# Flog Txt Version 1 # Analyzer Version: 4.6.0 # Analyzer Build Date: Jul 8 2022 06:26:21 # Log Creation Date: 21.09.2022 05:24:50.135 Process: id = "1" image_name = "66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe" filename = "c:\\users\\rdhj0cnfevzx\\desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe" page_root = "0x58e4f000" os_pid = "0x1388" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x670" cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe\" " cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f213" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 117 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 118 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 119 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 120 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 121 start_va = 0xa0000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 122 start_va = 0x1a0000 end_va = 0x1a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 123 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 124 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 125 start_va = 0x400000 end_va = 0x409fff monitored = 1 entry_point = 0x404fc2 region_type = mapped_file name = "66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe") Region: id = 126 start_va = 0x77760000 end_va = 0x778dafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 127 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 128 start_va = 0xfffb0000 end_va = 0xfffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000fffb0000" filename = "" Region: id = 129 start_va = 0xfffe0000 end_va = 0x7ffd0d94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffe0000" filename = "" Region: id = 130 start_va = 0x7ffd0d950000 end_va = 0x7ffd0db10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 131 start_va = 0x7ffd0db11000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffd0db11000" filename = "" Region: id = 270 start_va = 0x410000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 271 start_va = 0x700a0000 end_va = 0x700effff monitored = 0 entry_point = 0x700b8180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 272 start_va = 0x70020000 end_va = 0x70099fff monitored = 0 entry_point = 0x70033290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 273 start_va = 0x77340000 end_va = 0x7741ffff monitored = 0 entry_point = 0x77353980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 274 start_va = 0x700f0000 end_va = 0x700f7fff monitored = 0 entry_point = 0x700f17c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 275 start_va = 0x520000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 276 start_va = 0x6fb40000 end_va = 0x6fb98fff monitored = 1 entry_point = 0x6fb50780 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 277 start_va = 0x77340000 end_va = 0x7741ffff monitored = 0 entry_point = 0x77353980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 278 start_va = 0x75580000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75631b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 279 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 280 start_va = 0xffeb0000 end_va = 0xfffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000ffeb0000" filename = "" Region: id = 281 start_va = 0x410000 end_va = 0x4cdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 282 start_va = 0x510000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 283 start_va = 0x520000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 284 start_va = 0x630000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 285 start_va = 0x7fff0000 end_va = 0x7fffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 286 start_va = 0x80000000 end_va = 0x8000ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000080000000" filename = "" Region: id = 287 start_va = 0x743e0000 end_va = 0x74471fff monitored = 0 entry_point = 0x74420380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 288 start_va = 0xffb00000 end_va = 0xffea0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 289 start_va = 0x20000 end_va = 0x23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 290 start_va = 0x77420000 end_va = 0x7749afff monitored = 0 entry_point = 0x7743e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 291 start_va = 0x753c0000 end_va = 0x7547dfff monitored = 0 entry_point = 0x753f5630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 292 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 293 start_va = 0x730000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 294 start_va = 0x776b0000 end_va = 0x776f3fff monitored = 0 entry_point = 0x776c9d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 295 start_va = 0x74e90000 end_va = 0x74f3cfff monitored = 0 entry_point = 0x74ea4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 296 start_va = 0x74490000 end_va = 0x744adfff monitored = 0 entry_point = 0x7449b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 297 start_va = 0x74480000 end_va = 0x74489fff monitored = 0 entry_point = 0x74482a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 298 start_va = 0x772c0000 end_va = 0x77317fff monitored = 0 entry_point = 0x773025c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 299 start_va = 0x830000 end_va = 0x9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 300 start_va = 0x6fc70000 end_va = 0x6fcecfff monitored = 1 entry_point = 0x6fc80db0 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 301 start_va = 0x74df0000 end_va = 0x74e34fff monitored = 0 entry_point = 0x74e0de90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 302 start_va = 0x75700000 end_va = 0x758bcfff monitored = 0 entry_point = 0x757e2a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 303 start_va = 0x75210000 end_va = 0x7535efff monitored = 0 entry_point = 0x752c6820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 304 start_va = 0x74f40000 end_va = 0x75086fff monitored = 0 entry_point = 0x74f51cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 305 start_va = 0x4d0000 end_va = 0x4f9fff monitored = 0 entry_point = 0x4d5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 306 start_va = 0x9b0000 end_va = 0xb37fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009b0000" filename = "" Region: id = 307 start_va = 0x76df0000 end_va = 0x76e1afff monitored = 0 entry_point = 0x76df5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 308 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 309 start_va = 0x4d0000 end_va = 0x4d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 310 start_va = 0xb40000 end_va = 0xcc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b40000" filename = "" Region: id = 311 start_va = 0xcd0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000cd0000" filename = "" Region: id = 312 start_va = 0x4e0000 end_va = 0x4e3fff monitored = 1 entry_point = 0x4e4fc2 region_type = mapped_file name = "66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe") Region: id = 313 start_va = 0x77320000 end_va = 0x7732bfff monitored = 0 entry_point = 0x77323930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 314 start_va = 0x6fd40000 end_va = 0x6fd47fff monitored = 0 entry_point = 0x6fd417b0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 315 start_va = 0x6e480000 end_va = 0x6eb60fff monitored = 1 entry_point = 0x6e4acd70 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 316 start_va = 0x6edd0000 end_va = 0x6eec4fff monitored = 0 entry_point = 0x6ee24160 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\SysWOW64\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\syswow64\\msvcr120_clr0400.dll") Region: id = 317 start_va = 0x4e0000 end_va = 0x4e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004e0000" filename = "" Region: id = 318 start_va = 0x4f0000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004f0000" filename = "" Region: id = 319 start_va = 0x500000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 320 start_va = 0x520000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 321 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 322 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 323 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 324 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 325 start_va = 0x560000 end_va = 0x560fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 326 start_va = 0x570000 end_va = 0x570fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 327 start_va = 0x830000 end_va = 0x97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 328 start_va = 0x9a0000 end_va = 0x9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009a0000" filename = "" Region: id = 329 start_va = 0x20d0000 end_va = 0x22cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020d0000" filename = "" Region: id = 330 start_va = 0x580000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 331 start_va = 0x830000 end_va = 0x92ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 332 start_va = 0x970000 end_va = 0x97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000970000" filename = "" Region: id = 333 start_va = 0x5c0000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 334 start_va = 0x22d0000 end_va = 0x42cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022d0000" filename = "" Region: id = 335 start_va = 0x20d0000 end_va = 0x216ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020d0000" filename = "" Region: id = 336 start_va = 0x22c0000 end_va = 0x22cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 337 start_va = 0x5e0000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 338 start_va = 0x2170000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002170000" filename = "" Region: id = 339 start_va = 0x42d0000 end_va = 0x4606fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 340 start_va = 0x6d1c0000 end_va = 0x6e471fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\7582400666d289c016013ad0f6e0e3e6\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\7582400666d289c016013ad0f6e0e3e6\\mscorlib.ni.dll") Region: id = 341 start_va = 0x74720000 end_va = 0x7480afff monitored = 0 entry_point = 0x7475d650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 342 start_va = 0x4610000 end_va = 0x46a0fff monitored = 0 entry_point = 0x4648cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 343 start_va = 0x73240000 end_va = 0x732b4fff monitored = 0 entry_point = 0x73279a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 344 start_va = 0x4610000 end_va = 0x46effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004610000" filename = "" Region: id = 345 start_va = 0x5c0000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 346 start_va = 0x6fbf0000 end_va = 0x6fc6ffff monitored = 1 entry_point = 0x6fbf1180 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 347 start_va = 0x774a0000 end_va = 0x77531fff monitored = 0 entry_point = 0x774d8cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 348 start_va = 0x620000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 349 start_va = 0x6f170000 end_va = 0x6fb3bfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\1be7a15b1f33bf22e4f53aaf45518c77\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\1be7a15b1f33bf22e4f53aaf45518c77\\system.ni.dll") Region: id = 350 start_va = 0x6efe0000 end_va = 0x6f16efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\1d52bd4ac5e0a6422058a5d62c9f6d9d\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\1d52bd4ac5e0a6422058a5d62c9f6d9d\\system.drawing.ni.dll") Region: id = 351 start_va = 0x6c550000 end_va = 0x6d1b6fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\fb06ad4bc55b9c3ca68a3f9259d826cd\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\fb06ad4bc55b9c3ca68a3f9259d826cd\\system.windows.forms.ni.dll") Region: id = 352 start_va = 0x930000 end_va = 0x930fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000930000" filename = "" Region: id = 353 start_va = 0x930000 end_va = 0x931fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000930000" filename = "" Region: id = 354 start_va = 0x4610000 end_va = 0x469efff monitored = 0 entry_point = 0x461dd60 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll") Region: id = 355 start_va = 0x46e0000 end_va = 0x46effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000046e0000" filename = "" Region: id = 356 start_va = 0x6ef40000 end_va = 0x6efd1fff monitored = 0 entry_point = 0x6ef4dd60 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll") Region: id = 357 start_va = 0x46f0000 end_va = 0x484ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000046f0000" filename = "" Region: id = 358 start_va = 0x940000 end_va = 0x940fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000940000" filename = "" Region: id = 359 start_va = 0x4610000 end_va = 0x46cbfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004610000" filename = "" Region: id = 360 start_va = 0x940000 end_va = 0x943fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000940000" filename = "" Region: id = 361 start_va = 0x950000 end_va = 0x953fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000950000" filename = "" Region: id = 362 start_va = 0x4850000 end_va = 0x4a5afff monitored = 0 entry_point = 0x48fb0a0 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll") Region: id = 363 start_va = 0x73360000 end_va = 0x7356efff monitored = 0 entry_point = 0x7340b0a0 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll") Region: id = 364 start_va = 0x960000 end_va = 0x960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 365 start_va = 0x980000 end_va = 0x981fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000980000" filename = "" Region: id = 366 start_va = 0x960000 end_va = 0x96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 367 start_va = 0x71930000 end_va = 0x7194cfff monitored = 0 entry_point = 0x71933b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 368 start_va = 0x6ec60000 end_va = 0x6edcafff monitored = 0 entry_point = 0x6ecce360 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_538a540779726150\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_538a540779726150\\gdiplus.dll") Region: id = 369 start_va = 0x4850000 end_va = 0x49affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004850000" filename = "" Region: id = 370 start_va = 0x2270000 end_va = 0x22affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 371 start_va = 0x46f0000 end_va = 0x47effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000046f0000" filename = "" Region: id = 372 start_va = 0x4840000 end_va = 0x484ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004840000" filename = "" Region: id = 373 start_va = 0x77540000 end_va = 0x7765efff monitored = 0 entry_point = 0x77585980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 374 start_va = 0x71100000 end_va = 0x712f0fff monitored = 0 entry_point = 0x711e3cd0 region_type = mapped_file name = "dwrite.dll" filename = "\\Windows\\SysWOW64\\DWrite.dll" (normalized: "c:\\windows\\syswow64\\dwrite.dll") Region: id = 375 start_va = 0x47f0000 end_va = 0x4838fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "~fontcache-system.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-System.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-system.dat") Region: id = 376 start_va = 0x990000 end_va = 0x993fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 377 start_va = 0x49b0000 end_va = 0x59affff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "~fontcache-fontface.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-FontFace.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-fontface.dat") Region: id = 378 start_va = 0x22b0000 end_va = 0x22b3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022b0000" filename = "" Region: id = 379 start_va = 0x4850000 end_va = 0x494ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004850000" filename = "" Region: id = 380 start_va = 0x49a0000 end_va = 0x49affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049a0000" filename = "" Region: id = 381 start_va = 0x59b0000 end_va = 0x5aaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000059b0000" filename = "" Region: id = 382 start_va = 0x5ab0000 end_va = 0x5fa1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005ab0000" filename = "" Region: id = 383 start_va = 0x5fb0000 end_va = 0x606cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "micross.ttf" filename = "\\Windows\\Fonts\\micross.ttf" (normalized: "c:\\windows\\fonts\\micross.ttf") Region: id = 384 start_va = 0x6070000 end_va = 0x646ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006070000" filename = "" Region: id = 385 start_va = 0x46d0000 end_va = 0x46d4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\user32.dll.mui") Region: id = 386 start_va = 0x4950000 end_va = 0x4950fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004950000" filename = "" Region: id = 387 start_va = 0x77230000 end_va = 0x772bcfff monitored = 0 entry_point = 0x77279b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 388 start_va = 0x4960000 end_va = 0x4960fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004960000" filename = "" Region: id = 389 start_va = 0x4970000 end_va = 0x4970fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004970000" filename = "" Region: id = 390 start_va = 0x6470000 end_va = 0x6583fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006470000" filename = "" Region: id = 391 start_va = 0x6590000 end_va = 0x75cffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 392 start_va = 0x6470000 end_va = 0x656ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006470000" filename = "" Region: id = 393 start_va = 0x4980000 end_va = 0x498ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004980000" filename = "" Region: id = 394 start_va = 0x4990000 end_va = 0x499ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004990000" filename = "" Region: id = 395 start_va = 0x6be20000 end_va = 0x6c540fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\eb4cca4f06a15158c3f7e2c56516729b\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\eb4cca4f06a15158c3f7e2c56516729b\\system.core.ni.dll") Region: id = 396 start_va = 0x4980000 end_va = 0x498ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004980000" filename = "" Region: id = 397 start_va = 0x75960000 end_va = 0x76d5efff monitored = 0 entry_point = 0x75b1b990 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 398 start_va = 0x75540000 end_va = 0x75576fff monitored = 0 entry_point = 0x75543b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 399 start_va = 0x74820000 end_va = 0x74d18fff monitored = 0 entry_point = 0x74a27610 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 400 start_va = 0x74e40000 end_va = 0x74e83fff monitored = 0 entry_point = 0x74e47410 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 401 start_va = 0x75530000 end_va = 0x7553efff monitored = 0 entry_point = 0x75532e40 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 402 start_va = 0x71af0000 end_va = 0x71b0afff monitored = 0 entry_point = 0x71af9050 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 403 start_va = 0x71790000 end_va = 0x717a2fff monitored = 0 entry_point = 0x71799950 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 404 start_va = 0x707c0000 end_va = 0x707eefff monitored = 0 entry_point = 0x707d95e0 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 405 start_va = 0x75d0000 end_va = 0x760ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000075d0000" filename = "" Region: id = 406 start_va = 0x7610000 end_va = 0x770ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007610000" filename = "" Region: id = 407 start_va = 0x7710000 end_va = 0x774ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007710000" filename = "" Region: id = 408 start_va = 0x7750000 end_va = 0x784ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007750000" filename = "" Region: id = 409 start_va = 0x6570000 end_va = 0x6580fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006570000" filename = "" Region: id = 410 start_va = 0x6bd20000 end_va = 0x6be10fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\fe4b221b4109f0c78f57a792500699b5\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\fe4b221b4109f0c78f57a792500699b5\\system.configuration.ni.dll") Region: id = 411 start_va = 0x6b600000 end_va = 0x6bd1dfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\4fbda26d781323081b45526da6e87b35\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\4fbda26d781323081b45526da6e87b35\\system.xml.ni.dll") Region: id = 412 start_va = 0x6ebb0000 end_va = 0x6ec54fff monitored = 0 entry_point = 0x6ebcac50 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\SysWOW64\\rasapi32.dll" (normalized: "c:\\windows\\syswow64\\rasapi32.dll") Region: id = 413 start_va = 0x6fd60000 end_va = 0x6fd82fff monitored = 0 entry_point = 0x6fd65570 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\SysWOW64\\rasman.dll" (normalized: "c:\\windows\\syswow64\\rasman.dll") Region: id = 414 start_va = 0x6fd50000 end_va = 0x6fd5ffff monitored = 0 entry_point = 0x6fd53820 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\SysWOW64\\rtutils.dll" (normalized: "c:\\windows\\syswow64\\rtutils.dll") Region: id = 415 start_va = 0x75360000 end_va = 0x753befff monitored = 0 entry_point = 0x75364af0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 416 start_va = 0x719b0000 end_va = 0x719fefff monitored = 0 entry_point = 0x719bd850 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 417 start_va = 0x7850000 end_va = 0x792ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 418 start_va = 0x7930000 end_va = 0x796ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007930000" filename = "" Region: id = 419 start_va = 0x7970000 end_va = 0x7a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007970000" filename = "" Region: id = 420 start_va = 0x7a70000 end_va = 0x7aaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007a70000" filename = "" Region: id = 421 start_va = 0x7ab0000 end_va = 0x7baffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007ab0000" filename = "" Region: id = 422 start_va = 0x71a00000 end_va = 0x71a9afff monitored = 0 entry_point = 0x71a3f7e0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll") Region: id = 423 start_va = 0x71ad0000 end_va = 0x71ae1fff monitored = 0 entry_point = 0x71ad4510 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\SysWOW64\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\syswow64\\ondemandconnroutehelper.dll") Region: id = 424 start_va = 0x71aa0000 end_va = 0x71acefff monitored = 0 entry_point = 0x71aabb70 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 425 start_va = 0x74d80000 end_va = 0x74d86fff monitored = 0 entry_point = 0x74d81e10 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 426 start_va = 0x6fd20000 end_va = 0x6fd32fff monitored = 0 entry_point = 0x6fd225d0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc6.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc6.dll") Region: id = 427 start_va = 0x6fd00000 end_va = 0x6fd13fff monitored = 0 entry_point = 0x6fd03c10 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc.dll") Region: id = 428 start_va = 0x7bb0000 end_va = 0x7beffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007bb0000" filename = "" Region: id = 429 start_va = 0x7bf0000 end_va = 0x7ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007bf0000" filename = "" Region: id = 430 start_va = 0x7cf0000 end_va = 0x7d2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007cf0000" filename = "" Region: id = 431 start_va = 0x7d30000 end_va = 0x7e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007d30000" filename = "" Region: id = 432 start_va = 0x7e30000 end_va = 0x7f43fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007e30000" filename = "" Region: id = 433 start_va = 0x4980000 end_va = 0x4980fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 434 start_va = 0x4980000 end_va = 0x4988fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 435 start_va = 0x4980000 end_va = 0x4980fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 436 start_va = 0x4980000 end_va = 0x4988fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 437 start_va = 0x4980000 end_va = 0x4980fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 438 start_va = 0x4980000 end_va = 0x4988fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 439 start_va = 0x70fe0000 end_va = 0x71063fff monitored = 0 entry_point = 0x71006530 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 440 start_va = 0x719a0000 end_va = 0x719a7fff monitored = 0 entry_point = 0x719a1fc0 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 441 start_va = 0x701e0000 end_va = 0x701e7fff monitored = 0 entry_point = 0x701e1920 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 442 start_va = 0x70190000 end_va = 0x701d6fff monitored = 0 entry_point = 0x701a58d0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 443 start_va = 0x74810000 end_va = 0x74815fff monitored = 0 entry_point = 0x74811460 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 444 start_va = 0x70380000 end_va = 0x70389fff monitored = 0 entry_point = 0x70383200 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 445 start_va = 0x70120000 end_va = 0x70183fff monitored = 0 entry_point = 0x7013afd0 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\SysWOW64\\schannel.dll" (normalized: "c:\\windows\\syswow64\\schannel.dll") Region: id = 446 start_va = 0x75090000 end_va = 0x75207fff monitored = 0 entry_point = 0x750e8a90 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 447 start_va = 0x76d60000 end_va = 0x76d6dfff monitored = 0 entry_point = 0x76d65410 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 448 start_va = 0x70110000 end_va = 0x7011ffff monitored = 0 entry_point = 0x70114600 region_type = mapped_file name = "mskeyprotect.dll" filename = "\\Windows\\SysWOW64\\mskeyprotect.dll" (normalized: "c:\\windows\\syswow64\\mskeyprotect.dll") Region: id = 449 start_va = 0x6fde0000 end_va = 0x6fdfffff monitored = 0 entry_point = 0x6fded120 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\SysWOW64\\ncrypt.dll" (normalized: "c:\\windows\\syswow64\\ncrypt.dll") Region: id = 450 start_va = 0x6fdb0000 end_va = 0x6fddbfff monitored = 0 entry_point = 0x6fdcbb10 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\SysWOW64\\ntasn1.dll" (normalized: "c:\\windows\\syswow64\\ntasn1.dll") Region: id = 451 start_va = 0x6fd90000 end_va = 0x6fda9fff monitored = 0 entry_point = 0x6fd9fa70 region_type = mapped_file name = "ncryptsslp.dll" filename = "\\Windows\\SysWOW64\\ncryptsslp.dll" (normalized: "c:\\windows\\syswow64\\ncryptsslp.dll") Region: id = 452 start_va = 0x7e30000 end_va = 0x7e6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007e30000" filename = "" Region: id = 453 start_va = 0x7e70000 end_va = 0x7f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007e70000" filename = "" Region: id = 454 start_va = 0x7f70000 end_va = 0x7faffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007f70000" filename = "" Region: id = 455 start_va = 0x7fb0000 end_va = 0x80affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007fb0000" filename = "" Thread: id = 1 os_tid = 0x138c [0098.519] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0099.604] RoInitialize () returned 0x1 [0099.605] RoUninitialize () returned 0x0 [0103.713] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e558 | out: phkResult=0x19e558*=0x0) returned 0x2 [0103.750] LocalAlloc (uFlags=0x0, uBytes=0x208) returned 0x684c40 [0103.759] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x104, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0103.781] IsAppThemed () returned 0x1 [0103.784] CoTaskMemAlloc (cb=0xf0) returned 0x684f58 [0103.784] CreateActCtxA (pActCtx=0x19f418) returned 0x692fd4 [0103.887] CoTaskMemFree (pv=0x684f58) [0103.899] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc20b [0103.899] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc20a [0103.913] GetUserNameW (in: lpBuffer=0x19f240, pcbBuffer=0x19f4b8 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x19f4b8) returned 1 [0103.920] GetComputerNameW (in: lpBuffer=0x19f240, nSize=0x19f4b8 | out: lpBuffer="XC64ZB", nSize=0x19f4b8) returned 1 [0103.930] GetSystemMetrics (nIndex=75) returned 1 [0103.956] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0105.390] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x6ef40000 [0105.446] AdjustWindowRectEx (in: lpRect=0x19f458, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50081 | out: lpRect=0x19f458) returned 1 [0105.449] GetCurrentProcess () returned 0xffffffff [0105.449] GetCurrentThread () returned 0xfffffffe [0105.449] GetCurrentProcess () returned 0xffffffff [0105.449] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x19f370, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x19f370*=0x280) returned 1 [0105.452] GetCurrentThreadId () returned 0x138c [0105.462] GetCurrentActCtx (in: lphActCtx=0x19f2d0 | out: lphActCtx=0x19f2d0*=0x0) returned 1 [0105.463] ActivateActCtx (in: hActCtx=0x692fd4, lpCookie=0x19f2e0 | out: hActCtx=0x692fd4, lpCookie=0x19f2e0) returned 1 [0105.463] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0106.505] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x73360000 [0106.527] GetModuleHandleW (lpModuleName="user32.dll") returned 0x74f40000 [0106.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x19f194, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcWulîú¶\r(úHnhö\x19", lpUsedDefaultChar=0x0) returned 14 [0106.528] GetProcAddress (hModule=0x74f40000, lpProcName="DefWindowProcW") returned 0x744107e0 [0106.530] GetStockObject (i=5) returned 0x1900015 [0106.535] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0106.538] CoTaskMemAlloc (cb=0x5c) returned 0x6908c8 [0106.538] RegisterClassW (lpWndClass=0x19f184) returned 0xc207 [0106.538] CoTaskMemFree (pv=0x6908c8) [0106.539] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0106.539] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r10_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x80298 [0106.540] SetWindowLongW (hWnd=0x80298, nIndex=-4, dwNewLong=1950418912) returned 9831870 [0106.541] GetWindowLongW (hWnd=0x80298, nIndex=-4) returned 1950418912 [0106.542] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e9e4 | out: phkResult=0x19e9e4*=0x298) returned 0x0 [0106.542] RegQueryValueExW (in: hKey=0x298, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x19ea04, lpData=0x0, lpcbData=0x19ea00*=0x0 | out: lpType=0x19ea04*=0x0, lpData=0x0, lpcbData=0x19ea00*=0x0) returned 0x2 [0106.542] RegQueryValueExW (in: hKey=0x298, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x19ea04, lpData=0x0, lpcbData=0x19ea00*=0x0 | out: lpType=0x19ea04*=0x0, lpData=0x0, lpcbData=0x19ea00*=0x0) returned 0x2 [0106.542] RegCloseKey (hKey=0x298) returned 0x0 [0106.545] SetWindowLongW (hWnd=0x80298, nIndex=-4, dwNewLong=9831910) returned 1950418912 [0106.545] GetWindowLongW (hWnd=0x80298, nIndex=-4) returned 9831910 [0106.545] GetWindowLongW (hWnd=0x80298, nIndex=-16) returned 113311744 [0106.546] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc205 [0106.546] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x80298, Msg=0x24, wParam=0x0, lParam=0x19ecfc) returned 0x0 [0106.547] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc150 [0106.547] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x80298, Msg=0x81, wParam=0x0, lParam=0x19ecf0) returned 0x1 [0106.548] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x80298, Msg=0x83, wParam=0x0, lParam=0x19ecdc) returned 0x0 [0106.823] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x80298, Msg=0x1, wParam=0x0, lParam=0x19ecf0) returned 0x0 [0106.824] GetClientRect (in: hWnd=0x80298, lpRect=0x19ea1c | out: lpRect=0x19ea1c) returned 1 [0106.824] GetWindowRect (in: hWnd=0x80298, lpRect=0x19ea1c | out: lpRect=0x19ea1c) returned 1 [0106.826] GetParent (hWnd=0x80298) returned 0x0 [0106.826] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10e70001) returned 1 [0106.852] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6ef40000 [0106.853] AdjustWindowRectEx (in: lpRect=0x19f424, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0x19f424) returned 1 [0106.853] GetSystemMetrics (nIndex=59) returned 1456 [0106.853] GetSystemMetrics (nIndex=60) returned 916 [0106.853] GetSystemMetrics (nIndex=34) returned 136 [0106.853] GetSystemMetrics (nIndex=35) returned 39 [0106.853] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6ef40000 [0106.854] AdjustWindowRectEx (in: lpRect=0x19f324, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0x19f324) returned 1 [0106.858] CreateCompatibleDC (hdc=0x0) returned 0xf0106e5 [0106.863] GetSystemDefaultLCID () returned 0x409 [0106.863] GetStockObject (i=17) returned 0x10a0047 [0106.865] GetObjectW (in: h=0x10a0047, c=92, pv=0x19f188 | out: pv=0x19f188) returned 92 [0106.866] GetDC (hWnd=0x0) returned 0x1b0107ae [0107.529] GdiplusStartup (in: token=0x535ec8, input=0x19e740, output=0x19e790 | out: token=0x535ec8, output=0x19e790) returned 0x0 [0107.540] CoTaskMemAlloc (cb=0x5c) returned 0x690520 [0107.546] GdipCreateFontFromLogfontW (hdc=0x1b0107ae, logfont=0x690520, font=0x19f250) returned 0x0 [0108.952] CoTaskMemFree (pv=0x690520) [0108.953] CoTaskMemAlloc (cb=0x5c) returned 0x690a00 [0108.953] CoTaskMemFree (pv=0x690a00) [0108.953] CoTaskMemAlloc (cb=0x5c) returned 0x6904b8 [0108.954] CoTaskMemFree (pv=0x6904b8) [0108.954] GdipGetFontUnit (font=0x49a1f08, unit=0x19f21c) returned 0x0 [0108.954] GdipGetFontSize (font=0x49a1f08, size=0x19f220) returned 0x0 [0108.954] GdipGetFontStyle (font=0x49a1f08, style=0x19f218) returned 0x0 [0108.955] GdipGetFamily (font=0x49a1f08, family=0x19f214) returned 0x0 [0108.955] GdipGetFontSize (font=0x49a1f08, size=0x22d9abc) returned 0x0 [0108.955] ReleaseDC (hWnd=0x0, hDC=0x1b0107ae) returned 1 [0108.956] GetDC (hWnd=0x0) returned 0xc0100ae [0108.956] GdipCreateFromHDC (hdc=0xc0100ae, graphics=0x19f238) returned 0x0 [0108.966] GdipGetDpiY (graphics=0x59bf268, dpi=0x22d9bc4) returned 0x0 [0108.966] GdipGetFontHeight (font=0x49a1f08, graphics=0x59bf268, height=0x19f230) returned 0x0 [0108.966] GdipGetEmHeight (family=0x59b4f48, style=0, EmHeight=0x19f238) returned 0x0 [0108.966] GdipGetLineSpacing (family=0x59b4f48, style=0, LineSpacing=0x19f238) returned 0x0 [0108.967] GdipDeleteGraphics (graphics=0x59bf268) returned 0x0 [0108.969] ReleaseDC (hWnd=0x0, hDC=0xc0100ae) returned 1 [0108.969] GdipCreateFont (fontFamily=0x59b4f48, emSize=0x41040000, style=0, unit=0x3, font=0x22d9b84) returned 0x0 [0108.970] GdipGetFontSize (font=0x49aefc0, size=0x22d9b88) returned 0x0 [0108.970] GdipDeleteFont (font=0x49a1f08) returned 0x0 [0108.970] GetDC (hWnd=0x0) returned 0xc0100ae [0108.970] GdipCreateFromHDC (hdc=0xc0100ae, graphics=0x19f260) returned 0x0 [0108.971] CoTaskMemAlloc (cb=0x5c) returned 0x6905f0 [0108.972] GdipGetLogFontW (font=0x49aefc0, graphics=0x59bf268, logfontW=0x6905f0) returned 0x0 [0109.002] CoTaskMemFree (pv=0x6905f0) [0109.002] CoTaskMemAlloc (cb=0x5c) returned 0x690a00 [0109.002] CoTaskMemFree (pv=0x690a00) [0109.003] CoTaskMemAlloc (cb=0x5c) returned 0x690b38 [0109.003] CoTaskMemFree (pv=0x690b38) [0109.003] GdipDeleteGraphics (graphics=0x59bf268) returned 0x0 [0109.003] ReleaseDC (hWnd=0x0, hDC=0xc0100ae) returned 1 [0109.003] CoTaskMemAlloc (cb=0x5c) returned 0x690790 [0109.004] CreateFontIndirectW (lplf=0x690790) returned 0xf0a066f [0109.004] CoTaskMemFree (pv=0x690790) [0109.004] SelectObject (hdc=0xf0106e5, h=0xf0a066f) returned 0x18a0048 [0109.004] GetTextMetricsW (in: hdc=0xf0106e5, lptm=0x19f36c | out: lptm=0x19f36c) returned 1 [0109.005] GetTextExtentPoint32W (in: hdc=0xf0106e5, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x22d9de0 | out: psizl=0x22d9de0) returned 1 [0109.006] SelectObject (hdc=0xf0106e5, h=0x18a0048) returned 0xf0a066f [0109.009] DeleteDC (hdc=0xf0106e5) returned 1 [0109.010] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6ef40000 [0109.011] AdjustWindowRectEx (in: lpRect=0x19f0b8, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19f0b8) returned 1 [0109.011] AdjustWindowRectEx (in: lpRect=0x19f2f8, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0x19f2f8) returned 1 [0109.012] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6ef40000 [0109.012] AdjustWindowRectEx (in: lpRect=0x19f030, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19f030) returned 1 [0109.012] AdjustWindowRectEx (in: lpRect=0x19f130, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0x19f130) returned 1 [0109.013] GetSystemMetrics (nIndex=34) returned 136 [0109.013] GetSystemMetrics (nIndex=35) returned 39 [0109.014] GetCurrentActCtx (in: lphActCtx=0x19f48c | out: lphActCtx=0x19f48c*=0x0) returned 1 [0109.014] ActivateActCtx (in: hActCtx=0x692fd4, lpCookie=0x19f49c | out: hActCtx=0x692fd4, lpCookie=0x19f49c) returned 1 [0109.014] GetCurrentActCtx (in: lphActCtx=0x19f2ac | out: lphActCtx=0x19f2ac*=0x692fd4) returned 1 [0109.015] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x73360000 [0109.015] AdjustWindowRectEx (in: lpRect=0x19f1f0, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19f1f0) returned 1 [0109.015] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0109.015] CreateWindowExW (dwExStyle=0x50080, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r10_ad1", lpWindowName="Form1", dwStyle=0x2cf0000, X=-2147483648, Y=-2147483648, nWidth=541, nHeight=519, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x702e2 [0109.016] SetWindowLongW (hWnd=0x702e2, nIndex=-4, dwNewLong=1950418912) returned 9831870 [0109.016] GetWindowLongW (hWnd=0x702e2, nIndex=-4) returned 1950418912 [0109.016] SetWindowLongW (hWnd=0x702e2, nIndex=-4, dwNewLong=9831950) returned 1950418912 [0109.016] GetWindowLongW (hWnd=0x702e2, nIndex=-4) returned 9831950 [0109.016] GetWindowLongW (hWnd=0x702e2, nIndex=-16) returned 114229248 [0109.017] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0x81, wParam=0x0, lParam=0x19ecd0) returned 0x1 [0109.020] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0x83, wParam=0x0, lParam=0x19ecbc) returned 0x0 [0109.021] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0x1, wParam=0x0, lParam=0x19ecd0) returned 0x0 [0109.021] GetClientRect (in: hWnd=0x702e2, lpRect=0x19e9cc | out: lpRect=0x19e9cc) returned 1 [0109.021] GetWindowRect (in: hWnd=0x702e2, lpRect=0x19e9cc | out: lpRect=0x19e9cc) returned 1 [0109.022] SetWindowTextW (hWnd=0x702e2, lpString="Form1") returned 1 [0109.022] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0xc, wParam=0x0, lParam=0x22d930c) returned 0x1 [0109.036] GetProcessWindowStation () returned 0xf0 [0109.040] GetUserObjectInformationA (in: hObj=0xf0, nIndex=1, pvInfo=0x22da2fc, nLength=0xc, lpnLengthNeeded=0x19e8cc | out: pvInfo=0x22da2fc, lpnLengthNeeded=0x19e8cc) returned 1 [0109.044] SetConsoleCtrlHandler (HandlerRoutine=0x960636, Add=1) returned 1 [0109.045] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0109.045] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0109.047] GetClassInfoW (in: hInstance=0x400000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWndClass=0x22da360 | out: lpWndClass=0x22da360) returned 0 [0109.050] CoTaskMemAlloc (cb=0x58) returned 0x6868d0 [0109.050] RegisterClassW (lpWndClass=0x19e81c) returned 0xc20c [0109.050] CoTaskMemFree (pv=0x6868d0) [0109.051] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x502c2 [0109.062] NtdllDefWindowProc_W (hWnd=0x502c2, Msg=0x81, wParam=0x0, lParam=0x19e358) returned 0x1 [0109.066] NtdllDefWindowProc_W (hWnd=0x502c2, Msg=0x83, wParam=0x0, lParam=0x19e344) returned 0x0 [0109.067] NtdllDefWindowProc_W (hWnd=0x502c2, Msg=0x1, wParam=0x0, lParam=0x19e358) returned 0x0 [0109.067] NtdllDefWindowProc_W (hWnd=0x502c2, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0109.067] NtdllDefWindowProc_W (hWnd=0x502c2, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0109.076] GetStartupInfoW (in: lpStartupInfo=0x22da798 | out: lpStartupInfo=0x22da798*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0109.079] GetParent (hWnd=0x702e2) returned 0x0 [0109.079] SetWindowLongW (hWnd=0x702e2, nIndex=-8, dwNewLong=0) returned 0 [0109.085] GetSystemMetrics (nIndex=11) returned 32 [0109.085] GetSystemMetrics (nIndex=12) returned 32 [0109.085] GetDC (hWnd=0x0) returned 0xc0100ae [0109.085] GetDeviceCaps (hdc=0xc0100ae, index=12) returned 32 [0109.085] GetDeviceCaps (hdc=0xc0100ae, index=14) returned 1 [0109.085] ReleaseDC (hWnd=0x0, hDC=0xc0100ae) returned 1 [0109.086] CreateIconFromResourceEx (presbits=0x22dd234, dwResSize=0x10a8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x1e0067 [0109.088] GetSystemMetrics (nIndex=49) returned 16 [0109.088] GetSystemMetrics (nIndex=50) returned 16 [0109.088] CreateIconFromResourceEx (presbits=0x22de318, dwResSize=0x468, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x7020d [0109.090] SendMessageW (hWnd=0x702e2, Msg=0x80, wParam=0x0, lParam=0x7020d) returned 0x0 [0109.090] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0x80, wParam=0x0, lParam=0x7020d) returned 0x0 [0109.091] SendMessageW (hWnd=0x702e2, Msg=0x80, wParam=0x1, lParam=0x1e0067) returned 0x0 [0109.091] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0x80, wParam=0x1, lParam=0x1e0067) returned 0x0 [0109.091] GetSystemMenu (hWnd=0x702e2, bRevert=0) returned 0x50217 [0109.166] GetWindowPlacement (in: hWnd=0x702e2, lpwndpl=0x19f2bc | out: lpwndpl=0x19f2bc) returned 1 [0109.167] EnableMenuItem (hMenu=0x50217, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0109.167] EnableMenuItem (hMenu=0x50217, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0109.167] EnableMenuItem (hMenu=0x50217, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0109.167] EnableMenuItem (hMenu=0x50217, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0109.167] EnableMenuItem (hMenu=0x50217, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0109.168] GetClientRect (in: hWnd=0x702e2, lpRect=0x19f300 | out: lpRect=0x19f300) returned 1 [0109.168] GetClientRect (in: hWnd=0x702e2, lpRect=0x19f260 | out: lpRect=0x19f260) returned 1 [0109.168] GetWindowRect (in: hWnd=0x702e2, lpRect=0x19f260 | out: lpRect=0x19f260) returned 1 [0109.168] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x73360000 [0109.168] GetWindowLongW (hWnd=0x702e2, nIndex=-16) returned 114229248 [0109.169] GetWindowTextLengthW (hWnd=0x702e2) returned 5 [0109.169] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0109.169] GetSystemMetrics (nIndex=42) returned 0 [0109.169] GetWindowTextW (in: hWnd=0x702e2, lpString=0x19f1e4, nMaxCount=6 | out: lpString="Form1") returned 5 [0109.169] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0xd, wParam=0x6, lParam=0x19f1e4) returned 0x5 [0109.170] GetWindowTextLengthW (hWnd=0x702e2) returned 5 [0109.170] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0109.170] GetSystemMetrics (nIndex=42) returned 0 [0109.170] GetWindowTextW (in: hWnd=0x702e2, lpString=0x19f1e4, nMaxCount=6 | out: lpString="Form1") returned 5 [0109.170] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0xd, wParam=0x6, lParam=0x19f1e4) returned 0x5 [0109.170] GetWindowLongW (hWnd=0x702e2, nIndex=-16) returned 114229248 [0109.170] GetWindowLongW (hWnd=0x702e2, nIndex=-20) returned 328064 [0109.170] SetWindowLongW (hWnd=0x702e2, nIndex=-16, dwNewLong=47120384) returned 114229248 [0109.170] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0x7c, wParam=0xfffffff0, lParam=0x19f254) returned 0x0 [0109.171] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0x7d, wParam=0xfffffff0, lParam=0x19f254) returned 0x0 [0109.613] SetWindowLongW (hWnd=0x702e2, nIndex=-20, dwNewLong=327808) returned 328064 [0109.613] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0x7c, wParam=0xffffffec, lParam=0x19f254) returned 0x0 [0109.613] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0x7d, wParam=0xffffffec, lParam=0x19f254) returned 0x0 [0109.614] SetWindowPos (hWnd=0x702e2, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0109.614] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0x46, wParam=0x0, lParam=0x19f274) returned 0x0 [0109.614] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0x83, wParam=0x1, lParam=0x19f24c) returned 0x0 [0109.616] GetWindowPlacement (in: hWnd=0x702e2, lpwndpl=0x19efe4 | out: lpwndpl=0x19efe4) returned 1 [0109.616] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0x47, wParam=0x0, lParam=0x19f274) returned 0x0 [0109.616] GetClientRect (in: hWnd=0x702e2, lpRect=0x19ef94 | out: lpRect=0x19ef94) returned 1 [0109.616] GetWindowRect (in: hWnd=0x702e2, lpRect=0x19ef94 | out: lpRect=0x19ef94) returned 1 [0109.618] RedrawWindow (hWnd=0x702e2, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0109.618] GetSystemMenu (hWnd=0x702e2, bRevert=0) returned 0x50217 [0109.618] GetWindowPlacement (in: hWnd=0x702e2, lpwndpl=0x19f2ac | out: lpwndpl=0x19f2ac) returned 1 [0109.618] EnableMenuItem (hMenu=0x50217, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0109.618] EnableMenuItem (hMenu=0x50217, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0109.618] EnableMenuItem (hMenu=0x50217, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0109.618] EnableMenuItem (hMenu=0x50217, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0109.618] EnableMenuItem (hMenu=0x50217, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0109.618] ShowWindow (hWnd=0x702e2, nCmdShow=5) returned 0 [0109.619] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0109.619] GetWindowTextLengthW (hWnd=0x702e2) returned 5 [0109.619] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0109.619] GetSystemMetrics (nIndex=42) returned 0 [0109.619] GetWindowTextW (in: hWnd=0x702e2, lpString=0x19eeec, nMaxCount=6 | out: lpString="Form1") returned 5 [0109.620] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0xd, wParam=0x6, lParam=0x19eeec) returned 0x5 [0109.952] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x73360000 [0109.952] GetWindowLongW (hWnd=0x702e2, nIndex=-16) returned 114229248 [0109.967] GetWindowTextLengthW (hWnd=0x702e2) returned 5 [0109.967] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0109.967] GetSystemMetrics (nIndex=42) returned 0 [0109.967] GetWindowTextW (in: hWnd=0x702e2, lpString=0x19edcc, nMaxCount=6 | out: lpString="Form1") returned 5 [0109.967] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0xd, wParam=0x6, lParam=0x19edcc) returned 0x5 [0109.967] GetWindowTextLengthW (hWnd=0x702e2) returned 5 [0109.967] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0109.967] GetSystemMetrics (nIndex=42) returned 0 [0109.967] GetWindowTextW (in: hWnd=0x702e2, lpString=0x19edcc, nMaxCount=6 | out: lpString="Form1") returned 5 [0109.967] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0xd, wParam=0x6, lParam=0x19edcc) returned 0x5 [0109.967] GetWindowLongW (hWnd=0x702e2, nIndex=-16) returned 114229248 [0109.967] GetWindowLongW (hWnd=0x702e2, nIndex=-20) returned 328064 [0109.967] SetWindowLongW (hWnd=0x702e2, nIndex=-16, dwNewLong=315555840) returned 114229248 [0109.967] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0x7c, wParam=0xfffffff0, lParam=0x19ee3c) returned 0x0 [0109.990] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0x7d, wParam=0xfffffff0, lParam=0x19ee3c) returned 0x0 [0109.996] SetWindowLongW (hWnd=0x702e2, nIndex=-20, dwNewLong=852096) returned 328064 [0109.996] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0x7c, wParam=0xffffffec, lParam=0x19ee3c) returned 0x0 [0109.997] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0x7d, wParam=0xffffffec, lParam=0x19ee3c) returned 0x0 [0109.998] SetWindowPos (hWnd=0x702e2, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0109.998] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0x46, wParam=0x0, lParam=0x19ee5c) returned 0x0 [0109.998] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0x83, wParam=0x1, lParam=0x19ee34) returned 0x0 [0110.002] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0x85, wParam=0xc20406cd, lParam=0x0) returned 0x0 [0110.004] GetWindowPlacement (in: hWnd=0x702e2, lpwndpl=0x19ebe8 | out: lpwndpl=0x19ebe8) returned 1 [0110.004] GetClientRect (in: hWnd=0x702e2, lpRect=0x19eb94 | out: lpRect=0x19eb94) returned 1 [0110.004] GetWindowTextLengthW (hWnd=0x702e2) returned 5 [0110.004] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0110.004] GetSystemMetrics (nIndex=42) returned 0 [0110.004] GetWindowTextW (in: hWnd=0x702e2, lpString=0x19ea60, nMaxCount=6 | out: lpString="Form1") returned 5 [0110.004] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0xd, wParam=0x6, lParam=0x19ea60) returned 0x5 [0110.005] GetClientRect (in: hWnd=0x702e2, lpRect=0x19ea9c | out: lpRect=0x19ea9c) returned 1 [0110.006] GetSysColor (nIndex=10) returned 0xb4b4b4 [0110.006] GetSysColor (nIndex=2) returned 0xd1b499 [0110.006] GetSysColor (nIndex=9) returned 0x0 [0110.006] GetSysColor (nIndex=12) returned 0xababab [0110.006] GetSysColor (nIndex=15) returned 0xf0f0f0 [0110.006] GetSysColor (nIndex=20) returned 0xffffff [0110.007] GetSysColor (nIndex=16) returned 0xa0a0a0 [0110.007] GetSysColor (nIndex=15) returned 0xf0f0f0 [0110.007] GetSysColor (nIndex=16) returned 0xa0a0a0 [0110.007] GetSysColor (nIndex=21) returned 0x696969 [0110.007] GetSysColor (nIndex=22) returned 0xe3e3e3 [0110.007] GetSysColor (nIndex=20) returned 0xffffff [0110.007] GetSysColor (nIndex=18) returned 0x0 [0110.007] GetSysColor (nIndex=1) returned 0x0 [0110.007] GetSysColor (nIndex=27) returned 0xead1b9 [0110.007] GetSysColor (nIndex=28) returned 0xf2e4d7 [0110.007] GetSysColor (nIndex=17) returned 0x6d6d6d [0110.007] GetSysColor (nIndex=13) returned 0xff9933 [0110.007] GetSysColor (nIndex=14) returned 0xffffff [0110.007] GetSysColor (nIndex=26) returned 0xcc6600 [0110.007] GetSysColor (nIndex=11) returned 0xfcf7f4 [0110.007] GetSysColor (nIndex=3) returned 0xdbcdbf [0110.007] GetSysColor (nIndex=19) returned 0x0 [0110.007] GetSysColor (nIndex=24) returned 0xe1ffff [0110.008] GetSysColor (nIndex=23) returned 0x0 [0110.008] GetSysColor (nIndex=4) returned 0xf0f0f0 [0110.008] GetSysColor (nIndex=30) returned 0xf0f0f0 [0110.008] GetSysColor (nIndex=29) returned 0xff9933 [0110.008] GetSysColor (nIndex=7) returned 0x0 [0110.008] GetSysColor (nIndex=0) returned 0xc8c8c8 [0110.008] GetSysColor (nIndex=5) returned 0xffffff [0110.008] GetSysColor (nIndex=6) returned 0x646464 [0110.008] GetSysColor (nIndex=8) returned 0x0 [0110.010] GetSystemMetrics (nIndex=80) returned 1 [0110.046] EnumDisplayMonitors (hdc=0x0, lprcClip=0x0, lpfnEnum=0x960686, dwData=0x0) returned 1 [0110.049] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19e6fc | out: lpmi=0x19e6fc) returned 1 [0110.050] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x120109b0 [0110.051] GetDeviceCaps (hdc=0x120109b0, index=12) returned 32 [0110.051] GetDeviceCaps (hdc=0x120109b0, index=14) returned 1 [0110.051] DeleteDC (hdc=0x120109b0) returned 1 [0110.051] GetCurrentObject (hdc=0xc0100ae, type=0x1) returned 0x1b00017 [0110.051] GetCurrentObject (hdc=0xc0100ae, type=0x2) returned 0x1900010 [0110.051] GetCurrentObject (hdc=0xc0100ae, type=0x7) returned 0x53050974 [0110.052] GetCurrentObject (hdc=0xc0100ae, type=0x6) returned 0x18a0048 [0110.052] SaveDC (hdc=0xc0100ae) returned 1 [0110.052] GetNearestColor (hdc=0xc0100ae, color=0xf0f0f0) returned 0xf0f0f0 [0110.054] CreateSolidBrush (color=0xf0f0f0) returned 0x33100988 [0110.054] FillRect (hDC=0xc0100ae, lprc=0x19e93c, hbr=0x33100988) returned 1 [0110.055] DeleteObject (ho=0x33100988) returned 1 [0110.055] RestoreDC (hdc=0xc0100ae, nSavedDC=-1) returned 1 [0110.065] GetWindowPlacement (in: hWnd=0x702e2, lpwndpl=0x19ebcc | out: lpwndpl=0x19ebcc) returned 1 [0110.065] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0x47, wParam=0x0, lParam=0x19ee5c) returned 0x0 [0110.065] GetClientRect (in: hWnd=0x702e2, lpRect=0x19eb7c | out: lpRect=0x19eb7c) returned 1 [0110.065] GetWindowRect (in: hWnd=0x702e2, lpRect=0x19eb7c | out: lpRect=0x19eb7c) returned 1 [0110.067] RedrawWindow (hWnd=0x702e2, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0110.067] GetSystemMenu (hWnd=0x702e2, bRevert=0) returned 0x50217 [0110.067] GetWindowPlacement (in: hWnd=0x702e2, lpwndpl=0x19ee94 | out: lpwndpl=0x19ee94) returned 1 [0110.067] EnableMenuItem (hMenu=0x50217, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0110.067] EnableMenuItem (hMenu=0x50217, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0110.067] EnableMenuItem (hMenu=0x50217, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0110.067] EnableMenuItem (hMenu=0x50217, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0110.067] EnableMenuItem (hMenu=0x50217, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0110.143] SetLayeredWindowAttributes (hwnd=0x702e2, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0110.191] GetCurrentThreadId () returned 0x138c [0110.585] EnumThreadWindows (dwThreadId=0x138c, lpfn=0x9606ae, lParam=0x702e2) returned 1 [0110.849] GetWindowLongW (hWnd=0x502c2, nIndex=-8) returned 0 [0110.849] GetWindowLongW (hWnd=0x702e2, nIndex=-8) returned 0 [0110.849] GetWindowLongW (hWnd=0x40206, nIndex=-8) returned 459490 [0110.930] SetWindowLongW (hWnd=0x40206, nIndex=-8, dwNewLong=0) returned 459490 [0110.936] GetFocus () returned 0x0 [0110.936] GetParent (hWnd=0x702e2) returned 0x0 [0110.936] GetWindowLongW (hWnd=0x702e2, nIndex=-20) returned 852352 [0110.936] DestroyWindow (hWnd=0x702e2) returned 1 [0110.936] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0110.945] GetWindowTextLengthW (hWnd=0x702e2) returned 5 [0110.945] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0110.946] GetSystemMetrics (nIndex=42) returned 0 [0110.946] GetWindowTextW (in: hWnd=0x702e2, lpString=0x19e9e4, nMaxCount=6 | out: lpString="Form1") returned 5 [0110.946] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0xd, wParam=0x6, lParam=0x19e9e4) returned 0x5 [0110.946] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0110.947] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x702e2, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0110.953] GetCurrentActCtx (in: lphActCtx=0x19edf4 | out: lphActCtx=0x19edf4*=0x692fd4) returned 1 [0110.954] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x73360000 [0110.954] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0110.954] CreateWindowExW (dwExStyle=0x90080, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r10_ad1", lpWindowName="Form1", dwStyle=0x2cf0000, X=156, Y=156, nWidth=541, nHeight=519, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x60208 [0110.955] SetWindowLongW (hWnd=0x60208, nIndex=-4, dwNewLong=1950418912) returned 9831870 [0110.955] GetWindowLongW (hWnd=0x60208, nIndex=-4) returned 1950418912 [0110.955] SetWindowLongW (hWnd=0x60208, nIndex=-4, dwNewLong=9832150) returned 1950418912 [0110.955] GetWindowLongW (hWnd=0x60208, nIndex=-4) returned 9832150 [0110.955] GetWindowLongW (hWnd=0x60208, nIndex=-16) returned 114229248 [0110.957] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0x81, wParam=0x0, lParam=0x19e818) returned 0x1 [0110.957] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0x83, wParam=0x0, lParam=0x19e804) returned 0x0 [0110.958] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0x1, wParam=0x0, lParam=0x19e818) returned 0x0 [0110.958] GetClientRect (in: hWnd=0x60208, lpRect=0x19e514 | out: lpRect=0x19e514) returned 1 [0110.958] GetWindowRect (in: hWnd=0x60208, lpRect=0x19e514 | out: lpRect=0x19e514) returned 1 [0110.958] SetWindowTextW (hWnd=0x60208, lpString="Form1") returned 1 [0110.959] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0xc, wParam=0x0, lParam=0x22df6bc) returned 0x1 [0110.959] SetLayeredWindowAttributes (hwnd=0x60208, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0110.977] GetStartupInfoW (in: lpStartupInfo=0x22df98c | out: lpStartupInfo=0x22df98c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0110.978] GetParent (hWnd=0x60208) returned 0x0 [0110.978] GetStockObject (i=5) returned 0x1900015 [0110.979] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0110.980] CoTaskMemAlloc (cb=0x5c) returned 0x6906c0 [0110.980] RegisterClassW (lpWndClass=0x19ecd0) returned 0xc20d [0110.980] CoTaskMemFree (pv=0x6906c0) [0110.981] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0110.981] CreateWindowExW (dwExStyle=0x80, lpClassName="WindowsForms10.Window.0.app.0.141b42a_r10_ad1", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x4020a [0110.981] SetWindowLongW (hWnd=0x4020a, nIndex=-4, dwNewLong=1950418912) returned 9832190 [0110.981] GetWindowLongW (hWnd=0x4020a, nIndex=-4) returned 1950418912 [0110.982] SetWindowLongW (hWnd=0x4020a, nIndex=-4, dwNewLong=9832230) returned 1950418912 [0110.982] GetWindowLongW (hWnd=0x4020a, nIndex=-4) returned 9832230 [0110.982] GetWindowLongW (hWnd=0x4020a, nIndex=-16) returned 79691776 [0110.983] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x4020a, Msg=0x24, wParam=0x0, lParam=0x19e84c) returned 0x0 [0110.983] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x4020a, Msg=0x81, wParam=0x0, lParam=0x19e840) returned 0x1 [0110.984] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x4020a, Msg=0x83, wParam=0x0, lParam=0x19e82c) returned 0x0 [0110.985] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x4020a, Msg=0x1, wParam=0x0, lParam=0x19e840) returned 0x0 [0110.985] SetWindowLongW (hWnd=0x60208, nIndex=-8, dwNewLong=262666) returned 0 [0110.987] SendMessageW (hWnd=0x60208, Msg=0x80, wParam=0x0, lParam=0x7020d) returned 0x0 [0110.987] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0x80, wParam=0x0, lParam=0x7020d) returned 0x0 [0110.987] SendMessageW (hWnd=0x60208, Msg=0x80, wParam=0x1, lParam=0x1e0067) returned 0x0 [0110.987] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0x80, wParam=0x1, lParam=0x1e0067) returned 0x0 [0111.177] GetSystemMenu (hWnd=0x60208, bRevert=0) returned 0x60217 [0111.178] GetWindowPlacement (in: hWnd=0x60208, lpwndpl=0x19ee04 | out: lpwndpl=0x19ee04) returned 1 [0111.178] EnableMenuItem (hMenu=0x60217, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0111.178] EnableMenuItem (hMenu=0x60217, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0111.178] EnableMenuItem (hMenu=0x60217, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0111.178] EnableMenuItem (hMenu=0x60217, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0111.178] EnableMenuItem (hMenu=0x60217, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0111.178] GetClientRect (in: hWnd=0x60208, lpRect=0x19ee48 | out: lpRect=0x19ee48) returned 1 [0111.178] GetClientRect (in: hWnd=0x60208, lpRect=0x19eda8 | out: lpRect=0x19eda8) returned 1 [0111.178] GetWindowRect (in: hWnd=0x60208, lpRect=0x19eda8 | out: lpRect=0x19eda8) returned 1 [0111.178] SetWindowPos (hWnd=0x60208, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1 [0111.178] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0x46, wParam=0x0, lParam=0x19ed14) returned 0x0 [0111.197] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0111.221] GetWindowPlacement (in: hWnd=0x60208, lpwndpl=0x19eaa0 | out: lpwndpl=0x19eaa0) returned 1 [0111.221] GetClientRect (in: hWnd=0x60208, lpRect=0x19ea4c | out: lpRect=0x19ea4c) returned 1 [0111.221] GetWindowTextLengthW (hWnd=0x60208) returned 5 [0111.221] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0111.221] GetSystemMetrics (nIndex=42) returned 0 [0111.221] GetWindowTextW (in: hWnd=0x60208, lpString=0x19e918, nMaxCount=6 | out: lpString="Form1") returned 5 [0111.221] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0xd, wParam=0x6, lParam=0x19e918) returned 0x5 [0111.222] GetClientRect (in: hWnd=0x60208, lpRect=0x19e954 | out: lpRect=0x19e954) returned 1 [0111.222] GetCurrentObject (hdc=0x220106d6, type=0x1) returned 0x1b00017 [0111.222] GetCurrentObject (hdc=0x220106d6, type=0x2) returned 0x1900010 [0111.222] GetCurrentObject (hdc=0x220106d6, type=0x7) returned 0x1d050693 [0111.222] GetCurrentObject (hdc=0x220106d6, type=0x6) returned 0x18a0048 [0111.222] SaveDC (hdc=0x220106d6) returned 1 [0111.222] GetNearestColor (hdc=0x220106d6, color=0xf0f0f0) returned 0xf0f0f0 [0111.222] CreateSolidBrush (color=0xf0f0f0) returned 0x34100988 [0111.222] FillRect (hDC=0x220106d6, lprc=0x19e7f4, hbr=0x34100988) returned 1 [0111.223] DeleteObject (ho=0x34100988) returned 1 [0111.223] RestoreDC (hdc=0x220106d6, nSavedDC=-1) returned 1 [0111.223] GetWindowPlacement (in: hWnd=0x60208, lpwndpl=0x19ea84 | out: lpwndpl=0x19ea84) returned 1 [0111.223] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0x47, wParam=0x0, lParam=0x19ed14) returned 0x0 [0111.223] GetClientRect (in: hWnd=0x60208, lpRect=0x19ea34 | out: lpRect=0x19ea34) returned 1 [0111.223] GetWindowRect (in: hWnd=0x60208, lpRect=0x19ea34 | out: lpRect=0x19ea34) returned 1 [0111.225] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0x83, wParam=0x1, lParam=0x19e864) returned 0x0 [0111.242] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0111.250] GetWindowPlacement (in: hWnd=0x60208, lpwndpl=0x19e618 | out: lpwndpl=0x19e618) returned 1 [0111.250] GetClientRect (in: hWnd=0x60208, lpRect=0x19e5c4 | out: lpRect=0x19e5c4) returned 1 [0111.250] GetWindowTextLengthW (hWnd=0x60208) returned 5 [0111.250] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0111.250] GetSystemMetrics (nIndex=42) returned 0 [0111.250] GetWindowTextW (in: hWnd=0x60208, lpString=0x19e490, nMaxCount=6 | out: lpString="Form1") returned 5 [0111.250] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0xd, wParam=0x6, lParam=0x19e490) returned 0x5 [0111.250] GetClientRect (in: hWnd=0x60208, lpRect=0x19e4cc | out: lpRect=0x19e4cc) returned 1 [0111.250] GetCurrentObject (hdc=0x1b0107ae, type=0x1) returned 0x1b00017 [0111.250] GetCurrentObject (hdc=0x1b0107ae, type=0x2) returned 0x1900010 [0111.250] GetCurrentObject (hdc=0x1b0107ae, type=0x7) returned 0x1d050693 [0111.251] GetCurrentObject (hdc=0x1b0107ae, type=0x6) returned 0x18a0048 [0111.251] SaveDC (hdc=0x1b0107ae) returned 1 [0111.251] GetNearestColor (hdc=0x1b0107ae, color=0xf0f0f0) returned 0xf0f0f0 [0111.251] CreateSolidBrush (color=0xf0f0f0) returned 0x35100988 [0111.251] FillRect (hDC=0x1b0107ae, lprc=0x19e36c, hbr=0x35100988) returned 1 [0111.252] DeleteObject (ho=0x35100988) returned 1 [0111.252] RestoreDC (hdc=0x1b0107ae, nSavedDC=-1) returned 1 [0111.253] SetWindowLongW (hWnd=0x60208, nIndex=-8, dwNewLong=262666) returned 262666 [0111.254] SendMessageW (hWnd=0x4020a, Msg=0x80, wParam=0x1, lParam=0x1e0067) returned 0x0 [0111.254] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x4020a, Msg=0x80, wParam=0x1, lParam=0x1e0067) returned 0x0 [0111.256] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x73360000 [0111.257] GetWindowLongW (hWnd=0x60208, nIndex=-16) returned 382664704 [0111.257] GetWindowTextLengthW (hWnd=0x60208) returned 5 [0111.257] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0111.257] GetSystemMetrics (nIndex=42) returned 0 [0111.257] GetWindowTextW (in: hWnd=0x60208, lpString=0x19ed2c, nMaxCount=6 | out: lpString="Form1") returned 5 [0111.257] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0xd, wParam=0x6, lParam=0x19ed2c) returned 0x5 [0111.257] GetWindowTextLengthW (hWnd=0x60208) returned 5 [0111.257] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0111.257] GetSystemMetrics (nIndex=42) returned 0 [0111.257] GetWindowTextW (in: hWnd=0x60208, lpString=0x19ed2c, nMaxCount=6 | out: lpString="Form1") returned 5 [0111.257] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0xd, wParam=0x6, lParam=0x19ed2c) returned 0x5 [0111.257] GetWindowLongW (hWnd=0x60208, nIndex=-16) returned 382664704 [0111.257] GetWindowLongW (hWnd=0x60208, nIndex=-20) returned 590208 [0111.257] SetWindowLongW (hWnd=0x60208, nIndex=-16, dwNewLong=315555840) returned 382664704 [0111.257] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0x7c, wParam=0xfffffff0, lParam=0x19ed9c) returned 0x0 [0111.258] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0x7d, wParam=0xfffffff0, lParam=0x19ed9c) returned 0x0 [0111.259] SetWindowLongW (hWnd=0x60208, nIndex=-20, dwNewLong=589952) returned 590208 [0111.259] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0x7c, wParam=0xffffffec, lParam=0x19ed9c) returned 0x0 [0111.261] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0x7d, wParam=0xffffffec, lParam=0x19ed9c) returned 0x0 [0111.262] SetWindowPos (hWnd=0x60208, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0111.263] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0x46, wParam=0x0, lParam=0x19edbc) returned 0x0 [0111.263] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0x83, wParam=0x1, lParam=0x19ed94) returned 0x0 [0111.278] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0111.285] GetWindowPlacement (in: hWnd=0x60208, lpwndpl=0x19eb48 | out: lpwndpl=0x19eb48) returned 1 [0111.285] GetClientRect (in: hWnd=0x60208, lpRect=0x19eaf4 | out: lpRect=0x19eaf4) returned 1 [0111.285] GetWindowTextLengthW (hWnd=0x60208) returned 5 [0111.285] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0111.285] GetSystemMetrics (nIndex=42) returned 0 [0111.285] GetWindowTextW (in: hWnd=0x60208, lpString=0x19e9c0, nMaxCount=6 | out: lpString="Form1") returned 5 [0111.285] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0xd, wParam=0x6, lParam=0x19e9c0) returned 0x5 [0111.285] GetClientRect (in: hWnd=0x60208, lpRect=0x19e9fc | out: lpRect=0x19e9fc) returned 1 [0111.286] GetCurrentObject (hdc=0x220106d6, type=0x1) returned 0x1b00017 [0111.286] GetCurrentObject (hdc=0x220106d6, type=0x2) returned 0x1900010 [0111.286] GetCurrentObject (hdc=0x220106d6, type=0x7) returned 0x1d050693 [0111.286] GetCurrentObject (hdc=0x220106d6, type=0x6) returned 0x18a0048 [0111.286] SaveDC (hdc=0x220106d6) returned 1 [0111.286] GetNearestColor (hdc=0x220106d6, color=0xf0f0f0) returned 0xf0f0f0 [0111.286] CreateSolidBrush (color=0xf0f0f0) returned 0x36100988 [0111.286] FillRect (hDC=0x220106d6, lprc=0x19e89c, hbr=0x36100988) returned 1 [0111.286] DeleteObject (ho=0x36100988) returned 1 [0111.286] RestoreDC (hdc=0x220106d6, nSavedDC=-1) returned 1 [0111.287] GetWindowPlacement (in: hWnd=0x60208, lpwndpl=0x19eb2c | out: lpwndpl=0x19eb2c) returned 1 [0111.287] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0x47, wParam=0x0, lParam=0x19edbc) returned 0x0 [0111.287] GetClientRect (in: hWnd=0x60208, lpRect=0x19eadc | out: lpRect=0x19eadc) returned 1 [0111.287] GetWindowRect (in: hWnd=0x60208, lpRect=0x19eadc | out: lpRect=0x19eadc) returned 1 [0111.288] RedrawWindow (hWnd=0x60208, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0111.288] GetSystemMenu (hWnd=0x60208, bRevert=0) returned 0x60217 [0111.288] GetWindowPlacement (in: hWnd=0x60208, lpwndpl=0x19edf4 | out: lpwndpl=0x19edf4) returned 1 [0111.288] EnableMenuItem (hMenu=0x60217, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0111.288] EnableMenuItem (hMenu=0x60217, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0111.288] EnableMenuItem (hMenu=0x60217, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0111.288] EnableMenuItem (hMenu=0x60217, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0111.288] EnableMenuItem (hMenu=0x60217, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0111.289] SetWindowLongW (hWnd=0x40206, nIndex=-8, dwNewLong=393736) returned 328386 [0111.523] GetFullPathNameW (in: lpFileName="C:\\RDhJ0CNFevzX\\Rand123", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x18 [0111.523] GetFullPathNameW (in: lpFileName="C:\\RDhJ0CNFevzX\\Rand123", nBufferLength=0x18, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\RDhJ0CNFevzX\\Rand123", lpFilePart=0x0) returned 0x17 [0111.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee28) returned 1 [0111.524] GetFileAttributesExW (in: lpFileName="C:\\RDhJ0CNFevzX\\Rand123" (normalized: "c:\\rdhj0cnfevzx\\rand123"), fInfoLevelId=0x0, lpFileInformation=0x19eea4 | out: lpFileInformation=0x19eea4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0111.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee24) returned 1 [0111.525] GetFullPathNameW (in: lpFileName="C:\\RDhJ0CNFevzX\\Rand123", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x18 [0111.525] GetFullPathNameW (in: lpFileName="C:\\RDhJ0CNFevzX\\Rand123", nBufferLength=0x18, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\RDhJ0CNFevzX\\Rand123", lpFilePart=0x0) returned 0x17 [0111.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edbc) returned 1 [0111.531] GetFileAttributesExW (in: lpFileName="C:\\RDhJ0CNFevzX\\Rand123" (normalized: "c:\\rdhj0cnfevzx\\rand123"), fInfoLevelId=0x0, lpFileInformation=0x19ee38 | out: lpFileInformation=0x19ee38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0111.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb8) returned 1 [0111.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edbc) returned 1 [0111.532] GetFileAttributesExW (in: lpFileName="C:\\RDhJ0CNFevzX\\Rand123" (normalized: "c:\\rdhj0cnfevzx\\rand123"), fInfoLevelId=0x0, lpFileInformation=0x19ee38 | out: lpFileInformation=0x19ee38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0111.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb8) returned 1 [0111.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edbc) returned 1 [0111.532] GetFileAttributesExW (in: lpFileName="C:\\RDhJ0CNFevzX" (normalized: "c:\\rdhj0cnfevzx"), fInfoLevelId=0x0, lpFileInformation=0x19ee38 | out: lpFileInformation=0x19ee38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0111.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb8) returned 1 [0111.611] CreateDirectoryW (lpPathName="C:\\RDhJ0CNFevzX" (normalized: "c:\\rdhj0cnfevzx"), lpSecurityAttributes=0x0) returned 1 [0111.612] CreateDirectoryW (lpPathName="C:\\RDhJ0CNFevzX\\Rand123" (normalized: "c:\\rdhj0cnfevzx\\rand123"), lpSecurityAttributes=0x0) returned 1 [0111.627] GetCurrentProcessId () returned 0x1388 [0111.669] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x19e7b4 | out: lpLuid=0x19e7b4*(LowPart=0x14, HighPart=0)) returned 1 [0111.670] GetCurrentProcess () returned 0xffffffff [0111.671] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x19e7b0 | out: TokenHandle=0x19e7b0*=0x2e0) returned 1 [0111.678] AdjustTokenPrivileges (in: TokenHandle=0x2e0, DisableAllPrivileges=0, NewState=0x22e08a4*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0111.680] CloseHandle (hObject=0x2e0) returned 1 [0111.691] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x32d94d0, Length=0x20000, ResultLength=0x19ee98 | out: SystemInformation=0x32d94d0, ResultLength=0x19ee98*=0x15058) returned 0x0 [0111.744] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x684c40 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d [0111.745] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x63 [0111.745] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe", nBufferLength=0x63, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe", lpFilePart=0x0) returned 0x62 [0111.745] GetFullPathNameW (in: lpFileName="C:\\RDhJ0CNFevzX\\Rand123\\local.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x22 [0111.746] GetFullPathNameW (in: lpFileName="C:\\RDhJ0CNFevzX\\Rand123\\local.exe", nBufferLength=0x22, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\RDhJ0CNFevzX\\Rand123\\local.exe", lpFilePart=0x0) returned 0x21 [0111.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee40) returned 1 [0111.746] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe"), fInfoLevelId=0x0, lpFileInformation=0x19eebc | out: lpFileInformation=0x19eebc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73cdc900, ftCreationTime.dwHighDateTime=0x1d8cd7a, ftLastAccessTime.dwLowDateTime=0x74665f80, ftLastAccessTime.dwHighDateTime=0x1d8cd7a, ftLastWriteTime.dwLowDateTime=0x1c226400, ftLastWriteTime.dwHighDateTime=0x1d8cd60, nFileSizeHigh=0x0, nFileSizeLow=0x3be0)) returned 1 [0111.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee3c) returned 1 [0111.747] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe"), lpNewFileName="C:\\RDhJ0CNFevzX\\Rand123\\local.exe" (normalized: "c:\\rdhj0cnfevzx\\rand123\\local.exe")) returned 1 [0112.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edec) returned 1 [0112.536] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1e [0112.536] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x1e, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x0) returned 0x1d [0112.538] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\*"), lpFindFileData=0x19eb14 | out: lpFindFileData=0x19eb14*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xbac7a065, ftLastAccessTime.dwHighDateTime=0x1d8cd7a, ftLastWriteTime.dwLowDateTime=0xbac7a065, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6886d0 [0112.539] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xbac7a065, ftLastAccessTime.dwHighDateTime=0x1d8cd7a, ftLastWriteTime.dwLowDateTime=0xbac7a065, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.540] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50db7670, ftCreationTime.dwHighDateTime=0x1d8bd46, ftLastAccessTime.dwLowDateTime=0x251bda50, ftLastAccessTime.dwHighDateTime=0x1d8beb5, ftLastWriteTime.dwLowDateTime=0x251bda50, ftLastWriteTime.dwHighDateTime=0x1d8beb5, nFileSizeHigh=0x0, nFileSizeLow=0x16e05, dwReserved0=0x0, dwReserved1=0x0, cFileName="-Fh w0BxDTngt3.gif", cAlternateFileName="-FHW0B~1.GIF")) returned 1 [0112.540] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed9beb40, ftCreationTime.dwHighDateTime=0x1d8bdad, ftLastAccessTime.dwLowDateTime=0x157bd2c0, ftLastAccessTime.dwHighDateTime=0x1d8bf8d, ftLastWriteTime.dwLowDateTime=0x157bd2c0, ftLastWriteTime.dwHighDateTime=0x1d8bf8d, nFileSizeHigh=0x0, nFileSizeLow=0x1879d, dwReserved0=0x0, dwReserved1=0x0, cFileName="3ALR.avi", cAlternateFileName="")) returned 1 [0112.541] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47196310, ftCreationTime.dwHighDateTime=0x1d8bdc6, ftLastAccessTime.dwLowDateTime=0x9052ec80, ftLastAccessTime.dwHighDateTime=0x1d8c006, ftLastWriteTime.dwLowDateTime=0x9052ec80, ftLastWriteTime.dwHighDateTime=0x1d8c006, nFileSizeHigh=0x0, nFileSizeLow=0x16065, dwReserved0=0x0, dwReserved1=0x0, cFileName="3V26078_t3PycYa-.m4a", cAlternateFileName="3V2607~1.M4A")) returned 1 [0112.541] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x414fc4f0, ftCreationTime.dwHighDateTime=0x1d8bbd3, ftLastAccessTime.dwLowDateTime=0xbb970c20, ftLastAccessTime.dwHighDateTime=0x1d8bbdb, ftLastWriteTime.dwLowDateTime=0xbb970c20, ftLastWriteTime.dwHighDateTime=0x1d8bbdb, nFileSizeHigh=0x0, nFileSizeLow=0x121da, dwReserved0=0x0, dwReserved1=0x0, cFileName="6gsF_oOWDuB.ppt", cAlternateFileName="6GSF_O~1.PPT")) returned 1 [0112.541] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e5a50a0, ftCreationTime.dwHighDateTime=0x1d8b61d, ftLastAccessTime.dwLowDateTime=0x7376d990, ftLastAccessTime.dwHighDateTime=0x1d8c0fc, ftLastWriteTime.dwLowDateTime=0x7376d990, ftLastWriteTime.dwHighDateTime=0x1d8c0fc, nFileSizeHigh=0x0, nFileSizeLow=0x6880, dwReserved0=0x0, dwReserved1=0x0, cFileName="7aoXqL.swf", cAlternateFileName="")) returned 1 [0112.541] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x385fac20, ftCreationTime.dwHighDateTime=0x1d8b2d2, ftLastAccessTime.dwLowDateTime=0x986b4d30, ftLastAccessTime.dwHighDateTime=0x1d8b6e3, ftLastWriteTime.dwLowDateTime=0x986b4d30, ftLastWriteTime.dwHighDateTime=0x1d8b6e3, nFileSizeHigh=0x0, nFileSizeLow=0x16e46, dwReserved0=0x0, dwReserved1=0x0, cFileName="7ibZqS-WGiyBMZF.wav", cAlternateFileName="7IBZQS~1.WAV")) returned 1 [0112.541] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb016c0, ftCreationTime.dwHighDateTime=0x1d8bdfc, ftLastAccessTime.dwLowDateTime=0x5735fbe0, ftLastAccessTime.dwHighDateTime=0x1d8c097, ftLastWriteTime.dwLowDateTime=0x5735fbe0, ftLastWriteTime.dwHighDateTime=0x1d8c097, nFileSizeHigh=0x0, nFileSizeLow=0x146bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="8y9XFR.swf", cAlternateFileName="")) returned 1 [0112.541] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7143a430, ftCreationTime.dwHighDateTime=0x1d8bd3e, ftLastAccessTime.dwLowDateTime=0x705c7d60, ftLastAccessTime.dwHighDateTime=0x1d8c100, ftLastWriteTime.dwLowDateTime=0x705c7d60, ftLastWriteTime.dwHighDateTime=0x1d8c100, nFileSizeHigh=0x0, nFileSizeLow=0xe2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="avNCvKIbZERjJ6.odt", cAlternateFileName="AVNCVK~1.ODT")) returned 1 [0112.541] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4f9d7d0, ftCreationTime.dwHighDateTime=0x1d8b81b, ftLastAccessTime.dwLowDateTime=0xf54866c0, ftLastAccessTime.dwHighDateTime=0x1d8b998, ftLastWriteTime.dwLowDateTime=0xf54866c0, ftLastWriteTime.dwHighDateTime=0x1d8b998, nFileSizeHigh=0x0, nFileSizeLow=0xf4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bypP-pP55W0EP.flv", cAlternateFileName="BYPP-P~1.FLV")) returned 1 [0112.542] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0112.542] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb5ea9c0, ftCreationTime.dwHighDateTime=0x1d8b4a4, ftLastAccessTime.dwLowDateTime=0x32c1d270, ftLastAccessTime.dwHighDateTime=0x1d8b741, ftLastWriteTime.dwLowDateTime=0x32c1d270, ftLastWriteTime.dwHighDateTime=0x1d8b741, nFileSizeHigh=0x0, nFileSizeLow=0x4f56, dwReserved0=0x0, dwReserved1=0x0, cFileName="DN3YGl_MaifjgT.swf", cAlternateFileName="DN3YGL~1.SWF")) returned 1 [0112.542] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x604dc3a0, ftCreationTime.dwHighDateTime=0x1d8b752, ftLastAccessTime.dwLowDateTime=0xe75098d0, ftLastAccessTime.dwHighDateTime=0x1d8be11, ftLastWriteTime.dwLowDateTime=0xe75098d0, ftLastWriteTime.dwHighDateTime=0x1d8be11, nFileSizeHigh=0x0, nFileSizeLow=0x163fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="E4VYDeroN3BRcqUdFN5C.swf", cAlternateFileName="E4VYDE~1.SWF")) returned 1 [0112.543] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dd0ef0, ftCreationTime.dwHighDateTime=0x1d8b209, ftLastAccessTime.dwLowDateTime=0x5bfd82a0, ftLastAccessTime.dwHighDateTime=0x1d8bd00, ftLastWriteTime.dwLowDateTime=0x5bfd82a0, ftLastWriteTime.dwHighDateTime=0x1d8bd00, nFileSizeHigh=0x0, nFileSizeLow=0xcb57, dwReserved0=0x0, dwReserved1=0x0, cFileName="fZRMjwEXE.gif", cAlternateFileName="FZRMJW~1.GIF")) returned 1 [0112.543] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3e37cd0, ftCreationTime.dwHighDateTime=0x1d8b39c, ftLastAccessTime.dwLowDateTime=0xfc314330, ftLastAccessTime.dwHighDateTime=0x1d8be8e, ftLastWriteTime.dwLowDateTime=0xfc314330, ftLastWriteTime.dwHighDateTime=0x1d8be8e, nFileSizeHigh=0x0, nFileSizeLow=0x123d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="G620aC.jpg", cAlternateFileName="")) returned 1 [0112.543] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc595c380, ftCreationTime.dwHighDateTime=0x1d8bfb2, ftLastAccessTime.dwLowDateTime=0x2cc74ca0, ftLastAccessTime.dwHighDateTime=0x1d8c0fc, ftLastWriteTime.dwLowDateTime=0x2cc74ca0, ftLastWriteTime.dwHighDateTime=0x1d8c0fc, nFileSizeHigh=0x0, nFileSizeLow=0x17ee1, dwReserved0=0x0, dwReserved1=0x0, cFileName="g_RTTfqyXS6.jpg", cAlternateFileName="G_RTTF~1.JPG")) returned 