb5b8212f, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xb64806ec, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xa90, dwReserved0=0x0, dwReserved1=0x0, cFileName="evxrwLajfekQ0MYh.odt.locked", cAlternateFileName="EVXRWL~1.LOC")) returned 1 [0279.435] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb64806ec, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xb64806ec, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xb6cfed7f, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xb800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fw_.pptx.locked", cAlternateFileName="FW_PPT~1.LOC")) returned 1 [0279.436] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6cfed7f, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xb6cfed7f, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xb75c995b, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xeb00, dwReserved0=0x0, dwReserved1=0x0, cFileName="HN-eE.xlsx.locked", cAlternateFileName="HN-EEX~1.LOC")) returned 1 [0279.436] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb75efcd5, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xb75efcd5, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xb7e6e037, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x15a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="JAZPWfinV.docx.locked", cAlternateFileName="JAZPWF~1.LOC")) returned 1 [0279.436] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7e94287, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xb7e94287, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xb873e15f, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x139e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mbqXSaY.pptx.locked", cAlternateFileName="MBQXSA~1.LOC")) returned 1 [0279.436] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8764a99, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xb8764a99, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xb907b348, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x8710, dwReserved0=0x0, dwReserved1=0x0, cFileName="mfGUeqia2d4NY4DZsqxe.pps.locked", cAlternateFileName="MFGUEQ~1.LOC")) returned 1 [0279.436] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb90a15ad, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xb90a15ad, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xb99ba313, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x119c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MGm2RtZaI.xls.locked", cAlternateFileName="MGM2RT~1.LOC")) returned 1 [0279.436] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0279.436] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0279.437] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0279.437] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0279.437] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb99ba313, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xb99ba313, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xba282f7b, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x158b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oIHTAL.ots.locked", cAlternateFileName="OIHTAL~1.LOC")) returned 1 [0279.437] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x5ee892ad, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0279.437] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba282f7b, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xba282f7b, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xbaadb3e5, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x9890, dwReserved0=0x0, dwReserved1=0x0, cFileName="P0yAA1UNt_AeGs.xlsx.locked", cAlternateFileName="P0YAA1~1.LOC")) returned 1 [0279.437] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaadb3e5, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xbaadb3e5, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xbb3dddf7, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="R0o03ux1o.docx.locked", cAlternateFileName="R0O03U~1.LOC")) returned 1 [0279.437] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb3dddf7, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xbb3dddf7, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xbbcce959, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x79b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rbf3wxxAvTJg.pptx.locked", cAlternateFileName="RBF3WX~1.LOC")) returned 1 [0279.438] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbcf4bd8, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xbbcf4bd8, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xbc5aa67d, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x62e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RfOZfwQP oYTWlHa.ods.locked", cAlternateFileName="RFOZFW~1.LOC")) returned 1 [0279.438] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc5aa67d, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xbc5aa67d, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xbcddc61f, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xb570, dwReserved0=0x0, dwReserved1=0x0, cFileName="RPBREJYDP8jN2.odt.locked", cAlternateFileName="RPBREJ~1.LOC")) returned 1 [0279.438] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbce0282f, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xbce0282f, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xbd680e44, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xaa20, dwReserved0=0x0, dwReserved1=0x0, cFileName="v cbuLol-Xgmqz_W.xlsx.locked", cAlternateFileName="VCBULO~1.LOC")) returned 1 [0279.438] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd680e44, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xbd680e44, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xbdeff3e7, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WsbU.docx.locked", cAlternateFileName="WSBUDO~1.LOC")) returned 1 [0279.438] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdeff3e7, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xbdeff3e7, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xbe9bd572, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xb9f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ykBv0s0N.docx.locked", cAlternateFileName="YKBV0S~1.LOC")) returned 1 [0279.438] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbeb6069c, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xbeb6069c, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xbf477498, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xf50, dwReserved0=0x0, dwReserved1=0x0, cFileName="z8KGKougj.ots.locked", cAlternateFileName="Z8KGKO~1.LOC")) returned 1 [0279.438] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8feaa0 | out: lpFindFileData=0x8feaa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbeb6069c, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xbeb6069c, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xbf477498, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xf50, dwReserved0=0x0, dwReserved1=0x0, cFileName="z8KGKougj.ots.locked", cAlternateFileName="Z8KGKO~1.LOC")) returned 0 [0279.439] FindClose (in: hFindFile=0x960708 | out: hFindFile=0x960708) returned 1 [0279.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fed28) returned 1 [0279.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fed34) returned 1 [0279.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed08) returned 1 [0279.439] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x23 [0279.439] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5", nBufferLength=0x23, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5", lpFilePart=0x0) returned 0x22 [0279.439] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\*", lpFindFileData=0x8fea30 | out: lpFindFileData=0x8fea30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69e3bf80, ftCreationTime.dwHighDateTime=0x1d5e48e, ftLastAccessTime.dwLowDateTime=0x6d2a9b30, ftLastAccessTime.dwHighDateTime=0x1d5ebe3, ftLastWriteTime.dwLowDateTime=0x6d2a9b30, ftLastWriteTime.dwHighDateTime=0x1d5ebe3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x960708 [0279.439] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69e3bf80, ftCreationTime.dwHighDateTime=0x1d5e48e, ftLastAccessTime.dwLowDateTime=0x6d2a9b30, ftLastAccessTime.dwHighDateTime=0x1d5ebe3, ftLastWriteTime.dwLowDateTime=0x6d2a9b30, ftLastWriteTime.dwHighDateTime=0x1d5ebe3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0279.440] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd92047d0, ftCreationTime.dwHighDateTime=0x1d5ed47, ftLastAccessTime.dwLowDateTime=0x4278f0d0, ftLastAccessTime.dwHighDateTime=0x1d5e869, ftLastWriteTime.dwLowDateTime=0x4278f0d0, ftLastWriteTime.dwHighDateTime=0x1d5e869, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0WXsxR-HBmfStF5Lqwpj", cAlternateFileName="0WXSXR~1")) returned 1 [0279.440] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc03b7c00, ftCreationTime.dwHighDateTime=0x1d5f088, ftLastAccessTime.dwLowDateTime=0xc98c0a80, ftLastAccessTime.dwHighDateTime=0x1d5e855, ftLastWriteTime.dwLowDateTime=0xc98c0a80, ftLastWriteTime.dwHighDateTime=0x1d5e855, nFileSizeHigh=0x0, nFileSizeLow=0x1536b, dwReserved0=0x0, dwReserved1=0x0, cFileName="A 45siGRhQlvz.ods", cAlternateFileName="A45SIG~1.ODS")) returned 1 [0279.440] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf86e91b0, ftCreationTime.dwHighDateTime=0x1d5e97c, ftLastAccessTime.dwLowDateTime=0x5f7d2f80, ftLastAccessTime.dwHighDateTime=0x1d5ef66, ftLastWriteTime.dwLowDateTime=0x5f7d2f80, ftLastWriteTime.dwHighDateTime=0x1d5ef66, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gwXegIJB", cAlternateFileName="")) returned 1 [0279.440] FindNextFileW (in: hFindFile=0x960708, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf86e91b0, ftCreationTime.dwHighDateTime=0x1d5e97c, ftLastAccessTime.dwLowDateTime=0x5f7d2f80, ftLastAccessTime.dwHighDateTime=0x1d5ef66, ftLastWriteTime.dwLowDateTime=0x5f7d2f80, ftLastWriteTime.dwHighDateTime=0x1d5ef66, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gwXegIJB", cAlternateFileName="")) returned 0 [0279.440] FindClose (in: hFindFile=0x960708 | out: hFindFile=0x960708) returned 1 [0279.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecc4) returned 1 [0279.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd0) returned 1 [0279.441] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\A 45siGRhQlvz.ods.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0279.441] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\A 45siGRhQlvz.ods.locked", nBufferLength=0x3c, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\A 45siGRhQlvz.ods.locked", lpFilePart=0x0) returned 0x3b [0279.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb80) returned 1 [0279.442] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\A 45siGRhQlvz.ods.locked" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\a 45sigrhqlvz.ods.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0279.445] GetFileType (hFile=0x37c) returned 0x1 [0279.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb7c) returned 1 [0279.445] GetFileType (hFile=0x37c) returned 0x1 [0280.255] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\A 45siGRhQlvz.ods", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0280.255] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\A 45siGRhQlvz.ods", nBufferLength=0x35, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\A 45siGRhQlvz.ods", lpFilePart=0x0) returned 0x34 [0280.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb80) returned 1 [0280.255] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\A 45siGRhQlvz.ods" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\a 45sigrhqlvz.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0280.255] GetFileType (hFile=0x378) returned 0x1 [0280.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb7c) returned 1 [0280.255] GetFileType (hFile=0x378) returned 0x1 [0280.258] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec34, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec34*=0x1536b, lpOverlapped=0x0) returned 1 [0280.302] WriteFile (in: hFile=0x37c, lpBuffer=0x27ad000*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fec0c, lpOverlapped=0x0 | out: lpBuffer=0x27ad000*, lpNumberOfBytesWritten=0x8fec0c*=0x1000, lpOverlapped=0x0) returned 1 [0280.303] WriteFile (in: hFile=0x37c, lpBuffer=0x386a4e8*, nNumberOfBytesToWrite=0x14380, lpNumberOfBytesWritten=0x8fec0c, lpOverlapped=0x0 | out: lpBuffer=0x386a4e8*, lpNumberOfBytesWritten=0x8fec0c*=0x14380, lpOverlapped=0x0) returned 1 [0280.305] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8fec34, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8fec34*=0x0, lpOverlapped=0x0) returned 1 [0280.305] CloseHandle (hObject=0x378) returned 1 [0280.305] WriteFile (in: hFile=0x37c, lpBuffer=0x27ad000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8febd4, lpOverlapped=0x0 | out: lpBuffer=0x27ad000*, lpNumberOfBytesWritten=0x8febd4*=0x10, lpOverlapped=0x0) returned 1 [0280.305] CloseHandle (hObject=0x37c) returned 1 [0280.309] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\A 45siGRhQlvz.ods", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0280.309] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\A 45siGRhQlvz.ods", nBufferLength=0x35, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\A 45siGRhQlvz.ods", lpFilePart=0x0) returned 0x34 [0280.309] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\A 45siGRhQlvz.ods" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\a 45sigrhqlvz.ods")) returned 1 [0280.