1 [0112.543] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c90710, ftCreationTime.dwHighDateTime=0x1d8bd9a, ftLastAccessTime.dwLowDateTime=0xb4ce3ab0, ftLastAccessTime.dwHighDateTime=0x1d8bfc0, ftLastWriteTime.dwLowDateTime=0xb4ce3ab0, ftLastWriteTime.dwHighDateTime=0x1d8bfc0, nFileSizeHigh=0x0, nFileSizeLow=0x46e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="hBUYL.flv", cAlternateFileName="")) returned 1 [0112.543] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fc32e10, ftCreationTime.dwHighDateTime=0x1d8be91, ftLastAccessTime.dwLowDateTime=0x91d06a50, ftLastAccessTime.dwHighDateTime=0x1d8c03e, ftLastWriteTime.dwLowDateTime=0x91d06a50, ftLastWriteTime.dwHighDateTime=0x1d8c03e, nFileSizeHigh=0x0, nFileSizeLow=0x8b95, dwReserved0=0x0, dwReserved1=0x0, cFileName="jmlwn5Tr.mp3", cAlternateFileName="")) returned 1 [0112.544] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eee2140, ftCreationTime.dwHighDateTime=0x1d8b759, ftLastAccessTime.dwLowDateTime=0xa0800a40, ftLastAccessTime.dwHighDateTime=0x1d8c01d, ftLastWriteTime.dwLowDateTime=0xa0800a40, ftLastWriteTime.dwHighDateTime=0x1d8c01d, nFileSizeHigh=0x0, nFileSizeLow=0x185bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ll2MxwxRHWpc2D.jpg", cAlternateFileName="LL2MXW~1.JPG")) returned 1 [0112.544] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7cee820, ftCreationTime.dwHighDateTime=0x1d8b4aa, ftLastAccessTime.dwLowDateTime=0xa2e45040, ftLastAccessTime.dwHighDateTime=0x1d8c0f2, ftLastWriteTime.dwLowDateTime=0xa2e45040, ftLastWriteTime.dwHighDateTime=0x1d8c0f2, nFileSizeHigh=0x0, nFileSizeLow=0xe6b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="LS8Cz.ods", cAlternateFileName="")) returned 1 [0112.544] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7e125b0, ftCreationTime.dwHighDateTime=0x1d8bc4d, ftLastAccessTime.dwLowDateTime=0xec5e50f0, ftLastAccessTime.dwHighDateTime=0x1d8bf07, ftLastWriteTime.dwLowDateTime=0xec5e50f0, ftLastWriteTime.dwHighDateTime=0x1d8bf07, nFileSizeHigh=0x0, nFileSizeLow=0x41c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lsistx.ods", cAlternateFileName="")) returned 1 [0112.544] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa53ec0, ftCreationTime.dwHighDateTime=0x1d8b8df, ftLastAccessTime.dwLowDateTime=0x4da33d50, ftLastAccessTime.dwHighDateTime=0x1d8c050, ftLastWriteTime.dwLowDateTime=0x4da33d50, ftLastWriteTime.dwHighDateTime=0x1d8c050, nFileSizeHigh=0x0, nFileSizeLow=0x1878e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MF5o-hDHAf3Lkh.gif", cAlternateFileName="MF5O-H~1.GIF")) returned 1 [0112.544] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dd7c7b0, ftCreationTime.dwHighDateTime=0x1d8ba6b, ftLastAccessTime.dwLowDateTime=0xf2f2ca00, ftLastAccessTime.dwHighDateTime=0x1d8bf56, ftLastWriteTime.dwLowDateTime=0xf2f2ca00, ftLastWriteTime.dwHighDateTime=0x1d8bf56, nFileSizeHigh=0x0, nFileSizeLow=0x7a07, dwReserved0=0x0, dwReserved1=0x0, cFileName="mO8vZJ2N.png", cAlternateFileName="")) returned 1 [0112.544] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a1a3f40, ftCreationTime.dwHighDateTime=0x1d8bbd1, ftLastAccessTime.dwLowDateTime=0x699555d0, ftLastAccessTime.dwHighDateTime=0x1d8bde3, ftLastWriteTime.dwLowDateTime=0x699555d0, ftLastWriteTime.dwHighDateTime=0x1d8bde3, nFileSizeHigh=0x0, nFileSizeLow=0x111c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="oFnSAYDpRZb46.mkv", cAlternateFileName="OFNSAY~1.MKV")) returned 1 [0112.545] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a551b0, ftCreationTime.dwHighDateTime=0x1d8bab5, ftLastAccessTime.dwLowDateTime=0x3f44f490, ftLastAccessTime.dwHighDateTime=0x1d8bf67, ftLastWriteTime.dwLowDateTime=0x3f44f490, ftLastWriteTime.dwHighDateTime=0x1d8bf67, nFileSizeHigh=0x0, nFileSizeLow=0x6767, dwReserved0=0x0, dwReserved1=0x0, cFileName="p-cVbO84.doc", cAlternateFileName="")) returned 1 [0112.545] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3dc7d10, ftCreationTime.dwHighDateTime=0x1d8be87, ftLastAccessTime.dwLowDateTime=0xe04d23b0, ftLastAccessTime.dwHighDateTime=0x1d8c117, ftLastWriteTime.dwLowDateTime=0xe04d23b0, ftLastWriteTime.dwHighDateTime=0x1d8c117, nFileSizeHigh=0x0, nFileSizeLow=0x133ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUJ3QKPvdT.m4a", cAlternateFileName="QUJ3QK~1.M4A")) returned 1 [0112.545] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4add3a80, ftCreationTime.dwHighDateTime=0x1d8bba5, ftLastAccessTime.dwLowDateTime=0x1e605de0, ftLastAccessTime.dwHighDateTime=0x1d8bd8d, ftLastWriteTime.dwLowDateTime=0x1e605de0, ftLastWriteTime.dwHighDateTime=0x1d8bd8d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="r2PRf1U9FnysJo7qVmv", cAlternateFileName="R2PRF1~1")) returned 1 [0112.545] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16785480, ftCreationTime.dwHighDateTime=0x1d8c0e8, ftLastAccessTime.dwLowDateTime=0x52e88960, ftLastAccessTime.dwHighDateTime=0x1d8c108, ftLastWriteTime.dwLowDateTime=0x52e88960, ftLastWriteTime.dwHighDateTime=0x1d8c108, nFileSizeHigh=0x0, nFileSizeLow=0xb29f, dwReserved0=0x0, dwReserved1=0x0, cFileName="rR-MqVkTA.ots", cAlternateFileName="RR-MQV~1.OTS")) returned 1 [0112.545] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a7d44b0, ftCreationTime.dwHighDateTime=0x1d8b88d, ftLastAccessTime.dwLowDateTime=0x1cf4ce0, ftLastAccessTime.dwHighDateTime=0x1d8ba81, ftLastWriteTime.dwLowDateTime=0x1cf4ce0, ftLastWriteTime.dwHighDateTime=0x1d8ba81, nFileSizeHigh=0x0, nFileSizeLow=0x11026, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCyUkv.pps", cAlternateFileName="")) returned 1 [0112.545] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x617393a0, ftCreationTime.dwHighDateTime=0x1d8b7ce, ftLastAccessTime.dwLowDateTime=0xafa57760, ftLastAccessTime.dwHighDateTime=0x1d8c0b5, ftLastWriteTime.dwLowDateTime=0xafa57760, ftLastWriteTime.dwHighDateTime=0x1d8c0b5, nFileSizeHigh=0x0, nFileSizeLow=0xddfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="tDKzRMjG6IpSS.gif", cAlternateFileName="TDKZRM~1.GIF")) returned 1 [0112.546] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d077da0, ftCreationTime.dwHighDateTime=0x1d8b464, ftLastAccessTime.dwLowDateTime=0x2295a640, ftLastAccessTime.dwHighDateTime=0x1d8b702, ftLastWriteTime.dwLowDateTime=0x2295a640, ftLastWriteTime.dwHighDateTime=0x1d8b702, nFileSizeHigh=0x0, nFileSizeLow=0x16b47, dwReserved0=0x0, dwReserved1=0x0, cFileName="VHrKBoE.mkv", cAlternateFileName="")) returned 1 [0112.546] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7b96490, ftCreationTime.dwHighDateTime=0x1d8b40b, ftLastAccessTime.dwLowDateTime=0x53d381e0, ftLastAccessTime.dwHighDateTime=0x1d8c095, ftLastWriteTime.dwLowDateTime=0x53d381e0, ftLastWriteTime.dwHighDateTime=0x1d8c095, nFileSizeHigh=0x0, nFileSizeLow=0x36d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPoKyX82Om8q4Ed.avi", cAlternateFileName="WPOKYX~1.AVI")) returned 1 [0112.546] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0c04460, ftCreationTime.dwHighDateTime=0x1d8bbac, ftLastAccessTime.dwLowDateTime=0xe22a1d70, ftLastAccessTime.dwHighDateTime=0x1d8bcab, ftLastWriteTime.dwLowDateTime=0xe22a1d70, ftLastWriteTime.dwHighDateTime=0x1d8bcab, nFileSizeHigh=0x0, nFileSizeLow=0xe622, dwReserved0=0x0, dwReserved1=0x0, cFileName="x5SAnVmwCY.bmp", cAlternateFileName="X5SANV~1.BMP")) returned 1 [0112.546] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd96da110, ftCreationTime.dwHighDateTime=0x1d8b937, ftLastAccessTime.dwLowDateTime=0x16b959b0, ftLastAccessTime.dwHighDateTime=0x1d8b9d8, ftLastWriteTime.dwLowDateTime=0x16b959b0, ftLastWriteTime.dwHighDateTime=0x1d8b9d8, nFileSizeHigh=0x0, nFileSizeLow=0x3a34, dwReserved0=0x0, dwReserved1=0x0, cFileName="XsV9.gif", cAlternateFileName="")) returned 1 [0112.546] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32be5e0, ftCreationTime.dwHighDateTime=0x1d8b8f0, ftLastAccessTime.dwLowDateTime=0x80082520, ftLastAccessTime.dwHighDateTime=0x1d8ba7f, ftLastWriteTime.dwLowDateTime=0x80082520, ftLastWriteTime.dwHighDateTime=0x1d8ba7f, nFileSizeHigh=0x0, nFileSizeLow=0x12845, dwReserved0=0x0, dwReserved1=0x0, cFileName="x_OLlWcMaQI.gif", cAlternateFileName="X_OLLW~1.GIF")) returned 1 [0112.547] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c5aec0, ftCreationTime.dwHighDateTime=0x1d8c090, ftLastAccessTime.dwLowDateTime=0x417610, ftLastAccessTime.dwHighDateTime=0x1d8c0c5, ftLastWriteTime.dwLowDateTime=0x417610, ftLastWriteTime.dwHighDateTime=0x1d8c0c5, nFileSizeHigh=0x0, nFileSizeLow=0xc3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="y-ufahLBUL h.avi", cAlternateFileName="Y-UFAH~1.AVI")) returned 1 [0112.547] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29fd1960, ftCreationTime.dwHighDateTime=0x1d8b2b4, ftLastAccessTime.dwLowDateTime=0xdf85ec0, ftLastAccessTime.dwHighDateTime=0x1d8bdde, ftLastWriteTime.dwLowDateTime=0xdf85ec0, ftLastWriteTime.dwHighDateTime=0x1d8bdde, nFileSizeHigh=0x0, nFileSizeLow=0x10b47, dwReserved0=0x0, dwReserved1=0x0, cFileName="zSxZ4J_7Ak.ppt", cAlternateFileName="ZSXZ4J~1.PPT")) returned 1 [0112.547] FindNextFileW (in: hFindFile=0x6886d0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.547] FindClose (in: hFindFile=0x6886d0 | out: hFindFile=0x6886d0) returned 1 [0112.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda8) returned 1 [0112.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb4) returned 1 [0112.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edec) returned 1 [0112.548] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1e [0112.548] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x1e, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x0) returned 0x1d [0112.548] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\*"), lpFindFileData=0x19eb14 | out: lpFindFileData=0x19eb14*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xbac7a065, ftLastAccessTime.dwHighDateTime=0x1d8cd7a, ftLastWriteTime.dwLowDateTime=0xbac7a065, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688a50 [0112.548] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xbac7a065, ftLastAccessTime.dwHighDateTime=0x1d8cd7a, ftLastWriteTime.dwLowDateTime=0xbac7a065, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.548] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50db7670, ftCreationTime.dwHighDateTime=0x1d8bd46, ftLastAccessTime.dwLowDateTime=0x251bda50, ftLastAccessTime.dwHighDateTime=0x1d8beb5, ftLastWriteTime.dwLowDateTime=0x251bda50, ftLastWriteTime.dwHighDateTime=0x1d8beb5, nFileSizeHigh=0x0, nFileSizeLow=0x16e05, dwReserved0=0x0, dwReserved1=0x0, cFileName="-Fh w0BxDTngt3.gif", cAlternateFileName="-FHW0B~1.GIF")) returned 1 [0112.549] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed9beb40, ftCreationTime.dwHighDateTime=0x1d8bdad, ftLastAccessTime.dwLowDateTime=0x157bd2c0, ftLastAccessTime.dwHighDateTime=0x1d8bf8d, ftLastWriteTime.dwLowDateTime=0x157bd2c0, ftLastWriteTime.dwHighDateTime=0x1d8bf8d, nFileSizeHigh=0x0, nFileSizeLow=0x1879d, dwReserved0=0x0, dwReserved1=0x0, cFileName="3ALR.avi", cAlternateFileName="")) returned 1 [0112.549] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47196310, ftCreationTime.dwHighDateTime=0x1d8bdc6, ftLastAccessTime.dwLowDateTime=0x9052ec80, ftLastAccessTime.dwHighDateTime=0x1d8c006, ftLastWriteTime.dwLowDateTime=0x9052ec80, ftLastWriteTime.dwHighDateTime=0x1d8c006, nFileSizeHigh=0x0, nFileSizeLow=0x16065, dwReserved0=0x0, dwReserved1=0x0, cFileName="3V26078_t3PycYa-.m4a", cAlternateFileName="3V2607~1.M4A")) returned 1 [0112.549] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x414fc4f0, ftCreationTime.dwHighDateTime=0x1d8bbd3, ftLastAccessTime.dwLowDateTime=0xbb970c20, ftLastAccessTime.dwHighDateTime=0x1d8bbdb, ftLastWriteTime.dwLowDateTime=0xbb970c20, ftLastWriteTime.dwHighDateTime=0x1d8bbdb, nFileSizeHigh=0x0, nFileSizeLow=0x121da, dwReserved0=0x0, dwReserved1=0x0, cFileName="6gsF_oOWDuB.ppt", cAlternateFileName="6GSF_O~1.PPT")) returned 1 [0112.549] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e5a50a0, ftCreationTime.dwHighDateTime=0x1d8b61d, ftLastAccessTime.dwLowDateTime=0x7376d990, ftLastAccessTime.dwHighDateTime=0x1d8c0fc, ftLastWriteTime.dwLowDateTime=0x7376d990, ftLastWriteTime.dwHighDateTime=0x1d8c0fc, nFileSizeHigh=0x0, nFileSizeLow=0x6880, dwReserved0=0x0, dwReserved1=0x0, cFileName="7aoXqL.swf", cAlternateFileName="")) returned 1 [0112.549] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x385fac20, ftCreationTime.dwHighDateTime=0x1d8b2d2, ftLastAccessTime.dwLowDateTime=0x986b4d30, ftLastAccessTime.dwHighDateTime=0x1d8b6e3, ftLastWriteTime.dwLowDateTime=0x986b4d30, ftLastWriteTime.dwHighDateTime=0x1d8b6e3, nFileSizeHigh=0x0, nFileSizeLow=0x16e46, dwReserved0=0x0, dwReserved1=0x0, cFileName="7ibZqS-WGiyBMZF.wav", cAlternateFileName="7IBZQS~1.WAV")) returned 1 [0112.550] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb016c0, ftCreationTime.dwHighDateTime=0x1d8bdfc, ftLastAccessTime.dwLowDateTime=0x5735fbe0, ftLastAccessTime.dwHighDateTime=0x1d8c097, ftLastWriteTime.dwLowDateTime=0x5735fbe0, ftLastWriteTime.dwHighDateTime=0x1d8c097, nFileSizeHigh=0x0, nFileSizeLow=0x146bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="8y9XFR.swf", cAlternateFileName="")) returned 1 [0112.550] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7143a430, ftCreationTime.dwHighDateTime=0x1d8bd3e, ftLastAccessTime.dwLowDateTime=0x705c7d60, ftLastAccessTime.dwHighDateTime=0x1d8c100, ftLastWriteTime.dwLowDateTime=0x705c7d60, ftLastWriteTime.dwHighDateTime=0x1d8c100, nFileSizeHigh=0x0, nFileSizeLow=0xe2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="avNCvKIbZERjJ6.odt", cAlternateFileName="AVNCVK~1.ODT")) returned 1 [0112.550] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4f9d7d0, ftCreationTime.dwHighDateTime=0x1d8b81b, ftLastAccessTime.dwLowDateTime=0xf54866c0, ftLastAccessTime.dwHighDateTime=0x1d8b998, ftLastWriteTime.dwLowDateTime=0xf54866c0, ftLastWriteTime.dwHighDateTime=0x1d8b998, nFileSizeHigh=0x0, nFileSizeLow=0xf4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bypP-pP55W0EP.flv", cAlternateFileName="BYPP-P~1.FLV")) returned 1 [0112.550] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0112.550] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb5ea9c0, ftCreationTime.dwHighDateTime=0x1d8b4a4, ftLastAccessTime.dwLowDateTime=0x32c1d270, ftLastAccessTime.dwHighDateTime=0x1d8b741, ftLastWriteTime.dwLowDateTime=0x32c1d270, ftLastWriteTime.dwHighDateTime=0x1d8b741, nFileSizeHigh=0x0, nFileSizeLow=0x4f56, dwReserved0=0x0, dwReserved1=0x0, cFileName="DN3YGl_MaifjgT.swf", cAlternateFileName="DN3YGL~1.SWF")) returned 1 [0112.551] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x604dc3a0, ftCreationTime.dwHighDateTime=0x1d8b752, ftLastAccessTime.dwLowDateTime=0xe75098d0, ftLastAccessTime.dwHighDateTime=0x1d8be11, ftLastWriteTime.dwLowDateTime=0xe75098d0, ftLastWriteTime.dwHighDateTime=0x1d8be11, nFileSizeHigh=0x0, nFileSizeLow=0x163fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="E4VYDeroN3BRcqUdFN5C.swf", cAlternateFileName="E4VYDE~1.SWF")) returned 1 [0112.551] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dd0ef0, ftCreationTime.dwHighDateTime=0x1d8b209, ftLastAccessTime.dwLowDateTime=0x5bfd82a0, ftLastAccessTime.dwHighDateTime=0x1d8bd00, ftLastWriteTime.dwLowDateTime=0x5bfd82a0, ftLastWriteTime.dwHighDateTime=0x1d8bd00, nFileSizeHigh=0x0, nFileSizeLow=0xcb57, dwReserved0=0x0, dwReserved1=0x0, cFileName="fZRMjwEXE.gif", cAlternateFileName="FZRMJW~1.GIF")) returned 1 [0112.551] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3e37cd0, ftCreationTime.dwHighDateTime=0x1d8b39c, ftLastAccessTime.dwLowDateTime=0xfc314330, ftLastAccessTime.dwHighDateTime=0x1d8be8e, ftLastWriteTime.dwLowDateTime=0xfc314330, ftLastWriteTime.dwHighDateTime=0x1d8be8e, nFileSizeHigh=0x0, nFileSizeLow=0x123d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="G620aC.jpg", cAlternateFileName="")) returned 1 [0112.551] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc595c380, ftCreationTime.dwHighDateTime=0x1d8bfb2, ftLastAccessTime.dwLowDateTime=0x2cc74ca0, ftLastAccessTime.dwHighDateTime=0x1d8c0fc, ftLastWriteTime.dwLowDateTime=0x2cc74ca0, ftLastWriteTime.dwHighDateTime=0x1d8c0fc, nFileSizeHigh=0x0, nFileSizeLow=0x17ee1, dwReserved0=0x0, dwReserved1=0x0, cFileName="g_RTTfqyXS6.jpg", cAlternateFileName="G_RTTF~1.JPG")) returned 1 [0112.551] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c90710, ftCreationTime.dwHighDateTime=0x1d8bd9a, ftLastAccessTime.dwLowDateTime=0xb4ce3ab0, ftLastAccessTime.dwHighDateTime=0x1d8bfc0, ftLastWriteTime.dwLowDateTime=0xb4ce3ab0, ftLastWriteTime.dwHighDateTime=0x1d8bfc0, nFileSizeHigh=0x0, nFileSizeLow=0x46e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="hBUYL.flv", cAlternateFileName="")) returned 1 [0112.552] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fc32e10, ftCreationTime.dwHighDateTime=0x1d8be91, ftLastAccessTime.dwLowDateTime=0x91d06a50, ftLastAccessTime.dwHighDateTime=0x1d8c03e, ftLastWriteTime.dwLowDateTime=0x91d06a50, ftLastWriteTime.dwHighDateTime=0x1d8c03e, nFileSizeHigh=0x0, nFileSizeLow=0x8b95, dwReserved0=0x0, dwReserved1=0x0, cFileName="jmlwn5Tr.mp3", cAlternateFileName="")) returned 1 [0112.552] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eee2140, ftCreationTime.dwHighDateTime=0x1d8b759, ftLastAccessTime.dwLowDateTime=0xa0800a40, ftLastAccessTime.dwHighDateTime=0x1d8c01d, ftLastWriteTime.dwLowDateTime=0xa0800a40, ftLastWriteTime.dwHighDateTime=0x1d8c01d, nFileSizeHigh=0x0, nFileSizeLow=0x185bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ll2MxwxRHWpc2D.jpg", cAlternateFileName="LL2MXW~1.JPG")) returned 1 [0112.552] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7cee820, ftCreationTime.dwHighDateTime=0x1d8b4aa, ftLastAccessTime.dwLowDateTime=0xa2e45040, ftLastAccessTime.dwHighDateTime=0x1d8c0f2, ftLastWriteTime.dwLowDateTime=0xa2e45040, ftLastWriteTime.dwHighDateTime=0x1d8c0f2, nFileSizeHigh=0x0, nFileSizeLow=0xe6b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="LS8Cz.ods", cAlternateFileName="")) returned 1 [0112.553] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7e125b0, ftCreationTime.dwHighDateTime=0x1d8bc4d, ftLastAccessTime.dwLowDateTime=0xec5e50f0, ftLastAccessTime.dwHighDateTime=0x1d8bf07, ftLastWriteTime.dwLowDateTime=0xec5e50f0, ftLastWriteTime.dwHighDateTime=0x1d8bf07, nFileSizeHigh=0x0, nFileSizeLow=0x41c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lsistx.ods", cAlternateFileName="")) returned 1 [0112.553] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa53ec0, ftCreationTime.dwHighDateTime=0x1d8b8df, ftLastAccessTime.dwLowDateTime=0x4da33d50, ftLastAccessTime.dwHighDateTime=0x1d8c050, ftLastWriteTime.dwLowDateTime=0x4da33d50, ftLastWriteTime.dwHighDateTime=0x1d8c050, nFileSizeHigh=0x0, nFileSizeLow=0x1878e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MF5o-hDHAf3Lkh.gif", cAlternateFileName="MF5O-H~1.GIF")) returned 1 [0112.553] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dd7c7b0, ftCreationTime.dwHighDateTime=0x1d8ba6b, ftLastAccessTime.dwLowDateTime=0xf2f2ca00, ftLastAccessTime.dwHighDateTime=0x1d8bf56, ftLastWriteTime.dwLowDateTime=0xf2f2ca00, ftLastWriteTime.dwHighDateTime=0x1d8bf56, nFileSizeHigh=0x0, nFileSizeLow=0x7a07, dwReserved0=0x0, dwReserved1=0x0, cFileName="mO8vZJ2N.png", cAlternateFileName="")) returned 1 [0112.553] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a1a3f40, ftCreationTime.dwHighDateTime=0x1d8bbd1, ftLastAccessTime.dwLowDateTime=0x699555d0, ftLastAccessTime.dwHighDateTime=0x1d8bde3, ftLastWriteTime.dwLowDateTime=0x699555d0, ftLastWriteTime.dwHighDateTime=0x1d8bde3, nFileSizeHigh=0x0, nFileSizeLow=0x111c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="oFnSAYDpRZb46.mkv", cAlternateFileName="OFNSAY~1.MKV")) returned 1 [0112.553] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a551b0, ftCreationTime.dwHighDateTime=0x1d8bab5, ftLastAccessTime.dwLowDateTime=0x3f44f490, ftLastAccessTime.dwHighDateTime=0x1d8bf67, ftLastWriteTime.dwLowDateTime=0x3f44f490, ftLastWriteTime.dwHighDateTime=0x1d8bf67, nFileSizeHigh=0x0, nFileSizeLow=0x6767, dwReserved0=0x0, dwReserved1=0x0, cFileName="p-cVbO84.doc", cAlternateFileName="")) returned 1 [0112.553] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3dc7d10, ftCreationTime.dwHighDateTime=0x1d8be87, ftLastAccessTime.dwLowDateTime=0xe04d23b0, ftLastAccessTime.dwHighDateTime=0x1d8c117, ftLastWriteTime.dwLowDateTime=0xe04d23b0, ftLastWriteTime.dwHighDateTime=0x1d8c117, nFileSizeHigh=0x0, nFileSizeLow=0x133ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUJ3QKPvdT.m4a", cAlternateFileName="QUJ3QK~1.M4A")) returned 1 [0112.554] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4add3a80, ftCreationTime.dwHighDateTime=0x1d8bba5, ftLastAccessTime.dwLowDateTime=0x1e605de0, ftLastAccessTime.dwHighDateTime=0x1d8bd8d, ftLastWriteTime.dwLowDateTime=0x1e605de0, ftLastWriteTime.dwHighDateTime=0x1d8bd8d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="r2PRf1U9FnysJo7qVmv", cAlternateFileName="R2PRF1~1")) returned 1 [0112.554] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16785480, ftCreationTime.dwHighDateTime=0x1d8c0e8, ftLastAccessTime.dwLowDateTime=0x52e88960, ftLastAccessTime.dwHighDateTime=0x1d8c108, ftLastWriteTime.dwLowDateTime=0x52e88960, ftLastWriteTime.dwHighDateTime=0x1d8c108, nFileSizeHigh=0x0, nFileSizeLow=0xb29f, dwReserved0=0x0, dwReserved1=0x0, cFileName="rR-MqVkTA.ots", cAlternateFileName="RR-MQV~1.OTS")) returned 1 [0112.554] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a7d44b0, ftCreationTime.dwHighDateTime=0x1d8b88d, ftLastAccessTime.dwLowDateTime=0x1cf4ce0, ftLastAccessTime.dwHighDateTime=0x1d8ba81, ftLastWriteTime.dwLowDateTime=0x1cf4ce0, ftLastWriteTime.dwHighDateTime=0x1d8ba81, nFileSizeHigh=0x0, nFileSizeLow=0x11026, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCyUkv.pps", cAlternateFileName="")) returned 1 [0112.554] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x617393a0, ftCreationTime.dwHighDateTime=0x1d8b7ce, ftLastAccessTime.dwLowDateTime=0xafa57760, ftLastAccessTime.dwHighDateTime=0x1d8c0b5, ftLastWriteTime.dwLowDateTime=0xafa57760, ftLastWriteTime.dwHighDateTime=0x1d8c0b5, nFileSizeHigh=0x0, nFileSizeLow=0xddfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="tDKzRMjG6IpSS.gif", cAlternateFileName="TDKZRM~1.GIF")) returned 1 [0112.554] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d077da0, ftCreationTime.dwHighDateTime=0x1d8b464, ftLastAccessTime.dwLowDateTime=0x2295a640, ftLastAccessTime.dwHighDateTime=0x1d8b702, ftLastWriteTime.dwLowDateTime=0x2295a640, ftLastWriteTime.dwHighDateTime=0x1d8b702, nFileSizeHigh=0x0, nFileSizeLow=0x16b47, dwReserved0=0x0, dwReserved1=0x0, cFileName="VHrKBoE.mkv", cAlternateFileName="")) returned 1 [0112.555] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7b96490, ftCreationTime.dwHighDateTime=0x1d8b40b, ftLastAccessTime.dwLowDateTime=0x53d381e0, ftLastAccessTime.dwHighDateTime=0x1d8c095, ftLastWriteTime.dwLowDateTime=0x53d381e0, ftLastWriteTime.dwHighDateTime=0x1d8c095, nFileSizeHigh=0x0, nFileSizeLow=0x36d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPoKyX82Om8q4Ed.avi", cAlternateFileName="WPOKYX~1.AVI")) returned 1 [0112.555] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0c04460, ftCreationTime.dwHighDateTime=0x1d8bbac, ftLastAccessTime.dwLowDateTime=0xe22a1d70, ftLastAccessTime.dwHighDateTime=0x1d8bcab, ftLastWriteTime.dwLowDateTime=0xe22a1d70, ftLastWriteTime.dwHighDateTime=0x1d8bcab, nFileSizeHigh=0x0, nFileSizeLow=0xe622, dwReserved0=0x0, dwReserved1=0x0, cFileName="x5SAnVmwCY.bmp", cAlternateFileName="X5SANV~1.BMP")) returned 1 [0112.555] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd96da110, ftCreationTime.dwHighDateTime=0x1d8b937, ftLastAccessTime.dwLowDateTime=0x16b959b0, ftLastAccessTime.dwHighDateTime=0x1d8b9d8, ftLastWriteTime.dwLowDateTime=0x16b959b0, ftLastWriteTime.dwHighDateTime=0x1d8b9d8, nFileSizeHigh=0x0, nFileSizeLow=0x3a34, dwReserved0=0x0, dwReserved1=0x0, cFileName="XsV9.gif", cAlternateFileName="")) returned 1 [0112.555] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32be5e0, ftCreationTime.dwHighDateTime=0x1d8b8f0, ftLastAccessTime.dwLowDateTime=0x80082520, ftLastAccessTime.dwHighDateTime=0x1d8ba7f, ftLastWriteTime.dwLowDateTime=0x80082520, ftLastWriteTime.dwHighDateTime=0x1d8ba7f, nFileSizeHigh=0x0, nFileSizeLow=0x12845, dwReserved0=0x0, dwReserved1=0x0, cFileName="x_OLlWcMaQI.gif", cAlternateFileName="X_OLLW~1.GIF")) returned 1 [0112.556] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c5aec0, ftCreationTime.dwHighDateTime=0x1d8c090, ftLastAccessTime.dwLowDateTime=0x417610, ftLastAccessTime.dwHighDateTime=0x1d8c0c5, ftLastWriteTime.dwLowDateTime=0x417610, ftLastWriteTime.dwHighDateTime=0x1d8c0c5, nFileSizeHigh=0x0, nFileSizeLow=0xc3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="y-ufahLBUL h.avi", cAlternateFileName="Y-UFAH~1.AVI")) returned 1 [0112.556] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29fd1960, ftCreationTime.dwHighDateTime=0x1d8b2b4, ftLastAccessTime.dwLowDateTime=0xdf85ec0, ftLastAccessTime.dwHighDateTime=0x1d8bdde, ftLastWriteTime.dwLowDateTime=0xdf85ec0, ftLastWriteTime.dwHighDateTime=0x1d8bdde, nFileSizeHigh=0x0, nFileSizeLow=0x10b47, dwReserved0=0x0, dwReserved1=0x0, cFileName="zSxZ4J_7Ak.ppt", cAlternateFileName="ZSXZ4J~1.PPT")) returned 1 [0112.556] FindNextFileW (in: hFindFile=0x688a50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29fd1960, ftCreationTime.dwHighDateTime=0x1d8b2b4, ftLastAccessTime.dwLowDateTime=0xdf85ec0, ftLastAccessTime.dwHighDateTime=0x1d8bdde, ftLastWriteTime.dwLowDateTime=0xdf85ec0, ftLastWriteTime.dwHighDateTime=0x1d8bdde, nFileSizeHigh=0x0, nFileSizeLow=0x10b47, dwReserved0=0x0, dwReserved1=0x0, cFileName="zSxZ4J_7Ak.ppt", cAlternateFileName="ZSXZ4J~1.PPT")) returned 0 [0112.556] FindClose (in: hFindFile=0x688a50 | out: hFindFile=0x688a50) returned 1 [0112.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda8) returned 1 [0112.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb4) returned 1 [0112.579] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\3ALR.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0112.579] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\3ALR.avi", nBufferLength=0x27, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\3ALR.avi", lpFilePart=0x0) returned 0x26 [0112.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0112.580] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\3ALR.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\3alr.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0112.580] GetFileType (hFile=0x2e0) returned 0x1 [0112.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0112.580] GetFileType (hFile=0x2e0) returned 0x1 [0112.580] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x1879d [0112.581] ReadFile (in: hFile=0x2e0, lpBuffer=0x32f94f0, nNumberOfBytesToRead=0x1879d, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x32f94f0*, lpNumberOfBytesRead=0x19ed40*=0x1879d, lpOverlapped=0x0) returned 1 [0112.583] CloseHandle (hObject=0x2e0) returned 1 [0119.770] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0119.770] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x44, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0119.770] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0119.770] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x44, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0119.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec00) returned 1 [0119.770] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19ec7c | out: lpFileInformation=0x19ec7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0119.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebfc) returned 1 [0120.205] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x19eb58 | out: pfEnabled=0x19eb58) returned 0x0 [0120.833] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0120.833] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0120.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0120.833] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0120.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0120.834] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\3ALR.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0120.834] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\3ALR.avi", nBufferLength=0x27, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\3ALR.avi", lpFilePart=0x0) returned 0x26 [0120.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0120.835] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\3ALR.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\3alr.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0120.838] GetFileType (hFile=0x364) returned 0x1 [0120.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0120.838] GetFileType (hFile=0x364) returned 0x1 [0120.838] WriteFile (in: hFile=0x364, lpBuffer=0x3373b50*, nNumberOfBytesToWrite=0x187a0, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x3373b50*, lpNumberOfBytesWritten=0x19ed34*=0x187a0, lpOverlapped=0x0) returned 1 [0120.843] CloseHandle (hObject=0x364) returned 1 [0120.847] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\3ALR.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0120.847] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\3ALR.avi", nBufferLength=0x27, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\3ALR.avi", lpFilePart=0x0) returned 0x26 [0120.847] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\3ALR.avi.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0120.847] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\3ALR.avi.paradox", nBufferLength=0x2f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\3ALR.avi.paradox", lpFilePart=0x0) returned 0x2e [0120.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0120.847] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\3ALR.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\3alr.avi"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed9beb40, ftCreationTime.dwHighDateTime=0x1d8bdad, ftLastAccessTime.dwLowDateTime=0x157bd2c0, ftLastAccessTime.dwHighDateTime=0x1d8bf8d, ftLastWriteTime.dwLowDateTime=0xc0339b2b, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x187a0)) returned 1 [0120.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0120.848] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\3ALR.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\3alr.avi"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\3ALR.avi.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\3alr.avi.paradox")) returned 1 [0120.849] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\6gsF_oOWDuB.ppt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0120.849] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\6gsF_oOWDuB.ppt", nBufferLength=0x2e, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\6gsF_oOWDuB.ppt", lpFilePart=0x0) returned 0x2d [0120.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0120.849] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\6gsF_oOWDuB.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\6gsf_oowdub.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0120.850] GetFileType (hFile=0x364) returned 0x1 [0120.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0120.850] GetFileType (hFile=0x364) returned 0x1 [0120.850] GetFileSize (in: hFile=0x364, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x121da [0120.851] ReadFile (in: hFile=0x364, lpBuffer=0x23818dc, nNumberOfBytesToRead=0x121da, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x23818dc*, lpNumberOfBytesRead=0x19ed40*=0x121da, lpOverlapped=0x0) returned 1 [0120.852] CloseHandle (hObject=0x364) returned 1 [0120.929] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0120.929] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0120.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0120.929] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0120.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0120.930] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\6gsF_oOWDuB.ppt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0120.930] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\6gsF_oOWDuB.ppt", nBufferLength=0x2e, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\6gsF_oOWDuB.ppt", lpFilePart=0x0) returned 0x2d [0120.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0120.930] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\6gsF_oOWDuB.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\6gsf_oowdub.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0120.933] GetFileType (hFile=0x364) returned 0x1 [0120.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0120.933] GetFileType (hFile=0x364) returned 0x1 [0120.934] WriteFile (in: hFile=0x364, lpBuffer=0x2404c7c*, nNumberOfBytesToWrite=0x121e0, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x2404c7c*, lpNumberOfBytesWritten=0x19ed34*=0x121e0, lpOverlapped=0x0) returned 1 [0120.936] CloseHandle (hObject=0x364) returned 1 [0120.942] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\6gsF_oOWDuB.ppt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0120.942] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\6gsF_oOWDuB.ppt", nBufferLength=0x2e, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\6gsF_oOWDuB.ppt", lpFilePart=0x0) returned 0x2d [0120.943] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\6gsF_oOWDuB.ppt.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0120.943] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\6gsF_oOWDuB.ppt.paradox", nBufferLength=0x36, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\6gsF_oOWDuB.ppt.paradox", lpFilePart=0x0) returned 0x35 [0120.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0120.943] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\6gsF_oOWDuB.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\6gsf_oowdub.ppt"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x414fc4f0, ftCreationTime.dwHighDateTime=0x1d8bbd3, ftLastAccessTime.dwLowDateTime=0xbb970c20, ftLastAccessTime.dwHighDateTime=0x1d8bbdb, ftLastWriteTime.dwLowDateTime=0xc041e958, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x121e0)) returned 1 [0120.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0120.943] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\6gsF_oOWDuB.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\6gsf_oowdub.ppt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\6gsF_oOWDuB.ppt.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\6gsf_oowdub.ppt.paradox")) returned 1 [0120.946] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\avNCvKIbZERjJ6.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0120.946] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\avNCvKIbZERjJ6.odt", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\avNCvKIbZERjJ6.odt", lpFilePart=0x0) returned 0x30 [0120.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0120.946] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\avNCvKIbZERjJ6.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\avncvkibzerjj6.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0120.946] GetFileType (hFile=0x364) returned 0x1 [0120.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0120.946] GetFileType (hFile=0x364) returned 0x1 [0120.946] GetFileSize (in: hFile=0x364, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0xe2f0 [0120.947] ReadFile (in: hFile=0x364, lpBuffer=0x2417130, nNumberOfBytesToRead=0xe2f0, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x2417130*, lpNumberOfBytesRead=0x19ed40*=0xe2f0, lpOverlapped=0x0) returned 1 [0120.948] CloseHandle (hObject=0x364) returned 1 [0120.980] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0120.981] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0120.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0120.981] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0120.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0120.981] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\avNCvKIbZERjJ6.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0120.981] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\avNCvKIbZERjJ6.odt", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\avNCvKIbZERjJ6.odt", lpFilePart=0x0) returned 0x30 [0120.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0120.981] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\avNCvKIbZERjJ6.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\avncvkibzerjj6.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0120.986] GetFileType (hFile=0x364) returned 0x1 [0120.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0120.986] GetFileType (hFile=0x364) returned 0x1 [0120.986] WriteFile (in: hFile=0x364, lpBuffer=0x248e82c*, nNumberOfBytesToWrite=0xe300, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x248e82c*, lpNumberOfBytesWritten=0x19ed34*=0xe300, lpOverlapped=0x0) returned 1 [0120.988] CloseHandle (hObject=0x364) returned 1 [0120.991] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\avNCvKIbZERjJ6.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0120.991] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\avNCvKIbZERjJ6.odt", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\avNCvKIbZERjJ6.odt", lpFilePart=0x0) returned 0x30 [0120.991] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\avNCvKIbZERjJ6.odt.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0120.991] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\avNCvKIbZERjJ6.odt.paradox", nBufferLength=0x39, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\avNCvKIbZERjJ6.odt.paradox", lpFilePart=0x0) returned 0x38 [0120.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0120.992] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\avNCvKIbZERjJ6.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\avncvkibzerjj6.odt"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7143a430, ftCreationTime.dwHighDateTime=0x1d8bd3e, ftLastAccessTime.dwLowDateTime=0x705c7d60, ftLastAccessTime.dwHighDateTime=0x1d8c100, ftLastWriteTime.dwLowDateTime=0xc049111f, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xe300)) returned 1 [0120.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0120.992] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\avNCvKIbZERjJ6.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\avncvkibzerjj6.odt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\avNCvKIbZERjJ6.odt.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\avncvkibzerjj6.odt.paradox")) returned 1 [0120.994] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\G620aC.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0120.994] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\G620aC.jpg", nBufferLength=0x29, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\G620aC.jpg", lpFilePart=0x0) returned 0x28 [0120.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0120.994] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\G620aC.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\g620ac.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0120.994] GetFileType (hFile=0x364) returned 0x1 [0120.