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed08) returned 1 [0280.312] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x23 [0280.312] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5", nBufferLength=0x23, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5", lpFilePart=0x0) returned 0x22 [0280.312] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\*", lpFindFileData=0x8fea30 | out: lpFindFileData=0x8fea30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69e3bf80, ftCreationTime.dwHighDateTime=0x1d5e48e, ftLastAccessTime.dwLowDateTime=0x6d2a9b30, ftLastAccessTime.dwHighDateTime=0x1d5ebe3, ftLastWriteTime.dwLowDateTime=0xbfccf845, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x960748 [0280.312] FindNextFileW (in: hFindFile=0x960748, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69e3bf80, ftCreationTime.dwHighDateTime=0x1d5e48e, ftLastAccessTime.dwLowDateTime=0x6d2a9b30, ftLastAccessTime.dwHighDateTime=0x1d5ebe3, ftLastWriteTime.dwLowDateTime=0xbfccf845, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0280.312] FindNextFileW (in: hFindFile=0x960748, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd92047d0, ftCreationTime.dwHighDateTime=0x1d5ed47, ftLastAccessTime.dwLowDateTime=0x4278f0d0, ftLastAccessTime.dwHighDateTime=0x1d5e869, ftLastWriteTime.dwLowDateTime=0x4278f0d0, ftLastWriteTime.dwHighDateTime=0x1d5e869, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0WXsxR-HBmfStF5Lqwpj", cAlternateFileName="0WXSXR~1")) returned 1 [0280.312] FindNextFileW (in: hFindFile=0x960748, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf49d775, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xbf49d775, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xbfccf845, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x15390, dwReserved0=0x0, dwReserved1=0x0, cFileName="A 45siGRhQlvz.ods.locked", cAlternateFileName="A45SIG~1.LOC")) returned 1 [0280.313] FindNextFileW (in: hFindFile=0x960748, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf86e91b0, ftCreationTime.dwHighDateTime=0x1d5e97c, ftLastAccessTime.dwLowDateTime=0x5f7d2f80, ftLastAccessTime.dwHighDateTime=0x1d5ef66, ftLastWriteTime.dwLowDateTime=0x5f7d2f80, ftLastWriteTime.dwHighDateTime=0x1d5ef66, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gwXegIJB", cAlternateFileName="")) returned 1 [0280.313] FindNextFileW (in: hFindFile=0x960748, lpFindFileData=0x8fea3c | out: lpFindFileData=0x8fea3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0280.313] FindClose (in: hFindFile=0x960748 | out: hFindFile=0x960748) returned 1 [0280.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecc4) returned 1 [0280.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd0) returned 1 [0280.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feca4) returned 1 [0280.313] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0280.313] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj", nBufferLength=0x38, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj", lpFilePart=0x0) returned 0x37 [0280.313] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\*", lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd92047d0, ftCreationTime.dwHighDateTime=0x1d5ed47, ftLastAccessTime.dwLowDateTime=0x4278f0d0, ftLastAccessTime.dwHighDateTime=0x1d5e869, ftLastWriteTime.dwLowDateTime=0x4278f0d0, ftLastWriteTime.dwHighDateTime=0x1d5e869, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x960748 [0280.313] FindNextFileW (in: hFindFile=0x960748, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd92047d0, ftCreationTime.dwHighDateTime=0x1d5ed47, ftLastAccessTime.dwLowDateTime=0x4278f0d0, ftLastAccessTime.dwHighDateTime=0x1d5e869, ftLastWriteTime.dwLowDateTime=0x4278f0d0, ftLastWriteTime.dwHighDateTime=0x1d5e869, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0280.314] FindNextFileW (in: hFindFile=0x960748, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa50dce00, ftCreationTime.dwHighDateTime=0x1d5e0b7, ftLastAccessTime.dwLowDateTime=0x222fdc10, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x222fdc10, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1807a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bc u.ods", cAlternateFileName="BCU~1.ODS")) returned 1 [0280.314] FindNextFileW (in: hFindFile=0x960748, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae6c8090, ftCreationTime.dwHighDateTime=0x1d5f0de, ftLastAccessTime.dwLowDateTime=0xd3a37a30, ftLastAccessTime.dwHighDateTime=0x1d5e9e0, ftLastWriteTime.dwLowDateTime=0xd3a37a30, ftLastWriteTime.dwHighDateTime=0x1d5e9e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kDDaxo_0hno2qBX", cAlternateFileName="KDDAXO~1")) returned 1 [0280.314] FindNextFileW (in: hFindFile=0x960748, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15ee5cf0, ftCreationTime.dwHighDateTime=0x1d5ece0, ftLastAccessTime.dwLowDateTime=0xace3ba0, ftLastAccessTime.dwHighDateTime=0x1d5eaac, ftLastWriteTime.dwLowDateTime=0xace3ba0, ftLastWriteTime.dwHighDateTime=0x1d5eaac, nFileSizeHigh=0x0, nFileSizeLow=0xaf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmK-kDE.ppt", cAlternateFileName="")) returned 1 [0280.314] FindNextFileW (in: hFindFile=0x960748, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52582a20, ftCreationTime.dwHighDateTime=0x1d5eb48, ftLastAccessTime.dwLowDateTime=0xcb691970, ftLastAccessTime.dwHighDateTime=0x1d5e598, ftLastWriteTime.dwLowDateTime=0xcb691970, ftLastWriteTime.dwHighDateTime=0x1d5e598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WuX HUM1UOjiQM9JKAEh", cAlternateFileName="WUXHUM~1")) returned 1 [0280.314] FindNextFileW (in: hFindFile=0x960748, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb77f1eb0, ftCreationTime.dwHighDateTime=0x1d5e3a8, ftLastAccessTime.dwLowDateTime=0x63a1aa50, ftLastAccessTime.dwHighDateTime=0x1d5ea20, ftLastWriteTime.dwLowDateTime=0x63a1aa50, ftLastWriteTime.dwHighDateTime=0x1d5ea20, nFileSizeHigh=0x0, nFileSizeLow=0x17977, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zte8Ja2AKP6.odt", cAlternateFileName="ZTE8JA~1.ODT")) returned 1 [0280.314] FindNextFileW (in: hFindFile=0x960748, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0280.314] FindClose (in: hFindFile=0x960748 | out: hFindFile=0x960748) returned 1 [0280.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0280.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec6c) returned 1 [0280.316] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\bc u.ods.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x48 [0280.316] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\bc u.ods.locked", nBufferLength=0x48, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\bc u.ods.locked", lpFilePart=0x0) returned 0x47 [0280.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb1c) returned 1 [0280.316] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\bc u.ods.locked" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\bc u.ods.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0280.316] GetFileType (hFile=0x37c) returned 0x1 [0280.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb18) returned 1 [0280.316] GetFileType (hFile=0x37c) returned 0x1 [0281.122] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\bc u.ods", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0281.122] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\bc u.ods", nBufferLength=0x41, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\bc u.ods", lpFilePart=0x0) returned 0x40 [0281.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb1c) returned 1 [0281.122] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\bc u.ods" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\bc u.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0281.123] GetFileType (hFile=0x378) returned 0x1 [0281.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb18) returned 1 [0281.123] GetFileType (hFile=0x378) returned 0x1 [0281.125] ReadFile (in: hFile=0x378, lpBuffer=0x387e888, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8febd0, lpOverlapped=0x0 | out: lpBuffer=0x387e888*, lpNumberOfBytesRead=0x8febd0*=0x1807a, lpOverlapped=0x0) returned 1 [0281.145] WriteFile (in: hFile=0x37c, lpBuffer=0x26a0ba0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feba8, lpOverlapped=0x0 | out: lpBuffer=0x26a0ba0*, lpNumberOfBytesWritten=0x8feba8*=0x1000, lpOverlapped=0x0) returned 1 [0281.147] WriteFile (in: hFile=0x37c, lpBuffer=0x366a4a8*, nNumberOfBytesToWrite=0x17090, lpNumberOfBytesWritten=0x8feba8, lpOverlapped=0x0 | out: lpBuffer=0x366a4a8*, lpNumberOfBytesWritten=0x8feba8*=0x17090, lpOverlapped=0x0) returned 1 [0281.148] ReadFile (in: hFile=0x378, lpBuffer=0x387e888, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8febd0, lpOverlapped=0x0 | out: lpBuffer=0x387e888*, lpNumberOfBytesRead=0x8febd0*=0x0, lpOverlapped=0x0) returned 1 [0281.148] CloseHandle (hObject=0x378) returned 1 [0281.148] WriteFile (in: hFile=0x37c, lpBuffer=0x26a0ba0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8feb70, lpOverlapped=0x0 | out: lpBuffer=0x26a0ba0*, lpNumberOfBytesWritten=0x8feb70*=0x10, lpOverlapped=0x0) returned 1 [0281.149] CloseHandle (hObject=0x37c) returned 1 [0281.151] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\bc u.ods", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0281.152] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\bc u.ods", nBufferLength=0x41, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\bc u.ods", lpFilePart=0x0) returned 0x40 [0281.152] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\bc u.ods" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\bc u.ods")) returned 1 [0281.157] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\SmK-kDE.ppt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4b [0281.157] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\SmK-kDE.ppt.locked", nBufferLength=0x4b, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\SmK-kDE.ppt.locked", lpFilePart=0x0) returned 0x4a [0281.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb1c) returned 1 [0281.157] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\SmK-kDE.ppt.locked" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\smk-kde.ppt.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0281.157] GetFileType (hFile=0x37c) returned 0x1 [0281.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb18) returned 1 [0281.157] GetFileType (hFile=0x37c) returned 0x1 [0282.122] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\SmK-kDE.ppt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0282.122] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\SmK-kDE.ppt", nBufferLength=0x44, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\SmK-kDE.ppt", lpFilePart=0x0) returned 0x43 [0282.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb1c) returned 1 [0282.122] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\SmK-kDE.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\smk-kde.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0282.123] GetFileType (hFile=0x378) returned 0x1 [0282.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb18) returned 1 [0282.123] GetFileType (hFile=0x378) returned 0x1 [0282.123] ReadFile (in: hFile=0x378, lpBuffer=0x3681558, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8febd0, lpOverlapped=0x0 | out: lpBuffer=0x3681558*, lpNumberOfBytesRead=0x8febd0*=0xaf6, lpOverlapped=0x0) returned 1 [0282.124] ReadFile (in: hFile=0x378, lpBuffer=0x3681558, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8febd0, lpOverlapped=0x0 | out: lpBuffer=0x3681558*, lpNumberOfBytesRead=0x8febd0*=0x0, lpOverlapped=0x0) returned 1 [0282.124] CloseHandle (hObject=0x378) returned 1 [0282.124] WriteFile (in: hFile=0x37c, lpBuffer=0x27886c4*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x8feb70, lpOverlapped=0x0 | out: lpBuffer=0x27886c4*, lpNumberOfBytesWritten=0x8feb70*=0xb20, lpOverlapped=0x0) returned 1 [0282.125] CloseHandle (hObject=0x37c) returned 1 [0282.126] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\SmK-kDE.ppt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0282.126] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\SmK-kDE.ppt", nBufferLength=0x44, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\SmK-kDE.ppt", lpFilePart=0x0) returned 0x43 [0282.126] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\SmK-kDE.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\smk-kde.ppt")) returned 1 [0282.129] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\Zte8Ja2AKP6.odt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0282.129] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\Zte8Ja2AKP6.odt.locked", nBufferLength=0x4f, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\Zte8Ja2AKP6.odt.locked", lpFilePart=0x0) returned 0x4e [0282.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb1c) returned 1 [0282.130] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\Zte8Ja2AKP6.odt.locked" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\zte8ja2akp6.odt.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0282.130] GetFileType (hFile=0x37c) returned 0x1 [0282.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb18) returned 1 [0282.130] GetFileType (hFile=0x37c) returned 0x1 [0283.008] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\Zte8Ja2AKP6.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x48 [0283.008] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\Zte8Ja2AKP6.odt", nBufferLength=0x48, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\Zte8Ja2AKP6.odt", lpFilePart=0x0) returned 0x47 [0283.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb1c) returned 1 [0283.008] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\Zte8Ja2AKP6.odt" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\zte8ja2akp6.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0283.009] GetFileType (hFile=0x378) returned 0x1 [0283.