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0120.994] GetFileType (hFile=0x364) returned 0x1 [0120.995] GetFileSize (in: hFile=0x364, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x123d6 [0120.996] ReadFile (in: hFile=0x364, lpBuffer=0x249ce30, nNumberOfBytesToRead=0x123d6, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x249ce30*, lpNumberOfBytesRead=0x19ed40*=0x123d6, lpOverlapped=0x0) returned 1 [0120.997] CloseHandle (hObject=0x364) returned 1 [0121.102] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0121.102] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0121.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0121.102] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0121.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0121.103] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\G620aC.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0121.103] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\G620aC.jpg", nBufferLength=0x29, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\G620aC.jpg", lpFilePart=0x0) returned 0x28 [0121.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0121.103] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\G620aC.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\g620ac.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0121.107] GetFileType (hFile=0x364) returned 0x1 [0121.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0121.107] GetFileType (hFile=0x364) returned 0x1 [0121.107] WriteFile (in: hFile=0x364, lpBuffer=0x234abd0*, nNumberOfBytesToWrite=0x123e0, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x234abd0*, lpNumberOfBytesWritten=0x19ed34*=0x123e0, lpOverlapped=0x0) returned 1 [0121.110] CloseHandle (hObject=0x364) returned 1 [0121.114] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\G620aC.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0121.114] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\G620aC.jpg", nBufferLength=0x29, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\G620aC.jpg", lpFilePart=0x0) returned 0x28 [0121.114] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\G620aC.jpg.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0121.114] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\G620aC.jpg.paradox", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\G620aC.jpg.paradox", lpFilePart=0x0) returned 0x30 [0121.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0121.115] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\G620aC.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\g620ac.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3e37cd0, ftCreationTime.dwHighDateTime=0x1d8b39c, ftLastAccessTime.dwLowDateTime=0xfc314330, ftLastAccessTime.dwHighDateTime=0x1d8be8e, ftLastWriteTime.dwLowDateTime=0xc05c2331, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x123e0)) returned 1 [0121.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0121.115] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\G620aC.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\g620ac.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\G620aC.jpg.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\g620ac.jpg.paradox")) returned 1 [0121.117] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\g_RTTfqyXS6.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0121.117] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\g_RTTfqyXS6.jpg", nBufferLength=0x2e, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\g_RTTfqyXS6.jpg", lpFilePart=0x0) returned 0x2d [0121.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0121.117] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\g_RTTfqyXS6.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\g_rttfqyxs6.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0121.117] GetFileType (hFile=0x364) returned 0x1 [0121.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0121.117] GetFileType (hFile=0x364) returned 0x1 [0121.117] GetFileSize (in: hFile=0x364, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x17ee1 [0121.118] ReadFile (in: hFile=0x364, lpBuffer=0x33f1490, nNumberOfBytesToRead=0x17ee1, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x33f1490*, lpNumberOfBytesRead=0x19ed40*=0x17ee1, lpOverlapped=0x0) returned 1 [0121.121] CloseHandle (hObject=0x364) returned 1 [0121.161] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0121.161] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0121.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0121.161] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0121.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0121.161] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\g_RTTfqyXS6.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0121.161] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\g_RTTfqyXS6.jpg", nBufferLength=0x2e, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\g_RTTfqyXS6.jpg", lpFilePart=0x0) returned 0x2d [0121.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0121.161] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\g_RTTfqyXS6.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\g_rttfqyxs6.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0121.167] GetFileType (hFile=0x364) returned 0x1 [0121.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0121.167] GetFileType (hFile=0x364) returned 0x1 [0121.167] WriteFile (in: hFile=0x364, lpBuffer=0x3468f70*, nNumberOfBytesToWrite=0x17ef0, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x3468f70*, lpNumberOfBytesWritten=0x19ed34*=0x17ef0, lpOverlapped=0x0) returned 1 [0121.173] CloseHandle (hObject=0x364) returned 1 [0121.282] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\g_RTTfqyXS6.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0121.282] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\g_RTTfqyXS6.jpg", nBufferLength=0x2e, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\g_RTTfqyXS6.jpg", lpFilePart=0x0) returned 0x2d [0121.282] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\g_RTTfqyXS6.jpg.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0121.282] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\g_RTTfqyXS6.jpg.paradox", nBufferLength=0x36, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\g_RTTfqyXS6.jpg.paradox", lpFilePart=0x0) returned 0x35 [0121.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0121.283] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\g_RTTfqyXS6.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\g_rttfqyxs6.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc595c380, ftCreationTime.dwHighDateTime=0x1d8bfb2, ftLastAccessTime.dwLowDateTime=0x2cc74ca0, ftLastAccessTime.dwHighDateTime=0x1d8c0fc, ftLastWriteTime.dwLowDateTime=0xc0765cc0, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x17ef0)) returned 1 [0121.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0121.283] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\g_RTTfqyXS6.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\g_rttfqyxs6.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\g_RTTfqyXS6.jpg.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\g_rttfqyxs6.jpg.paradox")) returned 1 [0121.286] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jmlwn5Tr.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0121.286] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jmlwn5Tr.mp3", nBufferLength=0x2b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jmlwn5Tr.mp3", lpFilePart=0x0) returned 0x2a [0121.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0121.286] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jmlwn5Tr.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jmlwn5tr.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0121.286] GetFileType (hFile=0x364) returned 0x1 [0121.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0121.286] GetFileType (hFile=0x364) returned 0x1 [0121.287] GetFileSize (in: hFile=0x364, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x8b95 [0121.287] ReadFile (in: hFile=0x364, lpBuffer=0x23aa414, nNumberOfBytesToRead=0x8b95, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x23aa414*, lpNumberOfBytesRead=0x19ed40*=0x8b95, lpOverlapped=0x0) returned 1 [0121.287] CloseHandle (hObject=0x364) returned 1 [0121.314] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0121.315] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0121.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0121.315] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0121.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0121.315] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jmlwn5Tr.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0121.315] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jmlwn5Tr.mp3", nBufferLength=0x2b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jmlwn5Tr.mp3", lpFilePart=0x0) returned 0x2a [0121.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0121.315] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jmlwn5Tr.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jmlwn5tr.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0121.318] GetFileType (hFile=0x364) returned 0x1 [0121.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0121.318] GetFileType (hFile=0x364) returned 0x1 [0121.318] WriteFile (in: hFile=0x364, lpBuffer=0x2422c20*, nNumberOfBytesToWrite=0x8ba0, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x2422c20*, lpNumberOfBytesWritten=0x19ed34*=0x8ba0, lpOverlapped=0x0) returned 1 [0121.320] CloseHandle (hObject=0x364) returned 1 [0121.323] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jmlwn5Tr.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0121.323] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jmlwn5Tr.mp3", nBufferLength=0x2b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jmlwn5Tr.mp3", lpFilePart=0x0) returned 0x2a [0121.323] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jmlwn5Tr.mp3.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0121.323] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jmlwn5Tr.mp3.paradox", nBufferLength=0x33, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jmlwn5Tr.mp3.paradox", lpFilePart=0x0) returned 0x32 [0121.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0121.324] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jmlwn5Tr.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jmlwn5tr.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fc32e10, ftCreationTime.dwHighDateTime=0x1d8be91, ftLastAccessTime.dwLowDateTime=0x91d06a50, ftLastAccessTime.dwHighDateTime=0x1d8c03e, ftLastWriteTime.dwLowDateTime=0xc07b21fa, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x8ba0)) returned 1 [0121.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0121.324] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jmlwn5Tr.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jmlwn5tr.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jmlwn5Tr.mp3.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jmlwn5tr.mp3.paradox")) returned 1 [0121.326] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Ll2MxwxRHWpc2D.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0121.326] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Ll2MxwxRHWpc2D.jpg", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Ll2MxwxRHWpc2D.jpg", lpFilePart=0x0) returned 0x30 [0121.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0121.326] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Ll2MxwxRHWpc2D.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ll2mxwxrhwpc2d.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0121.326] GetFileType (hFile=0x364) returned 0x1 [0121.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0121.327] GetFileType (hFile=0x364) returned 0x1 [0121.327] GetFileSize (in: hFile=0x364, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x185bc [0121.327] ReadFile (in: hFile=0x364, lpBuffer=0x3480e80, nNumberOfBytesToRead=0x185bc, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x3480e80*, lpNumberOfBytesRead=0x19ed40*=0x185bc, lpOverlapped=0x0) returned 1 [0121.330] CloseHandle (hObject=0x364) returned 1 [0121.387] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0121.387] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0121.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0121.387] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0121.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0121.387] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Ll2MxwxRHWpc2D.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0121.387] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Ll2MxwxRHWpc2D.jpg", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Ll2MxwxRHWpc2D.jpg", lpFilePart=0x0) returned 0x30 [0121.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0121.387] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Ll2MxwxRHWpc2D.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ll2mxwxrhwpc2d.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0121.407] GetFileType (hFile=0x364) returned 0x1 [0121.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0121.407] GetFileType (hFile=0x364) returned 0x1 [0121.407] WriteFile (in: hFile=0x364, lpBuffer=0x34fab78*, nNumberOfBytesToWrite=0x185c0, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x34fab78*, lpNumberOfBytesWritten=0x19ed34*=0x185c0, lpOverlapped=0x0) returned 1 [0121.412] CloseHandle (hObject=0x364) returned 1 [0121.421] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Ll2MxwxRHWpc2D.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0121.421] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Ll2MxwxRHWpc2D.jpg", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Ll2MxwxRHWpc2D.jpg", lpFilePart=0x0) returned 0x30 [0121.421] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Ll2MxwxRHWpc2D.jpg.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0121.421] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Ll2MxwxRHWpc2D.jpg.paradox", nBufferLength=0x39, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Ll2MxwxRHWpc2D.jpg.paradox", lpFilePart=0x0) returned 0x38 [0121.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0121.421] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Ll2MxwxRHWpc2D.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ll2mxwxrhwpc2d.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eee2140, ftCreationTime.dwHighDateTime=0x1d8b759, ftLastAccessTime.dwLowDateTime=0xa0800a40, ftLastAccessTime.dwHighDateTime=0x1d8c01d, ftLastWriteTime.dwLowDateTime=0xc08a0148, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x185c0)) returned 1 [0121.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0121.422] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Ll2MxwxRHWpc2D.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ll2mxwxrhwpc2d.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Ll2MxwxRHWpc2D.jpg.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ll2mxwxrhwpc2d.jpg.paradox")) returned 1 [0121.424] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\mO8vZJ2N.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0121.424] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\mO8vZJ2N.png", nBufferLength=0x2b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\mO8vZJ2N.png", lpFilePart=0x0) returned 0x2a [0121.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0121.424] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\mO8vZJ2N.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\mo8vzj2n.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0121.424] GetFileType (hFile=0x364) returned 0x1 [0121.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0121.425] GetFileType (hFile=0x364) returned 0x1 [0121.425] GetFileSize (in: hFile=0x364, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x7a07 [0121.425] ReadFile (in: hFile=0x364, lpBuffer=0x2478b0c, nNumberOfBytesToRead=0x7a07, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x2478b0c*, lpNumberOfBytesRead=0x19ed40*=0x7a07, lpOverlapped=0x0) returned 1 [0121.425] CloseHandle (hObject=0x364) returned 1 [0121.461] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0121.461] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0121.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0121.462] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0121.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0121.462] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\mO8vZJ2N.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0121.462] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\mO8vZJ2N.png", nBufferLength=0x2b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\mO8vZJ2N.png", lpFilePart=0x0) returned 0x2a [0121.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0121.462] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\mO8vZJ2N.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\mo8vzj2n.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0121.470] GetFileType (hFile=0x364) returned 0x1 [0121.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0121.470] GetFileType (hFile=0x364) returned 0x1 [0121.470] WriteFile (in: hFile=0x364, lpBuffer=0x24ebb48*, nNumberOfBytesToWrite=0x7a10, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x24ebb48*, lpNumberOfBytesWritten=0x19ed34*=0x7a10, lpOverlapped=0x0) returned 1 [0121.472] CloseHandle (hObject=0x364) returned 1 [0121.475] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\mO8vZJ2N.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0121.475] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\mO8vZJ2N.png", nBufferLength=0x2b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\mO8vZJ2N.png", lpFilePart=0x0) returned 0x2a [0121.476] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\mO8vZJ2N.png.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0121.476] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\mO8vZJ2N.png.paradox", nBufferLength=0x33, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\mO8vZJ2N.png.paradox", lpFilePart=0x0) returned 0x32 [0121.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0121.476] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\mO8vZJ2N.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\mo8vzj2n.png"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dd7c7b0, ftCreationTime.dwHighDateTime=0x1d8ba6b, ftLastAccessTime.dwLowDateTime=0xf2f2ca00, ftLastAccessTime.dwHighDateTime=0x1d8bf56, ftLastWriteTime.dwLowDateTime=0xc0938ac4, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x7a10)) returned 1 [0121.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0121.476] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\mO8vZJ2N.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\mo8vzj2n.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\mO8vZJ2N.png.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\mo8vzj2n.png.paradox")) returned 1 [0121.481] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\oFnSAYDpRZb46.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0121.481] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\oFnSAYDpRZb46.mkv", nBufferLength=0x30, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\oFnSAYDpRZb46.mkv", lpFilePart=0x0) returned 0x2f [0121.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0121.482] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\oFnSAYDpRZb46.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ofnsaydprzb46.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0121.482] GetFileType (hFile=0x364) returned 0x1 [0121.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0121.482] GetFileType (hFile=0x364) returned 0x1 [0121.482] GetFileSize (in: hFile=0x364, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x111c4 [0121.483] ReadFile (in: hFile=0x364, lpBuffer=0x24f37d8, nNumberOfBytesToRead=0x111c4, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x24f37d8*, lpNumberOfBytesRead=0x19ed40*=0x111c4, lpOverlapped=0x0) returned 1 [0121.484] CloseHandle (hObject=0x364) returned 1 [0121.619] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0121.619] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0121.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0121.619] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0121.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0121.619] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\oFnSAYDpRZb46.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0121.619] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\oFnSAYDpRZb46.mkv", nBufferLength=0x30, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\oFnSAYDpRZb46.mkv", lpFilePart=0x0) returned 0x2f [0121.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0121.619] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\oFnSAYDpRZb46.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ofnsaydprzb46.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0121.630] GetFileType (hFile=0x364) returned 0x1 [0121.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0121.630] GetFileType (hFile=0x364) returned 0x1 [0121.630] WriteFile (in: hFile=0x364, lpBuffer=0x2573b44*, nNumberOfBytesToWrite=0x111d0, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x2573b44*, lpNumberOfBytesWritten=0x19ed34*=0x111d0, lpOverlapped=0x0) returned 1 [0121.633] CloseHandle (hObject=0x364) returned 1 [0121.655] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\oFnSAYDpRZb46.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0121.655] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\oFnSAYDpRZb46.mkv", nBufferLength=0x30, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\oFnSAYDpRZb46.mkv", lpFilePart=0x0) returned 0x2f [0121.655] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\oFnSAYDpRZb46.mkv.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0121.655] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\oFnSAYDpRZb46.mkv.paradox", nBufferLength=0x38, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\oFnSAYDpRZb46.mkv.paradox", lpFilePart=0x0) returned 0x37 [0121.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0121.655] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\oFnSAYDpRZb46.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ofnsaydprzb46.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a1a3f40, ftCreationTime.dwHighDateTime=0x1d8bbd1, ftLastAccessTime.dwLowDateTime=0x699555d0, ftLastAccessTime.dwHighDateTime=0x1d8bde3, ftLastWriteTime.dwLowDateTime=0xc0ab62c9, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x111d0)) returned 1 [0121.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0121.656] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\oFnSAYDpRZb46.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ofnsaydprzb46.mkv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\oFnSAYDpRZb46.mkv.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ofnsaydprzb46.mkv.paradox")) returned 1 [0121.661] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\p-cVbO84.doc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0121.661] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\p-cVbO84.doc", nBufferLength=0x2b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\p-cVbO84.doc", lpFilePart=0x0) returned 0x2a [0121.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0121.661] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\p-cVbO84.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\p-cvbo84.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0121.662] GetFileType (hFile=0x364) returned 0x1 [0121.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0121.662] GetFileType (hFile=0x364) returned 0x1 [0121.662] GetFileSize (in: hFile=0x364, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x6767 [0121.662] ReadFile (in: hFile=0x364, lpBuffer=0x2584f9c, nNumberOfBytesToRead=0x6767, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x2584f9c*, lpNumberOfBytesRead=0x19ed40*=0x6767, lpOverlapped=0x0) returned 1 [0121.663] CloseHandle (hObject=0x364) returned 1 [0121.695] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0121.695] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0121.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0121.695] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0121.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0121.695] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\p-cVbO84.doc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0121.695] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\p-cVbO84.doc", nBufferLength=0x2b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\p-cVbO84.doc", lpFilePart=0x0) returned 0x2a [0121.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0121.696] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\p-cVbO84.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\p-cvbo84.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0121.704] GetFileType (hFile=0x364) returned 0x1 [0121.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0121.704] GetFileType (hFile=0x364) returned 0x1 [0121.704] WriteFile (in: hFile=0x364, lpBuffer=0x25f22b8*, nNumberOfBytesToWrite=0x6770, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x25f22b8*, lpNumberOfBytesWritten=0x19ed34*=0x6770, lpOverlapped=0x0) returned 1 [0121.706] CloseHandle (hObject=0x364) returned 1 [0121.711] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\p-cVbO84.doc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0121.711] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\p-cVbO84.doc", nBufferLength=0x2b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\p-cVbO84.doc", lpFilePart=0x0) returned 0x2a [0121.711] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\p-cVbO84.doc.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0121.711] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\p-cVbO84.doc.paradox", nBufferLength=0x33, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\p-cVbO84.doc.paradox", lpFilePart=0x0) returned 0x32 [0121.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0121.711] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\p-cVbO84.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\p-cvbo84.doc"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a551b0, ftCreationTime.dwHighDateTime=0x1d8bab5, ftLastAccessTime.dwLowDateTime=0x3f44f490, ftLastAccessTime.dwHighDateTime=0x1d8bf67, ftLastWriteTime.dwLowDateTime=0xc0b74dfe, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x6770)) returned 1 [0121.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0121.712] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\p-cVbO84.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\p-cvbo84.doc"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\p-cVbO84.doc.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\p-cvbo84.doc.paradox")) returned 1 [0121.714] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\VHrKBoE.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0121.714] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\VHrKBoE.mkv", nBufferLength=0x2a, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\VHrKBoE.mkv", lpFilePart=0x0) returned 0x29 [0121.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0121.714] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\VHrKBoE.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\vhrkboe.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0121.714] GetFileType (hFile=0x364) returned 0x1 [0121.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0121.714] GetFileType (hFile=0x364) returned 0x1 [0121.714] GetFileSize (in: hFile=0x364, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x16b47 [0121.715] ReadFile (in: hFile=0x364, lpBuffer=0x35354f8, nNumberOfBytesToRead=0x16b47, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x35354f8*, lpNumberOfBytesRead=0x19ed40*=0x16b47, lpOverlapped=0x0) returned 1 [0121.716] CloseHandle (hObject=0x364) returned 1 [0121.759] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0121.759] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0121.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0121.759] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0121.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0121.760] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\VHrKBoE.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0121.760] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\VHrKBoE.mkv", nBufferLength=0x2a, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\VHrKBoE.mkv", lpFilePart=0x0) returned 0x29 [0121.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0121.760] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\VHrKBoE.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\vhrkboe.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0121.768] GetFileType (hFile=0x364) returned 0x1 [0121.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0121.768] GetFileType (hFile=0x364) returned 0x1 [0121.768] WriteFile (in: hFile=0x364, lpBuffer=0x35a6dc0*, nNumberOfBytesToWrite=0x16b50, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x35a6dc0*, lpNumberOfBytesWritten=0x19ed34*=0x16b50, lpOverlapped=0x0) returned 1 [0121.771] CloseHandle (hObject=0x364) returned 1 [0121.784] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\VHrKBoE.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0121.784] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\VHrKBoE.mkv", nBufferLength=0x2a, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\VHrKBoE.mkv", lpFilePart=0x0) returned 0x29 [0121.784] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\VHrKBoE.mkv.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0121.784] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\VHrKBoE.mkv.paradox", nBufferLength=0x32, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\VHrKBoE.mkv.paradox", lpFilePart=0x0) returned 0x31 [0121.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0121.785] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\VHrKBoE.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\vhrkboe.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d077da0, ftCreationTime.dwHighDateTime=0x1d8b464, ftLastAccessTime.dwLowDateTime=0x2295a640, ftLastAccessTime.dwHighDateTime=0x1d8b702, ftLastWriteTime.dwLowDateTime=0xc0c0d977, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x16b50)) returned 1 [0121.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0121.785] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\VHrKBoE.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\vhrkboe.mkv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\VHrKBoE.mkv.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\vhrkboe.mkv.paradox")) returned 1 [0121.788] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WPoKyX82Om8q4Ed.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0121.788] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WPoKyX82Om8q4Ed.avi", nBufferLength=0x32, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WPoKyX82Om8q4Ed.avi", lpFilePart=0x0) returned 0x31 [0121.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0121.788] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WPoKyX82Om8q4Ed.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\wpokyx82om8q4ed.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0121.789] GetFileType (hFile=0x364) returned 0x1 [0121.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0121.789] GetFileType (hFile=0x364) returned 0x1 [0121.789] GetFileSize (in: hFile=0x364, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x36d3 [0121.789] ReadFile (in: hFile=0x364, lpBuffer=0x2301ef4, nNumberOfBytesToRead=0x36d3, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x2301ef4*, lpNumberOfBytesRead=0x19ed40*=0x36d3, lpOverlapped=0x0) returned 1 [0121.789] CloseHandle (hObject=0x364) returned 1 [0121.850] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0121.850] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0121.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0121.850] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0121.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0121.851] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WPoKyX82Om8q4Ed.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0121.851] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WPoKyX82Om8q4Ed.avi", nBufferLength=0x32, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WPoKyX82Om8q4Ed.avi", lpFilePart=0x0) returned 0x31 [0121.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0121.851] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WPoKyX82Om8q4Ed.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\wpokyx82om8q4ed.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0121.853] GetFileType (hFile=0x364) returned 0x1 [0121.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0121.853] GetFileType (hFile=0x364) returned 0x1 [0121.853] WriteFile (in: hFile=0x364, lpBuffer=0x236009c*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x236009c*, lpNumberOfBytesWritten=0x19ed34*=0x36e0, lpOverlapped=0x0) returned 1 [0121.854] CloseHandle (hObject=0x364) returned 1 [0121.857] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WPoKyX82Om8q4Ed.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0121.857] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WPoKyX82Om8q4Ed.avi", nBufferLength=0x32, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WPoKyX82Om8q4Ed.avi", lpFilePart=0x0) returned 0x31 [0121.857] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WPoKyX82Om8q4Ed.avi.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0121.857] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WPoKyX82Om8q4Ed.avi.paradox", nBufferLength=0x3a, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WPoKyX82Om8q4Ed.avi.paradox", lpFilePart=0x0) returned 0x39 [0121.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0121.857] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WPoKyX82Om8q4Ed.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\wpokyx82om8q4ed.avi"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7b96490, ftCreationTime.dwHighDateTime=0x1d8b40b, ftLastAccessTime.dwLowDateTime=0x53d381e0, ftLastAccessTime.dwHighDateTime=0x1d8c095, ftLastWriteTime.dwLowDateTime=0xc0ccc4a4, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x36e0)) returned 1 [0121.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0121.858] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WPoKyX82Om8q4Ed.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\wpokyx82om8q4ed.avi"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WPoKyX82Om8q4Ed.avi.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\wpokyx82om8q4ed.avi.paradox")) returned 1 [0121.860] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\x5SAnVmwCY.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0121.860] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\x5SAnVmwCY.bmp", nBufferLength=0x2d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\x5SAnVmwCY.bmp", lpFilePart=0x0) returned 0x2c [0121.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0121.860] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\x5SAnVmwCY.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\x5sanvmwcy.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0121.860] GetFileType (hFile=0x364) returned 0x1 [0121.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0121.860] GetFileType (hFile=0x364) returned 0x1 [0121.860] GetFileSize (in: hFile=0x364, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0xe622 [0121.861] ReadFile (in: hFile=0x364, lpBuffer=0x2363a10, nNumberOfBytesToRead=0xe622, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x2363a10*, lpNumberOfBytesRead=0x19ed40*=0xe622, lpOverlapped=0x0) returned 1 [0121.862] CloseHandle (hObject=0x364) returned 1 [0121.972] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0121.972] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0121.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0121.972] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0121.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0121.972] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\x5SAnVmwCY.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0121.972] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\x5SAnVmwCY.bmp", nBufferLength=0x2d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\x5SAnVmwCY.bmp", lpFilePart=0x0) returned 0x2c [0121.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0121.972] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\x5SAnVmwCY.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\x5sanvmwcy.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0121.974] GetFileType (hFile=0x364) returned 0x1 [0121.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0121.974] GetFileType (hFile=0x364) returned 0x1 [0121.974] WriteFile (in: hFile=0x364, lpBuffer=0x23dbaa0*, nNumberOfBytesToWrite=0xe630, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x23dbaa0*, lpNumberOfBytesWritten=0x19ed34*=0xe630, lpOverlapped=0x0) returned 1 [0121.976] CloseHandle (hObject=0x364) returned 1 [0121.979] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\x5SAnVmwCY.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0121.979] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\x5SAnVmwCY.bmp", nBufferLength=0x2d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\x5SAnVmwCY.bmp", lpFilePart=0x0) returned 0x2c [0121.979] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\x5SAnVmwCY.bmp.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0121.979] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\x5SAnVmwCY.bmp.paradox", nBufferLength=0x35, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\x5SAnVmwCY.bmp.paradox", lpFilePart=0x0) returned 0x34 [0121.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0121.979] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\x5SAnVmwCY.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\x5sanvmwcy.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0c04460, ftCreationTime.dwHighDateTime=0x1d8bbac, ftLastAccessTime.dwLowDateTime=0xe22a1d70, ftLastAccessTime.dwHighDateTime=0x1d8bcab, ftLastWriteTime.dwLowDateTime=0xc0dfd702, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xe630)) returned 1 [0121.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0121.979] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\x5SAnVmwCY.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\x5sanvmwcy.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\x5SAnVmwCY.bmp.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\x5sanvmwcy.bmp.paradox")) returned 1 [0121.980] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\y-ufahLBUL h.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0121.980] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\y-ufahLBUL h.avi", nBufferLength=0x2f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\y-ufahLBUL h.avi", lpFilePart=0x0) returned 0x2e [0121.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0121.980] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\y-ufahLBUL h.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\y-ufahlbul h.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0121.980] GetFileType (hFile=0x364) returned 0x1 [0121.