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb18) returned 1 [0283.009] GetFileType (hFile=0x378) returned 0x1 [0283.012] ReadFile (in: hFile=0x378, lpBuffer=0x397e8a8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8febd0, lpOverlapped=0x0 | out: lpBuffer=0x397e8a8*, lpNumberOfBytesRead=0x8febd0*=0x17977, lpOverlapped=0x0) returned 1 [0283.027] WriteFile (in: hFile=0x37c, lpBuffer=0x2871fe8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feba8, lpOverlapped=0x0 | out: lpBuffer=0x2871fe8*, lpNumberOfBytesWritten=0x8feba8*=0x1000, lpOverlapped=0x0) returned 1 [0283.029] WriteFile (in: hFile=0x37c, lpBuffer=0x3782558*, nNumberOfBytesToWrite=0x16990, lpNumberOfBytesWritten=0x8feba8, lpOverlapped=0x0 | out: lpBuffer=0x3782558*, lpNumberOfBytesWritten=0x8feba8*=0x16990, lpOverlapped=0x0) returned 1 [0283.030] ReadFile (in: hFile=0x378, lpBuffer=0x397e8a8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8febd0, lpOverlapped=0x0 | out: lpBuffer=0x397e8a8*, lpNumberOfBytesRead=0x8febd0*=0x0, lpOverlapped=0x0) returned 1 [0283.030] CloseHandle (hObject=0x378) returned 1 [0283.030] WriteFile (in: hFile=0x37c, lpBuffer=0x2871fe8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8feb70, lpOverlapped=0x0 | out: lpBuffer=0x2871fe8*, lpNumberOfBytesWritten=0x8feb70*=0x10, lpOverlapped=0x0) returned 1 [0283.031] CloseHandle (hObject=0x37c) returned 1 [0283.033] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\Zte8Ja2AKP6.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x48 [0283.033] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\Zte8Ja2AKP6.odt", nBufferLength=0x48, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\Zte8Ja2AKP6.odt", lpFilePart=0x0) returned 0x47 [0283.033] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\Zte8Ja2AKP6.odt" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\zte8ja2akp6.odt")) returned 1 [0283.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feca4) returned 1 [0283.039] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0283.039] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj", nBufferLength=0x38, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj", lpFilePart=0x0) returned 0x37 [0283.039] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\*", lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd92047d0, ftCreationTime.dwHighDateTime=0x1d5ed47, ftLastAccessTime.dwLowDateTime=0x4278f0d0, ftLastAccessTime.dwHighDateTime=0x1d5e869, ftLastWriteTime.dwLowDateTime=0xc16ce4eb, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x960a08 [0283.039] FindNextFileW (in: hFindFile=0x960a08, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd92047d0, ftCreationTime.dwHighDateTime=0x1d5ed47, ftLastAccessTime.dwLowDateTime=0x4278f0d0, ftLastAccessTime.dwHighDateTime=0x1d5e869, ftLastWriteTime.dwLowDateTime=0xc16ce4eb, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0283.039] FindNextFileW (in: hFindFile=0x960a08, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfcf5ac6, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xbfcf5ac6, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xc04db6fb, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x180a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bc u.ods.locked", cAlternateFileName="BCUODS~1.LOC")) returned 1 [0283.039] FindNextFileW (in: hFindFile=0x960a08, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae6c8090, ftCreationTime.dwHighDateTime=0x1d5f0de, ftLastAccessTime.dwLowDateTime=0xd3a37a30, ftLastAccessTime.dwHighDateTime=0x1d5e9e0, ftLastWriteTime.dwLowDateTime=0xd3a37a30, ftLastWriteTime.dwHighDateTime=0x1d5e9e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kDDaxo_0hno2qBX", cAlternateFileName="KDDAXO~1")) returned 1 [0283.040] FindNextFileW (in: hFindFile=0x960a08, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc04db6fb, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xc04db6fb, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xc0e1882c, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmK-kDE.ppt.locked", cAlternateFileName="SMK-KD~1.LOC")) returned 1 [0283.040] FindNextFileW (in: hFindFile=0x960a08, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52582a20, ftCreationTime.dwHighDateTime=0x1d5eb48, ftLastAccessTime.dwLowDateTime=0xcb691970, ftLastAccessTime.dwHighDateTime=0x1d5e598, ftLastWriteTime.dwLowDateTime=0xcb691970, ftLastWriteTime.dwHighDateTime=0x1d5e598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WuX HUM1UOjiQM9JKAEh", cAlternateFileName="WUXHUM~1")) returned 1 [0283.040] FindNextFileW (in: hFindFile=0x960a08, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0e3eb8f, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xc0e3eb8f, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xc16ce4eb, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x179a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zte8Ja2AKP6.odt.locked", cAlternateFileName="ZTE8JA~1.LOC")) returned 1 [0283.040] FindNextFileW (in: hFindFile=0x960a08, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0e3eb8f, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xc0e3eb8f, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xc16ce4eb, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x179a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zte8Ja2AKP6.odt.locked", cAlternateFileName="ZTE8JA~1.LOC")) returned 0 [0283.040] FindClose (in: hFindFile=0x960a08 | out: hFindFile=0x960a08) returned 1 [0283.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0283.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec6c) returned 1 [0283.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec40) returned 1 [0283.040] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x48 [0283.040] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX", nBufferLength=0x48, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX", lpFilePart=0x0) returned 0x47 [0283.041] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\*", lpFindFileData=0x8fe968 | out: lpFindFileData=0x8fe968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae6c8090, ftCreationTime.dwHighDateTime=0x1d5f0de, ftLastAccessTime.dwLowDateTime=0xd3a37a30, ftLastAccessTime.dwHighDateTime=0x1d5e9e0, ftLastWriteTime.dwLowDateTime=0xd3a37a30, ftLastWriteTime.dwHighDateTime=0x1d5e9e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x960a08 [0283.041] FindNextFileW (in: hFindFile=0x960a08, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae6c8090, ftCreationTime.dwHighDateTime=0x1d5f0de, ftLastAccessTime.dwLowDateTime=0xd3a37a30, ftLastAccessTime.dwHighDateTime=0x1d5e9e0, ftLastWriteTime.dwLowDateTime=0xd3a37a30, ftLastWriteTime.dwHighDateTime=0x1d5e9e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0283.041] FindNextFileW (in: hFindFile=0x960a08, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22866f90, ftCreationTime.dwHighDateTime=0x1d5e6c1, ftLastAccessTime.dwLowDateTime=0xe0ea25c0, ftLastAccessTime.dwHighDateTime=0x1d5ea37, ftLastWriteTime.dwLowDateTime=0xe0ea25c0, ftLastWriteTime.dwHighDateTime=0x1d5ea37, nFileSizeHigh=0x0, nFileSizeLow=0x16482, dwReserved0=0x0, dwReserved1=0x0, cFileName="0U5e tG.pptx", cAlternateFileName="0U5ETG~1.PPT")) returned 1 [0283.041] FindNextFileW (in: hFindFile=0x960a08, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49e82ae0, ftCreationTime.dwHighDateTime=0x1d5f0fa, ftLastAccessTime.dwLowDateTime=0xf6470f90, ftLastAccessTime.dwHighDateTime=0x1d5e362, ftLastWriteTime.dwLowDateTime=0xf6470f90, ftLastWriteTime.dwHighDateTime=0x1d5e362, nFileSizeHigh=0x0, nFileSizeLow=0x78f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="bf9p6M8RugI8hKdTEw.pdf", cAlternateFileName="BF9P6M~1.PDF")) returned 1 [0283.041] FindNextFileW (in: hFindFile=0x960a08, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa466ec70, ftCreationTime.dwHighDateTime=0x1d5e274, ftLastAccessTime.dwLowDateTime=0x57c20a60, ftLastAccessTime.dwHighDateTime=0x1d5ec9e, ftLastWriteTime.dwLowDateTime=0x57c20a60, ftLastWriteTime.dwHighDateTime=0x1d5ec9e, nFileSizeHigh=0x0, nFileSizeLow=0xd3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VHH9Bs.xlsx", cAlternateFileName="VHH9BS~1.XLS")) returned 1 [0283.041] FindNextFileW (in: hFindFile=0x960a08, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262deba0, ftCreationTime.dwHighDateTime=0x1d5eb12, ftLastAccessTime.dwLowDateTime=0x774f0870, ftLastAccessTime.dwHighDateTime=0x1d5e545, ftLastWriteTime.dwLowDateTime=0x774f0870, ftLastWriteTime.dwHighDateTime=0x1d5e545, nFileSizeHigh=0x0, nFileSizeLow=0xb820, dwReserved0=0x0, dwReserved1=0x0, cFileName="YgdL3w.ods", cAlternateFileName="")) returned 1 [0283.042] FindNextFileW (in: hFindFile=0x960a08, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0283.042] FindClose (in: hFindFile=0x960a08 | out: hFindFile=0x960a08) returned 1 [0283.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febfc) returned 1 [0283.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec08) returned 1 [0283.043] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\0U5e tG.pptx.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0283.043] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\0U5e tG.pptx.locked", nBufferLength=0x5c, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\0U5e tG.pptx.locked", lpFilePart=0x0) returned 0x5b [0283.043] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0283.043] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\0U5e tG.pptx.locked" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\kddaxo_0hno2qbx\\0u5e tg.pptx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0283.043] GetFileType (hFile=0x37c) returned 0x1 [0283.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0283.043] GetFileType (hFile=0x37c) returned 0x1 [0284.038] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\0U5e tG.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0284.038] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\0U5e tG.pptx", nBufferLength=0x55, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\0U5e tG.pptx", lpFilePart=0x0) returned 0x54 [0284.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0284.038] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\0U5e tG.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\kddaxo_0hno2qbx\\0u5e tg.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0284.039] GetFileType (hFile=0x378) returned 0x1 [0284.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0284.039] GetFileType (hFile=0x378) returned 0x1 [0284.042] ReadFile (in: hFile=0x378, lpBuffer=0x3a7e8c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x3a7e8c8*, lpNumberOfBytesRead=0x8feb6c*=0x16482, lpOverlapped=0x0) returned 1 [0284.087] WriteFile (in: hFile=0x37c, lpBuffer=0x275d3b4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x275d3b4*, lpNumberOfBytesWritten=0x8feb44*=0x1000, lpOverlapped=0x0) returned 1 [0284.089] WriteFile (in: hFile=0x37c, lpBuffer=0x366a4a8*, nNumberOfBytesToWrite=0x154a0, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x366a4a8*, lpNumberOfBytesWritten=0x8feb44*=0x154a0, lpOverlapped=0x0) returned 1 [0284.090] ReadFile (in: hFile=0x378, lpBuffer=0x3a7e8c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x3a7e8c8*, lpNumberOfBytesRead=0x8feb6c*=0x0, lpOverlapped=0x0) returned 1 [0284.093] CloseHandle (hObject=0x378) returned 1 [0284.093] WriteFile (in: hFile=0x37c, lpBuffer=0x275d3b4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8feb0c, lpOverlapped=0x0 | out: lpBuffer=0x275d3b4*, lpNumberOfBytesWritten=0x8feb0c*=0x10, lpOverlapped=0x0) returned 1 [0284.093] CloseHandle (hObject=0x37c) returned 1 [0284.096] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\0U5e tG.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0284.096] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\0U5e tG.pptx", nBufferLength=0x55, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\0U5e tG.pptx", lpFilePart=0x0) returned 0x54 [0284.096] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\0U5e tG.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\kddaxo_0hno2qbx\\0u5e tg.pptx")) returned 1 [0284.100] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\bf9p6M8RugI8hKdTEw.pdf.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x66 [0284.100] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\bf9p6M8RugI8hKdTEw.pdf.locked", nBufferLength=0x66, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\bf9p6M8RugI8hKdTEw.pdf.locked", lpFilePart=0x0) returned 0x65 [0284.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0284.100] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\bf9p6M8RugI8hKdTEw.pdf.locked" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\kddaxo_0hno2qbx\\bf9p6m8rugi8hkdtew.pdf.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0284.100] GetFileType (hFile=0x37c) returned 0x1 [0284.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0284.100] GetFileType (hFile=0x37c) returned 0x1 [0284.924] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\bf9p6M8RugI8hKdTEw.pdf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5f [0284.924] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\bf9p6M8RugI8hKdTEw.pdf", nBufferLength=0x5f, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\bf9p6M8RugI8hKdTEw.pdf", lpFilePart=0x0) returned 0x5e [0284.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0284.924] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\bf9p6M8RugI8hKdTEw.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\kddaxo_0hno2qbx\\bf9p6m8rugi8hkdtew.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0284.924] GetFileType (hFile=0x378) returned 0x1 [0284.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0284.925] GetFileType (hFile=0x378) returned 0x1 [0284.927] ReadFile (in: hFile=0x378, lpBuffer=0x367f968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x367f968*, lpNumberOfBytesRead=0x8feb6c*=0x78f4, lpOverlapped=0x0) returned 1 [0284.929] WriteFile (in: hFile=0x37c, lpBuffer=0x2843128*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x2843128*, lpNumberOfBytesWritten=0x8feb44*=0x1000, lpOverlapped=0x0) returned 1 [0284.930] WriteFile (in: hFile=0x37c, lpBuffer=0x2845608*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x2845608*, lpNumberOfBytesWritten=0x8feb44*=0x6910, lpOverlapped=0x0) returned 1 [0284.931] ReadFile (in: hFile=0x378, lpBuffer=0x367f968, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x367f968*, lpNumberOfBytesRead=0x8feb6c*=0x0, lpOverlapped=0x0) returned 1 [0284.931] CloseHandle (hObject=0x378) returned 1 [0284.931] WriteFile (in: hFile=0x37c, lpBuffer=0x2843128*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8feb0c, lpOverlapped=0x0 | out: lpBuffer=0x2843128*, lpNumberOfBytesWritten=0x8feb0c*=0x10, lpOverlapped=0x0) returned 1 [0284.931] CloseHandle (hObject=0x37c) returned 1 [0284.933] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\bf9p6M8RugI8hKdTEw.pdf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5f [0284.933] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\bf9p6M8RugI8hKdTEw.pdf", nBufferLength=0x5f, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\bf9p6M8RugI8hKdTEw.pdf", lpFilePart=0x0) returned 0x5e [0284.933] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\bf9p6M8RugI8hKdTEw.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\kddaxo_0hno2qbx\\bf9p6m8rugi8hkdtew.pdf")) returned 1 [0284.938] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\VHH9Bs.xlsx.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5b [0284.938] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\VHH9Bs.xlsx.locked", nBufferLength=0x5b, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\VHH9Bs.xlsx.locked", lpFilePart=0x0) returned 0x5a [0284.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0284.938] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\VHH9Bs.xlsx.locked" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\kddaxo_0hno2qbx\\vhh9bs.xlsx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0284.938] GetFileType (hFile=0x37c) returned 0x1 [0284.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0284.939] GetFileType (hFile=0x37c) returned 0x1 [0285.749] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\VHH9Bs.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0285.749] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\VHH9Bs.xlsx", nBufferLength=0x54, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\VHH9Bs.xlsx", lpFilePart=0x0) returned 0x53 [0285.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0285.750] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\VHH9Bs.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\kddaxo_0hno2qbx\\vhh9bs.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0285.750] GetFileType (hFile=0x378) returned 0x1 [0285.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0285.750] GetFileType (hFile=0x378) returned 0x1 [0285.753] ReadFile (in: hFile=0x378, lpBuffer=0x377f988, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x377f988*, lpNumberOfBytesRead=0x8feb6c*=0xd3a0, lpOverlapped=0x0) returned 1 [0285.755] WriteFile (in: hFile=0x37c, lpBuffer=0x27328b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x27328b0*, lpNumberOfBytesWritten=0x8feb44*=0x1000, lpOverlapped=0x0) returned 1 [0285.756] WriteFile (in: hFile=0x37c, lpBuffer=0x2734d78*, nNumberOfBytesToWrite=0xc3c0, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x2734d78*, lpNumberOfBytesWritten=0x8feb44*=0xc3c0, lpOverlapped=0x0) returned 1 [0285.757] ReadFile (in: hFile=0x378, lpBuffer=0x377f988, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x377f988*, lpNumberOfBytesRead=0x8feb6c*=0x0, lpOverlapped=0x0) returned 1 [0285.757] CloseHandle (hObject=0x378) returned 1 [0285.758] WriteFile (in: hFile=0x37c, lpBuffer=0x27328b0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8feb0c, lpOverlapped=0x0 | out: lpBuffer=0x27328b0*, lpNumberOfBytesWritten=0x8feb0c*=0x10, lpOverlapped=0x0) returned 1 [0285.758] CloseHandle (hObject=0x37c) returned 1 [0285.760] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\VHH9Bs.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0285.760] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\VHH9Bs.xlsx", nBufferLength=0x54, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\VHH9Bs.xlsx", lpFilePart=0x0) returned 0x53 [0285.760] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\VHH9Bs.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\kddaxo_0hno2qbx\\vhh9bs.xlsx")) returned 1 [0285.764] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\YgdL3w.ods.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0285.764] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\YgdL3w.ods.locked", nBufferLength=0x5a, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\YgdL3w.ods.locked", lpFilePart=0x0) returned 0x59 [0285.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0285.764] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\YgdL3w.ods.locked" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\kddaxo_0hno2qbx\\ygdl3w.ods.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0285.765] GetFileType (hFile=0x37c) returned 0x1 [0285.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0285.765] GetFileType (hFile=0x37c) returned 0x1 [0286.707] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\YgdL3w.ods", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0286.707] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\YgdL3w.ods", nBufferLength=0x53, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\YgdL3w.ods", lpFilePart=0x0) returned 0x52 [0286.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0286.707] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\YgdL3w.ods" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\kddaxo_0hno2qbx\\ygdl3w.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0286.707] GetFileType (hFile=0x378) returned 0x1 [0286.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0286.707] GetFileType (hFile=0x378) returned 0x1 [0286.710] ReadFile (in: hFile=0x378, lpBuffer=0x387f9a8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x387f9a8*, lpNumberOfBytesRead=0x8feb6c*=0xb820, lpOverlapped=0x0) returned 1 [0286.713] WriteFile (in: hFile=0x37c, lpBuffer=0x2827c4c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x2827c4c*, lpNumberOfBytesWritten=0x8feb44*=0x1000, lpOverlapped=0x0) returned 1 [0286.714] WriteFile (in: hFile=0x37c, lpBuffer=0x282a114*, nNumberOfBytesToWrite=0xa840, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x282a114*, lpNumberOfBytesWritten=0x8feb44*=0xa840, lpOverlapped=0x0) returned 1 [0286.715] ReadFile (in: hFile=0x378, lpBuffer=0x387f9a8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x387f9a8*, lpNumberOfBytesRead=0x8feb6c*=0x0, lpOverlapped=0x0) returned 1 [0286.715] CloseHandle (hObject=0x378) returned 1 [0286.716] WriteFile (in: hFile=0x37c, lpBuffer=0x2827c4c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8feb0c, lpOverlapped=0x0 | out: lpBuffer=0x2827c4c*, lpNumberOfBytesWritten=0x8feb0c*=0x10, lpOverlapped=0x0) returned 1 [0286.716] CloseHandle (hObject=0x37c) returned 1 [0286.718] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\YgdL3w.ods", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0286.718] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\YgdL3w.ods", nBufferLength=0x53, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\YgdL3w.ods", lpFilePart=0x0) returned 0x52 [0286.718] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\YgdL3w.ods" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\kddaxo_0hno2qbx\\ygdl3w.ods")) returned 1 [0286.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec40) returned 1 [0286.721] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x48 [0286.721] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX", nBufferLength=0x48, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX", lpFilePart=0x0) returned 0x47 [0286.721] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\kDDaxo_0hno2qBX\\*", lpFindFileData=0x8fe968 | out: lpFindFileData=0x8fe968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae6c8090, ftCreationTime.dwHighDateTime=0x1d5f0de, ftLastAccessTime.dwLowDateTime=0xd3a37a30, ftLastAccessTime.dwHighDateTime=0x1d5e9e0, ftLastWriteTime.dwLowDateTime=0xc3a09182, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x960788 [0286.722] FindNextFileW (in: hFindFile=0x960788, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae6c8090, ftCreationTime.dwHighDateTime=0x1d5f0de, ftLastAccessTime.dwLowDateTime=0xd3a37a30, ftLastAccessTime.dwHighDateTime=0x1d5e9e0, ftLastWriteTime.dwLowDateTime=0xc3a09182, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0286.722] FindNextFileW (in: hFindFile=0x960788, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc16f46b1, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xc16f46b1, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xc20f2a81, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x164b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0U5e tG.pptx.locked", cAlternateFileName="0U5ETG~1.LOC")) returned 1 [0286.722] FindNextFileW (in: hFindFile=0x960788, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc20f2a81, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xc20f2a81, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xc28e6452, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x7920, dwReserved0=0x0, dwReserved1=0x0, cFileName="bf9p6M8RugI8hKdTEw.pdf.locked", cAlternateFileName="BF9P6M~1.LOC")) returned 1 [0286.722] FindNextFileW (in: hFindFile=0x960788, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc290c6ab, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xc290c6ab, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xc30cbf12, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xd3d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VHH9Bs.xlsx.locked", cAlternateFileName="VHH9BS~1.LOC")) returned 1 [0286.722] FindNextFileW (in: hFindFile=0x960788, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc30cbf12, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xc30cbf12, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xc39e3033, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xb850, dwReserved0=0x0, dwReserved1=0x0, cFileName="YgdL3w.ods.locked", cAlternateFileName="YGDL3W~1.LOC")) returned 1 [0286.723] FindNextFileW (in: hFindFile=0x960788, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc30cbf12, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xc30cbf12, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xc39e3033, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xb850, dwReserved0=0x0, dwReserved1=0x0, cFileName="YgdL3w.ods.locked", cAlternateFileName="YGDL3W~1.LOC")) returned 0 [0286.723] FindClose (in: hFindFile=0x960788 | out: hFindFile=0x960788) returned 1 [0286.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febfc) returned 1 [0286.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec08) returned 1 [0286.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec40) returned 1 [0286.723] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0286.723] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh", nBufferLength=0x4d, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh", lpFilePart=0x0) returned 0x4c [0286.723] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\*", lpFindFileData=0x8fe968 | out: lpFindFileData=0x8fe968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52582a20, ftCreationTime.dwHighDateTime=0x1d5eb48, ftLastAccessTime.dwLowDateTime=0xcb691970, ftLastAccessTime.dwHighDateTime=0x1d5e598, ftLastWriteTime.dwLowDateTime=0xcb691970, ftLastWriteTime.dwHighDateTime=0x1d5e598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x960a88 [0286.723] FindNextFileW (in: hFindFile=0x960a88, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52582a20, ftCreationTime.dwHighDateTime=0x1d5eb48, ftLastAccessTime.dwLowDateTime=0xcb691970, ftLastAccessTime.dwHighDateTime=0x1d5e598, ftLastWriteTime.dwLowDateTime=0xcb691970, ftLastWriteTime.dwHighDateTime=0x1d5e598, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0286.724] FindNextFileW (in: hFindFile=0x960a88, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa17d9710, ftCreationTime.dwHighDateTime=0x1d5e9e6, ftLastAccessTime.dwLowDateTime=0x6fdc35f0, ftLastAccessTime.dwHighDateTime=0x1d5e9db, ftLastWriteTime.dwLowDateTime=0x6fdc35f0, ftLastWriteTime.dwHighDateTime=0x1d5e9db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cokdrv3_kpPUpbGAy", cAlternateFileName="COKDRV~1")) returned 1 [0286.724] FindNextFileW (in: hFindFile=0x960a88, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbdbca0, ftCreationTime.dwHighDateTime=0x1d5eabb, ftLastAccessTime.dwLowDateTime=0xf36b5d10, ftLastAccessTime.dwHighDateTime=0x1d5e184, ftLastWriteTime.dwLowDateTime=0xf36b5d10, ftLastWriteTime.dwHighDateTime=0x1d5e184, nFileSizeHigh=0x0, nFileSizeLow=0xa4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="cz0QFFzHRCCKAk2U.odt", cAlternateFileName="CZ0QFF~1.ODT")) returned 1 [0286.724] FindNextFileW (in: hFindFile=0x960a88, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e3669a0, ftCreationTime.dwHighDateTime=0x1d5eeee, ftLastAccessTime.dwLowDateTime=0x5c14e280, ftLastAccessTime.dwHighDateTime=0x1d5e8a8, ftLastWriteTime.dwLowDateTime=0x5c14e280, ftLastWriteTime.dwHighDateTime=0x1d5e8a8, nFileSizeHigh=0x0, nFileSizeLow=0xa933, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dl-0VcvE7AT.pptx", cAlternateFileName="DL-0VC~1.PPT")) returned 1 [0286.724] FindNextFileW (in: hFindFile=0x960a88, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ddb9130, ftCreationTime.dwHighDateTime=0x1d5ead0, ftLastAccessTime.dwLowDateTime=0x2c8cd850, ftLastAccessTime.dwHighDateTime=0x1d5e1f6, ftLastWriteTime.dwLowDateTime=0x2c8cd850, ftLastWriteTime.dwHighDateTime=0x1d5e1f6, nFileSizeHigh=0x0, nFileSizeLow=0x1693b, dwReserved0=0x0, dwReserved1=0x0, cFileName="fGJKcy.ods", cAlternateFileName="")) returned 1 [0286.724] FindNextFileW (in: hFindFile=0x960a88, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712919a0, ftCreationTime.dwHighDateTime=0x1d5e6ac, ftLastAccessTime.dwLowDateTime=0x475e0f30, ftLastAccessTime.dwHighDateTime=0x1d5e897, ftLastWriteTime.dwLowDateTime=0x475e0f30, ftLastWriteTime.dwHighDateTime=0x1d5e897, nFileSizeHigh=0x0, nFileSizeLow=0xa605, dwReserved0=0x0, dwReserved1=0x0, cFileName="hPhD1K2F55.docx", cAlternateFileName="HPHD1K~1.DOC")) returned 1 [0286.724] FindNextFileW (in: hFindFile=0x960a88, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6188670, ftCreationTime.dwHighDateTime=0x1d5eb47, ftLastAccessTime.dwLowDateTime=0xc473c2c0, ftLastAccessTime.dwHighDateTime=0x1d5e6a9, ftLastWriteTime.dwLowDateTime=0xc473c2c0, ftLastWriteTime.dwHighDateTime=0x1d5e6a9, nFileSizeHigh=0x0, nFileSizeLow=0xe9f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MVenpLguM.xlsx", cAlternateFileName="MVENPL~1.XLS")) returned 1 [0286.724] FindNextFileW (in: hFindFile=0x960a88, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0286.725] FindClose (in: hFindFile=0x960a88 | out: hFindFile=0x960a88) returned 1 [0286.