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0121.980] GetFileType (hFile=0x364) returned 0x1 [0121.980] GetFileSize (in: hFile=0x364, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0xc3a8 [0121.980] ReadFile (in: hFile=0x364, lpBuffer=0x23ea388, nNumberOfBytesToRead=0xc3a8, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x23ea388*, lpNumberOfBytesRead=0x19ed40*=0xc3a8, lpOverlapped=0x0) returned 1 [0121.981] CloseHandle (hObject=0x364) returned 1 [0122.019] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0122.019] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0122.019] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0122.019] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0122.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0122.020] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\y-ufahLBUL h.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0122.020] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\y-ufahLBUL h.avi", nBufferLength=0x2f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\y-ufahLBUL h.avi", lpFilePart=0x0) returned 0x2e [0122.020] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0122.020] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\y-ufahLBUL h.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\y-ufahlbul h.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0122.021] GetFileType (hFile=0x364) returned 0x1 [0122.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0122.021] GetFileType (hFile=0x364) returned 0x1 [0122.021] WriteFile (in: hFile=0x364, lpBuffer=0x23016a4*, nNumberOfBytesToWrite=0xc3b0, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x23016a4*, lpNumberOfBytesWritten=0x19ed34*=0xc3b0, lpOverlapped=0x0) returned 1 [0122.023] CloseHandle (hObject=0x364) returned 1 [0122.025] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\y-ufahLBUL h.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0122.026] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\y-ufahLBUL h.avi", nBufferLength=0x2f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\y-ufahLBUL h.avi", lpFilePart=0x0) returned 0x2e [0122.026] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\y-ufahLBUL h.avi.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0122.026] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\y-ufahLBUL h.avi.paradox", nBufferLength=0x37, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\y-ufahLBUL h.avi.paradox", lpFilePart=0x0) returned 0x36 [0122.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0122.026] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\y-ufahLBUL h.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\y-ufahlbul h.avi"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c5aec0, ftCreationTime.dwHighDateTime=0x1d8c090, ftLastAccessTime.dwLowDateTime=0x417610, ftLastAccessTime.dwHighDateTime=0x1d8c0c5, ftLastWriteTime.dwLowDateTime=0xc0e70acc, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xc3b0)) returned 1 [0122.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0122.026] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\y-ufahLBUL h.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\y-ufahlbul h.avi"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\y-ufahLBUL h.avi.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\y-ufahlbul h.avi.paradox")) returned 1 [0122.027] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\zSxZ4J_7Ak.ppt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0122.027] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\zSxZ4J_7Ak.ppt", nBufferLength=0x2d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\zSxZ4J_7Ak.ppt", lpFilePart=0x0) returned 0x2c [0122.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0122.027] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\zSxZ4J_7Ak.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\zsxz4j_7ak.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0122.027] GetFileType (hFile=0x364) returned 0x1 [0122.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0122.027] GetFileType (hFile=0x364) returned 0x1 [0122.027] GetFileSize (in: hFile=0x364, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x10b47 [0122.027] ReadFile (in: hFile=0x364, lpBuffer=0x230dce0, nNumberOfBytesToRead=0x10b47, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x230dce0*, lpNumberOfBytesRead=0x19ed40*=0x10b47, lpOverlapped=0x0) returned 1 [0122.028] CloseHandle (hObject=0x364) returned 1 [0122.090] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0122.090] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0122.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0122.090] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0122.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0122.090] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\zSxZ4J_7Ak.ppt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0122.090] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\zSxZ4J_7Ak.ppt", nBufferLength=0x2d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\zSxZ4J_7Ak.ppt", lpFilePart=0x0) returned 0x2c [0122.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0122.090] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\zSxZ4J_7Ak.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\zsxz4j_7ak.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0122.092] GetFileType (hFile=0x364) returned 0x1 [0122.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0122.092] GetFileType (hFile=0x364) returned 0x1 [0122.092] WriteFile (in: hFile=0x364, lpBuffer=0x238ce2c*, nNumberOfBytesToWrite=0x10b50, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x238ce2c*, lpNumberOfBytesWritten=0x19ed34*=0x10b50, lpOverlapped=0x0) returned 1 [0122.094] CloseHandle (hObject=0x364) returned 1 [0122.097] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\zSxZ4J_7Ak.ppt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0122.097] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\zSxZ4J_7Ak.ppt", nBufferLength=0x2d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\zSxZ4J_7Ak.ppt", lpFilePart=0x0) returned 0x2c [0122.097] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\zSxZ4J_7Ak.ppt.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0122.097] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\zSxZ4J_7Ak.ppt.paradox", nBufferLength=0x35, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\zSxZ4J_7Ak.ppt.paradox", lpFilePart=0x0) returned 0x34 [0122.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0122.098] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\zSxZ4J_7Ak.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\zsxz4j_7ak.ppt"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29fd1960, ftCreationTime.dwHighDateTime=0x1d8b2b4, ftLastAccessTime.dwLowDateTime=0xdf85ec0, ftLastAccessTime.dwHighDateTime=0x1d8bdde, ftLastWriteTime.dwLowDateTime=0xc0f2eaba, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x10b50)) returned 1 [0122.098] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0122.098] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\zSxZ4J_7Ak.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\zsxz4j_7ak.ppt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\zSxZ4J_7Ak.ppt.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\zsxz4j_7ak.ppt.paradox")) returned 1 [0122.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed78) returned 1 [0122.099] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0122.099] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv", nBufferLength=0x32, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv", lpFilePart=0x0) returned 0x31 [0122.099] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\*"), lpFindFileData=0x19eaa0 | out: lpFindFileData=0x19eaa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4add3a80, ftCreationTime.dwHighDateTime=0x1d8bba5, ftLastAccessTime.dwLowDateTime=0x1e605de0, ftLastAccessTime.dwHighDateTime=0x1d8bd8d, ftLastWriteTime.dwLowDateTime=0x1e605de0, ftLastWriteTime.dwHighDateTime=0x1d8bd8d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688f90 [0122.099] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4add3a80, ftCreationTime.dwHighDateTime=0x1d8bba5, ftLastAccessTime.dwLowDateTime=0x1e605de0, ftLastAccessTime.dwHighDateTime=0x1d8bd8d, ftLastWriteTime.dwLowDateTime=0x1e605de0, ftLastWriteTime.dwHighDateTime=0x1d8bd8d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0122.101] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24372040, ftCreationTime.dwHighDateTime=0x1d8be60, ftLastAccessTime.dwLowDateTime=0x2c985b60, ftLastAccessTime.dwHighDateTime=0x1d8c062, ftLastWriteTime.dwLowDateTime=0x2c985b60, ftLastWriteTime.dwHighDateTime=0x1d8c062, nFileSizeHigh=0x0, nFileSizeLow=0x1100a, dwReserved0=0x0, dwReserved1=0x0, cFileName="0ItsVjI3Z5uTF3b.mp3", cAlternateFileName="0ITSVJ~1.MP3")) returned 1 [0122.101] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb77dddd0, ftCreationTime.dwHighDateTime=0x1d8b8cf, ftLastAccessTime.dwLowDateTime=0xc18481e0, ftLastAccessTime.dwHighDateTime=0x1d8bc4d, ftLastWriteTime.dwLowDateTime=0xc18481e0, ftLastWriteTime.dwHighDateTime=0x1d8bc4d, nFileSizeHigh=0x0, nFileSizeLow=0x1097a, dwReserved0=0x0, dwReserved1=0x0, cFileName="4v Ewyk-A.gif", cAlternateFileName="4VEWYK~1.GIF")) returned 1 [0122.101] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b1896b0, ftCreationTime.dwHighDateTime=0x1d8bab1, ftLastAccessTime.dwLowDateTime=0xb622a920, ftLastAccessTime.dwHighDateTime=0x1d8bac8, ftLastWriteTime.dwLowDateTime=0xb622a920, ftLastWriteTime.dwHighDateTime=0x1d8bac8, nFileSizeHigh=0x0, nFileSizeLow=0x16386, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cd IpDdd5KAfj8fH3OK3.xls", cAlternateFileName="CDIPDD~1.XLS")) returned 1 [0122.101] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe80673a0, ftCreationTime.dwHighDateTime=0x1d8bd06, ftLastAccessTime.dwLowDateTime=0x6c369250, ftLastAccessTime.dwHighDateTime=0x1d8c0bc, ftLastWriteTime.dwLowDateTime=0x6c369250, ftLastWriteTime.dwHighDateTime=0x1d8c0bc, nFileSizeHigh=0x0, nFileSizeLow=0xc7f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="iHB.mkv", cAlternateFileName="")) returned 1 [0122.101] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b6f9160, ftCreationTime.dwHighDateTime=0x1d8bf39, ftLastAccessTime.dwLowDateTime=0x53015690, ftLastAccessTime.dwHighDateTime=0x1d8bf5d, ftLastWriteTime.dwLowDateTime=0x53015690, ftLastWriteTime.dwHighDateTime=0x1d8bf5d, nFileSizeHigh=0x0, nFileSizeLow=0x15212, dwReserved0=0x0, dwReserved1=0x0, cFileName="lnmC0XMyDQ9.jpg", cAlternateFileName="LNMC0X~1.JPG")) returned 1 [0122.101] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729ee040, ftCreationTime.dwHighDateTime=0x1d8b660, ftLastAccessTime.dwLowDateTime=0x9c9a3120, ftLastAccessTime.dwHighDateTime=0x1d8ba15, ftLastWriteTime.dwLowDateTime=0x9c9a3120, ftLastWriteTime.dwHighDateTime=0x1d8ba15, nFileSizeHigh=0x0, nFileSizeLow=0xfbbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="LykQr.jpg", cAlternateFileName="")) returned 1 [0122.102] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x683e4460, ftCreationTime.dwHighDateTime=0x1d8b3ea, ftLastAccessTime.dwLowDateTime=0xb362a7e0, ftLastAccessTime.dwHighDateTime=0x1d8bb4e, ftLastWriteTime.dwLowDateTime=0xb362a7e0, ftLastWriteTime.dwHighDateTime=0x1d8bb4e, nFileSizeHigh=0x0, nFileSizeLow=0xf659, dwReserved0=0x0, dwReserved1=0x0, cFileName="molJpyIPFV.jpg", cAlternateFileName="MOLJPY~1.JPG")) returned 1 [0122.102] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x931d0800, ftCreationTime.dwHighDateTime=0x1d8b3dc, ftLastAccessTime.dwLowDateTime=0xa5274680, ftLastAccessTime.dwHighDateTime=0x1d8b79e, ftLastWriteTime.dwLowDateTime=0xa5274680, ftLastWriteTime.dwHighDateTime=0x1d8b79e, nFileSizeHigh=0x0, nFileSizeLow=0x15f9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="NoJ2oBK.swf", cAlternateFileName="")) returned 1 [0122.102] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60f3fb40, ftCreationTime.dwHighDateTime=0x1d8c101, ftLastAccessTime.dwLowDateTime=0x43221150, ftLastAccessTime.dwHighDateTime=0x1d8c120, ftLastWriteTime.dwLowDateTime=0x43221150, ftLastWriteTime.dwHighDateTime=0x1d8c120, nFileSizeHigh=0x0, nFileSizeLow=0xa0b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhOQUGFxH.swf", cAlternateFileName="RHOQUG~1.SWF")) returned 1 [0122.102] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9224d2c0, ftCreationTime.dwHighDateTime=0x1d8bf08, ftLastAccessTime.dwLowDateTime=0x3b26a600, ftLastAccessTime.dwHighDateTime=0x1d8bfa4, ftLastWriteTime.dwLowDateTime=0x3b26a600, ftLastWriteTime.dwHighDateTime=0x1d8bfa4, nFileSizeHigh=0x0, nFileSizeLow=0x3d73, dwReserved0=0x0, dwReserved1=0x0, cFileName="XGbXp3C5lHRkkh6wQq.png", cAlternateFileName="XGBXP3~1.PNG")) returned 1 [0122.102] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa96a7ee0, ftCreationTime.dwHighDateTime=0x1d8bdc7, ftLastAccessTime.dwLowDateTime=0xd9084ac0, ftLastAccessTime.dwHighDateTime=0x1d8be75, ftLastWriteTime.dwLowDateTime=0xd9084ac0, ftLastWriteTime.dwHighDateTime=0x1d8be75, nFileSizeHigh=0x0, nFileSizeLow=0x3a0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="xXflM6cqnSqpKGQtY8r.wav", cAlternateFileName="XXFLM6~1.WAV")) returned 1 [0122.102] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0122.102] FindClose (in: hFindFile=0x688f90 | out: hFindFile=0x688f90) returned 1 [0122.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed34) returned 1 [0122.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed40) returned 1 [0122.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed78) returned 1 [0122.103] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0122.103] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv", nBufferLength=0x32, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv", lpFilePart=0x0) returned 0x31 [0122.103] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\*"), lpFindFileData=0x19eaa0 | out: lpFindFileData=0x19eaa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4add3a80, ftCreationTime.dwHighDateTime=0x1d8bba5, ftLastAccessTime.dwLowDateTime=0x1e605de0, ftLastAccessTime.dwHighDateTime=0x1d8bd8d, ftLastWriteTime.dwLowDateTime=0x1e605de0, ftLastWriteTime.dwHighDateTime=0x1d8bd8d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688f90 [0122.103] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4add3a80, ftCreationTime.dwHighDateTime=0x1d8bba5, ftLastAccessTime.dwLowDateTime=0x1e605de0, ftLastAccessTime.dwHighDateTime=0x1d8bd8d, ftLastWriteTime.dwLowDateTime=0x1e605de0, ftLastWriteTime.dwHighDateTime=0x1d8bd8d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0122.103] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24372040, ftCreationTime.dwHighDateTime=0x1d8be60, ftLastAccessTime.dwLowDateTime=0x2c985b60, ftLastAccessTime.dwHighDateTime=0x1d8c062, ftLastWriteTime.dwLowDateTime=0x2c985b60, ftLastWriteTime.dwHighDateTime=0x1d8c062, nFileSizeHigh=0x0, nFileSizeLow=0x1100a, dwReserved0=0x0, dwReserved1=0x0, cFileName="0ItsVjI3Z5uTF3b.mp3", cAlternateFileName="0ITSVJ~1.MP3")) returned 1 [0122.104] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb77dddd0, ftCreationTime.dwHighDateTime=0x1d8b8cf, ftLastAccessTime.dwLowDateTime=0xc18481e0, ftLastAccessTime.dwHighDateTime=0x1d8bc4d, ftLastWriteTime.dwLowDateTime=0xc18481e0, ftLastWriteTime.dwHighDateTime=0x1d8bc4d, nFileSizeHigh=0x0, nFileSizeLow=0x1097a, dwReserved0=0x0, dwReserved1=0x0, cFileName="4v Ewyk-A.gif", cAlternateFileName="4VEWYK~1.GIF")) returned 1 [0122.104] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b1896b0, ftCreationTime.dwHighDateTime=0x1d8bab1, ftLastAccessTime.dwLowDateTime=0xb622a920, ftLastAccessTime.dwHighDateTime=0x1d8bac8, ftLastWriteTime.dwLowDateTime=0xb622a920, ftLastWriteTime.dwHighDateTime=0x1d8bac8, nFileSizeHigh=0x0, nFileSizeLow=0x16386, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cd IpDdd5KAfj8fH3OK3.xls", cAlternateFileName="CDIPDD~1.XLS")) returned 1 [0122.104] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe80673a0, ftCreationTime.dwHighDateTime=0x1d8bd06, ftLastAccessTime.dwLowDateTime=0x6c369250, ftLastAccessTime.dwHighDateTime=0x1d8c0bc, ftLastWriteTime.dwLowDateTime=0x6c369250, ftLastWriteTime.dwHighDateTime=0x1d8c0bc, nFileSizeHigh=0x0, nFileSizeLow=0xc7f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="iHB.mkv", cAlternateFileName="")) returned 1 [0122.104] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b6f9160, ftCreationTime.dwHighDateTime=0x1d8bf39, ftLastAccessTime.dwLowDateTime=0x53015690, ftLastAccessTime.dwHighDateTime=0x1d8bf5d, ftLastWriteTime.dwLowDateTime=0x53015690, ftLastWriteTime.dwHighDateTime=0x1d8bf5d, nFileSizeHigh=0x0, nFileSizeLow=0x15212, dwReserved0=0x0, dwReserved1=0x0, cFileName="lnmC0XMyDQ9.jpg", cAlternateFileName="LNMC0X~1.JPG")) returned 1 [0122.104] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729ee040, ftCreationTime.dwHighDateTime=0x1d8b660, ftLastAccessTime.dwLowDateTime=0x9c9a3120, ftLastAccessTime.dwHighDateTime=0x1d8ba15, ftLastWriteTime.dwLowDateTime=0x9c9a3120, ftLastWriteTime.dwHighDateTime=0x1d8ba15, nFileSizeHigh=0x0, nFileSizeLow=0xfbbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="LykQr.jpg", cAlternateFileName="")) returned 1 [0122.104] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x683e4460, ftCreationTime.dwHighDateTime=0x1d8b3ea, ftLastAccessTime.dwLowDateTime=0xb362a7e0, ftLastAccessTime.dwHighDateTime=0x1d8bb4e, ftLastWriteTime.dwLowDateTime=0xb362a7e0, ftLastWriteTime.dwHighDateTime=0x1d8bb4e, nFileSizeHigh=0x0, nFileSizeLow=0xf659, dwReserved0=0x0, dwReserved1=0x0, cFileName="molJpyIPFV.jpg", cAlternateFileName="MOLJPY~1.JPG")) returned 1 [0122.105] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x931d0800, ftCreationTime.dwHighDateTime=0x1d8b3dc, ftLastAccessTime.dwLowDateTime=0xa5274680, ftLastAccessTime.dwHighDateTime=0x1d8b79e, ftLastWriteTime.dwLowDateTime=0xa5274680, ftLastWriteTime.dwHighDateTime=0x1d8b79e, nFileSizeHigh=0x0, nFileSizeLow=0x15f9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="NoJ2oBK.swf", cAlternateFileName="")) returned 1 [0122.105] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60f3fb40, ftCreationTime.dwHighDateTime=0x1d8c101, ftLastAccessTime.dwLowDateTime=0x43221150, ftLastAccessTime.dwHighDateTime=0x1d8c120, ftLastWriteTime.dwLowDateTime=0x43221150, ftLastWriteTime.dwHighDateTime=0x1d8c120, nFileSizeHigh=0x0, nFileSizeLow=0xa0b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhOQUGFxH.swf", cAlternateFileName="RHOQUG~1.SWF")) returned 1 [0122.105] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9224d2c0, ftCreationTime.dwHighDateTime=0x1d8bf08, ftLastAccessTime.dwLowDateTime=0x3b26a600, ftLastAccessTime.dwHighDateTime=0x1d8bfa4, ftLastWriteTime.dwLowDateTime=0x3b26a600, ftLastWriteTime.dwHighDateTime=0x1d8bfa4, nFileSizeHigh=0x0, nFileSizeLow=0x3d73, dwReserved0=0x0, dwReserved1=0x0, cFileName="XGbXp3C5lHRkkh6wQq.png", cAlternateFileName="XGBXP3~1.PNG")) returned 1 [0122.105] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa96a7ee0, ftCreationTime.dwHighDateTime=0x1d8bdc7, ftLastAccessTime.dwLowDateTime=0xd9084ac0, ftLastAccessTime.dwHighDateTime=0x1d8be75, ftLastWriteTime.dwLowDateTime=0xd9084ac0, ftLastWriteTime.dwHighDateTime=0x1d8be75, nFileSizeHigh=0x0, nFileSizeLow=0x3a0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="xXflM6cqnSqpKGQtY8r.wav", cAlternateFileName="XXFLM6~1.WAV")) returned 1 [0122.105] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa96a7ee0, ftCreationTime.dwHighDateTime=0x1d8bdc7, ftLastAccessTime.dwLowDateTime=0xd9084ac0, ftLastAccessTime.dwHighDateTime=0x1d8be75, ftLastWriteTime.dwLowDateTime=0xd9084ac0, ftLastWriteTime.dwHighDateTime=0x1d8be75, nFileSizeHigh=0x0, nFileSizeLow=0x3a0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="xXflM6cqnSqpKGQtY8r.wav", cAlternateFileName="XXFLM6~1.WAV")) returned 0 [0122.106] FindClose (in: hFindFile=0x688f90 | out: hFindFile=0x688f90) returned 1 [0122.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed34) returned 1 [0122.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed40) returned 1 [0122.106] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\0ItsVjI3Z5uTF3b.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0122.106] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\0ItsVjI3Z5uTF3b.mp3", nBufferLength=0x46, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\0ItsVjI3Z5uTF3b.mp3", lpFilePart=0x0) returned 0x45 [0122.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0122.106] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\0ItsVjI3Z5uTF3b.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\0itsvji3z5utf3b.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0122.106] GetFileType (hFile=0x364) returned 0x1 [0122.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0122.106] GetFileType (hFile=0x364) returned 0x1 [0122.107] GetFileSize (in: hFile=0x364, lpFileSizeHigh=0x19ed20 | out: lpFileSizeHigh=0x19ed20*=0x0) returned 0x1100a [0122.107] ReadFile (in: hFile=0x364, lpBuffer=0x23a0d6c, nNumberOfBytesToRead=0x1100a, lpNumberOfBytesRead=0x19eccc, lpOverlapped=0x0 | out: lpBuffer=0x23a0d6c*, lpNumberOfBytesRead=0x19eccc*=0x1100a, lpOverlapped=0x0) returned 1 [0122.107] CloseHandle (hObject=0x364) returned 1 [0122.136] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0122.136] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0122.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0122.136] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed14 | out: lpFileInformation=0x19ed14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0122.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0122.136] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\0ItsVjI3Z5uTF3b.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0122.137] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\0ItsVjI3Z5uTF3b.mp3", nBufferLength=0x46, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\0ItsVjI3Z5uTF3b.mp3", lpFilePart=0x0) returned 0x45 [0122.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec10) returned 1 [0122.137] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\0ItsVjI3Z5uTF3b.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\0itsvji3z5utf3b.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0122.139] GetFileType (hFile=0x364) returned 0x1 [0122.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec0c) returned 1 [0122.139] GetFileType (hFile=0x364) returned 0x1 [0122.139] WriteFile (in: hFile=0x364, lpBuffer=0x2420b9c*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x19ecc0, lpOverlapped=0x0 | out: lpBuffer=0x2420b9c*, lpNumberOfBytesWritten=0x19ecc0*=0x11010, lpOverlapped=0x0) returned 1 [0122.141] CloseHandle (hObject=0x364) returned 1 [0122.145] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\0ItsVjI3Z5uTF3b.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0122.145] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\0ItsVjI3Z5uTF3b.mp3", nBufferLength=0x46, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\0ItsVjI3Z5uTF3b.mp3", lpFilePart=0x0) returned 0x45 [0122.145] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\0ItsVjI3Z5uTF3b.mp3.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0122.145] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\0ItsVjI3Z5uTF3b.mp3.paradox", nBufferLength=0x4e, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\0ItsVjI3Z5uTF3b.mp3.paradox", lpFilePart=0x0) returned 0x4d [0122.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eca4) returned 1 [0122.145] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\0ItsVjI3Z5uTF3b.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\0itsvji3z5utf3b.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19ed20 | out: lpFileInformation=0x19ed20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24372040, ftCreationTime.dwHighDateTime=0x1d8be60, ftLastAccessTime.dwLowDateTime=0x2c985b60, ftLastAccessTime.dwHighDateTime=0x1d8c062, ftLastWriteTime.dwLowDateTime=0xc0fa105e, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x11010)) returned 1 [0122.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eca0) returned 1 [0122.146] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\0ItsVjI3Z5uTF3b.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\0itsvji3z5utf3b.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\0ItsVjI3Z5uTF3b.mp3.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\0itsvji3z5utf3b.mp3.paradox")) returned 1 [0122.147] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\Cd IpDdd5KAfj8fH3OK3.xls", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4b [0122.147] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\Cd IpDdd5KAfj8fH3OK3.xls", nBufferLength=0x4b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\Cd IpDdd5KAfj8fH3OK3.xls", lpFilePart=0x0) returned 0x4a [0122.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0122.147] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\Cd IpDdd5KAfj8fH3OK3.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\cd ipddd5kafj8fh3ok3.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0122.147] GetFileType (hFile=0x364) returned 0x1 [0122.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0122.147] GetFileType (hFile=0x364) returned 0x1 [0122.147] GetFileSize (in: hFile=0x364, lpFileSizeHigh=0x19ed20 | out: lpFileSizeHigh=0x19ed20*=0x0) returned 0x16386 [0122.148] ReadFile (in: hFile=0x364, lpBuffer=0x3355310, nNumberOfBytesToRead=0x16386, lpNumberOfBytesRead=0x19eccc, lpOverlapped=0x0 | out: lpBuffer=0x3355310*, lpNumberOfBytesRead=0x19eccc*=0x16386, lpOverlapped=0x0) returned 1 [0122.150] CloseHandle (hObject=0x364) returned 1 [0122.186] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0122.186] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0122.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0122.186] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed14 | out: lpFileInformation=0x19ed14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0122.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0122.186] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\Cd IpDdd5KAfj8fH3OK3.xls", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4b [0122.186] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\Cd IpDdd5KAfj8fH3OK3.xls", nBufferLength=0x4b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\Cd IpDdd5KAfj8fH3OK3.xls", lpFilePart=0x0) returned 0x4a [0122.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec10) returned 1 [0122.186] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\Cd IpDdd5KAfj8fH3OK3.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\cd ipddd5kafj8fh3ok3.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0122.188] GetFileType (hFile=0x364) returned 0x1 [0122.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec0c) returned 1 [0122.189] GetFileType (hFile=0x364) returned 0x1 [0122.189] WriteFile (in: hFile=0x364, lpBuffer=0x33c4518*, nNumberOfBytesToWrite=0x16390, lpNumberOfBytesWritten=0x19ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33c4518*, lpNumberOfBytesWritten=0x19ecc0*=0x16390, lpOverlapped=0x0) returned 1 [0122.195] CloseHandle (hObject=0x364) returned 1 [0122.199] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\Cd IpDdd5KAfj8fH3OK3.xls", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4b [0122.199] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\Cd IpDdd5KAfj8fH3OK3.xls", nBufferLength=0x4b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\Cd IpDdd5KAfj8fH3OK3.xls", lpFilePart=0x0) returned 0x4a [0122.199] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\Cd IpDdd5KAfj8fH3OK3.xls.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0122.199] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\Cd IpDdd5KAfj8fH3OK3.xls.paradox", nBufferLength=0x53, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\Cd IpDdd5KAfj8fH3OK3.xls.paradox", lpFilePart=0x0) returned 0x52 [0122.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eca4) returned 1 [0122.200] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\Cd IpDdd5KAfj8fH3OK3.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\cd ipddd5kafj8fh3ok3.xls"), fInfoLevelId=0x0, lpFileInformation=0x19ed20 | out: lpFileInformation=0x19ed20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b1896b0, ftCreationTime.dwHighDateTime=0x1d8bab1, ftLastAccessTime.dwLowDateTime=0xb622a920, ftLastAccessTime.dwHighDateTime=0x1d8bac8, ftLastWriteTime.dwLowDateTime=0xc1013848, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x16390)) returned 1 [0122.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eca0) returned 1 [0122.200] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\Cd IpDdd5KAfj8fH3OK3.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\cd ipddd5kafj8fh3ok3.xls"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\Cd IpDdd5KAfj8fH3OK3.xls.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\cd ipddd5kafj8fh3ok3.xls.paradox")) returned 1 [0122.201] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\iHB.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0122.201] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\iHB.mkv", nBufferLength=0x3a, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\iHB.mkv", lpFilePart=0x0) returned 0x39 [0122.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0122.201] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\iHB.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\ihb.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0122.201] GetFileType (hFile=0x364) returned 0x1 [0122.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0122.201] GetFileType (hFile=0x364) returned 0x1 [0122.201] GetFileSize (in: hFile=0x364, lpFileSizeHigh=0x19ed20 | out: lpFileSizeHigh=0x19ed20*=0x0) returned 0xc7f0 [0122.201] ReadFile (in: hFile=0x364, lpBuffer=0x247ef50, nNumberOfBytesToRead=0xc7f0, lpNumberOfBytesRead=0x19eccc, lpOverlapped=0x0 | out: lpBuffer=0x247ef50*, lpNumberOfBytesRead=0x19eccc*=0xc7f0, lpOverlapped=0x0) returned 1 [0122.202] CloseHandle (hObject=0x364) returned 1 [0122.282] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0122.282] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0122.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0122.282] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed14 | out: lpFileInformation=0x19ed14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0122.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0122.282] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\iHB.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0122.282] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\iHB.mkv", nBufferLength=0x3a, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\iHB.mkv", lpFilePart=0x0) returned 0x39 [0122.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec10) returned 1 [0122.283] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\iHB.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\ihb.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0122.285] GetFileType (hFile=0x364) returned 0x1 [0122.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec0c) returned 1 [0122.285] GetFileType (hFile=0x364) returned 0x1 [0122.285] WriteFile (in: hFile=0x364, lpBuffer=0x24f154c*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x19ecc0, lpOverlapped=0x0 | out: lpBuffer=0x24f154c*, lpNumberOfBytesWritten=0x19ecc0*=0xc800, lpOverlapped=0x0) returned 1 [0122.287] CloseHandle (hObject=0x364) returned 1 [0122.294] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\iHB.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0122.294] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\iHB.mkv", nBufferLength=0x3a, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\iHB.mkv", lpFilePart=0x0) returned 0x39 [0122.294] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\iHB.mkv.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0122.294] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\iHB.mkv.paradox", nBufferLength=0x42, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\iHB.mkv.paradox", lpFilePart=0x0) returned 0x41 [0122.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eca4) returned 1 [0122.294] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\iHB.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\ihb.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19ed20 | out: lpFileInformation=0x19ed20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe80673a0, ftCreationTime.dwHighDateTime=0x1d8bd06, ftLastAccessTime.dwLowDateTime=0x6c369250, ftLastAccessTime.dwHighDateTime=0x1d8c0bc, ftLastWriteTime.dwLowDateTime=0xc10f8671, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xc800)) returned 1 [0122.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eca0) returned 1 [0122.294] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\iHB.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\ihb.mkv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\iHB.mkv.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\ihb.mkv.paradox")) returned 1 [0122.295] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\lnmC0XMyDQ9.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0122.295] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\lnmC0XMyDQ9.jpg", nBufferLength=0x42, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\lnmC0XMyDQ9.jpg", lpFilePart=0x0) returned 0x41 [0122.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0122.295] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\lnmC0XMyDQ9.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\lnmc0xmydq9.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0122.296] GetFileType (hFile=0x364) returned 0x1 [0122.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0122.296] GetFileType (hFile=0x364) returned 0x1 [0122.296] GetFileSize (in: hFile=0x364, lpFileSizeHigh=0x19ed20 | out: lpFileSizeHigh=0x19ed20*=0x0) returned 0x15212 [0122.297] ReadFile (in: hFile=0x364, lpBuffer=0x33f38c8, nNumberOfBytesToRead=0x15212, lpNumberOfBytesRead=0x19eccc, lpOverlapped=0x0 | out: lpBuffer=0x33f38c8*, lpNumberOfBytesRead=0x19eccc*=0x15212, lpOverlapped=0x0) returned 1 [0122.299] CloseHandle (hObject=0x364) returned 1 [0122.340] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0122.340] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0122.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0122.340] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed14 | out: lpFileInformation=0x19ed14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0122.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0122.341] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\lnmC0XMyDQ9.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0122.341] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\lnmC0XMyDQ9.jpg", nBufferLength=0x42, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\lnmC0XMyDQ9.jpg", lpFilePart=0x0) returned 0x41 [0122.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec10) returned 1 [0122.341] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\lnmC0XMyDQ9.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\lnmc0xmydq9.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0122.343] GetFileType (hFile=0x364) returned 0x1 [0122.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec0c) returned 1 [0122.343] GetFileType (hFile=0x364) returned 0x1 [0122.343] WriteFile (in: hFile=0x364, lpBuffer=0x345d398*, nNumberOfBytesToWrite=0x15220, lpNumberOfBytesWritten=0x19ecc0, lpOverlapped=0x0 | out: lpBuffer=0x345d398*, lpNumberOfBytesWritten=0x19ecc0*=0x15220, lpOverlapped=0x0) returned 1 [0122.347] CloseHandle (hObject=0x364) returned 1 [0122.351] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\lnmC0XMyDQ9.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0122.351] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\lnmC0XMyDQ9.jpg", nBufferLength=0x42, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\lnmC0XMyDQ9.jpg", lpFilePart=0x0) returned 0x41 [0122.351] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\lnmC0XMyDQ9.jpg.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0122.351] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\lnmC0XMyDQ9.jpg.paradox", nBufferLength=0x4a, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\lnmC0XMyDQ9.jpg.paradox", lpFilePart=0x0) returned 0x49 [0122.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eca4) returned 1 [0122.351] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\lnmC0XMyDQ9.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\lnmc0xmydq9.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ed20 | out: lpFileInformation=0x19ed20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b6f9160, ftCreationTime.dwHighDateTime=0x1d8bf39, ftLastAccessTime.dwLowDateTime=0x53015690, ftLastAccessTime.dwHighDateTime=0x1d8bf5d, ftLastWriteTime.dwLowDateTime=0xc1190fe7, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x15220)) returned 1 [0122.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eca0) returned 1 [0122.352] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\lnmC0XMyDQ9.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\lnmc0xmydq9.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\lnmC0XMyDQ9.jpg.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\lnmc0xmydq9.jpg.paradox")) returned 1 [0122.357] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\LykQr.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0122.357] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\LykQr.jpg", nBufferLength=0x3c, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\LykQr.jpg", lpFilePart=0x0) returned 0x3b [0122.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0122.357] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\LykQr.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\lykqr.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0122.357] GetFileType (hFile=0x364) returned 0x1 [0122.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0122.357] GetFileType (hFile=0x364) returned 0x1 [0122.358] GetFileSize (in: hFile=0x364, lpFileSizeHigh=0x19ed20 | out: lpFileSizeHigh=0x19ed20*=0x0) returned 0xfbbe [0122.358] ReadFile (in: hFile=0x364, lpBuffer=0x234be48, nNumberOfBytesToRead=0xfbbe, lpNumberOfBytesRead=0x19eccc, lpOverlapped=0x0 | out: lpBuffer=0x234be48*, lpNumberOfBytesRead=0x19eccc*=0xfbbe, lpOverlapped=0x0) returned 1 [0122.358] CloseHandle (hObject=0x364) returned 1 [0122.390] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0122.390] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0122.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0122.391] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed14 | out: lpFileInformation=0x19ed14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0122.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0122.391] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\LykQr.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0122.391] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\LykQr.jpg", nBufferLength=0x3c, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\LykQr.jpg", lpFilePart=0x0) returned 0x3b [0122.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec10) returned 1 [0122.391] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\LykQr.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\lykqr.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0122.404] GetFileType (hFile=0x364) returned 0x1 [0122.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec0c) returned 1 [0122.404] GetFileType (hFile=0x364) returned 0x1 [0122.404] WriteFile (in: hFile=0x364, lpBuffer=0x23c80e4*, nNumberOfBytesToWrite=0xfbc0, lpNumberOfBytesWritten=0x19ecc0, lpOverlapped=0x0 | out: lpBuffer=0x23c80e4*, lpNumberOfBytesWritten=0x19ecc0*=0xfbc0, lpOverlapped=0x0) returned 1 [0122.406] CloseHandle (hObject=0x364) returned 1 [0122.413] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\LykQr.