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febfc) returned 1 [0286.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec08) returned 1 [0286.726] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cz0QFFzHRCCKAk2U.odt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x69 [0286.726] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cz0QFFzHRCCKAk2U.odt.locked", nBufferLength=0x69, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cz0QFFzHRCCKAk2U.odt.locked", lpFilePart=0x0) returned 0x68 [0286.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0286.726] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cz0QFFzHRCCKAk2U.odt.locked" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\wux hum1uojiqm9jkaeh\\cz0qffzhrcckak2u.odt.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0286.726] GetFileType (hFile=0x37c) returned 0x1 [0286.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0286.726] GetFileType (hFile=0x37c) returned 0x1 [0286.845] SleepEx (dwMilliseconds=0x2, bAlertable=0) returned 0x0 [0287.693] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cz0QFFzHRCCKAk2U.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0287.694] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cz0QFFzHRCCKAk2U.odt", nBufferLength=0x62, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cz0QFFzHRCCKAk2U.odt", lpFilePart=0x0) returned 0x61 [0287.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0287.694] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cz0QFFzHRCCKAk2U.odt" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\wux hum1uojiqm9jkaeh\\cz0qffzhrcckak2u.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0287.695] GetFileType (hFile=0x378) returned 0x1 [0287.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0287.695] GetFileType (hFile=0x378) returned 0x1 [0287.803] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8feb6c*=0xa4d, lpOverlapped=0x0) returned 1 [0287.834] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8feb6c*=0x0, lpOverlapped=0x0) returned 1 [0287.834] CloseHandle (hObject=0x378) returned 1 [0287.834] WriteFile (in: hFile=0x37c, lpBuffer=0x271e494*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x8feb0c, lpOverlapped=0x0 | out: lpBuffer=0x271e494*, lpNumberOfBytesWritten=0x8feb0c*=0xa70, lpOverlapped=0x0) returned 1 [0287.835] CloseHandle (hObject=0x37c) returned 1 [0287.836] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cz0QFFzHRCCKAk2U.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0287.836] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cz0QFFzHRCCKAk2U.odt", nBufferLength=0x62, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cz0QFFzHRCCKAk2U.odt", lpFilePart=0x0) returned 0x61 [0287.837] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cz0QFFzHRCCKAk2U.odt" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\wux hum1uojiqm9jkaeh\\cz0qffzhrcckak2u.odt")) returned 1 [0287.839] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\Dl-0VcvE7AT.pptx.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x65 [0287.839] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\Dl-0VcvE7AT.pptx.locked", nBufferLength=0x65, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\Dl-0VcvE7AT.pptx.locked", lpFilePart=0x0) returned 0x64 [0287.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0287.839] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\Dl-0VcvE7AT.pptx.locked" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\wux hum1uojiqm9jkaeh\\dl-0vcve7at.pptx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0287.840] GetFileType (hFile=0x37c) returned 0x1 [0287.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0287.840] GetFileType (hFile=0x37c) returned 0x1 [0288.930] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\Dl-0VcvE7AT.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5e [0288.930] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\Dl-0VcvE7AT.pptx", nBufferLength=0x5e, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\Dl-0VcvE7AT.pptx", lpFilePart=0x0) returned 0x5d [0288.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0288.930] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\Dl-0VcvE7AT.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\wux hum1uojiqm9jkaeh\\dl-0vcve7at.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0288.930] GetFileType (hFile=0x378) returned 0x1 [0288.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0288.930] GetFileType (hFile=0x378) returned 0x1 [0288.933] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8feb6c*=0xa933, lpOverlapped=0x0) returned 1 [0288.951] WriteFile (in: hFile=0x37c, lpBuffer=0x2804138*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x2804138*, lpNumberOfBytesWritten=0x8feb44*=0x1000, lpOverlapped=0x0) returned 1 [0288.952] WriteFile (in: hFile=0x37c, lpBuffer=0x280660c*, nNumberOfBytesToWrite=0x9950, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x280660c*, lpNumberOfBytesWritten=0x8feb44*=0x9950, lpOverlapped=0x0) returned 1 [0288.953] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8feb6c*=0x0, lpOverlapped=0x0) returned 1 [0288.953] CloseHandle (hObject=0x378) returned 1 [0288.953] WriteFile (in: hFile=0x37c, lpBuffer=0x2804138*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8feb0c, lpOverlapped=0x0 | out: lpBuffer=0x2804138*, lpNumberOfBytesWritten=0x8feb0c*=0x10, lpOverlapped=0x0) returned 1 [0288.954] CloseHandle (hObject=0x37c) returned 1 [0288.958] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\Dl-0VcvE7AT.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5e [0288.958] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\Dl-0VcvE7AT.pptx", nBufferLength=0x5e, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\Dl-0VcvE7AT.pptx", lpFilePart=0x0) returned 0x5d [0288.958] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\Dl-0VcvE7AT.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\wux hum1uojiqm9jkaeh\\dl-0vcve7at.pptx")) returned 1 [0288.961] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\fGJKcy.ods.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5f [0288.961] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\fGJKcy.ods.locked", nBufferLength=0x5f, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\fGJKcy.ods.locked", lpFilePart=0x0) returned 0x5e [0288.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0288.961] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\fGJKcy.ods.locked" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\wux hum1uojiqm9jkaeh\\fgjkcy.ods.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0288.962] GetFileType (hFile=0x37c) returned 0x1 [0288.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0288.962] GetFileType (hFile=0x37c) returned 0x1 [0289.826] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\fGJKcy.ods", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x58 [0289.826] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\fGJKcy.ods", nBufferLength=0x58, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\fGJKcy.ods", lpFilePart=0x0) returned 0x57 [0289.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0289.826] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\fGJKcy.ods" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\wux hum1uojiqm9jkaeh\\fgjkcy.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0289.826] GetFileType (hFile=0x378) returned 0x1 [0289.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0289.827] GetFileType (hFile=0x378) returned 0x1 [0289.829] ReadFile (in: hFile=0x378, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8feb6c*=0x1693b, lpOverlapped=0x0) returned 1 [0289.848] WriteFile (in: hFile=0x37c, lpBuffer=0x26a17f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x26a17f0*, lpNumberOfBytesWritten=0x8feb44*=0x1000, lpOverlapped=0x0) returned 1 [0289.849] WriteFile (in: hFile=0x37c, lpBuffer=0x366a4a8*, nNumberOfBytesToWrite=0x15950, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x366a4a8*, lpNumberOfBytesWritten=0x8feb44*=0x15950, lpOverlapped=0x0) returned 1 [0289.851] ReadFile (in: hFile=0x378, lpBuffer=0x3869508, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x3869508*, lpNumberOfBytesRead=0x8feb6c*=0x0, lpOverlapped=0x0) returned 1 [0289.851] CloseHandle (hObject=0x378) returned 1 [0289.851] WriteFile (in: hFile=0x37c, lpBuffer=0x26a17f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8feb0c, lpOverlapped=0x0 | out: lpBuffer=0x26a17f0*, lpNumberOfBytesWritten=0x8feb0c*=0x10, lpOverlapped=0x0) returned 1 [0289.851] CloseHandle (hObject=0x37c) returned 1 [0289.854] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\fGJKcy.ods", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x58 [0289.854] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\fGJKcy.ods", nBufferLength=0x58, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\fGJKcy.ods", lpFilePart=0x0) returned 0x57 [0289.854] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\fGJKcy.ods" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\wux hum1uojiqm9jkaeh\\fgjkcy.ods")) returned 1 [0289.858] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\hPhD1K2F55.docx.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x64 [0289.858] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\hPhD1K2F55.docx.locked", nBufferLength=0x64, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\hPhD1K2F55.docx.locked", lpFilePart=0x0) returned 0x63 [0289.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0289.858] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\hPhD1K2F55.docx.locked" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\wux hum1uojiqm9jkaeh\\hphd1k2f55.docx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0289.858] GetFileType (hFile=0x37c) returned 0x1 [0289.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0289.858] GetFileType (hFile=0x37c) returned 0x1 [0290.683] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\hPhD1K2F55.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5d [0290.683] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\hPhD1K2F55.docx", nBufferLength=0x5d, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\hPhD1K2F55.docx", lpFilePart=0x0) returned 0x5c [0290.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0290.684] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\hPhD1K2F55.docx" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\wux hum1uojiqm9jkaeh\\hphd1k2f55.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0290.684] GetFileType (hFile=0x378) returned 0x1 [0290.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0290.684] GetFileType (hFile=0x378) returned 0x1 [0290.684] ReadFile (in: hFile=0x378, lpBuffer=0x367fe18, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x367fe18*, lpNumberOfBytesRead=0x8feb6c*=0xa605, lpOverlapped=0x0) returned 1 [0290.686] WriteFile (in: hFile=0x37c, lpBuffer=0x2789ff8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x2789ff8*, lpNumberOfBytesWritten=0x8feb44*=0x1000, lpOverlapped=0x0) returned 1 [0290.687] WriteFile (in: hFile=0x37c, lpBuffer=0x278c4c8*, nNumberOfBytesToWrite=0x9620, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x278c4c8*, lpNumberOfBytesWritten=0x8feb44*=0x9620, lpOverlapped=0x0) returned 1 [0290.688] ReadFile (in: hFile=0x378, lpBuffer=0x367fe18, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x367fe18*, lpNumberOfBytesRead=0x8feb6c*=0x0, lpOverlapped=0x0) returned 1 [0290.688] CloseHandle (hObject=0x378) returned 1 [0290.688] WriteFile (in: hFile=0x37c, lpBuffer=0x2789ff8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8feb0c, lpOverlapped=0x0 | out: lpBuffer=0x2789ff8*, lpNumberOfBytesWritten=0x8feb0c*=0x10, lpOverlapped=0x0) returned 1 [0290.689] CloseHandle (hObject=0x37c) returned 1 [0290.691] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\hPhD1K2F55.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5d [0290.691] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\hPhD1K2F55.docx", nBufferLength=0x5d, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\hPhD1K2F55.docx", lpFilePart=0x0) returned 0x5c [0290.691] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\hPhD1K2F55.docx" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\wux hum1uojiqm9jkaeh\\hphd1k2f55.docx")) returned 1 [0290.694] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\MVenpLguM.xlsx.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x63 [0290.694] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\MVenpLguM.xlsx.locked", nBufferLength=0x63, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\MVenpLguM.xlsx.locked", lpFilePart=0x0) returned 0x62 [0290.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0290.694] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\MVenpLguM.xlsx.locked" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\wux hum1uojiqm9jkaeh\\mvenplgum.xlsx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0290.694] GetFileType (hFile=0x37c) returned 0x1 [0290.