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0122.413] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\LykQr.jpg", nBufferLength=0x3c, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\LykQr.jpg", lpFilePart=0x0) returned 0x3b [0122.413] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\LykQr.jpg.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0122.413] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\LykQr.jpg.paradox", nBufferLength=0x44, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\LykQr.jpg.paradox", lpFilePart=0x0) returned 0x43 [0122.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eca4) returned 1 [0122.413] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\LykQr.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\lykqr.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ed20 | out: lpFileInformation=0x19ed20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729ee040, ftCreationTime.dwHighDateTime=0x1d8b660, ftLastAccessTime.dwLowDateTime=0x9c9a3120, ftLastAccessTime.dwHighDateTime=0x1d8ba15, ftLastWriteTime.dwLowDateTime=0xc12298f4, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xfbc0)) returned 1 [0122.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eca0) returned 1 [0122.413] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\LykQr.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\lykqr.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\LykQr.jpg.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\lykqr.jpg.paradox")) returned 1 [0122.414] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\molJpyIPFV.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0122.414] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\molJpyIPFV.jpg", nBufferLength=0x41, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\molJpyIPFV.jpg", lpFilePart=0x0) returned 0x40 [0122.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0122.414] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\molJpyIPFV.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\moljpyipfv.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0122.414] GetFileType (hFile=0x364) returned 0x1 [0122.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0122.415] GetFileType (hFile=0x364) returned 0x1 [0122.415] GetFileSize (in: hFile=0x364, lpFileSizeHigh=0x19ed20 | out: lpFileSizeHigh=0x19ed20*=0x0) returned 0xf659 [0122.415] ReadFile (in: hFile=0x364, lpBuffer=0x23d7f38, nNumberOfBytesToRead=0xf659, lpNumberOfBytesRead=0x19eccc, lpOverlapped=0x0 | out: lpBuffer=0x23d7f38*, lpNumberOfBytesRead=0x19eccc*=0xf659, lpOverlapped=0x0) returned 1 [0122.415] CloseHandle (hObject=0x364) returned 1 [0122.444] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0122.444] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0122.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0122.444] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed14 | out: lpFileInformation=0x19ed14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0122.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0122.444] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\molJpyIPFV.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0122.444] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\molJpyIPFV.jpg", nBufferLength=0x41, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\molJpyIPFV.jpg", lpFilePart=0x0) returned 0x40 [0122.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec10) returned 1 [0122.444] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\molJpyIPFV.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\moljpyipfv.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0122.446] GetFileType (hFile=0x364) returned 0x1 [0122.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec0c) returned 1 [0122.446] GetFileType (hFile=0x364) returned 0x1 [0122.446] WriteFile (in: hFile=0x364, lpBuffer=0x2453058*, nNumberOfBytesToWrite=0xf660, lpNumberOfBytesWritten=0x19ecc0, lpOverlapped=0x0 | out: lpBuffer=0x2453058*, lpNumberOfBytesWritten=0x19ecc0*=0xf660, lpOverlapped=0x0) returned 1 [0122.449] CloseHandle (hObject=0x364) returned 1 [0122.453] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\molJpyIPFV.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0122.453] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\molJpyIPFV.jpg", nBufferLength=0x41, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\molJpyIPFV.jpg", lpFilePart=0x0) returned 0x40 [0122.453] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\molJpyIPFV.jpg.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0122.453] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\molJpyIPFV.jpg.paradox", nBufferLength=0x49, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\molJpyIPFV.jpg.paradox", lpFilePart=0x0) returned 0x48 [0122.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eca4) returned 1 [0122.453] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\molJpyIPFV.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\moljpyipfv.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ed20 | out: lpFileInformation=0x19ed20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x683e4460, ftCreationTime.dwHighDateTime=0x1d8b3ea, ftLastAccessTime.dwLowDateTime=0xb362a7e0, ftLastAccessTime.dwHighDateTime=0x1d8bb4e, ftLastWriteTime.dwLowDateTime=0xc1275dde, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xf660)) returned 1 [0122.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eca0) returned 1 [0122.453] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\molJpyIPFV.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\moljpyipfv.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\molJpyIPFV.jpg.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\moljpyipfv.jpg.paradox")) returned 1 [0122.454] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\XGbXp3C5lHRkkh6wQq.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0122.454] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\XGbXp3C5lHRkkh6wQq.png", nBufferLength=0x49, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\XGbXp3C5lHRkkh6wQq.png", lpFilePart=0x0) returned 0x48 [0122.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0122.454] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\XGbXp3C5lHRkkh6wQq.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\xgbxp3c5lhrkkh6wqq.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0122.454] GetFileType (hFile=0x364) returned 0x1 [0122.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0122.583] GetFileType (hFile=0x364) returned 0x1 [0122.583] GetFileSize (in: hFile=0x364, lpFileSizeHigh=0x19ed20 | out: lpFileSizeHigh=0x19ed20*=0x0) returned 0x3d73 [0122.583] ReadFile (in: hFile=0x364, lpBuffer=0x24629a4, nNumberOfBytesToRead=0x3d73, lpNumberOfBytesRead=0x19eccc, lpOverlapped=0x0 | out: lpBuffer=0x24629a4*, lpNumberOfBytesRead=0x19eccc*=0x3d73, lpOverlapped=0x0) returned 1 [0122.583] CloseHandle (hObject=0x364) returned 1 [0122.708] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0122.708] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0122.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0122.708] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed14 | out: lpFileInformation=0x19ed14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0122.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0122.708] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\XGbXp3C5lHRkkh6wQq.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0122.709] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\XGbXp3C5lHRkkh6wQq.png", nBufferLength=0x49, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\XGbXp3C5lHRkkh6wQq.png", lpFilePart=0x0) returned 0x48 [0122.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec10) returned 1 [0122.709] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\XGbXp3C5lHRkkh6wQq.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\xgbxp3c5lhrkkh6wqq.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0122.710] GetFileType (hFile=0x364) returned 0x1 [0122.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec0c) returned 1 [0122.710] GetFileType (hFile=0x364) returned 0x1 [0122.710] WriteFile (in: hFile=0x364, lpBuffer=0x24c2b10*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x19ecc0, lpOverlapped=0x0 | out: lpBuffer=0x24c2b10*, lpNumberOfBytesWritten=0x19ecc0*=0x3d80, lpOverlapped=0x0) returned 1 [0122.712] CloseHandle (hObject=0x364) returned 1 [0122.714] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\XGbXp3C5lHRkkh6wQq.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0122.714] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\XGbXp3C5lHRkkh6wQq.png", nBufferLength=0x49, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\XGbXp3C5lHRkkh6wQq.png", lpFilePart=0x0) returned 0x48 [0122.714] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\XGbXp3C5lHRkkh6wQq.png.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0122.714] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\XGbXp3C5lHRkkh6wQq.png.paradox", nBufferLength=0x51, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\XGbXp3C5lHRkkh6wQq.png.paradox", lpFilePart=0x0) returned 0x50 [0122.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eca4) returned 1 [0122.714] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\XGbXp3C5lHRkkh6wQq.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\xgbxp3c5lhrkkh6wqq.png"), fInfoLevelId=0x0, lpFileInformation=0x19ed20 | out: lpFileInformation=0x19ed20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9224d2c0, ftCreationTime.dwHighDateTime=0x1d8bf08, ftLastAccessTime.dwLowDateTime=0x3b26a600, ftLastAccessTime.dwHighDateTime=0x1d8bfa4, ftLastWriteTime.dwLowDateTime=0xc14fe5d1, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x3d80)) returned 1 [0122.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eca0) returned 1 [0122.714] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\XGbXp3C5lHRkkh6wQq.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\xgbxp3c5lhrkkh6wqq.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\XGbXp3C5lHRkkh6wQq.png.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\xgbxp3c5lhrkkh6wqq.png.paradox")) returned 1 [0122.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edec) returned 1 [0122.716] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1c [0122.716] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links", nBufferLength=0x1c, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Links", lpFilePart=0x0) returned 0x1b [0122.716] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\links\\*"), lpFindFileData=0x19eb14 | out: lpFindFileData=0x19eb14*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437c7194, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437ed538, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x689290 [0122.717] FindNextFileW (in: hFindFile=0x689290, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437c7194, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437ed538, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0122.717] FindNextFileW (in: hFindFile=0x689290, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x43754b80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43754b80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437ed538, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0122.717] FindNextFileW (in: hFindFile=0x689290, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437c7194, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437c7194, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437c7194, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x207, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0122.717] FindNextFileW (in: hFindFile=0x689290, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437c7194, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437c7194, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437c7194, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x3d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0122.717] FindNextFileW (in: hFindFile=0x689290, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0122.718] FindClose (in: hFindFile=0x689290 | out: hFindFile=0x689290) returned 1 [0122.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda8) returned 1 [0122.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb4) returned 1 [0122.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edec) returned 1 [0122.718] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1c [0122.718] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links", nBufferLength=0x1c, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Links", lpFilePart=0x0) returned 0x1b [0122.718] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\links\\*"), lpFindFileData=0x19eb14 | out: lpFindFileData=0x19eb14*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437c7194, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437ed538, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688e50 [0122.719] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437c7194, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437ed538, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0122.719] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x43754b80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43754b80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437ed538, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0122.719] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437c7194, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437c7194, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437c7194, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x207, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0122.719] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437c7194, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437c7194, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437c7194, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x3d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0122.719] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437c7194, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437c7194, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437c7194, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x3d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 0 [0122.720] FindClose (in: hFindFile=0x688e50 | out: hFindFile=0x688e50) returned 1 [0122.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda8) returned 1 [0122.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb4) returned 1 [0122.720] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\Desktop.lnk", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0122.720] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\Desktop.lnk", nBufferLength=0x28, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x27 [0122.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0122.767] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\Desktop.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\links\\desktop.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0122.768] GetFileType (hFile=0x364) returned 0x1 [0122.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0122.768] GetFileType (hFile=0x364) returned 0x1 [0122.768] GetFileSize (in: hFile=0x364, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x207 [0122.768] ReadFile (in: hFile=0x364, lpBuffer=0x24c7e40, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x24c7e40*, lpNumberOfBytesRead=0x19ed40*=0x207, lpOverlapped=0x0) returned 1 [0122.769] CloseHandle (hObject=0x364) returned 1 [0122.950] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0122.950] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0122.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0122.951] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0122.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0122.951] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\Desktop.lnk", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0122.951] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\Desktop.lnk", nBufferLength=0x28, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x27 [0122.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0122.951] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\Desktop.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\links\\desktop.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0122.952] GetFileType (hFile=0x364) returned 0x1 [0122.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0122.952] GetFileType (hFile=0x364) returned 0x1 [0122.953] WriteFile (in: hFile=0x364, lpBuffer=0x2317308*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x19ed08, lpOverlapped=0x0 | out: lpBuffer=0x2317308*, lpNumberOfBytesWritten=0x19ed08*=0x210, lpOverlapped=0x0) returned 1 [0122.954] CloseHandle (hObject=0x364) returned 1 [0123.212] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\Desktop.lnk", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0123.212] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\Desktop.lnk", nBufferLength=0x28, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x27 [0123.212] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\Desktop.lnk.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0123.212] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\Desktop.lnk.paradox", nBufferLength=0x30, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Links\\Desktop.lnk.paradox", lpFilePart=0x0) returned 0x2f [0123.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0123.212] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\Desktop.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\links\\desktop.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437c7194, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437c7194, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xc19c310d, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x210)) returned 1 [0123.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0123.212] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\Desktop.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\links\\desktop.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\Desktop.lnk.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\links\\desktop.lnk.paradox")) returned 1 [0123.213] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\Downloads.lnk", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0123.213] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\Downloads.lnk", nBufferLength=0x2a, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x29 [0123.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0123.213] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\Downloads.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\links\\downloads.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0123.213] GetFileType (hFile=0x364) returned 0x1 [0123.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0123.213] GetFileType (hFile=0x364) returned 0x1 [0123.213] GetFileSize (in: hFile=0x364, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x3d0 [0123.214] ReadFile (in: hFile=0x364, lpBuffer=0x23187f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x23187f8*, lpNumberOfBytesRead=0x19ed40*=0x3d0, lpOverlapped=0x0) returned 1 [0123.215] CloseHandle (hObject=0x364) returned 1 [0123.232] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0123.232] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0123.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0123.232] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0123.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0123.232] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\Downloads.lnk", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0123.232] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\Downloads.lnk", nBufferLength=0x2a, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x29 [0123.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0123.232] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\Downloads.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\links\\downloads.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0123.233] GetFileType (hFile=0x364) returned 0x1 [0123.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0123.233] GetFileType (hFile=0x364) returned 0x1 [0123.233] WriteFile (in: hFile=0x364, lpBuffer=0x2367c14*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x19ed08, lpOverlapped=0x0 | out: lpBuffer=0x2367c14*, lpNumberOfBytesWritten=0x19ed08*=0x3e0, lpOverlapped=0x0) returned 1 [0123.234] CloseHandle (hObject=0x364) returned 1 [0123.236] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\Downloads.lnk", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0123.236] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\Downloads.lnk", nBufferLength=0x2a, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x29 [0123.236] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\Downloads.lnk.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0123.236] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\Downloads.lnk.paradox", nBufferLength=0x32, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Links\\Downloads.lnk.paradox", lpFilePart=0x0) returned 0x31 [0123.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0123.236] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\Downloads.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\links\\downloads.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437c7194, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437c7194, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xc19e96e7, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x3e0)) returned 1 [0123.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0123.236] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\Downloads.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\links\\downloads.lnk"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\Downloads.lnk.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\links\\downloads.lnk.paradox")) returned 1 [0123.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edec) returned 1 [0123.237] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Contacts", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1f [0123.237] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Contacts", nBufferLength=0x1f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Contacts", lpFilePart=0x0) returned 0x1e [0123.237] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Contacts\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\contacts\\*"), lpFindFileData=0x19eb14 | out: lpFindFileData=0x19eb14*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688f90 [0123.238] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.238] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0123.238] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0123.238] FindClose (in: hFindFile=0x688f90 | out: hFindFile=0x688f90) returned 1 [0123.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda8) returned 1 [0123.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb4) returned 1 [0123.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edec) returned 1 [0123.238] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Contacts", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1f [0123.238] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Contacts", nBufferLength=0x1f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Contacts", lpFilePart=0x0) returned 0x1e [0123.238] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Contacts\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\contacts\\*"), lpFindFileData=0x19eb14 | out: lpFindFileData=0x19eb14*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688f90 [0123.239] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.239] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0123.239] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0123.239] FindClose (in: hFindFile=0x688f90 | out: hFindFile=0x688f90) returned 1 [0123.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda8) returned 1 [0123.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb4) returned 1 [0123.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edec) returned 1 [0123.239] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1e [0123.240] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x1e, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x0) returned 0x1d [0123.240] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\*"), lpFindFileData=0x19eb14 | out: lpFindFileData=0x19eb14*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xc0f2eaba, ftLastAccessTime.dwHighDateTime=0x1d8cd7a, ftLastWriteTime.dwLowDateTime=0xc0f2eaba, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688f90 [0123.240] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xc0f2eaba, ftLastAccessTime.dwHighDateTime=0x1d8cd7a, ftLastWriteTime.dwLowDateTime=0xc0f2eaba, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.240] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50db7670, ftCreationTime.dwHighDateTime=0x1d8bd46, ftLastAccessTime.dwLowDateTime=0x251bda50, ftLastAccessTime.dwHighDateTime=0x1d8beb5, ftLastWriteTime.dwLowDateTime=0x251bda50, ftLastWriteTime.dwHighDateTime=0x1d8beb5, nFileSizeHigh=0x0, nFileSizeLow=0x16e05, dwReserved0=0x0, dwReserved1=0x0, cFileName="-Fh w0BxDTngt3.gif", cAlternateFileName="-FHW0B~1.GIF")) returned 1 [0123.240] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed9beb40, ftCreationTime.dwHighDateTime=0x1d8bdad, ftLastAccessTime.dwLowDateTime=0x157bd2c0, ftLastAccessTime.dwHighDateTime=0x1d8bf8d, ftLastWriteTime.dwLowDateTime=0xc0339b2b, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x187a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3ALR.avi.paradox", cAlternateFileName="3ALRAV~1.PAR")) returned 1 [0123.240] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47196310, ftCreationTime.dwHighDateTime=0x1d8bdc6, ftLastAccessTime.dwLowDateTime=0x9052ec80, ftLastAccessTime.dwHighDateTime=0x1d8c006, ftLastWriteTime.dwLowDateTime=0x9052ec80, ftLastWriteTime.dwHighDateTime=0x1d8c006, nFileSizeHigh=0x0, nFileSizeLow=0x16065, dwReserved0=0x0, dwReserved1=0x0, cFileName="3V26078_t3PycYa-.m4a", cAlternateFileName="3V2607~1.M4A")) returned 1 [0123.241] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x414fc4f0, ftCreationTime.dwHighDateTime=0x1d8bbd3, ftLastAccessTime.dwLowDateTime=0xbb970c20, ftLastAccessTime.dwHighDateTime=0x1d8bbdb, ftLastWriteTime.dwLowDateTime=0xc041e958, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x121e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6gsF_oOWDuB.ppt.paradox", cAlternateFileName="6GSF_O~1.PAR")) returned 1 [0123.241] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e5a50a0, ftCreationTime.dwHighDateTime=0x1d8b61d, ftLastAccessTime.dwLowDateTime=0x7376d990, ftLastAccessTime.dwHighDateTime=0x1d8c0fc, ftLastWriteTime.dwLowDateTime=0x7376d990, ftLastWriteTime.dwHighDateTime=0x1d8c0fc, nFileSizeHigh=0x0, nFileSizeLow=0x6880, dwReserved0=0x0, dwReserved1=0x0, cFileName="7aoXqL.swf", cAlternateFileName="")) returned 1 [0123.241] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x385fac20, ftCreationTime.dwHighDateTime=0x1d8b2d2, ftLastAccessTime.dwLowDateTime=0x986b4d30, ftLastAccessTime.dwHighDateTime=0x1d8b6e3, ftLastWriteTime.dwLowDateTime=0x986b4d30, ftLastWriteTime.dwHighDateTime=0x1d8b6e3, nFileSizeHigh=0x0, nFileSizeLow=0x16e46, dwReserved0=0x0, dwReserved1=0x0, cFileName="7ibZqS-WGiyBMZF.wav", cAlternateFileName="7IBZQS~1.WAV")) returned 1 [0123.241] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb016c0, ftCreationTime.dwHighDateTime=0x1d8bdfc, ftLastAccessTime.dwLowDateTime=0x5735fbe0, ftLastAccessTime.dwHighDateTime=0x1d8c097, ftLastWriteTime.dwLowDateTime=0x5735fbe0, ftLastWriteTime.dwHighDateTime=0x1d8c097, nFileSizeHigh=0x0, nFileSizeLow=0x146bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="8y9XFR.swf", cAlternateFileName="")) returned 1 [0123.241] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7143a430, ftCreationTime.dwHighDateTime=0x1d8bd3e, ftLastAccessTime.dwLowDateTime=0x705c7d60, ftLastAccessTime.dwHighDateTime=0x1d8c100, ftLastWriteTime.dwLowDateTime=0xc049111f, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xe300, dwReserved0=0x0, dwReserved1=0x0, cFileName="avNCvKIbZERjJ6.odt.paradox", cAlternateFileName="AVNCVK~1.PAR")) returned 1 [0123.241] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4f9d7d0, ftCreationTime.dwHighDateTime=0x1d8b81b, ftLastAccessTime.dwLowDateTime=0xf54866c0, ftLastAccessTime.dwHighDateTime=0x1d8b998, ftLastWriteTime.dwLowDateTime=0xf54866c0, ftLastWriteTime.dwHighDateTime=0x1d8b998, nFileSizeHigh=0x0, nFileSizeLow=0xf4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bypP-pP55W0EP.flv", cAlternateFileName="BYPP-P~1.FLV")) returned 1 [0123.242] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0123.242] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb5ea9c0, ftCreationTime.dwHighDateTime=0x1d8b4a4, ftLastAccessTime.dwLowDateTime=0x32c1d270, ftLastAccessTime.dwHighDateTime=0x1d8b741, ftLastWriteTime.dwLowDateTime=0x32c1d270, ftLastWriteTime.dwHighDateTime=0x1d8b741, nFileSizeHigh=0x0, nFileSizeLow=0x4f56, dwReserved0=0x0, dwReserved1=0x0, cFileName="DN3YGl_MaifjgT.swf", cAlternateFileName="DN3YGL~1.SWF")) returned 1 [0123.242] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x604dc3a0, ftCreationTime.dwHighDateTime=0x1d8b752, ftLastAccessTime.dwLowDateTime=0xe75098d0, ftLastAccessTime.dwHighDateTime=0x1d8be11, ftLastWriteTime.dwLowDateTime=0xe75098d0, ftLastWriteTime.dwHighDateTime=0x1d8be11, nFileSizeHigh=0x0, nFileSizeLow=0x163fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="E4VYDeroN3BRcqUdFN5C.swf", cAlternateFileName="E4VYDE~1.SWF")) returned 1 [0123.242] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dd0ef0, ftCreationTime.dwHighDateTime=0x1d8b209, ftLastAccessTime.dwLowDateTime=0x5bfd82a0, ftLastAccessTime.dwHighDateTime=0x1d8bd00, ftLastWriteTime.dwLowDateTime=0x5bfd82a0, ftLastWriteTime.dwHighDateTime=0x1d8bd00, nFileSizeHigh=0x0, nFileSizeLow=0xcb57, dwReserved0=0x0, dwReserved1=0x0, cFileName="fZRMjwEXE.gif", cAlternateFileName="FZRMJW~1.GIF")) returned 1 [0123.242] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3e37cd0, ftCreationTime.dwHighDateTime=0x1d8b39c, ftLastAccessTime.dwLowDateTime=0xfc314330, ftLastAccessTime.dwHighDateTime=0x1d8be8e, ftLastWriteTime.dwLowDateTime=0xc05c2331, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x123e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="G620aC.jpg.paradox", cAlternateFileName="G620AC~1.PAR")) returned 1 [0123.242] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc595c380, ftCreationTime.dwHighDateTime=0x1d8bfb2, ftLastAccessTime.dwLowDateTime=0x2cc74ca0, ftLastAccessTime.dwHighDateTime=0x1d8c0fc, ftLastWriteTime.dwLowDateTime=0xc0765cc0, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x17ef0, dwReserved0=0x0, dwReserved1=0x0, cFileName="g_RTTfqyXS6.jpg.paradox", cAlternateFileName="G_RTTF~1.PAR")) returned 1 [0123.243] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c90710, ftCreationTime.dwHighDateTime=0x1d8bd9a, ftLastAccessTime.dwLowDateTime=0xb4ce3ab0, ftLastAccessTime.dwHighDateTime=0x1d8bfc0, ftLastWriteTime.dwLowDateTime=0xb4ce3ab0, ftLastWriteTime.dwHighDateTime=0x1d8bfc0, nFileSizeHigh=0x0, nFileSizeLow=0x46e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="hBUYL.flv", cAlternateFileName="")) returned 1 [0123.243] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fc32e10, ftCreationTime.dwHighDateTime=0x1d8be91, ftLastAccessTime.dwLowDateTime=0x91d06a50, ftLastAccessTime.dwHighDateTime=0x1d8c03e, ftLastWriteTime.dwLowDateTime=0xc07b21fa, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x8ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jmlwn5Tr.mp3.paradox", cAlternateFileName="JMLWN5~1.PAR")) returned 1 [0123.243] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eee2140, ftCreationTime.dwHighDateTime=0x1d8b759, ftLastAccessTime.dwLowDateTime=0xa0800a40, ftLastAccessTime.dwHighDateTime=0x1d8c01d, ftLastWriteTime.dwLowDateTime=0xc08a0148, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x185c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ll2MxwxRHWpc2D.jpg.paradox", cAlternateFileName="LL2MXW~1.PAR")) returned 1 [0123.243] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7cee820, ftCreationTime.dwHighDateTime=0x1d8b4aa, ftLastAccessTime.dwLowDateTime=0xa2e45040, ftLastAccessTime.dwHighDateTime=0x1d8c0f2, ftLastWriteTime.dwLowDateTime=0xa2e45040, ftLastWriteTime.dwHighDateTime=0x1d8c0f2, nFileSizeHigh=0x0, nFileSizeLow=0xe6b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="LS8Cz.ods", cAlternateFileName="")) returned 1 [0123.243] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7e125b0, ftCreationTime.dwHighDateTime=0x1d8bc4d, ftLastAccessTime.dwLowDateTime=0xec5e50f0, ftLastAccessTime.dwHighDateTime=0x1d8bf07, ftLastWriteTime.dwLowDateTime=0xec5e50f0, ftLastWriteTime.dwHighDateTime=0x1d8bf07, nFileSizeHigh=0x0, nFileSizeLow=0x41c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lsistx.ods", cAlternateFileName="")) returned 1 [0123.243] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa53ec0, ftCreationTime.dwHighDateTime=0x1d8b8df, ftLastAccessTime.dwLowDateTime=0x4da33d50, ftLastAccessTime.dwHighDateTime=0x1d8c050, ftLastWriteTime.dwLowDateTime=0x4da33d50, ftLastWriteTime.dwHighDateTime=0x1d8c050, nFileSizeHigh=0x0, nFileSizeLow=0x1878e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MF5o-hDHAf3Lkh.gif", cAlternateFileName="MF5O-H~1.GIF")) returned 1 [0123.244] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dd7c7b0, ftCreationTime.dwHighDateTime=0x1d8ba6b, ftLastAccessTime.dwLowDateTime=0xf2f2ca00, ftLastAccessTime.dwHighDateTime=0x1d8bf56, ftLastWriteTime.dwLowDateTime=0xc0938ac4, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x7a10, dwReserved0=0x0, dwReserved1=0x0, cFileName="mO8vZJ2N.png.paradox", cAlternateFileName="MO8VZJ~1.PAR")) returned 1 [0123.244] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a1a3f40, ftCreationTime.dwHighDateTime=0x1d8bbd1, ftLastAccessTime.dwLowDateTime=0x699555d0, ftLastAccessTime.dwHighDateTime=0x1d8bde3, ftLastWriteTime.dwLowDateTime=0xc0ab62c9, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x111d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oFnSAYDpRZb46.mkv.paradox", cAlternateFileName="OFNSAY~1.PAR")) returned 1 [0123.244] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a551b0, ftCreationTime.dwHighDateTime=0x1d8bab5, ftLastAccessTime.dwLowDateTime=0x3f44f490, ftLastAccessTime.dwHighDateTime=0x1d8bf67, ftLastWriteTime.dwLowDateTime=0xc0b74dfe, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x6770, dwReserved0=0x0, dwReserved1=0x0, cFileName="p-cVbO84.doc.paradox", cAlternateFileName="P-CVBO~1.PAR")) returned 1 [0123.244] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3dc7d10, ftCreationTime.dwHighDateTime=0x1d8be87, ftLastAccessTime.dwLowDateTime=0xe04d23b0, ftLastAccessTime.dwHighDateTime=0x1d8c117, ftLastWriteTime.dwLowDateTime=0xe04d23b0, ftLastWriteTime.dwHighDateTime=0x1d8c117, nFileSizeHigh=0x0, nFileSizeLow=0x133ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUJ3QKPvdT.m4a", cAlternateFileName="QUJ3QK~1.M4A")) returned 1 [0123.244] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4add3a80, ftCreationTime.dwHighDateTime=0x1d8bba5, ftLastAccessTime.dwLowDateTime=0xc14fe5d1, ftLastAccessTime.dwHighDateTime=0x1d8cd7a, ftLastWriteTime.dwLowDateTime=0xc14fe5d1, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="r2PRf1U9FnysJo7qVmv", cAlternateFileName="R2PRF1~1")) returned 1 [0123.244] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16785480, ftCreationTime.dwHighDateTime=0x1d8c0e8, ftLastAccessTime.dwLowDateTime=0x52e88960, ftLastAccessTime.dwHighDateTime=0x1d8c108, ftLastWriteTime.dwLowDateTime=0x52e88960, ftLastWriteTime.dwHighDateTime=0x1d8c108, nFileSizeHigh=0x0, nFileSizeLow=0xb29f, dwReserved0=0x0, dwReserved1=0x0, cFileName="rR-MqVkTA.ots", cAlternateFileName="RR-MQV~1.OTS")) returned 1 [0123.244] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a7d44b0, ftCreationTime.dwHighDateTime=0x1d8b88d, ftLastAccessTime.dwLowDateTime=0x1cf4ce0, ftLastAccessTime.dwHighDateTime=0x1d8ba81, ftLastWriteTime.dwLowDateTime=0x1cf4ce0, ftLastWriteTime.dwHighDateTime=0x1d8ba81, nFileSizeHigh=0x0, nFileSizeLow=0x11026, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCyUkv.pps", cAlternateFileName="")) returned 1 [0123.245] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x617393a0, ftCreationTime.dwHighDateTime=0x1d8b7ce, ftLastAccessTime.dwLowDateTime=0xafa57760, ftLastAccessTime.dwHighDateTime=0x1d8c0b5, ftLastWriteTime.dwLowDateTime=0xafa57760, ftLastWriteTime.dwHighDateTime=0x1d8c0b5, nFileSizeHigh=0x0, nFileSizeLow=0xddfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="tDKzRMjG6IpSS.gif", cAlternateFileName="TDKZRM~1.GIF")) returned 1 [0123.245] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d077da0, ftCreationTime.dwHighDateTime=0x1d8b464, ftLastAccessTime.dwLowDateTime=0x2295a640, ftLastAccessTime.dwHighDateTime=0x1d8b702, ftLastWriteTime.dwLowDateTime=0xc0c0d977, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x16b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="VHrKBoE.mkv.paradox", cAlternateFileName="VHRKBO~1.PAR")) returned 1 [0123.245] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7b96490, ftCreationTime.dwHighDateTime=0x1d8b40b, ftLastAccessTime.dwLowDateTime=0x53d381e0, ftLastAccessTime.dwHighDateTime=0x1d8c095, ftLastWriteTime.dwLowDateTime=0xc0ccc4a4, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x36e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPoKyX82Om8q4Ed.avi.paradox", cAlternateFileName="WPOKYX~1.PAR")) returned 1 [0123.245] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0c04460, ftCreationTime.dwHighDateTime=0x1d8bbac, ftLastAccessTime.dwLowDateTime=0xe22a1d70, ftLastAccessTime.dwHighDateTime=0x1d8bcab, ftLastWriteTime.dwLowDateTime=0xc0dfd702, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xe630, dwReserved0=0x0, dwReserved1=0x0, cFileName="x5SAnVmwCY.bmp.paradox", cAlternateFileName="X5SANV~1.PAR")) returned 1 [0123.245] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd96da110, ftCreationTime.dwHighDateTime=0x1d8b937, ftLastAccessTime.dwLowDateTime=0x16b959b0, ftLastAccessTime.dwHighDateTime=0x1d8b9d8, ftLastWriteTime.dwLowDateTime=0x16b959b0, ftLastWriteTime.dwHighDateTime=0x1d8b9d8, nFileSizeHigh=0x0, nFileSizeLow=0x3a34, dwReserved0=0x0, dwReserved1=0x0, cFileName="XsV9.gif", cAlternateFileName="")) returned 1 [0123.245] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32be5e0, ftCreationTime.dwHighDateTime=0x1d8b8f0, ftLastAccessTime.dwLowDateTime=0x80082520, ftLastAccessTime.dwHighDateTime=0x1d8ba7f, ftLastWriteTime.dwLowDateTime=0x80082520, ftLastWriteTime.dwHighDateTime=0x1d8ba7f, nFileSizeHigh=0x0, nFileSizeLow=0x12845, dwReserved0=0x0, dwReserved1=0x0, cFileName="x_OLlWcMaQI.gif", cAlternateFileName="X_OLLW~1.GIF")) returned 1 [0123.246] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c5aec0, ftCreationTime.dwHighDateTime=0x1d8c090, ftLastAccessTime.dwLowDateTime=0x417610, ftLastAccessTime.dwHighDateTime=0x1d8c0c5, ftLastWriteTime.dwLowDateTime=0xc0e70acc, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xc3b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="y-ufahLBUL h.avi.paradox", cAlternateFileName="Y-UFAH~1.PAR")) returned 1 [0123.246] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29fd1960, ftCreationTime.dwHighDateTime=0x1d8b2b4, ftLastAccessTime.dwLowDateTime=0xdf85ec0, ftLastAccessTime.dwHighDateTime=0x1d8bdde, ftLastWriteTime.dwLowDateTime=0xc0f2eaba, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x10b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="zSxZ4J_7Ak.ppt.paradox", cAlternateFileName="ZSXZ4J~1.PAR")) returned 1 [0123.246] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0123.246] FindClose (in: hFindFile=0x688f90 | out: hFindFile=0x688f90) returned 1 [0123.