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0290.694] GetFileType (hFile=0x37c) returned 0x1 [0291.582] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\MVenpLguM.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0291.583] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\MVenpLguM.xlsx", nBufferLength=0x5c, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\MVenpLguM.xlsx", lpFilePart=0x0) returned 0x5b [0291.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab8) returned 1 [0291.583] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\MVenpLguM.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\wux hum1uojiqm9jkaeh\\mvenplgum.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0291.584] GetFileType (hFile=0x378) returned 0x1 [0291.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab4) returned 1 [0291.585] GetFileType (hFile=0x378) returned 0x1 [0291.587] ReadFile (in: hFile=0x378, lpBuffer=0x3969528, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x3969528*, lpNumberOfBytesRead=0x8feb6c*=0xe9f6, lpOverlapped=0x0) returned 1 [0291.603] WriteFile (in: hFile=0x37c, lpBuffer=0x287e14c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x287e14c*, lpNumberOfBytesWritten=0x8feb44*=0x1000, lpOverlapped=0x0) returned 1 [0291.605] WriteFile (in: hFile=0x37c, lpBuffer=0x288061c*, nNumberOfBytesToWrite=0xda10, lpNumberOfBytesWritten=0x8feb44, lpOverlapped=0x0 | out: lpBuffer=0x288061c*, lpNumberOfBytesWritten=0x8feb44*=0xda10, lpOverlapped=0x0) returned 1 [0291.607] ReadFile (in: hFile=0x378, lpBuffer=0x3969528, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb6c, lpOverlapped=0x0 | out: lpBuffer=0x3969528*, lpNumberOfBytesRead=0x8feb6c*=0x0, lpOverlapped=0x0) returned 1 [0291.607] CloseHandle (hObject=0x378) returned 1 [0291.607] WriteFile (in: hFile=0x37c, lpBuffer=0x287e14c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8feb0c, lpOverlapped=0x0 | out: lpBuffer=0x287e14c*, lpNumberOfBytesWritten=0x8feb0c*=0x10, lpOverlapped=0x0) returned 1 [0291.607] CloseHandle (hObject=0x37c) returned 1 [0291.610] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\MVenpLguM.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0291.610] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\MVenpLguM.xlsx", nBufferLength=0x5c, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\MVenpLguM.xlsx", lpFilePart=0x0) returned 0x5b [0291.610] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\MVenpLguM.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\wux hum1uojiqm9jkaeh\\mvenplgum.xlsx")) returned 1 [0291.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec40) returned 1 [0291.614] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0291.614] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh", nBufferLength=0x4d, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh", lpFilePart=0x0) returned 0x4c [0291.614] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\*", lpFindFileData=0x8fe968 | out: lpFindFileData=0x8fe968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52582a20, ftCreationTime.dwHighDateTime=0x1d5eb48, ftLastAccessTime.dwLowDateTime=0xcb691970, ftLastAccessTime.dwHighDateTime=0x1d5e598, ftLastWriteTime.dwLowDateTime=0xc68b10db, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x960988 [0291.615] FindNextFileW (in: hFindFile=0x960988, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52582a20, ftCreationTime.dwHighDateTime=0x1d5eb48, ftLastAccessTime.dwLowDateTime=0xcb691970, ftLastAccessTime.dwHighDateTime=0x1d5e598, ftLastWriteTime.dwLowDateTime=0xc68b10db, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0291.615] FindNextFileW (in: hFindFile=0x960988, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa17d9710, ftCreationTime.dwHighDateTime=0x1d5e9e6, ftLastAccessTime.dwLowDateTime=0x6fdc35f0, ftLastAccessTime.dwHighDateTime=0x1d5e9db, ftLastWriteTime.dwLowDateTime=0x6fdc35f0, ftLastWriteTime.dwHighDateTime=0x1d5e9db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cokdrv3_kpPUpbGAy", cAlternateFileName="COKDRV~1")) returned 1 [0291.615] FindNextFileW (in: hFindFile=0x960988, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3a09182, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xc3a09182, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xc44a1b30, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xa70, dwReserved0=0x0, dwReserved1=0x0, cFileName="cz0QFFzHRCCKAk2U.odt.locked", cAlternateFileName="CZ0QFF~1.LOC")) returned 1 [0291.615] FindNextFileW (in: hFindFile=0x960988, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc44a1b30, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xc44a1b30, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xc4f60fb5, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xa960, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dl-0VcvE7AT.pptx.locked", cAlternateFileName="DL-0VC~1.LOC")) returned 1 [0291.615] FindNextFileW (in: hFindFile=0x960988, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f60fb5, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xc4f60fb5, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xc57da4b5, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x16960, dwReserved0=0x0, dwReserved1=0x0, cFileName="fGJKcy.ods.locked", cAlternateFileName="FGJKCY~1.LOC")) returned 1 [0291.616] FindNextFileW (in: hFindFile=0x960988, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc57da4b5, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xc57da4b5, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xc5fe915c, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xa630, dwReserved0=0x0, dwReserved1=0x0, cFileName="hPhD1K2F55.docx.locked", cAlternateFileName="HPHD1K~1.LOC")) returned 1 [0291.616] FindNextFileW (in: hFindFile=0x960988, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5fe915c, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xc5fe915c, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xc688ada0, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xea20, dwReserved0=0x0, dwReserved1=0x0, cFileName="MVenpLguM.xlsx.locked", cAlternateFileName="MVENPL~1.LOC")) returned 1 [0291.616] FindNextFileW (in: hFindFile=0x960988, lpFindFileData=0x8fe974 | out: lpFindFileData=0x8fe974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5fe915c, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xc5fe915c, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xc688ada0, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0xea20, dwReserved0=0x0, dwReserved1=0x0, cFileName="MVenpLguM.xlsx.locked", cAlternateFileName="MVENPL~1.LOC")) returned 0 [0291.616] FindClose (in: hFindFile=0x960988 | out: hFindFile=0x960988) returned 1 [0291.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febfc) returned 1 [0291.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec08) returned 1 [0291.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febdc) returned 1 [0291.616] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5f [0291.616] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy", nBufferLength=0x5f, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy", lpFilePart=0x0) returned 0x5e [0291.617] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\*", lpFindFileData=0x8fe904 | out: lpFindFileData=0x8fe904*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa17d9710, ftCreationTime.dwHighDateTime=0x1d5e9e6, ftLastAccessTime.dwLowDateTime=0x6fdc35f0, ftLastAccessTime.dwHighDateTime=0x1d5e9db, ftLastWriteTime.dwLowDateTime=0x6fdc35f0, ftLastWriteTime.dwHighDateTime=0x1d5e9db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x960988 [0291.617] FindNextFileW (in: hFindFile=0x960988, lpFindFileData=0x8fe910 | out: lpFindFileData=0x8fe910*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa17d9710, ftCreationTime.dwHighDateTime=0x1d5e9e6, ftLastAccessTime.dwLowDateTime=0x6fdc35f0, ftLastAccessTime.dwHighDateTime=0x1d5e9db, ftLastWriteTime.dwLowDateTime=0x6fdc35f0, ftLastWriteTime.dwHighDateTime=0x1d5e9db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0291.617] FindNextFileW (in: hFindFile=0x960988, lpFindFileData=0x8fe910 | out: lpFindFileData=0x8fe910*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57854290, ftCreationTime.dwHighDateTime=0x1d5eeda, ftLastAccessTime.dwLowDateTime=0xa7ff07d0, ftLastAccessTime.dwHighDateTime=0x1d5efdc, ftLastWriteTime.dwLowDateTime=0xa7ff07d0, ftLastWriteTime.dwHighDateTime=0x1d5efdc, nFileSizeHigh=0x0, nFileSizeLow=0x11c78, dwReserved0=0x0, dwReserved1=0x0, cFileName="06HHYZgt.ots", cAlternateFileName="")) returned 1 [0291.617] FindNextFileW (in: hFindFile=0x960988, lpFindFileData=0x8fe910 | out: lpFindFileData=0x8fe910*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff904240, ftCreationTime.dwHighDateTime=0x1d5e57b, ftLastAccessTime.dwLowDateTime=0xdad64d90, ftLastAccessTime.dwHighDateTime=0x1d5e2c5, ftLastWriteTime.dwLowDateTime=0xdad64d90, ftLastWriteTime.dwHighDateTime=0x1d5e2c5, nFileSizeHigh=0x0, nFileSizeLow=0x316c, dwReserved0=0x0, dwReserved1=0x0, cFileName="54gj 45mKt9Rr.pdf", cAlternateFileName="54GJ45~1.PDF")) returned 1 [0291.617] FindNextFileW (in: hFindFile=0x960988, lpFindFileData=0x8fe910 | out: lpFindFileData=0x8fe910*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf201a90, ftCreationTime.dwHighDateTime=0x1d5e50f, ftLastAccessTime.dwLowDateTime=0xcf635c70, ftLastAccessTime.dwHighDateTime=0x1d5e372, ftLastWriteTime.dwLowDateTime=0xcf635c70, ftLastWriteTime.dwHighDateTime=0x1d5e372, nFileSizeHigh=0x0, nFileSizeLow=0x186bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="bERt.odt", cAlternateFileName="")) returned 1 [0291.617] FindNextFileW (in: hFindFile=0x960988, lpFindFileData=0x8fe910 | out: lpFindFileData=0x8fe910*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e19c580, ftCreationTime.dwHighDateTime=0x1d5e98c, ftLastAccessTime.dwLowDateTime=0xb9ff69b0, ftLastAccessTime.dwHighDateTime=0x1d5f019, ftLastWriteTime.dwLowDateTime=0xb9ff69b0, ftLastWriteTime.dwHighDateTime=0x1d5f019, nFileSizeHigh=0x0, nFileSizeLow=0x5d4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrTDbEHpWYL6F.ppt", cAlternateFileName="CRTDBE~1.PPT")) returned 1 [0291.618] FindNextFileW (in: hFindFile=0x960988, lpFindFileData=0x8fe910 | out: lpFindFileData=0x8fe910*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0291.618] FindClose (in: hFindFile=0x960988 | out: hFindFile=0x960988) returned 1 [0291.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb98) returned 1 [0291.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba4) returned 1 [0291.619] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\06HHYZgt.ots.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x73 [0291.619] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\06HHYZgt.ots.locked", nBufferLength=0x73, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\06HHYZgt.ots.locked", lpFilePart=0x0) returned 0x72 [0291.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea54) returned 1 [0291.619] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\06HHYZgt.ots.locked" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\wux hum1uojiqm9jkaeh\\cokdrv3_kppupbgay\\06hhyzgt.ots.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0291.620] GetFileType (hFile=0x37c) returned 0x1 [0291.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea50) returned 1 [0291.620] GetFileType (hFile=0x37c) returned 0x1 [0292.508] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\06HHYZgt.ots", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6c [0292.508] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\06HHYZgt.ots", nBufferLength=0x6c, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\06HHYZgt.ots", lpFilePart=0x0) returned 0x6b [0292.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea54) returned 1 [0292.508] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\06HHYZgt.ots" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\wux hum1uojiqm9jkaeh\\cokdrv3_kppupbgay\\06hhyzgt.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0292.508] GetFileType (hFile=0x378) returned 0x1 [0292.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea50) returned 1 [0292.509] GetFileType (hFile=0x378) returned 0x1 [0292.511] ReadFile (in: hFile=0x378, lpBuffer=0x3a69548, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb08, lpOverlapped=0x0 | out: lpBuffer=0x3a69548*, lpNumberOfBytesRead=0x8feb08*=0x11c78, lpOverlapped=0x0) returned 1 [0292.527] WriteFile (in: hFile=0x37c, lpBuffer=0x2779520*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feae0, lpOverlapped=0x0 | out: lpBuffer=0x2779520*, lpNumberOfBytesWritten=0x8feae0*=0x1000, lpOverlapped=0x0) returned 1 [0292.528] WriteFile (in: hFile=0x37c, lpBuffer=0x277b9ec*, nNumberOfBytesToWrite=0x10c90, lpNumberOfBytesWritten=0x8feae0, lpOverlapped=0x0 | out: lpBuffer=0x277b9ec*, lpNumberOfBytesWritten=0x8feae0*=0x10c90, lpOverlapped=0x0) returned 1 [0292.530] ReadFile (in: hFile=0x378, lpBuffer=0x3a69548, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb08, lpOverlapped=0x0 | out: lpBuffer=0x3a69548*, lpNumberOfBytesRead=0x8feb08*=0x0, lpOverlapped=0x0) returned 1 [0292.530] CloseHandle (hObject=0x378) returned 1 [0292.530] WriteFile (in: hFile=0x37c, lpBuffer=0x2779520*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8feaa8, lpOverlapped=0x0 | out: lpBuffer=0x2779520*, lpNumberOfBytesWritten=0x8feaa8*=0x10, lpOverlapped=0x0) returned 1 [0292.530] CloseHandle (hObject=0x37c) returned 1 [0292.532] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\06HHYZgt.ots", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6c [0292.532] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\06HHYZgt.ots", nBufferLength=0x6c, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\06HHYZgt.ots", lpFilePart=0x0) returned 0x6b [0292.532] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\06HHYZgt.ots" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\wux hum1uojiqm9jkaeh\\cokdrv3_kppupbgay\\06hhyzgt.ots")) returned 1 [0292.537] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\54gj 45mKt9Rr.pdf.