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda8) returned 1 [0123.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb4) returned 1 [0123.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edec) returned 1 [0123.246] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1e [0123.246] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x1e, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x0) returned 0x1d [0123.246] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\*"), lpFindFileData=0x19eb14 | out: lpFindFileData=0x19eb14*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xc0f2eaba, ftLastAccessTime.dwHighDateTime=0x1d8cd7a, ftLastWriteTime.dwLowDateTime=0xc0f2eaba, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688c10 [0123.247] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xc0f2eaba, ftLastAccessTime.dwHighDateTime=0x1d8cd7a, ftLastWriteTime.dwLowDateTime=0xc0f2eaba, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.247] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50db7670, ftCreationTime.dwHighDateTime=0x1d8bd46, ftLastAccessTime.dwLowDateTime=0x251bda50, ftLastAccessTime.dwHighDateTime=0x1d8beb5, ftLastWriteTime.dwLowDateTime=0x251bda50, ftLastWriteTime.dwHighDateTime=0x1d8beb5, nFileSizeHigh=0x0, nFileSizeLow=0x16e05, dwReserved0=0x0, dwReserved1=0x0, cFileName="-Fh w0BxDTngt3.gif", cAlternateFileName="-FHW0B~1.GIF")) returned 1 [0123.247] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed9beb40, ftCreationTime.dwHighDateTime=0x1d8bdad, ftLastAccessTime.dwLowDateTime=0x157bd2c0, ftLastAccessTime.dwHighDateTime=0x1d8bf8d, ftLastWriteTime.dwLowDateTime=0xc0339b2b, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x187a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3ALR.avi.paradox", cAlternateFileName="3ALRAV~1.PAR")) returned 1 [0123.247] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47196310, ftCreationTime.dwHighDateTime=0x1d8bdc6, ftLastAccessTime.dwLowDateTime=0x9052ec80, ftLastAccessTime.dwHighDateTime=0x1d8c006, ftLastWriteTime.dwLowDateTime=0x9052ec80, ftLastWriteTime.dwHighDateTime=0x1d8c006, nFileSizeHigh=0x0, nFileSizeLow=0x16065, dwReserved0=0x0, dwReserved1=0x0, cFileName="3V26078_t3PycYa-.m4a", cAlternateFileName="3V2607~1.M4A")) returned 1 [0123.248] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x414fc4f0, ftCreationTime.dwHighDateTime=0x1d8bbd3, ftLastAccessTime.dwLowDateTime=0xbb970c20, ftLastAccessTime.dwHighDateTime=0x1d8bbdb, ftLastWriteTime.dwLowDateTime=0xc041e958, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x121e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6gsF_oOWDuB.ppt.paradox", cAlternateFileName="6GSF_O~1.PAR")) returned 1 [0123.248] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e5a50a0, ftCreationTime.dwHighDateTime=0x1d8b61d, ftLastAccessTime.dwLowDateTime=0x7376d990, ftLastAccessTime.dwHighDateTime=0x1d8c0fc, ftLastWriteTime.dwLowDateTime=0x7376d990, ftLastWriteTime.dwHighDateTime=0x1d8c0fc, nFileSizeHigh=0x0, nFileSizeLow=0x6880, dwReserved0=0x0, dwReserved1=0x0, cFileName="7aoXqL.swf", cAlternateFileName="")) returned 1 [0123.248] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x385fac20, ftCreationTime.dwHighDateTime=0x1d8b2d2, ftLastAccessTime.dwLowDateTime=0x986b4d30, ftLastAccessTime.dwHighDateTime=0x1d8b6e3, ftLastWriteTime.dwLowDateTime=0x986b4d30, ftLastWriteTime.dwHighDateTime=0x1d8b6e3, nFileSizeHigh=0x0, nFileSizeLow=0x16e46, dwReserved0=0x0, dwReserved1=0x0, cFileName="7ibZqS-WGiyBMZF.wav", cAlternateFileName="7IBZQS~1.WAV")) returned 1 [0123.248] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb016c0, ftCreationTime.dwHighDateTime=0x1d8bdfc, ftLastAccessTime.dwLowDateTime=0x5735fbe0, ftLastAccessTime.dwHighDateTime=0x1d8c097, ftLastWriteTime.dwLowDateTime=0x5735fbe0, ftLastWriteTime.dwHighDateTime=0x1d8c097, nFileSizeHigh=0x0, nFileSizeLow=0x146bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="8y9XFR.swf", cAlternateFileName="")) returned 1 [0123.249] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7143a430, ftCreationTime.dwHighDateTime=0x1d8bd3e, ftLastAccessTime.dwLowDateTime=0x705c7d60, ftLastAccessTime.dwHighDateTime=0x1d8c100, ftLastWriteTime.dwLowDateTime=0xc049111f, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xe300, dwReserved0=0x0, dwReserved1=0x0, cFileName="avNCvKIbZERjJ6.odt.paradox", cAlternateFileName="AVNCVK~1.PAR")) returned 1 [0123.249] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4f9d7d0, ftCreationTime.dwHighDateTime=0x1d8b81b, ftLastAccessTime.dwLowDateTime=0xf54866c0, ftLastAccessTime.dwHighDateTime=0x1d8b998, ftLastWriteTime.dwLowDateTime=0xf54866c0, ftLastWriteTime.dwHighDateTime=0x1d8b998, nFileSizeHigh=0x0, nFileSizeLow=0xf4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bypP-pP55W0EP.flv", cAlternateFileName="BYPP-P~1.FLV")) returned 1 [0123.249] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0123.249] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb5ea9c0, ftCreationTime.dwHighDateTime=0x1d8b4a4, ftLastAccessTime.dwLowDateTime=0x32c1d270, ftLastAccessTime.dwHighDateTime=0x1d8b741, ftLastWriteTime.dwLowDateTime=0x32c1d270, ftLastWriteTime.dwHighDateTime=0x1d8b741, nFileSizeHigh=0x0, nFileSizeLow=0x4f56, dwReserved0=0x0, dwReserved1=0x0, cFileName="DN3YGl_MaifjgT.swf", cAlternateFileName="DN3YGL~1.SWF")) returned 1 [0123.250] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x604dc3a0, ftCreationTime.dwHighDateTime=0x1d8b752, ftLastAccessTime.dwLowDateTime=0xe75098d0, ftLastAccessTime.dwHighDateTime=0x1d8be11, ftLastWriteTime.dwLowDateTime=0xe75098d0, ftLastWriteTime.dwHighDateTime=0x1d8be11, nFileSizeHigh=0x0, nFileSizeLow=0x163fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="E4VYDeroN3BRcqUdFN5C.swf", cAlternateFileName="E4VYDE~1.SWF")) returned 1 [0123.250] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dd0ef0, ftCreationTime.dwHighDateTime=0x1d8b209, ftLastAccessTime.dwLowDateTime=0x5bfd82a0, ftLastAccessTime.dwHighDateTime=0x1d8bd00, ftLastWriteTime.dwLowDateTime=0x5bfd82a0, ftLastWriteTime.dwHighDateTime=0x1d8bd00, nFileSizeHigh=0x0, nFileSizeLow=0xcb57, dwReserved0=0x0, dwReserved1=0x0, cFileName="fZRMjwEXE.gif", cAlternateFileName="FZRMJW~1.GIF")) returned 1 [0123.250] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3e37cd0, ftCreationTime.dwHighDateTime=0x1d8b39c, ftLastAccessTime.dwLowDateTime=0xfc314330, ftLastAccessTime.dwHighDateTime=0x1d8be8e, ftLastWriteTime.dwLowDateTime=0xc05c2331, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x123e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="G620aC.jpg.paradox", cAlternateFileName="G620AC~1.PAR")) returned 1 [0123.250] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc595c380, ftCreationTime.dwHighDateTime=0x1d8bfb2, ftLastAccessTime.dwLowDateTime=0x2cc74ca0, ftLastAccessTime.dwHighDateTime=0x1d8c0fc, ftLastWriteTime.dwLowDateTime=0xc0765cc0, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x17ef0, dwReserved0=0x0, dwReserved1=0x0, cFileName="g_RTTfqyXS6.jpg.paradox", cAlternateFileName="G_RTTF~1.PAR")) returned 1 [0123.251] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c90710, ftCreationTime.dwHighDateTime=0x1d8bd9a, ftLastAccessTime.dwLowDateTime=0xb4ce3ab0, ftLastAccessTime.dwHighDateTime=0x1d8bfc0, ftLastWriteTime.dwLowDateTime=0xb4ce3ab0, ftLastWriteTime.dwHighDateTime=0x1d8bfc0, nFileSizeHigh=0x0, nFileSizeLow=0x46e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="hBUYL.flv", cAlternateFileName="")) returned 1 [0123.251] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fc32e10, ftCreationTime.dwHighDateTime=0x1d8be91, ftLastAccessTime.dwLowDateTime=0x91d06a50, ftLastAccessTime.dwHighDateTime=0x1d8c03e, ftLastWriteTime.dwLowDateTime=0xc07b21fa, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x8ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jmlwn5Tr.mp3.paradox", cAlternateFileName="JMLWN5~1.PAR")) returned 1 [0123.251] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eee2140, ftCreationTime.dwHighDateTime=0x1d8b759, ftLastAccessTime.dwLowDateTime=0xa0800a40, ftLastAccessTime.dwHighDateTime=0x1d8c01d, ftLastWriteTime.dwLowDateTime=0xc08a0148, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x185c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ll2MxwxRHWpc2D.jpg.paradox", cAlternateFileName="LL2MXW~1.PAR")) returned 1 [0123.251] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7cee820, ftCreationTime.dwHighDateTime=0x1d8b4aa, ftLastAccessTime.dwLowDateTime=0xa2e45040, ftLastAccessTime.dwHighDateTime=0x1d8c0f2, ftLastWriteTime.dwLowDateTime=0xa2e45040, ftLastWriteTime.dwHighDateTime=0x1d8c0f2, nFileSizeHigh=0x0, nFileSizeLow=0xe6b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="LS8Cz.ods", cAlternateFileName="")) returned 1 [0123.270] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7e125b0, ftCreationTime.dwHighDateTime=0x1d8bc4d, ftLastAccessTime.dwLowDateTime=0xec5e50f0, ftLastAccessTime.dwHighDateTime=0x1d8bf07, ftLastWriteTime.dwLowDateTime=0xec5e50f0, ftLastWriteTime.dwHighDateTime=0x1d8bf07, nFileSizeHigh=0x0, nFileSizeLow=0x41c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lsistx.ods", cAlternateFileName="")) returned 1 [0123.271] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa53ec0, ftCreationTime.dwHighDateTime=0x1d8b8df, ftLastAccessTime.dwLowDateTime=0x4da33d50, ftLastAccessTime.dwHighDateTime=0x1d8c050, ftLastWriteTime.dwLowDateTime=0x4da33d50, ftLastWriteTime.dwHighDateTime=0x1d8c050, nFileSizeHigh=0x0, nFileSizeLow=0x1878e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MF5o-hDHAf3Lkh.gif", cAlternateFileName="MF5O-H~1.GIF")) returned 1 [0123.271] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dd7c7b0, ftCreationTime.dwHighDateTime=0x1d8ba6b, ftLastAccessTime.dwLowDateTime=0xf2f2ca00, ftLastAccessTime.dwHighDateTime=0x1d8bf56, ftLastWriteTime.dwLowDateTime=0xc0938ac4, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x7a10, dwReserved0=0x0, dwReserved1=0x0, cFileName="mO8vZJ2N.png.paradox", cAlternateFileName="MO8VZJ~1.PAR")) returned 1 [0123.271] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a1a3f40, ftCreationTime.dwHighDateTime=0x1d8bbd1, ftLastAccessTime.dwLowDateTime=0x699555d0, ftLastAccessTime.dwHighDateTime=0x1d8bde3, ftLastWriteTime.dwLowDateTime=0xc0ab62c9, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x111d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oFnSAYDpRZb46.mkv.paradox", cAlternateFileName="OFNSAY~1.PAR")) returned 1 [0123.271] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a551b0, ftCreationTime.dwHighDateTime=0x1d8bab5, ftLastAccessTime.dwLowDateTime=0x3f44f490, ftLastAccessTime.dwHighDateTime=0x1d8bf67, ftLastWriteTime.dwLowDateTime=0xc0b74dfe, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x6770, dwReserved0=0x0, dwReserved1=0x0, cFileName="p-cVbO84.doc.paradox", cAlternateFileName="P-CVBO~1.PAR")) returned 1 [0123.271] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3dc7d10, ftCreationTime.dwHighDateTime=0x1d8be87, ftLastAccessTime.dwLowDateTime=0xe04d23b0, ftLastAccessTime.dwHighDateTime=0x1d8c117, ftLastWriteTime.dwLowDateTime=0xe04d23b0, ftLastWriteTime.dwHighDateTime=0x1d8c117, nFileSizeHigh=0x0, nFileSizeLow=0x133ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUJ3QKPvdT.m4a", cAlternateFileName="QUJ3QK~1.M4A")) returned 1 [0123.272] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4add3a80, ftCreationTime.dwHighDateTime=0x1d8bba5, ftLastAccessTime.dwLowDateTime=0xc14fe5d1, ftLastAccessTime.dwHighDateTime=0x1d8cd7a, ftLastWriteTime.dwLowDateTime=0xc14fe5d1, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="r2PRf1U9FnysJo7qVmv", cAlternateFileName="R2PRF1~1")) returned 1 [0123.272] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16785480, ftCreationTime.dwHighDateTime=0x1d8c0e8, ftLastAccessTime.dwLowDateTime=0x52e88960, ftLastAccessTime.dwHighDateTime=0x1d8c108, ftLastWriteTime.dwLowDateTime=0x52e88960, ftLastWriteTime.dwHighDateTime=0x1d8c108, nFileSizeHigh=0x0, nFileSizeLow=0xb29f, dwReserved0=0x0, dwReserved1=0x0, cFileName="rR-MqVkTA.ots", cAlternateFileName="RR-MQV~1.OTS")) returned 1 [0123.272] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a7d44b0, ftCreationTime.dwHighDateTime=0x1d8b88d, ftLastAccessTime.dwLowDateTime=0x1cf4ce0, ftLastAccessTime.dwHighDateTime=0x1d8ba81, ftLastWriteTime.dwLowDateTime=0x1cf4ce0, ftLastWriteTime.dwHighDateTime=0x1d8ba81, nFileSizeHigh=0x0, nFileSizeLow=0x11026, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCyUkv.pps", cAlternateFileName="")) returned 1 [0123.272] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x617393a0, ftCreationTime.dwHighDateTime=0x1d8b7ce, ftLastAccessTime.dwLowDateTime=0xafa57760, ftLastAccessTime.dwHighDateTime=0x1d8c0b5, ftLastWriteTime.dwLowDateTime=0xafa57760, ftLastWriteTime.dwHighDateTime=0x1d8c0b5, nFileSizeHigh=0x0, nFileSizeLow=0xddfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="tDKzRMjG6IpSS.gif", cAlternateFileName="TDKZRM~1.GIF")) returned 1 [0123.272] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d077da0, ftCreationTime.dwHighDateTime=0x1d8b464, ftLastAccessTime.dwLowDateTime=0x2295a640, ftLastAccessTime.dwHighDateTime=0x1d8b702, ftLastWriteTime.dwLowDateTime=0xc0c0d977, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x16b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="VHrKBoE.mkv.paradox", cAlternateFileName="VHRKBO~1.PAR")) returned 1 [0123.272] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7b96490, ftCreationTime.dwHighDateTime=0x1d8b40b, ftLastAccessTime.dwLowDateTime=0x53d381e0, ftLastAccessTime.dwHighDateTime=0x1d8c095, ftLastWriteTime.dwLowDateTime=0xc0ccc4a4, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x36e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPoKyX82Om8q4Ed.avi.paradox", cAlternateFileName="WPOKYX~1.PAR")) returned 1 [0123.273] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0c04460, ftCreationTime.dwHighDateTime=0x1d8bbac, ftLastAccessTime.dwLowDateTime=0xe22a1d70, ftLastAccessTime.dwHighDateTime=0x1d8bcab, ftLastWriteTime.dwLowDateTime=0xc0dfd702, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xe630, dwReserved0=0x0, dwReserved1=0x0, cFileName="x5SAnVmwCY.bmp.paradox", cAlternateFileName="X5SANV~1.PAR")) returned 1 [0123.273] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd96da110, ftCreationTime.dwHighDateTime=0x1d8b937, ftLastAccessTime.dwLowDateTime=0x16b959b0, ftLastAccessTime.dwHighDateTime=0x1d8b9d8, ftLastWriteTime.dwLowDateTime=0x16b959b0, ftLastWriteTime.dwHighDateTime=0x1d8b9d8, nFileSizeHigh=0x0, nFileSizeLow=0x3a34, dwReserved0=0x0, dwReserved1=0x0, cFileName="XsV9.gif", cAlternateFileName="")) returned 1 [0123.273] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32be5e0, ftCreationTime.dwHighDateTime=0x1d8b8f0, ftLastAccessTime.dwLowDateTime=0x80082520, ftLastAccessTime.dwHighDateTime=0x1d8ba7f, ftLastWriteTime.dwLowDateTime=0x80082520, ftLastWriteTime.dwHighDateTime=0x1d8ba7f, nFileSizeHigh=0x0, nFileSizeLow=0x12845, dwReserved0=0x0, dwReserved1=0x0, cFileName="x_OLlWcMaQI.gif", cAlternateFileName="X_OLLW~1.GIF")) returned 1 [0123.273] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c5aec0, ftCreationTime.dwHighDateTime=0x1d8c090, ftLastAccessTime.dwLowDateTime=0x417610, ftLastAccessTime.dwHighDateTime=0x1d8c0c5, ftLastWriteTime.dwLowDateTime=0xc0e70acc, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xc3b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="y-ufahLBUL h.avi.paradox", cAlternateFileName="Y-UFAH~1.PAR")) returned 1 [0123.273] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29fd1960, ftCreationTime.dwHighDateTime=0x1d8b2b4, ftLastAccessTime.dwLowDateTime=0xdf85ec0, ftLastAccessTime.dwHighDateTime=0x1d8bdde, ftLastWriteTime.dwLowDateTime=0xc0f2eaba, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x10b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="zSxZ4J_7Ak.ppt.paradox", cAlternateFileName="ZSXZ4J~1.PAR")) returned 1 [0123.274] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29fd1960, ftCreationTime.dwHighDateTime=0x1d8b2b4, ftLastAccessTime.dwLowDateTime=0xdf85ec0, ftLastAccessTime.dwHighDateTime=0x1d8bdde, ftLastWriteTime.dwLowDateTime=0xc0f2eaba, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x10b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="zSxZ4J_7Ak.ppt.paradox", cAlternateFileName="ZSXZ4J~1.PAR")) returned 0 [0123.274] FindClose (in: hFindFile=0x688c10 | out: hFindFile=0x688c10) returned 1 [0123.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda8) returned 1 [0123.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb4) returned 1 [0123.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed78) returned 1 [0123.274] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0123.274] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv", nBufferLength=0x32, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv", lpFilePart=0x0) returned 0x31 [0123.274] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\*"), lpFindFileData=0x19eaa0 | out: lpFindFileData=0x19eaa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4add3a80, ftCreationTime.dwHighDateTime=0x1d8bba5, ftLastAccessTime.dwLowDateTime=0xc14fe5d1, ftLastAccessTime.dwHighDateTime=0x1d8cd7a, ftLastWriteTime.dwLowDateTime=0xc14fe5d1, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x689110 [0123.275] FindNextFileW (in: hFindFile=0x689110, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4add3a80, ftCreationTime.dwHighDateTime=0x1d8bba5, ftLastAccessTime.dwLowDateTime=0xc14fe5d1, ftLastAccessTime.dwHighDateTime=0x1d8cd7a, ftLastWriteTime.dwLowDateTime=0xc14fe5d1, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.275] FindNextFileW (in: hFindFile=0x689110, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24372040, ftCreationTime.dwHighDateTime=0x1d8be60, ftLastAccessTime.dwLowDateTime=0x2c985b60, ftLastAccessTime.dwHighDateTime=0x1d8c062, ftLastWriteTime.dwLowDateTime=0xc0fa105e, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x11010, dwReserved0=0x0, dwReserved1=0x0, cFileName="0ItsVjI3Z5uTF3b.mp3.paradox", cAlternateFileName="0ITSVJ~1.PAR")) returned 1 [0123.275] FindNextFileW (in: hFindFile=0x689110, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb77dddd0, ftCreationTime.dwHighDateTime=0x1d8b8cf, ftLastAccessTime.dwLowDateTime=0xc18481e0, ftLastAccessTime.dwHighDateTime=0x1d8bc4d, ftLastWriteTime.dwLowDateTime=0xc18481e0, ftLastWriteTime.dwHighDateTime=0x1d8bc4d, nFileSizeHigh=0x0, nFileSizeLow=0x1097a, dwReserved0=0x0, dwReserved1=0x0, cFileName="4v Ewyk-A.gif", cAlternateFileName="4VEWYK~1.GIF")) returned 1 [0123.275] FindNextFileW (in: hFindFile=0x689110, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b1896b0, ftCreationTime.dwHighDateTime=0x1d8bab1, ftLastAccessTime.dwLowDateTime=0xb622a920, ftLastAccessTime.dwHighDateTime=0x1d8bac8, ftLastWriteTime.dwLowDateTime=0xc1013848, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x16390, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cd IpDdd5KAfj8fH3OK3.xls.paradox", cAlternateFileName="CDIPDD~1.PAR")) returned 1 [0123.275] FindNextFileW (in: hFindFile=0x689110, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe80673a0, ftCreationTime.dwHighDateTime=0x1d8bd06, ftLastAccessTime.dwLowDateTime=0x6c369250, ftLastAccessTime.dwHighDateTime=0x1d8c0bc, ftLastWriteTime.dwLowDateTime=0xc10f8671, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x0, dwReserved1=0x0, cFileName="iHB.mkv.paradox", cAlternateFileName="IHBMKV~1.PAR")) returned 1 [0123.275] FindNextFileW (in: hFindFile=0x689110, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b6f9160, ftCreationTime.dwHighDateTime=0x1d8bf39, ftLastAccessTime.dwLowDateTime=0x53015690, ftLastAccessTime.dwHighDateTime=0x1d8bf5d, ftLastWriteTime.dwLowDateTime=0xc1190fe7, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x15220, dwReserved0=0x0, dwReserved1=0x0, cFileName="lnmC0XMyDQ9.jpg.paradox", cAlternateFileName="LNMC0X~1.PAR")) returned 1 [0123.276] FindNextFileW (in: hFindFile=0x689110, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729ee040, ftCreationTime.dwHighDateTime=0x1d8b660, ftLastAccessTime.dwLowDateTime=0x9c9a3120, ftLastAccessTime.dwHighDateTime=0x1d8ba15, ftLastWriteTime.dwLowDateTime=0xc12298f4, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xfbc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LykQr.jpg.paradox", cAlternateFileName="LYKQRJ~1.PAR")) returned 1 [0123.276] FindNextFileW (in: hFindFile=0x689110, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x683e4460, ftCreationTime.dwHighDateTime=0x1d8b3ea, ftLastAccessTime.dwLowDateTime=0xb362a7e0, ftLastAccessTime.dwHighDateTime=0x1d8bb4e, ftLastWriteTime.dwLowDateTime=0xc1275dde, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xf660, dwReserved0=0x0, dwReserved1=0x0, cFileName="molJpyIPFV.jpg.paradox", cAlternateFileName="MOLJPY~1.PAR")) returned 1 [0123.276] FindNextFileW (in: hFindFile=0x689110, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x931d0800, ftCreationTime.dwHighDateTime=0x1d8b3dc, ftLastAccessTime.dwLowDateTime=0xa5274680, ftLastAccessTime.dwHighDateTime=0x1d8b79e, ftLastWriteTime.dwLowDateTime=0xa5274680, ftLastWriteTime.dwHighDateTime=0x1d8b79e, nFileSizeHigh=0x0, nFileSizeLow=0x15f9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="NoJ2oBK.swf", cAlternateFileName="")) returned 1 [0123.276] FindNextFileW (in: hFindFile=0x689110, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60f3fb40, ftCreationTime.dwHighDateTime=0x1d8c101, ftLastAccessTime.dwLowDateTime=0x43221150, ftLastAccessTime.dwHighDateTime=0x1d8c120, ftLastWriteTime.dwLowDateTime=0x43221150, ftLastWriteTime.dwHighDateTime=0x1d8c120, nFileSizeHigh=0x0, nFileSizeLow=0xa0b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhOQUGFxH.swf", cAlternateFileName="RHOQUG~1.SWF")) returned 1 [0123.276] FindNextFileW (in: hFindFile=0x689110, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9224d2c0, ftCreationTime.dwHighDateTime=0x1d8bf08, ftLastAccessTime.dwLowDateTime=0x3b26a600, ftLastAccessTime.dwHighDateTime=0x1d8bfa4, ftLastWriteTime.dwLowDateTime=0xc14fe5d1, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="XGbXp3C5lHRkkh6wQq.png.paradox", cAlternateFileName="XGBXP3~1.PAR")) returned 1 [0123.276] FindNextFileW (in: hFindFile=0x689110, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa96a7ee0, ftCreationTime.dwHighDateTime=0x1d8bdc7, ftLastAccessTime.dwLowDateTime=0xd9084ac0, ftLastAccessTime.dwHighDateTime=0x1d8be75, ftLastWriteTime.dwLowDateTime=0xd9084ac0, ftLastWriteTime.dwHighDateTime=0x1d8be75, nFileSizeHigh=0x0, nFileSizeLow=0x3a0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="xXflM6cqnSqpKGQtY8r.wav", cAlternateFileName="XXFLM6~1.WAV")) returned 1 [0123.277] FindNextFileW (in: hFindFile=0x689110, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0123.277] FindClose (in: hFindFile=0x689110 | out: hFindFile=0x689110) returned 1 [0123.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed34) returned 1 [0123.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed40) returned 1 [0123.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed78) returned 1 [0123.277] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0123.277] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv", nBufferLength=0x32, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv", lpFilePart=0x0) returned 0x31 [0123.277] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\r2PRf1U9FnysJo7qVmv\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r2prf1u9fnysjo7qvmv\\*"), lpFindFileData=0x19eaa0 | out: lpFindFileData=0x19eaa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4add3a80, ftCreationTime.dwHighDateTime=0x1d8bba5, ftLastAccessTime.dwLowDateTime=0xc14fe5d1, ftLastAccessTime.dwHighDateTime=0x1d8cd7a, ftLastWriteTime.dwLowDateTime=0xc14fe5d1, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688f90 [0123.277] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4add3a80, ftCreationTime.dwHighDateTime=0x1d8bba5, ftLastAccessTime.dwLowDateTime=0xc14fe5d1, ftLastAccessTime.dwHighDateTime=0x1d8cd7a, ftLastWriteTime.dwLowDateTime=0xc14fe5d1, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.278] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24372040, ftCreationTime.dwHighDateTime=0x1d8be60, ftLastAccessTime.dwLowDateTime=0x2c985b60, ftLastAccessTime.dwHighDateTime=0x1d8c062, ftLastWriteTime.dwLowDateTime=0xc0fa105e, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x11010, dwReserved0=0x0, dwReserved1=0x0, cFileName="0ItsVjI3Z5uTF3b.mp3.paradox", cAlternateFileName="0ITSVJ~1.PAR")) returned 1 [0123.278] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb77dddd0, ftCreationTime.dwHighDateTime=0x1d8b8cf, ftLastAccessTime.dwLowDateTime=0xc18481e0, ftLastAccessTime.dwHighDateTime=0x1d8bc4d, ftLastWriteTime.dwLowDateTime=0xc18481e0, ftLastWriteTime.dwHighDateTime=0x1d8bc4d, nFileSizeHigh=0x0, nFileSizeLow=0x1097a, dwReserved0=0x0, dwReserved1=0x0, cFileName="4v Ewyk-A.gif", cAlternateFileName="4VEWYK~1.GIF")) returned 1 [0123.278] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b1896b0, ftCreationTime.dwHighDateTime=0x1d8bab1, ftLastAccessTime.dwLowDateTime=0xb622a920, ftLastAccessTime.dwHighDateTime=0x1d8bac8, ftLastWriteTime.dwLowDateTime=0xc1013848, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x16390, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cd IpDdd5KAfj8fH3OK3.xls.paradox", cAlternateFileName="CDIPDD~1.PAR")) returned 1 [0123.278] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe80673a0, ftCreationTime.dwHighDateTime=0x1d8bd06, ftLastAccessTime.dwLowDateTime=0x6c369250, ftLastAccessTime.dwHighDateTime=0x1d8c0bc, ftLastWriteTime.dwLowDateTime=0xc10f8671, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x0, dwReserved1=0x0, cFileName="iHB.mkv.paradox", cAlternateFileName="IHBMKV~1.PAR")) returned 1 [0123.278] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b6f9160, ftCreationTime.dwHighDateTime=0x1d8bf39, ftLastAccessTime.dwLowDateTime=0x53015690, ftLastAccessTime.dwHighDateTime=0x1d8bf5d, ftLastWriteTime.dwLowDateTime=0xc1190fe7, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x15220, dwReserved0=0x0, dwReserved1=0x0, cFileName="lnmC0XMyDQ9.jpg.paradox", cAlternateFileName="LNMC0X~1.PAR")) returned 1 [0123.279] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729ee040, ftCreationTime.dwHighDateTime=0x1d8b660, ftLastAccessTime.dwLowDateTime=0x9c9a3120, ftLastAccessTime.dwHighDateTime=0x1d8ba15, ftLastWriteTime.dwLowDateTime=0xc12298f4, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xfbc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LykQr.jpg.paradox", cAlternateFileName="LYKQRJ~1.PAR")) returned 1 [0123.279] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x683e4460, ftCreationTime.dwHighDateTime=0x1d8b3ea, ftLastAccessTime.dwLowDateTime=0xb362a7e0, ftLastAccessTime.dwHighDateTime=0x1d8bb4e, ftLastWriteTime.dwLowDateTime=0xc1275dde, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xf660, dwReserved0=0x0, dwReserved1=0x0, cFileName="molJpyIPFV.jpg.paradox", cAlternateFileName="MOLJPY~1.PAR")) returned 1 [0123.279] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x931d0800, ftCreationTime.dwHighDateTime=0x1d8b3dc, ftLastAccessTime.dwLowDateTime=0xa5274680, ftLastAccessTime.dwHighDateTime=0x1d8b79e, ftLastWriteTime.dwLowDateTime=0xa5274680, ftLastWriteTime.dwHighDateTime=0x1d8b79e, nFileSizeHigh=0x0, nFileSizeLow=0x15f9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="NoJ2oBK.swf", cAlternateFileName="")) returned 1 [0123.279] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60f3fb40, ftCreationTime.dwHighDateTime=0x1d8c101, ftLastAccessTime.dwLowDateTime=0x43221150, ftLastAccessTime.dwHighDateTime=0x1d8c120, ftLastWriteTime.dwLowDateTime=0x43221150, ftLastWriteTime.dwHighDateTime=0x1d8c120, nFileSizeHigh=0x0, nFileSizeLow=0xa0b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhOQUGFxH.swf", cAlternateFileName="RHOQUG~1.SWF")) returned 1 [0123.279] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9224d2c0, ftCreationTime.dwHighDateTime=0x1d8bf08, ftLastAccessTime.dwLowDateTime=0x3b26a600, ftLastAccessTime.dwHighDateTime=0x1d8bfa4, ftLastWriteTime.dwLowDateTime=0xc14fe5d1, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="XGbXp3C5lHRkkh6wQq.png.paradox", cAlternateFileName="XGBXP3~1.PAR")) returned 1 [0123.280] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa96a7ee0, ftCreationTime.dwHighDateTime=0x1d8bdc7, ftLastAccessTime.dwLowDateTime=0xd9084ac0, ftLastAccessTime.dwHighDateTime=0x1d8be75, ftLastWriteTime.dwLowDateTime=0xd9084ac0, ftLastWriteTime.dwHighDateTime=0x1d8be75, nFileSizeHigh=0x0, nFileSizeLow=0x3a0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="xXflM6cqnSqpKGQtY8r.wav", cAlternateFileName="XXFLM6~1.WAV")) returned 1 [0123.280] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa96a7ee0, ftCreationTime.dwHighDateTime=0x1d8bdc7, ftLastAccessTime.dwLowDateTime=0xd9084ac0, ftLastAccessTime.dwHighDateTime=0x1d8be75, ftLastWriteTime.dwLowDateTime=0xd9084ac0, ftLastWriteTime.dwHighDateTime=0x1d8be75, nFileSizeHigh=0x0, nFileSizeLow=0x3a0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="xXflM6cqnSqpKGQtY8r.wav", cAlternateFileName="XXFLM6~1.WAV")) returned 0 [0123.280] FindClose (in: hFindFile=0x688f90 | out: hFindFile=0x688f90) returned 1 [0123.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed34) returned 1 [0123.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed40) returned 1 [0123.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edec) returned 1 [0123.280] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x20 [0123.281] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x20, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0123.281] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\*"), lpFindFileData=0x19eb14 | out: lpFindFileData=0x19eb14*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x72c771ac, ftLastAccessTime.dwHighDateTime=0x1d8c12e, ftLastWriteTime.dwLowDateTime=0x72c771ac, ftLastWriteTime.dwHighDateTime=0x1d8c12e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688f90 [0123.281] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x72c771ac, ftLastAccessTime.dwHighDateTime=0x1d8c12e, ftLastWriteTime.dwLowDateTime=0x72c771ac, ftLastWriteTime.dwHighDateTime=0x1d8c12e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.281] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6855ae0, ftCreationTime.dwHighDateTime=0x1d8365c, ftLastAccessTime.dwLowDateTime=0xb4852e50, ftLastAccessTime.dwHighDateTime=0x1d840cd, ftLastWriteTime.dwLowDateTime=0xb4852e50, ftLastWriteTime.dwHighDateTime=0x1d840cd, nFileSizeHigh=0x0, nFileSizeLow=0xe877, dwReserved0=0x0, dwReserved1=0x0, cFileName="a8ETnoann.pptx", cAlternateFileName="A8ETNO~1.PPT")) returned 1 [0123.281] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51133610, ftCreationTime.dwHighDateTime=0x1d86985, ftLastAccessTime.dwLowDateTime=0xca3beda0, ftLastAccessTime.dwHighDateTime=0x1d889e9, ftLastWriteTime.dwLowDateTime=0xca3beda0, ftLastWriteTime.dwHighDateTime=0x1d889e9, nFileSizeHigh=0x0, nFileSizeLow=0x17dfa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Axeso-6WCbUVjz.xlsx", cAlternateFileName="AXESO-~1.XLS")) returned 1 [0123.282] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec98030, ftCreationTime.dwHighDateTime=0x1d8bbb5, ftLastAccessTime.dwLowDateTime=0xd0367d90, ftLastAccessTime.dwHighDateTime=0x1d8bdb2, ftLastWriteTime.dwLowDateTime=0xd0367d90, ftLastWriteTime.dwHighDateTime=0x1d8bdb2, nFileSizeHigh=0x0, nFileSizeLow=0x102e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BMrG6iVDXlyg.docx", cAlternateFileName="BMRG6I~1.DOC")) returned 1 [0123.282] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3318acc0, ftCreationTime.dwHighDateTime=0x1d87cf0, ftLastAccessTime.dwLowDateTime=0xf8f434e0, ftLastAccessTime.dwHighDateTime=0x1d883db, ftLastWriteTime.dwLowDateTime=0xf8f434e0, ftLastWriteTime.dwHighDateTime=0x1d883db, nFileSizeHigh=0x0, nFileSizeLow=0x2d1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS18p.pptx", cAlternateFileName="BS18P~1.PPT")) returned 1 [0123.282] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x923bc440, ftCreationTime.dwHighDateTime=0x1d85b3e, ftLastAccessTime.dwLowDateTime=0xf9a25b10, ftLastAccessTime.dwHighDateTime=0x1d87d8c, ftLastWriteTime.dwLowDateTime=0xf9a25b10, ftLastWriteTime.dwHighDateTime=0x1d87d8c, nFileSizeHigh=0x0, nFileSizeLow=0xfcc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="bxkuQ7Rq0NwFlu_.xlsx", cAlternateFileName="BXKUQ7~1.XLS")) returned 1 [0123.282] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1134bb0, ftCreationTime.dwHighDateTime=0x1d858e0, ftLastAccessTime.dwLowDateTime=0x92f461e0, ftLastAccessTime.dwHighDateTime=0x1d89120, ftLastWriteTime.dwLowDateTime=0x92f461e0, ftLastWriteTime.dwHighDateTime=0x1d89120, nFileSizeHigh=0x0, nFileSizeLow=0x41d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="c9B91Yr5NnHGVSkP8ES.pptx", cAlternateFileName="C9B91Y~1.PPT")) returned 1 [0123.282] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0a3fb0, ftCreationTime.dwHighDateTime=0x1d84fd5, ftLastAccessTime.dwLowDateTime=0x52bd6510, ftLastAccessTime.dwHighDateTime=0x1d88b2e, ftLastWriteTime.dwLowDateTime=0x52bd6510, ftLastWriteTime.dwHighDateTime=0x1d88b2e, nFileSizeHigh=0x0, nFileSizeLow=0x72a, dwReserved0=0x0, dwReserved1=0x0, cFileName="dAFINowb06QqRO4uOt.docx", cAlternateFileName="DAFINO~1.DOC")) returned 1 [0123.282] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43649a85, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43649a85, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x4372e947, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0123.283] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccf91330, ftCreationTime.dwHighDateTime=0x1d8bd6d, ftLastAccessTime.dwLowDateTime=0x6e680b90, ftLastAccessTime.dwHighDateTime=0x1d8c0ac, ftLastWriteTime.dwLowDateTime=0x6e680b90, ftLastWriteTime.dwHighDateTime=0x1d8c0ac, nFileSizeHigh=0x0, nFileSizeLow=0x9ea3, dwReserved0=0x0, dwReserved1=0x0, cFileName="DoE cR5.xlsx", cAlternateFileName="DOECR5~1.XLS")) returned 1 [0123.283] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcae8ded0, ftCreationTime.dwHighDateTime=0x1d8ba62, ftLastAccessTime.dwLowDateTime=0xb6d28800, ftLastAccessTime.dwHighDateTime=0x1d8bb53, ftLastWriteTime.dwLowDateTime=0xb6d28800, ftLastWriteTime.dwHighDateTime=0x1d8bb53, nFileSizeHigh=0x0, nFileSizeLow=0x1317a, dwReserved0=0x0, dwReserved1=0x0, cFileName="equM7or1T3W19x6ke.docx", cAlternateFileName="EQUM7O~1.DOC")) returned 1 [0123.283] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd203eb0, ftCreationTime.dwHighDateTime=0x1d88c7c, ftLastAccessTime.dwLowDateTime=0x3f148070, ftLastAccessTime.dwHighDateTime=0x1d8934e, ftLastWriteTime.dwLowDateTime=0x3f148070, ftLastWriteTime.dwHighDateTime=0x1d8934e, nFileSizeHigh=0x0, nFileSizeLow=0x99da, dwReserved0=0x0, dwReserved1=0x0, cFileName="iBJ0lud-.docx", cAlternateFileName="IBJ0LU~1.DOC")) returned 1 [0123.283] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa85ca1a0, ftCreationTime.dwHighDateTime=0x1d8be25, ftLastAccessTime.dwLowDateTime=0x36411ec0, ftLastAccessTime.dwHighDateTime=0x1d8c000, ftLastWriteTime.dwLowDateTime=0x36411ec0, ftLastWriteTime.dwHighDateTime=0x1d8c000, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IhO0bQr", cAlternateFileName="")) returned 1 [0123.283] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdaaac730, ftCreationTime.dwHighDateTime=0x1d85148, ftLastAccessTime.dwLowDateTime=0xdebba830, ftLastAccessTime.dwHighDateTime=0x1d86caa, ftLastWriteTime.dwLowDateTime=0xdebba830, ftLastWriteTime.dwHighDateTime=0x1d86caa, nFileSizeHigh=0x0, nFileSizeLow=0x994a, dwReserved0=0x0, dwReserved1=0x0, cFileName="iXIBDT Gx.docx", cAlternateFileName="IXIBDT~1.DOC")) returned 1 [0123.283] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb07022f0, ftCreationTime.dwHighDateTime=0x1d8703b, ftLastAccessTime.dwLowDateTime=0x926323f0, ftLastAccessTime.dwHighDateTime=0x1d88523, ftLastWriteTime.dwLowDateTime=0x926323f0, ftLastWriteTime.dwHighDateTime=0x1d88523, nFileSizeHigh=0x0, nFileSizeLow=0x13db3, dwReserved0=0x0, dwReserved1=0x0, cFileName="JVYZ5G.pptx", cAlternateFileName="JVYZ5G~1.PPT")) returned 1 [0123.283] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x627ae760, ftCreationTime.dwHighDateTime=0x1d8c117, ftLastAccessTime.dwLowDateTime=0xa783b970, ftLastAccessTime.dwHighDateTime=0x1d8c128, ftLastWriteTime.dwLowDateTime=0xa783b970, ftLastWriteTime.dwHighDateTime=0x1d8c128, nFileSizeHigh=0x0, nFileSizeLow=0x14e47, dwReserved0=0x0, dwReserved1=0x0, cFileName="LfdJxcUKnYmX.ppt", cAlternateFileName="LFDJXC~1.PPT")) returned 1 [0123.283] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0fe8f30, ftCreationTime.dwHighDateTime=0x1d8b4dd, ftLastAccessTime.dwLowDateTime=0x3db8f3b0, ftLastAccessTime.dwHighDateTime=0x1d8bc01, ftLastWriteTime.dwLowDateTime=0x3db8f3b0, ftLastWriteTime.dwHighDateTime=0x1d8bc01, nFileSizeHigh=0x0, nFileSizeLow=0x128d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lqRCFpqE87LzQN.ppt", cAlternateFileName="LQRCFP~1.PPT")) returned 1 [0123.283] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60e689c0, ftCreationTime.dwHighDateTime=0x1d8b769, ftLastAccessTime.dwLowDateTime=0xa82be250, ftLastAccessTime.dwHighDateTime=0x1d8b9bf, ftLastWriteTime.dwLowDateTime=0xa82be250, ftLastWriteTime.dwHighDateTime=0x1d8b9bf, nFileSizeHigh=0x0, nFileSizeLow=0x5fc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="mQx7YPEejtyQadEX8L.docx", cAlternateFileName="MQX7YP~1.DOC")) returned 1 [0123.283] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d374e80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d374e80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d374e80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0123.283] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d374e80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d374e80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d374e80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0123.283] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0123.284] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe74b5bf0, ftCreationTime.dwHighDateTime=0x1d8c072, ftLastAccessTime.dwLowDateTime=0x8b787bd0, ftLastAccessTime.dwHighDateTime=0x1d8c0f1, ftLastWriteTime.dwLowDateTime=0x8b787bd0, ftLastWriteTime.dwHighDateTime=0x1d8c0f1, nFileSizeHigh=0x0, nFileSizeLow=0xe0aa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OdwXQ9DnhDRCV.ots", cAlternateFileName="ODWXQ9~1.OTS")) returned 1 [0123.284] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63954f0d, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x839084fb, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x839084fb, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0123.284] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89df1000, ftCreationTime.dwHighDateTime=0x1d8638f, ftLastAccessTime.dwLowDateTime=0xb065950, ftLastAccessTime.dwHighDateTime=0x1d88bd5, ftLastWriteTime.dwLowDateTime=0xb065950, ftLastWriteTime.dwHighDateTime=0x1d88bd5, nFileSizeHigh=0x0, nFileSizeLow=0x9c61, dwReserved0=0x0, dwReserved1=0x0, cFileName="pZRQ3ttLP58bKcO.docx", cAlternateFileName="PZRQ3T~1.DOC")) returned 1 [0123.284] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cf304c0, ftCreationTime.dwHighDateTime=0x1d85bb6, ftLastAccessTime.dwLowDateTime=0x33347c50, ftLastAccessTime.dwHighDateTime=0x1d85cea, ftLastWriteTime.dwLowDateTime=0x33347c50, ftLastWriteTime.dwHighDateTime=0x1d85cea, nFileSizeHigh=0x0, nFileSizeLow=0x3a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="rbYBf.xlsx", cAlternateFileName="RBYBF~1.XLS")) returned 1 [0123.284] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba85cfe0, ftCreationTime.dwHighDateTime=0x1d8b55c, ftLastAccessTime.dwLowDateTime=0xf81b550, ftLastAccessTime.dwHighDateTime=0x1d8c038, ftLastWriteTime.dwLowDateTime=0xf81b550, ftLastWriteTime.dwHighDateTime=0x1d8c038, nFileSizeHigh=0x0, nFileSizeLow=0x15c56, dwReserved0=0x0, dwReserved1=0x0, cFileName="Udu1XE4Hd0I8gwhDhX2.odt", cAlternateFileName="UDU1XE~1.ODT")) returned 1 [0123.284] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a3ea50, ftCreationTime.dwHighDateTime=0x1d8b8f4, ftLastAccessTime.dwLowDateTime=0x7910f5c0, ftLastAccessTime.dwHighDateTime=0x1d8bd69, ftLastWriteTime.dwLowDateTime=0x7910f5c0, ftLastWriteTime.dwHighDateTime=0x1d8bd69, nFileSizeHigh=0x0, nFileSizeLow=0xad1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGfbvj_4ydSGlCX-gZ2F.doc", cAlternateFileName="VGFBVJ~1.DOC")) returned 1 [0123.284] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52edee30, ftCreationTime.dwHighDateTime=0x1d8a067, ftLastAccessTime.dwLowDateTime=0x5f4f4a00, ftLastAccessTime.dwHighDateTime=0x1d8a307, ftLastWriteTime.dwLowDateTime=0x5f4f4a00, ftLastWriteTime.dwHighDateTime=0x1d8a307, nFileSizeHigh=0x0, nFileSizeLow=0x6106, dwReserved0=0x0, dwReserved1=0x0, cFileName="XIB 5.pptx", cAlternateFileName="XIB5~1.PPT")) returned 1 [0123.284] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc4bd550, ftCreationTime.dwHighDateTime=0x1d8524c, ftLastAccessTime.dwLowDateTime=0xd3d43440, ftLastAccessTime.dwHighDateTime=0x1d858c9, ftLastWriteTime.dwLowDateTime=0xd3d43440, ftLastWriteTime.dwHighDateTime=0x1d858c9, nFileSizeHigh=0x0, nFileSizeLow=0x90c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="_p4fCTIw.xlsx", cAlternateFileName="_P4FCT~1.XLS")) returned 1 [0123.285] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0123.285] FindClose (in: hFindFile=0x688f90 | out: hFindFile=0x688f90) returned 1 [0123.