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0292.537] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\54gj 45mKt9Rr.pdf.locked", nBufferLength=0x78, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\54gj 45mKt9Rr.pdf.locked", lpFilePart=0x0) returned 0x77 [0292.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea54) returned 1 [0292.537] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\54gj 45mKt9Rr.pdf.locked" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\wux hum1uojiqm9jkaeh\\cokdrv3_kppupbgay\\54gj 45mkt9rr.pdf.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0292.537] GetFileType (hFile=0x37c) returned 0x1 [0292.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea50) returned 1 [0292.537] GetFileType (hFile=0x37c) returned 0x1 [0292.711] SleepEx (dwMilliseconds=0x2, bAlertable=0) returned 0x0 [0293.485] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\54gj 45mKt9Rr.pdf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x71 [0293.486] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\54gj 45mKt9Rr.pdf", nBufferLength=0x71, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\54gj 45mKt9Rr.pdf", lpFilePart=0x0) returned 0x70 [0293.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea54) returned 1 [0293.486] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\54gj 45mKt9Rr.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\wux hum1uojiqm9jkaeh\\cokdrv3_kppupbgay\\54gj 45mkt9rr.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0293.486] GetFileType (hFile=0x378) returned 0x1 [0293.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea50) returned 1 [0293.486] GetFileType (hFile=0x378) returned 0x1 [0293.489] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb08, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8feb08*=0x316c, lpOverlapped=0x0) returned 1 [0293.501] WriteFile (in: hFile=0x37c, lpBuffer=0x2876140*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feae0, lpOverlapped=0x0 | out: lpBuffer=0x2876140*, lpNumberOfBytesWritten=0x8feae0*=0x1000, lpOverlapped=0x0) returned 1 [0293.502] WriteFile (in: hFile=0x37c, lpBuffer=0x2878614*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x8feae0, lpOverlapped=0x0 | out: lpBuffer=0x2878614*, lpNumberOfBytesWritten=0x8feae0*=0x2180, lpOverlapped=0x0) returned 1 [0293.502] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb08, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8feb08*=0x0, lpOverlapped=0x0) returned 1 [0293.503] CloseHandle (hObject=0x378) returned 1 [0293.503] WriteFile (in: hFile=0x37c, lpBuffer=0x2876140*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8feaa8, lpOverlapped=0x0 | out: lpBuffer=0x2876140*, lpNumberOfBytesWritten=0x8feaa8*=0x10, lpOverlapped=0x0) returned 1 [0293.503] CloseHandle (hObject=0x37c) returned 1 [0293.504] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\54gj 45mKt9Rr.pdf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x71 [0293.504] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\54gj 45mKt9Rr.pdf", nBufferLength=0x71, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\54gj 45mKt9Rr.pdf", lpFilePart=0x0) returned 0x70 [0293.504] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\54gj 45mKt9Rr.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\wux hum1uojiqm9jkaeh\\cokdrv3_kppupbgay\\54gj 45mkt9rr.pdf")) returned 1 [0293.507] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\bERt.odt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6f [0293.507] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\bERt.odt.locked", nBufferLength=0x6f, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\bERt.odt.locked", lpFilePart=0x0) returned 0x6e [0293.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea54) returned 1 [0293.508] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\bERt.odt.locked" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\wux hum1uojiqm9jkaeh\\cokdrv3_kppupbgay\\bert.odt.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0293.508] GetFileType (hFile=0x37c) returned 0x1 [0293.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea50) returned 1 [0293.508] GetFileType (hFile=0x37c) returned 0x1 [0294.363] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\bERt.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x68 [0294.363] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\bERt.odt", nBufferLength=0x68, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\bERt.odt", lpFilePart=0x0) returned 0x67 [0294.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea54) returned 1 [0294.363] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\bERt.odt" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\wux hum1uojiqm9jkaeh\\cokdrv3_kppupbgay\\bert.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0294.364] GetFileType (hFile=0x378) returned 0x1 [0294.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea50) returned 1 [0294.364] GetFileType (hFile=0x378) returned 0x1 [0294.366] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb08, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8feb08*=0x186bf, lpOverlapped=0x0) returned 1 [0294.386] WriteFile (in: hFile=0x37c, lpBuffer=0x275e8d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feae0, lpOverlapped=0x0 | out: lpBuffer=0x275e8d8*, lpNumberOfBytesWritten=0x8feae0*=0x1000, lpOverlapped=0x0) returned 1 [0294.387] WriteFile (in: hFile=0x37c, lpBuffer=0x386a4e8*, nNumberOfBytesToWrite=0x176d0, lpNumberOfBytesWritten=0x8feae0, lpOverlapped=0x0 | out: lpBuffer=0x386a4e8*, lpNumberOfBytesWritten=0x8feae0*=0x176d0, lpOverlapped=0x0) returned 1 [0294.389] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb08, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8feb08*=0x0, lpOverlapped=0x0) returned 1 [0294.389] CloseHandle (hObject=0x378) returned 1 [0294.389] WriteFile (in: hFile=0x37c, lpBuffer=0x275e8d8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8feaa8, lpOverlapped=0x0 | out: lpBuffer=0x275e8d8*, lpNumberOfBytesWritten=0x8feaa8*=0x10, lpOverlapped=0x0) returned 1 [0294.389] CloseHandle (hObject=0x37c) returned 1 [0294.392] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\bERt.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x68 [0294.392] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\bERt.odt", nBufferLength=0x68, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\bERt.odt", lpFilePart=0x0) returned 0x67 [0294.392] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\bERt.odt" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\wux hum1uojiqm9jkaeh\\cokdrv3_kppupbgay\\bert.odt")) returned 1 [0294.397] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\CrTDbEHpWYL6F.ppt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0294.397] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\CrTDbEHpWYL6F.ppt.locked", nBufferLength=0x78, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\CrTDbEHpWYL6F.ppt.locked", lpFilePart=0x0) returned 0x77 [0294.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea54) returned 1 [0294.397] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\CrTDbEHpWYL6F.ppt.locked" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\wux hum1uojiqm9jkaeh\\cokdrv3_kppupbgay\\crtdbehpwyl6f.ppt.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0294.397] GetFileType (hFile=0x37c) returned 0x1 [0294.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea50) returned 1 [0294.397] GetFileType (hFile=0x37c) returned 0x1 [0295.275] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\CrTDbEHpWYL6F.ppt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x71 [0295.275] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\CrTDbEHpWYL6F.ppt", nBufferLength=0x71, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\CrTDbEHpWYL6F.ppt", lpFilePart=0x0) returned 0x70 [0295.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea54) returned 1 [0295.275] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\CrTDbEHpWYL6F.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\wux hum1uojiqm9jkaeh\\cokdrv3_kppupbgay\\crtdbehpwyl6f.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0295.276] GetFileType (hFile=0x378) returned 0x1 [0295.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea50) returned 1 [0295.276] GetFileType (hFile=0x378) returned 0x1 [0295.278] ReadFile (in: hFile=0x378, lpBuffer=0x3881bd8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb08, lpOverlapped=0x0 | out: lpBuffer=0x3881bd8*, lpNumberOfBytesRead=0x8feb08*=0x5d4f, lpOverlapped=0x0) returned 1 [0295.291] WriteFile (in: hFile=0x37c, lpBuffer=0x28440f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feae0, lpOverlapped=0x0 | out: lpBuffer=0x28440f0*, lpNumberOfBytesWritten=0x8feae0*=0x1000, lpOverlapped=0x0) returned 1 [0295.292] WriteFile (in: hFile=0x37c, lpBuffer=0x28465c4*, nNumberOfBytesToWrite=0x4d60, lpNumberOfBytesWritten=0x8feae0, lpOverlapped=0x0 | out: lpBuffer=0x28465c4*, lpNumberOfBytesWritten=0x8feae0*=0x4d60, lpOverlapped=0x0) returned 1 [0295.293] ReadFile (in: hFile=0x378, lpBuffer=0x3881bd8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8feb08, lpOverlapped=0x0 | out: lpBuffer=0x3881bd8*, lpNumberOfBytesRead=0x8feb08*=0x0, lpOverlapped=0x0) returned 1 [0295.293] CloseHandle (hObject=0x378) returned 1 [0295.293] WriteFile (in: hFile=0x37c, lpBuffer=0x28440f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8feaa8, lpOverlapped=0x0 | out: lpBuffer=0x28440f0*, lpNumberOfBytesWritten=0x8feaa8*=0x10, lpOverlapped=0x0) returned 1 [0295.293] CloseHandle (hObject=0x37c) returned 1 [0295.294] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\CrTDbEHpWYL6F.ppt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x71 [0295.294] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\CrTDbEHpWYL6F.ppt", nBufferLength=0x71, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\CrTDbEHpWYL6F.ppt", lpFilePart=0x0) returned 0x70 [0295.294] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\CrTDbEHpWYL6F.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\0wxsxr-hbmfstf5lqwpj\\wux hum1uojiqm9jkaeh\\cokdrv3_kppupbgay\\crtdbehpwyl6f.ppt")) returned 1 [0295.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febdc) returned 1 [0295.297] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5f [0295.297] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy", nBufferLength=0x5f, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy", lpFilePart=0x0) returned 0x5e [0295.297] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\0WXsxR-HBmfStF5Lqwpj\\WuX HUM1UOjiQM9JKAEh\\cokdrv3_kpPUpbGAy\\*", lpFindFileData=0x8fe904 | out: lpFindFileData=0x8fe904*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa17d9710, ftCreationTime.dwHighDateTime=0x1d5e9e6, ftLastAccessTime.dwLowDateTime=0x6fdc35f0, ftLastAccessTime.dwHighDateTime=0x1d5e9db, ftLastWriteTime.dwLowDateTime=0xc8bb1926, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x960a48 [0295.297] FindNextFileW (in: hFindFile=0x960a48, lpFindFileData=0x8fe910 | out: lpFindFileData=0x8fe910*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa17d9710, ftCreationTime.dwHighDateTime=0x1d5e9e6, ftLastAccessTime.dwLowDateTime=0x6fdc35f0, ftLastAccessTime.dwHighDateTime=0x1d5e9db, ftLastWriteTime.dwLowDateTime=0xc8bb1926, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0295.298] FindNextFileW (in: hFindFile=0x960a48, lpFindFileData=0x8fe910 | out: lpFindFileData=0x8fe910*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc68b10db, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xc68b10db, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xc715571d, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x11ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="06HHYZgt.ots.locked", cAlternateFileName="06HHYZ~1.LOC")) returned 1 [0295.298] FindNextFileW (in: hFindFile=0x960a48, lpFindFileData=0x8fe910 | out: lpFindFileData=0x8fe910*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc717b8fc, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xc717b8fc, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xc7aa9fe8, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x3190, dwReserved0=0x0, dwReserved1=0x0, cFileName="54gj 45mKt9Rr.pdf.locked", cAlternateFileName="54GJ45~1.LOC")) returned 1 [0295.298] FindNextFileW (in: hFindFile=0x960a48, lpFindFileData=0x8fe910 | out: lpFindFileData=0x8fe910*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7aa9fe8, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xc7aa9fe8, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xc8335380, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x186e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bERt.odt.locked", cAlternateFileName="BERTOD~1.LOC")) returned 1 [0295.298] FindNextFileW (in: hFindFile=0x960a48, lpFindFileData=0x8fe910 | out: lpFindFileData=0x8fe910*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8335380, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xc8335380, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xc8bb1926, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x5d70, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrTDbEHpWYL6F.ppt.locked", cAlternateFileName="CRTDBE~1.LOC")) returned 1 [0295.298] FindNextFileW (in: hFindFile=0x960a48, lpFindFileData=0x8fe910 | out: lpFindFileData=0x8fe910*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8335380, ftCreationTime.dwHighDateTime=0x1d6fb68, ftLastAccessTime.dwLowDateTime=0xc8335380, ftLastAccessTime.dwHighDateTime=0x1d6fb68, ftLastWriteTime.dwLowDateTime=0xc8bb1926, ftLastWriteTime.dwHighDateTime=0x1d6fb68, nFileSizeHigh=0x0, nFileSizeLow=0x5d70, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrTDbEHpWYL6F.ppt.locked", cAlternateFileName="CRTDBE~1.LOC")) returned 0 [0295.298] FindClose (in: hFindFile=0x960a48 | out: hFindFile=0x960a48) returned 1 [0295.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb98) returned 1 [0295.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba4) returned 1 [0295.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feca4) returned 1 [0295.299] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\gwXegIJB", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0295.299] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\gwXegIJB", nBufferLength=0x2c, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\gwXegIJB", lpFilePart=0x0) returned 0x2b [0295.299] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\gwXegIJB\\*", lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf86e91b0, ftCreationTime.dwHighDateTime=0x1d5e97c, ftLastAccessTime.dwLowDateTime=0x5f7d2f80, ftLastAccessTime.dwHighDateTime=0x1d5ef66, ftLastWriteTime.dwLowDateTime=0x5f7d2f80, ftLastWriteTime.dwHighDateTime=0x1d5ef66, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x960788 [0295.299] FindNextFileW (in: hFindFile=0x960788, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf86e91b0, ftCreationTime.dwHighDateTime=0x1d5e97c, ftLastAccessTime.dwLowDateTime=0x5f7d2f80, ftLastAccessTime.dwHighDateTime=0x1d5ef66, ftLastWriteTime.dwLowDateTime=0x5f7d2f80, ftLastWriteTime.dwHighDateTime=0x1d5ef66, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0295.299] FindNextFileW (in: hFindFile=0x960788, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa456eb40, ftCreationTime.dwHighDateTime=0x1d5e774, ftLastAccessTime.dwLowDateTime=0x98c7060, ftLastAccessTime.dwHighDateTime=0x1d5eafa, ftLastWriteTime.dwLowDateTime=0x98c7060, ftLastWriteTime.dwHighDateTime=0x1d5eafa, nFileSizeHigh=0x0, nFileSizeLow=0x3d6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bVsbwxsIENwUzs.xlsx", cAlternateFileName="BVSBWX~1.XLS")) returned 1 [0295.299] FindNextFileW (in: hFindFile=0x960788, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29e9f970, ftCreationTime.dwHighDateTime=0x1d5f0c9, ftLastAccessTime.dwLowDateTime=0x4f831ce0, ftLastAccessTime.dwHighDateTime=0x1d5e8f2, ftLastWriteTime.dwLowDateTime=0x4f831ce0, ftLastWriteTime.dwHighDateTime=0x1d5e8f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C6cCVIjAOGOgDr_C21", cAlternateFileName="C6CCVI~1")) returned 1 [0295.300] FindNextFileW (in: hFindFile=0x960788, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf142fc80, ftCreationTime.dwHighDateTime=0x1d5ef32, ftLastAccessTime.dwLowDateTime=0x82579bc0, ftLastAccessTime.dwHighDateTime=0x1d5ea3a, ftLastWriteTime.dwLowDateTime=0x82579bc0, ftLastWriteTime.dwHighDateTime=0x1d5ea3a, nFileSizeHigh=0x0, nFileSizeLow=0xed6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="eI4gjwE2bdUzK.xls", cAlternateFileName="EI4GJW~1.XLS")) returned 1 [0295.300] FindNextFileW (in: hFindFile=0x960788, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce288ab0, ftCreationTime.dwHighDateTime=0x1d5f024, ftLastAccessTime.dwLowDateTime=0xd1f66cf0, ftLastAccessTime.dwHighDateTime=0x1d5e37e, ftLastWriteTime.dwLowDateTime=0xd1f66cf0, ftLastWriteTime.dwHighDateTime=0x1d5e37e, nFileSizeHigh=0x0, nFileSizeLow=0x14c25, dwReserved0=0x0, dwReserved1=0x0, cFileName="r8fnbzGwYTf_wBax3SP.pptx", cAlternateFileName="R8FNBZ~1.PPT")) returned 1 [0295.300] FindNextFileW (in: hFindFile=0x960788, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21c73f50, ftCreationTime.dwHighDateTime=0x1d5ead4, ftLastAccessTime.dwLowDateTime=0xa0874310, ftLastAccessTime.dwHighDateTime=0x1d5f0df, ftLastWriteTime.dwLowDateTime=0xa0874310, ftLastWriteTime.dwHighDateTime=0x1d5f0df, nFileSizeHigh=0x0, nFileSizeLow=0x11530, dwReserved0=0x0, dwReserved1=0x0, cFileName="X6tN5EaAA8nPWHX0_zV.odp", cAlternateFileName="X6TN5E~1.ODP")) returned 1 [0295.300] FindNextFileW (in: hFindFile=0x960788, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42179f80, ftCreationTime.dwHighDateTime=0x1d5ed62, ftLastAccessTime.dwLowDateTime=0x42646c70, ftLastAccessTime.dwHighDateTime=0x1d5f082, ftLastWriteTime.dwLowDateTime=0x42646c70, ftLastWriteTime.dwHighDateTime=0x1d5f082, nFileSizeHigh=0x0, nFileSizeLow=0x12f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zW1j 9HxJe2.csv", cAlternateFileName="ZW1J9H~1.CSV")) returned 1 [0295.300] FindNextFileW (in: hFindFile=0x960788, lpFindFileData=0x8fe9d8 | out: lpFindFileData=0x8fe9d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0295.300] FindClose (in: hFindFile=0x960788 | out: hFindFile=0x960788) returned 1 [0295.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0295.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec6c) returned 1 [0295.301] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\gwXegIJB\\bVsbwxsIENwUzs.xlsx.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0295.301] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\gwXegIJB\\bVsbwxsIENwUzs.xlsx.locked", nBufferLength=0x47, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\gwXegIJB\\bVsbwxsIENwUzs.xlsx.locked", lpFilePart=0x0) returned 0x46 [0295.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb1c) returned 1 [0295.301] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\gwXegIJB\\bVsbwxsIENwUzs.xlsx.locked" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\gwxegijb\\bvsbwxsienwuzs.xlsx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0295.302] GetFileType (hFile=0x37c) returned 0x1 [0295.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb18) returned 1 [0295.302] GetFileType (hFile=0x37c) returned 0x1 [0296.179] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\gwXegIJB\\bVsbwxsIENwUzs.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0296.179] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\gwXegIJB\\bVsbwxsIENwUzs.xlsx", nBufferLength=0x40, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\gwXegIJB\\bVsbwxsIENwUzs.xlsx", lpFilePart=0x0) returned 0x3f [0296.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb1c) returned 1 [0296.180] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\gwXegIJB\\bVsbwxsIENwUzs.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\gwxegijb\\bvsbwxsienwuzs.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0296.180] GetFileType (hFile=0x378) returned 0x1 [0296.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb18) returned 1 [0296.180] GetFileType (hFile=0x378) returned 0x1 [0296.182] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8febd0, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8febd0*=0x3d6a, lpOverlapped=0x0) returned 1 [0296.194] WriteFile (in: hFile=0x37c, lpBuffer=0x271f590*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feba8, lpOverlapped=0x0 | out: lpBuffer=0x271f590*, lpNumberOfBytesWritten=0x8feba8*=0x1000, lpOverlapped=0x0) returned 1 [0296.195] WriteFile (in: hFile=0x37c, lpBuffer=0x2721a68*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x8feba8, lpOverlapped=0x0 | out: lpBuffer=0x2721a68*, lpNumberOfBytesWritten=0x8feba8*=0x2d80, lpOverlapped=0x0) returned 1 [0296.195] ReadFile (in: hFile=0x378, lpBuffer=0x36694c8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8febd0, lpOverlapped=0x0 | out: lpBuffer=0x36694c8*, lpNumberOfBytesRead=0x8febd0*=0x0, lpOverlapped=0x0) returned 1 [0296.195] CloseHandle (hObject=0x378) returned 1 [0296.196] WriteFile (in: hFile=0x37c, lpBuffer=0x271f590*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8feb70, lpOverlapped=0x0 | out: lpBuffer=0x271f590*, lpNumberOfBytesWritten=0x8feb70*=0x10, lpOverlapped=0x0) returned 1 [0296.196] CloseHandle (hObject=0x37c) returned 1 [0296.197] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\gwXegIJB\\bVsbwxsIENwUzs.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0296.197] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\gwXegIJB\\bVsbwxsIENwUzs.xlsx", nBufferLength=0x40, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\gwXegIJB\\bVsbwxsIENwUzs.xlsx", lpFilePart=0x0) returned 0x3f [0296.197] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\gwXegIJB\\bVsbwxsIENwUzs.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\gwxegijb\\bvsbwxsienwuzs.xlsx")) returned 1 [0296.200] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\gwXegIJB\\eI4gjwE2bdUzK.xls.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x45 [0296.200] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\gwXegIJB\\eI4gjwE2bdUzK.xls.locked", nBufferLength=0x45, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\gwXegIJB\\eI4gjwE2bdUzK.xls.locked", lpFilePart=0x0) returned 0x44 [0296.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb1c) returned 1 [0296.200] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\gwXegIJB\\eI4gjwE2bdUzK.xls.locked" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\gwxegijb\\ei4gjwe2bduzk.xls.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0296.201] GetFileType (hFile=0x37c) returned 0x1 [0296.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb18) returned 1 [0296.201] GetFileType (hFile=0x37c) returned 0x1 [0297.090] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\gwXegIJB\\eI4gjwE2bdUzK.xls", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0297.090] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\gwXegIJB\\eI4gjwE2bdUzK.xls", nBufferLength=0x3e, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\gwXegIJB\\eI4gjwE2bdUzK.xls", lpFilePart=0x0) returned 0x3d [0297.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb1c) returned 1 [0297.090] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\gwXegIJB\\eI4gjwE2bdUzK.xls" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\gwxegijb\\ei4gjwe2bduzk.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0297.091] GetFileType (hFile=0x378) returned 0x1 [0297.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb18) returned 1 [0297.091] GetFileType (hFile=0x378) returned 0x1 [0297.093] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8febd0, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8febd0*=0xed6c, lpOverlapped=0x0) returned 1 [0297.109] WriteFile (in: hFile=0x37c, lpBuffer=0x280d650*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8feba8, lpOverlapped=0x0 | out: lpBuffer=0x280d650*, lpNumberOfBytesWritten=0x8feba8*=0x1000, lpOverlapped=0x0) returned 1 [0297.111] WriteFile (in: hFile=0x37c, lpBuffer=0x280fb24*, nNumberOfBytesToWrite=0xdd80, lpNumberOfBytesWritten=0x8feba8, lpOverlapped=0x0 | out: lpBuffer=0x280fb24*, lpNumberOfBytesWritten=0x8feba8*=0xdd80, lpOverlapped=0x0) returned 1 [0297.112] ReadFile (in: hFile=0x378, lpBuffer=0x37694e8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x8febd0, lpOverlapped=0x0 | out: lpBuffer=0x37694e8*, lpNumberOfBytesRead=0x8febd0*=0x0, lpOverlapped=0x0) returned 1 [0297.112] CloseHandle (hObject=0x378) returned 1 [0297.112] WriteFile (in: hFile=0x37c, lpBuffer=0x280d650*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x8feb70, lpOverlapped=0x0 | out: lpBuffer=0x280d650*, lpNumberOfBytesWritten=0x8feb70*=0x10, lpOverlapped=0x0) returned 1 [0297.112] CloseHandle (hObject=0x37c) returned 1 [0297.115] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\gwXegIJB\\eI4gjwE2bdUzK.xls", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0297.115] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\gwXegIJB\\eI4gjwE2bdUzK.xls", nBufferLength=0x3e, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\gwXegIJB\\eI4gjwE2bdUzK.xls", lpFilePart=0x0) returned 0x3d [0297.115] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\gwXegIJB\\eI4gjwE2bdUzK.xls" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\gwxegijb\\ei4gjwe2bduzk.xls")) returned 1 [0297.118] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\gwXegIJB\\r8fnbzGwYTf_wBax3SP.pptx.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4c [0297.118] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\gwXegIJB\\r8fnbzGwYTf_wBax3SP.pptx.locked", nBufferLength=0x4c, lpBuffer=0x956648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\gwXegIJB\\r8fnbzGwYTf_wBax3SP.pptx.locked", lpFilePart=0x0) returned 0x4b [0297.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb1c) returned 1 [0297.118] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\edP6exS5\\gwXegIJB\\r8fnbzGwYTf_wBax3SP.pptx.locked" (normalized: "c:\\users\\fd1hvy\\documents\\edp6exs5\\gwxegijb\\r8fnbzgwytf_wbax3sp.pptx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0297.119] GetFileType (hFile=0x37c) returned 0x1 [0297.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb18) returned 1 [0297.119] GetFileType (hFile=0x37c) returned 0x1 Thread: id = 2 os_tid = 0x1224 Thread: id = 3 os_tid = 0x122c Thread: id = 4 os_tid = 0x128c [0069.745] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0069.745] RoInitialize () returned 0x1 [0069.745] RoUninitialize () returned 0x0 [0107.443] CloseHandle (hObject=0x35c) returned 1 [0107.443] CloseHandle (hObject=0x36c) returned 1 [0107.443] CloseHandle (hObject=0x374) returned 1 [0107.444] CloseHandle (hObject=0x368) returned 1 [0107.444] CloseHandle (hObject=0x360) returned 1 [0107.444] CloseHandle (hObject=0x378) returned 1 [0107.444] CloseHandle (hObject=0x364) returned 1 [0107.445] CloseHandle (hObject=0x370) returned 1 [0107.445] CloseHandle (hObject=0x354) returned 1 [0107.445] CloseHandle (hObject=0x37c) returned 1 [0189.383] WriteFile (in: hFile=0x40c, lpBuffer=0x269be1c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x475f754, lpOverlapped=0x0 | out: lpBuffer=0x269be1c*, lpNumberOfBytesWritten=0x475f754*=0x20, lpOverlapped=0x0) returned 1 [0189.384] CloseHandle (hObject=0x40c) returned 1 Thread: id = 5 os_tid = 0x1378 Thread: id = 6 os_tid = 0xac0 Thread: id = 7 os_tid = 0xab4 Thread: id = 8 os_tid = 0x12d8 [0196.894] CoGetContextToken (in: pToken=0xc2f7fc | out: pToken=0xc2f7fc) returned 0x0 [0196.894] CObjectContext::QueryInterface () returned 0x0 [0196.895] CObjectContext::GetCurrentThreadType () returned 0x0 [0196.895] Release () returned 0x0 Thread: id = 9 os_tid = 0x67c