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda8) returned 1 [0123.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb4) returned 1 [0123.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edec) returned 1 [0123.285] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x20 [0123.285] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x20, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0123.285] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\*"), lpFindFileData=0x19eb14 | out: lpFindFileData=0x19eb14*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x72c771ac, ftLastAccessTime.dwHighDateTime=0x1d8c12e, ftLastWriteTime.dwLowDateTime=0x72c771ac, ftLastWriteTime.dwHighDateTime=0x1d8c12e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688d10 [0123.285] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x72c771ac, ftLastAccessTime.dwHighDateTime=0x1d8c12e, ftLastWriteTime.dwLowDateTime=0x72c771ac, ftLastWriteTime.dwHighDateTime=0x1d8c12e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.285] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6855ae0, ftCreationTime.dwHighDateTime=0x1d8365c, ftLastAccessTime.dwLowDateTime=0xb4852e50, ftLastAccessTime.dwHighDateTime=0x1d840cd, ftLastWriteTime.dwLowDateTime=0xb4852e50, ftLastWriteTime.dwHighDateTime=0x1d840cd, nFileSizeHigh=0x0, nFileSizeLow=0xe877, dwReserved0=0x0, dwReserved1=0x0, cFileName="a8ETnoann.pptx", cAlternateFileName="A8ETNO~1.PPT")) returned 1 [0123.285] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51133610, ftCreationTime.dwHighDateTime=0x1d86985, ftLastAccessTime.dwLowDateTime=0xca3beda0, ftLastAccessTime.dwHighDateTime=0x1d889e9, ftLastWriteTime.dwLowDateTime=0xca3beda0, ftLastWriteTime.dwHighDateTime=0x1d889e9, nFileSizeHigh=0x0, nFileSizeLow=0x17dfa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Axeso-6WCbUVjz.xlsx", cAlternateFileName="AXESO-~1.XLS")) returned 1 [0123.285] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec98030, ftCreationTime.dwHighDateTime=0x1d8bbb5, ftLastAccessTime.dwLowDateTime=0xd0367d90, ftLastAccessTime.dwHighDateTime=0x1d8bdb2, ftLastWriteTime.dwLowDateTime=0xd0367d90, ftLastWriteTime.dwHighDateTime=0x1d8bdb2, nFileSizeHigh=0x0, nFileSizeLow=0x102e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BMrG6iVDXlyg.docx", cAlternateFileName="BMRG6I~1.DOC")) returned 1 [0123.286] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3318acc0, ftCreationTime.dwHighDateTime=0x1d87cf0, ftLastAccessTime.dwLowDateTime=0xf8f434e0, ftLastAccessTime.dwHighDateTime=0x1d883db, ftLastWriteTime.dwLowDateTime=0xf8f434e0, ftLastWriteTime.dwHighDateTime=0x1d883db, nFileSizeHigh=0x0, nFileSizeLow=0x2d1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS18p.pptx", cAlternateFileName="BS18P~1.PPT")) returned 1 [0123.286] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x923bc440, ftCreationTime.dwHighDateTime=0x1d85b3e, ftLastAccessTime.dwLowDateTime=0xf9a25b10, ftLastAccessTime.dwHighDateTime=0x1d87d8c, ftLastWriteTime.dwLowDateTime=0xf9a25b10, ftLastWriteTime.dwHighDateTime=0x1d87d8c, nFileSizeHigh=0x0, nFileSizeLow=0xfcc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="bxkuQ7Rq0NwFlu_.xlsx", cAlternateFileName="BXKUQ7~1.XLS")) returned 1 [0123.286] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1134bb0, ftCreationTime.dwHighDateTime=0x1d858e0, ftLastAccessTime.dwLowDateTime=0x92f461e0, ftLastAccessTime.dwHighDateTime=0x1d89120, ftLastWriteTime.dwLowDateTime=0x92f461e0, ftLastWriteTime.dwHighDateTime=0x1d89120, nFileSizeHigh=0x0, nFileSizeLow=0x41d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="c9B91Yr5NnHGVSkP8ES.pptx", cAlternateFileName="C9B91Y~1.PPT")) returned 1 [0123.286] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0a3fb0, ftCreationTime.dwHighDateTime=0x1d84fd5, ftLastAccessTime.dwLowDateTime=0x52bd6510, ftLastAccessTime.dwHighDateTime=0x1d88b2e, ftLastWriteTime.dwLowDateTime=0x52bd6510, ftLastWriteTime.dwHighDateTime=0x1d88b2e, nFileSizeHigh=0x0, nFileSizeLow=0x72a, dwReserved0=0x0, dwReserved1=0x0, cFileName="dAFINowb06QqRO4uOt.docx", cAlternateFileName="DAFINO~1.DOC")) returned 1 [0123.286] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43649a85, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43649a85, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x4372e947, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0123.286] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccf91330, ftCreationTime.dwHighDateTime=0x1d8bd6d, ftLastAccessTime.dwLowDateTime=0x6e680b90, ftLastAccessTime.dwHighDateTime=0x1d8c0ac, ftLastWriteTime.dwLowDateTime=0x6e680b90, ftLastWriteTime.dwHighDateTime=0x1d8c0ac, nFileSizeHigh=0x0, nFileSizeLow=0x9ea3, dwReserved0=0x0, dwReserved1=0x0, cFileName="DoE cR5.xlsx", cAlternateFileName="DOECR5~1.XLS")) returned 1 [0123.286] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcae8ded0, ftCreationTime.dwHighDateTime=0x1d8ba62, ftLastAccessTime.dwLowDateTime=0xb6d28800, ftLastAccessTime.dwHighDateTime=0x1d8bb53, ftLastWriteTime.dwLowDateTime=0xb6d28800, ftLastWriteTime.dwHighDateTime=0x1d8bb53, nFileSizeHigh=0x0, nFileSizeLow=0x1317a, dwReserved0=0x0, dwReserved1=0x0, cFileName="equM7or1T3W19x6ke.docx", cAlternateFileName="EQUM7O~1.DOC")) returned 1 [0123.286] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd203eb0, ftCreationTime.dwHighDateTime=0x1d88c7c, ftLastAccessTime.dwLowDateTime=0x3f148070, ftLastAccessTime.dwHighDateTime=0x1d8934e, ftLastWriteTime.dwLowDateTime=0x3f148070, ftLastWriteTime.dwHighDateTime=0x1d8934e, nFileSizeHigh=0x0, nFileSizeLow=0x99da, dwReserved0=0x0, dwReserved1=0x0, cFileName="iBJ0lud-.docx", cAlternateFileName="IBJ0LU~1.DOC")) returned 1 [0123.286] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa85ca1a0, ftCreationTime.dwHighDateTime=0x1d8be25, ftLastAccessTime.dwLowDateTime=0x36411ec0, ftLastAccessTime.dwHighDateTime=0x1d8c000, ftLastWriteTime.dwLowDateTime=0x36411ec0, ftLastWriteTime.dwHighDateTime=0x1d8c000, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IhO0bQr", cAlternateFileName="")) returned 1 [0123.286] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdaaac730, ftCreationTime.dwHighDateTime=0x1d85148, ftLastAccessTime.dwLowDateTime=0xdebba830, ftLastAccessTime.dwHighDateTime=0x1d86caa, ftLastWriteTime.dwLowDateTime=0xdebba830, ftLastWriteTime.dwHighDateTime=0x1d86caa, nFileSizeHigh=0x0, nFileSizeLow=0x994a, dwReserved0=0x0, dwReserved1=0x0, cFileName="iXIBDT Gx.docx", cAlternateFileName="IXIBDT~1.DOC")) returned 1 [0123.286] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb07022f0, ftCreationTime.dwHighDateTime=0x1d8703b, ftLastAccessTime.dwLowDateTime=0x926323f0, ftLastAccessTime.dwHighDateTime=0x1d88523, ftLastWriteTime.dwLowDateTime=0x926323f0, ftLastWriteTime.dwHighDateTime=0x1d88523, nFileSizeHigh=0x0, nFileSizeLow=0x13db3, dwReserved0=0x0, dwReserved1=0x0, cFileName="JVYZ5G.pptx", cAlternateFileName="JVYZ5G~1.PPT")) returned 1 [0123.286] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x627ae760, ftCreationTime.dwHighDateTime=0x1d8c117, ftLastAccessTime.dwLowDateTime=0xa783b970, ftLastAccessTime.dwHighDateTime=0x1d8c128, ftLastWriteTime.dwLowDateTime=0xa783b970, ftLastWriteTime.dwHighDateTime=0x1d8c128, nFileSizeHigh=0x0, nFileSizeLow=0x14e47, dwReserved0=0x0, dwReserved1=0x0, cFileName="LfdJxcUKnYmX.ppt", cAlternateFileName="LFDJXC~1.PPT")) returned 1 [0123.286] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0fe8f30, ftCreationTime.dwHighDateTime=0x1d8b4dd, ftLastAccessTime.dwLowDateTime=0x3db8f3b0, ftLastAccessTime.dwHighDateTime=0x1d8bc01, ftLastWriteTime.dwLowDateTime=0x3db8f3b0, ftLastWriteTime.dwHighDateTime=0x1d8bc01, nFileSizeHigh=0x0, nFileSizeLow=0x128d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lqRCFpqE87LzQN.ppt", cAlternateFileName="LQRCFP~1.PPT")) returned 1 [0123.286] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60e689c0, ftCreationTime.dwHighDateTime=0x1d8b769, ftLastAccessTime.dwLowDateTime=0xa82be250, ftLastAccessTime.dwHighDateTime=0x1d8b9bf, ftLastWriteTime.dwLowDateTime=0xa82be250, ftLastWriteTime.dwHighDateTime=0x1d8b9bf, nFileSizeHigh=0x0, nFileSizeLow=0x5fc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="mQx7YPEejtyQadEX8L.docx", cAlternateFileName="MQX7YP~1.DOC")) returned 1 [0123.287] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d374e80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d374e80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d374e80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0123.287] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d374e80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d374e80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d374e80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0123.287] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0123.287] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe74b5bf0, ftCreationTime.dwHighDateTime=0x1d8c072, ftLastAccessTime.dwLowDateTime=0x8b787bd0, ftLastAccessTime.dwHighDateTime=0x1d8c0f1, ftLastWriteTime.dwLowDateTime=0x8b787bd0, ftLastWriteTime.dwHighDateTime=0x1d8c0f1, nFileSizeHigh=0x0, nFileSizeLow=0xe0aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="OdwXQ9DnhDRCV.ots", cAlternateFileName="ODWXQ9~1.OTS")) returned 1 [0123.287] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63954f0d, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x839084fb, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x839084fb, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0123.287] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89df1000, ftCreationTime.dwHighDateTime=0x1d8638f, ftLastAccessTime.dwLowDateTime=0xb065950, ftLastAccessTime.dwHighDateTime=0x1d88bd5, ftLastWriteTime.dwLowDateTime=0xb065950, ftLastWriteTime.dwHighDateTime=0x1d88bd5, nFileSizeHigh=0x0, nFileSizeLow=0x9c61, dwReserved0=0x0, dwReserved1=0x0, cFileName="pZRQ3ttLP58bKcO.docx", cAlternateFileName="PZRQ3T~1.DOC")) returned 1 [0123.287] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cf304c0, ftCreationTime.dwHighDateTime=0x1d85bb6, ftLastAccessTime.dwLowDateTime=0x33347c50, ftLastAccessTime.dwHighDateTime=0x1d85cea, ftLastWriteTime.dwLowDateTime=0x33347c50, ftLastWriteTime.dwHighDateTime=0x1d85cea, nFileSizeHigh=0x0, nFileSizeLow=0x3a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="rbYBf.xlsx", cAlternateFileName="RBYBF~1.XLS")) returned 1 [0123.287] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba85cfe0, ftCreationTime.dwHighDateTime=0x1d8b55c, ftLastAccessTime.dwLowDateTime=0xf81b550, ftLastAccessTime.dwHighDateTime=0x1d8c038, ftLastWriteTime.dwLowDateTime=0xf81b550, ftLastWriteTime.dwHighDateTime=0x1d8c038, nFileSizeHigh=0x0, nFileSizeLow=0x15c56, dwReserved0=0x0, dwReserved1=0x0, cFileName="Udu1XE4Hd0I8gwhDhX2.odt", cAlternateFileName="UDU1XE~1.ODT")) returned 1 [0123.287] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a3ea50, ftCreationTime.dwHighDateTime=0x1d8b8f4, ftLastAccessTime.dwLowDateTime=0x7910f5c0, ftLastAccessTime.dwHighDateTime=0x1d8bd69, ftLastWriteTime.dwLowDateTime=0x7910f5c0, ftLastWriteTime.dwHighDateTime=0x1d8bd69, nFileSizeHigh=0x0, nFileSizeLow=0xad1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGfbvj_4ydSGlCX-gZ2F.doc", cAlternateFileName="VGFBVJ~1.DOC")) returned 1 [0123.287] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52edee30, ftCreationTime.dwHighDateTime=0x1d8a067, ftLastAccessTime.dwLowDateTime=0x5f4f4a00, ftLastAccessTime.dwHighDateTime=0x1d8a307, ftLastWriteTime.dwLowDateTime=0x5f4f4a00, ftLastWriteTime.dwHighDateTime=0x1d8a307, nFileSizeHigh=0x0, nFileSizeLow=0x6106, dwReserved0=0x0, dwReserved1=0x0, cFileName="XIB 5.pptx", cAlternateFileName="XIB5~1.PPT")) returned 1 [0123.287] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc4bd550, ftCreationTime.dwHighDateTime=0x1d8524c, ftLastAccessTime.dwLowDateTime=0xd3d43440, ftLastAccessTime.dwHighDateTime=0x1d858c9, ftLastWriteTime.dwLowDateTime=0xd3d43440, ftLastWriteTime.dwHighDateTime=0x1d858c9, nFileSizeHigh=0x0, nFileSizeLow=0x90c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="_p4fCTIw.xlsx", cAlternateFileName="_P4FCT~1.XLS")) returned 1 [0123.287] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc4bd550, ftCreationTime.dwHighDateTime=0x1d8524c, ftLastAccessTime.dwLowDateTime=0xd3d43440, ftLastAccessTime.dwHighDateTime=0x1d858c9, ftLastWriteTime.dwLowDateTime=0xd3d43440, ftLastWriteTime.dwHighDateTime=0x1d858c9, nFileSizeHigh=0x0, nFileSizeLow=0x90c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="_p4fCTIw.xlsx", cAlternateFileName="_P4FCT~1.XLS")) returned 0 [0123.287] FindClose (in: hFindFile=0x688d10 | out: hFindFile=0x688d10) returned 1 [0123.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda8) returned 1 [0123.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb4) returned 1 [0123.287] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\a8ETnoann.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0123.287] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\a8ETnoann.pptx", nBufferLength=0x2f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\a8ETnoann.pptx", lpFilePart=0x0) returned 0x2e [0123.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0123.288] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\a8ETnoann.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\a8etnoann.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0123.288] GetFileType (hFile=0x364) returned 0x1 [0123.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0123.288] GetFileType (hFile=0x364) returned 0x1 [0123.288] GetFileSize (in: hFile=0x364, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0xe877 [0123.288] ReadFile (in: hFile=0x364, lpBuffer=0x2379c4c, nNumberOfBytesToRead=0xe877, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x2379c4c*, lpNumberOfBytesRead=0x19ed40*=0xe877, lpOverlapped=0x0) returned 1 [0123.289] CloseHandle (hObject=0x364) returned 1 [0123.307] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0123.307] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0123.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0123.307] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0123.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0123.307] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\a8ETnoann.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0123.307] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\a8ETnoann.pptx", nBufferLength=0x2f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\a8ETnoann.pptx", lpFilePart=0x0) returned 0x2e [0123.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0123.308] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\a8ETnoann.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\a8etnoann.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0123.309] GetFileType (hFile=0x364) returned 0x1 [0123.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0123.309] GetFileType (hFile=0x364) returned 0x1 [0123.309] WriteFile (in: hFile=0x364, lpBuffer=0x23f23cc*, nNumberOfBytesToWrite=0xe880, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x23f23cc*, lpNumberOfBytesWritten=0x19ed34*=0xe880, lpOverlapped=0x0) returned 1 [0123.311] CloseHandle (hObject=0x364) returned 1 [0123.313] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\a8ETnoann.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0123.313] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\a8ETnoann.pptx", nBufferLength=0x2f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\a8ETnoann.pptx", lpFilePart=0x0) returned 0x2e [0123.313] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\a8ETnoann.pptx.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0123.313] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\a8ETnoann.pptx.paradox", nBufferLength=0x37, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\a8ETnoann.pptx.paradox", lpFilePart=0x0) returned 0x36 [0123.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0123.314] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\a8ETnoann.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\a8etnoann.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6855ae0, ftCreationTime.dwHighDateTime=0x1d8365c, ftLastAccessTime.dwLowDateTime=0xb4852e50, ftLastAccessTime.dwHighDateTime=0x1d840cd, ftLastWriteTime.dwLowDateTime=0xc1aa7f3a, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xe880)) returned 1 [0123.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0123.314] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\a8ETnoann.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\a8etnoann.pptx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\a8ETnoann.pptx.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\a8etnoann.pptx.paradox")) returned 1 [0123.319] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Axeso-6WCbUVjz.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0123.319] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Axeso-6WCbUVjz.xlsx", nBufferLength=0x34, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Axeso-6WCbUVjz.xlsx", lpFilePart=0x0) returned 0x33 [0123.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0123.319] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Axeso-6WCbUVjz.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\axeso-6wcbuvjz.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0123.319] GetFileType (hFile=0x364) returned 0x1 [0123.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0123.319] GetFileType (hFile=0x364) returned 0x1 [0123.319] GetFileSize (in: hFile=0x364, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x17dfa [0123.320] ReadFile (in: hFile=0x364, lpBuffer=0x34cdb18, nNumberOfBytesToRead=0x17dfa, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x34cdb18*, lpNumberOfBytesRead=0x19ed40*=0x17dfa, lpOverlapped=0x0) returned 1 [0123.321] CloseHandle (hObject=0x364) returned 1 [0123.346] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0123.346] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0123.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0123.346] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0123.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0123.347] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Axeso-6WCbUVjz.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0123.347] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Axeso-6WCbUVjz.xlsx", nBufferLength=0x34, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Axeso-6WCbUVjz.xlsx", lpFilePart=0x0) returned 0x33 [0123.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0123.347] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Axeso-6WCbUVjz.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\axeso-6wcbuvjz.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0123.348] GetFileType (hFile=0x364) returned 0x1 [0123.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0123.349] GetFileType (hFile=0x364) returned 0x1 [0123.349] WriteFile (in: hFile=0x364, lpBuffer=0x3545150*, nNumberOfBytesToWrite=0x17e00, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x3545150*, lpNumberOfBytesWritten=0x19ed34*=0x17e00, lpOverlapped=0x0) returned 1 [0123.351] CloseHandle (hObject=0x364) returned 1 [0123.354] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Axeso-6WCbUVjz.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0123.354] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Axeso-6WCbUVjz.xlsx", nBufferLength=0x34, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Axeso-6WCbUVjz.xlsx", lpFilePart=0x0) returned 0x33 [0123.354] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Axeso-6WCbUVjz.xlsx.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0123.354] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Axeso-6WCbUVjz.xlsx.paradox", nBufferLength=0x3c, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Axeso-6WCbUVjz.xlsx.paradox", lpFilePart=0x0) returned 0x3b [0123.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0123.354] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Axeso-6WCbUVjz.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\axeso-6wcbuvjz.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51133610, ftCreationTime.dwHighDateTime=0x1d86985, ftLastAccessTime.dwLowDateTime=0xca3beda0, ftLastAccessTime.dwHighDateTime=0x1d889e9, ftLastWriteTime.dwLowDateTime=0xc1b1a616, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x17e00)) returned 1 [0123.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0123.354] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Axeso-6WCbUVjz.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\axeso-6wcbuvjz.xlsx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Axeso-6WCbUVjz.xlsx.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\axeso-6wcbuvjz.xlsx.paradox")) returned 1 [0123.355] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\BMrG6iVDXlyg.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0123.355] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\BMrG6iVDXlyg.docx", nBufferLength=0x32, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\BMrG6iVDXlyg.docx", lpFilePart=0x0) returned 0x31 [0123.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0123.355] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\BMrG6iVDXlyg.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\bmrg6ivdxlyg.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0123.355] GetFileType (hFile=0x364) returned 0x1 [0123.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0123.356] GetFileType (hFile=0x364) returned 0x1 [0123.356] GetFileSize (in: hFile=0x364, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x102e2 [0123.356] ReadFile (in: hFile=0x364, lpBuffer=0x244df6c, nNumberOfBytesToRead=0x102e2, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x244df6c*, lpNumberOfBytesRead=0x19ed40*=0x102e2, lpOverlapped=0x0) returned 1 [0123.356] CloseHandle (hObject=0x364) returned 1 [0123.471] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0123.471] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0123.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0123.471] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0123.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0123.472] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\BMrG6iVDXlyg.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0123.472] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\BMrG6iVDXlyg.docx", nBufferLength=0x32, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\BMrG6iVDXlyg.docx", lpFilePart=0x0) returned 0x31 [0123.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0123.472] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\BMrG6iVDXlyg.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\bmrg6ivdxlyg.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0123.474] GetFileType (hFile=0x364) returned 0x1 [0123.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0123.474] GetFileType (hFile=0x364) returned 0x1 [0123.474] WriteFile (in: hFile=0x364, lpBuffer=0x24cb63c*, nNumberOfBytesToWrite=0x102f0, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x24cb63c*, lpNumberOfBytesWritten=0x19ed34*=0x102f0, lpOverlapped=0x0) returned 1 [0123.476] CloseHandle (hObject=0x364) returned 1 [0123.941] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\BMrG6iVDXlyg.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0123.941] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\BMrG6iVDXlyg.docx", nBufferLength=0x32, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\BMrG6iVDXlyg.docx", lpFilePart=0x0) returned 0x31 [0123.941] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\BMrG6iVDXlyg.docx.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0123.941] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\BMrG6iVDXlyg.docx.paradox", nBufferLength=0x3a, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\BMrG6iVDXlyg.docx.paradox", lpFilePart=0x0) returned 0x39 [0123.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0123.942] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\BMrG6iVDXlyg.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\bmrg6ivdxlyg.docx"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec98030, ftCreationTime.dwHighDateTime=0x1d8bbb5, ftLastAccessTime.dwLowDateTime=0xd0367d90, ftLastAccessTime.dwHighDateTime=0x1d8bdb2, ftLastWriteTime.dwLowDateTime=0xc209ddef, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x102f0)) returned 1 [0123.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0123.942] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\BMrG6iVDXlyg.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\bmrg6ivdxlyg.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\BMrG6iVDXlyg.docx.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\bmrg6ivdxlyg.docx.paradox")) returned 1 [0123.943] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\BS18p.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0123.943] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\BS18p.pptx", nBufferLength=0x2b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\BS18p.pptx", lpFilePart=0x0) returned 0x2a [0123.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0123.943] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\BS18p.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\bs18p.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0123.943] GetFileType (hFile=0x364) returned 0x1 [0123.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0123.943] GetFileType (hFile=0x364) returned 0x1 [0123.943] GetFileSize (in: hFile=0x364, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x2d1f [0123.943] ReadFile (in: hFile=0x364, lpBuffer=0x24dbbb4, nNumberOfBytesToRead=0x2d1f, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x24dbbb4*, lpNumberOfBytesRead=0x19ed40*=0x2d1f, lpOverlapped=0x0) returned 1 [0123.943] CloseHandle (hObject=0x364) returned 1 [0123.963] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0123.963] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0123.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0123.963] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0123.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0123.963] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\BS18p.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0123.963] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\BS18p.pptx", nBufferLength=0x2b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\BS18p.pptx", lpFilePart=0x0) returned 0x2a [0123.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0123.963] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\BS18p.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\bs18p.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0123.965] GetFileType (hFile=0x364) returned 0x1 [0123.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0123.965] GetFileType (hFile=0x364) returned 0x1 [0123.965] WriteFile (in: hFile=0x364, lpBuffer=0x233b0d8*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x233b0d8*, lpNumberOfBytesWritten=0x19ed34*=0x2d20, lpOverlapped=0x0) returned 1 [0123.966] CloseHandle (hObject=0x364) returned 1 [0123.967] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\BS18p.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0123.967] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\BS18p.pptx", nBufferLength=0x2b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\BS18p.pptx", lpFilePart=0x0) returned 0x2a [0123.967] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\BS18p.pptx.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0123.967] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\BS18p.pptx.paradox", nBufferLength=0x33, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\BS18p.pptx.paradox", lpFilePart=0x0) returned 0x32 [0123.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0123.967] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\BS18p.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\bs18p.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3318acc0, ftCreationTime.dwHighDateTime=0x1d87cf0, ftLastAccessTime.dwLowDateTime=0xf8f434e0, ftLastAccessTime.dwHighDateTime=0x1d883db, ftLastWriteTime.dwLowDateTime=0xc20ea10b, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x2d20)) returned 1 [0123.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0123.968] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\BS18p.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\bs18p.pptx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\BS18p.pptx.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\bs18p.pptx.paradox")) returned 1 [0123.968] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\bxkuQ7Rq0NwFlu_.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0123.968] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\bxkuQ7Rq0NwFlu_.xlsx", nBufferLength=0x35, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\bxkuQ7Rq0NwFlu_.xlsx", lpFilePart=0x0) returned 0x34 [0123.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0123.969] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\bxkuQ7Rq0NwFlu_.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\bxkuq7rq0nwflu_.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0123.969] GetFileType (hFile=0x364) returned 0x1 [0123.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0123.969] GetFileType (hFile=0x364) returned 0x1 [0123.969] GetFileSize (in: hFile=0x364, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0xfcc1 [0123.969] ReadFile (in: hFile=0x364, lpBuffer=0x233e07c, nNumberOfBytesToRead=0xfcc1, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x233e07c*, lpNumberOfBytesRead=0x19ed40*=0xfcc1, lpOverlapped=0x0) returned 1 [0123.970] CloseHandle (hObject=0x364) returned 1 [0123.997] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0123.997] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0123.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0123.997] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0123.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0123.998] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\bxkuQ7Rq0NwFlu_.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0123.998] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\bxkuQ7Rq0NwFlu_.xlsx", nBufferLength=0x35, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\bxkuQ7Rq0NwFlu_.xlsx", lpFilePart=0x0) returned 0x34 [0123.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0123.998] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\bxkuQ7Rq0NwFlu_.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\bxkuq7rq0nwflu_.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0123.999] GetFileType (hFile=0x378) returned 0x1 [0123.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0123.999] GetFileType (hFile=0x378) returned 0x1 [0123.999] WriteFile (in: hFile=0x378, lpBuffer=0x23ba648*, nNumberOfBytesToWrite=0xfcd0, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x23ba648*, lpNumberOfBytesWritten=0x19ed34*=0xfcd0, lpOverlapped=0x0) returned 1 [0124.001] CloseHandle (hObject=0x378) returned 1 [0124.004] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\bxkuQ7Rq0NwFlu_.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0124.004] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\bxkuQ7Rq0NwFlu_.xlsx", nBufferLength=0x35, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\bxkuQ7Rq0NwFlu_.xlsx", lpFilePart=0x0) returned 0x34 [0124.004] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\bxkuQ7Rq0NwFlu_.xlsx.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0124.004] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\bxkuQ7Rq0NwFlu_.xlsx.paradox", nBufferLength=0x3d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\bxkuQ7Rq0NwFlu_.xlsx.paradox", lpFilePart=0x0) returned 0x3c [0124.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0124.004] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\bxkuQ7Rq0NwFlu_.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\bxkuq7rq0nwflu_.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x923bc440, ftCreationTime.dwHighDateTime=0x1d85b3e, ftLastAccessTime.dwLowDateTime=0xf9a25b10, ftLastAccessTime.dwHighDateTime=0x1d87d8c, ftLastWriteTime.dwLowDateTime=0xc215c9c6, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xfcd0)) returned 1 [0124.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0124.005] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\bxkuQ7Rq0NwFlu_.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\bxkuq7rq0nwflu_.xlsx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\bxkuQ7Rq0NwFlu_.xlsx.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\bxkuq7rq0nwflu_.xlsx.paradox")) returned 1 [0124.005] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\c9B91Yr5NnHGVSkP8ES.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0124.005] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\c9B91Yr5NnHGVSkP8ES.pptx", nBufferLength=0x39, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\c9B91Yr5NnHGVSkP8ES.pptx", lpFilePart=0x0) returned 0x38 [0124.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0124.005] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\c9B91Yr5NnHGVSkP8ES.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\c9b91yr5nnhgvskp8es.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.006] GetFileType (hFile=0x378) returned 0x1 [0124.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0124.006] GetFileType (hFile=0x378) returned 0x1 [0124.006] GetFileSize (in: hFile=0x378, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x41d1 [0124.006] ReadFile (in: hFile=0x378, lpBuffer=0x23ca5cc, nNumberOfBytesToRead=0x41d1, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x23ca5cc*, lpNumberOfBytesRead=0x19ed40*=0x41d1, lpOverlapped=0x0) returned 1 [0124.006] CloseHandle (hObject=0x378) returned 1 [0124.023] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0124.023] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0124.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0124.023] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0124.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0124.024] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\c9B91Yr5NnHGVSkP8ES.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0124.024] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\c9B91Yr5NnHGVSkP8ES.pptx", nBufferLength=0x39, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\c9B91Yr5NnHGVSkP8ES.pptx", lpFilePart=0x0) returned 0x38 [0124.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0124.024] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\c9B91Yr5NnHGVSkP8ES.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\c9b91yr5nnhgvskp8es.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.025] GetFileType (hFile=0x378) returned 0x1 [0124.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0124.025] GetFileType (hFile=0x378) returned 0x1 [0124.025] WriteFile (in: hFile=0x378, lpBuffer=0x242bd18*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x242bd18*, lpNumberOfBytesWritten=0x19ed34*=0x41e0, lpOverlapped=0x0) returned 1 [0124.026] CloseHandle (hObject=0x378) returned 1 [0124.028] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\c9B91Yr5NnHGVSkP8ES.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0124.028] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\c9B91Yr5NnHGVSkP8ES.pptx", nBufferLength=0x39, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\c9B91Yr5NnHGVSkP8ES.pptx", lpFilePart=0x0) returned 0x38 [0124.028] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\c9B91Yr5NnHGVSkP8ES.pptx.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0124.028] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\c9B91Yr5NnHGVSkP8ES.pptx.paradox", nBufferLength=0x41, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\c9B91Yr5NnHGVSkP8ES.pptx.paradox", lpFilePart=0x0) returned 0x40 [0124.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0124.028] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\c9B91Yr5NnHGVSkP8ES.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\c9b91yr5nnhgvskp8es.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1134bb0, ftCreationTime.dwHighDateTime=0x1d858e0, ftLastAccessTime.dwLowDateTime=0x92f461e0, ftLastAccessTime.dwHighDateTime=0x1d89120, ftLastWriteTime.dwLowDateTime=0xc2182ab6, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x41e0)) returned 1 [0124.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0124.028] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\c9B91Yr5NnHGVSkP8ES.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\c9b91yr5nnhgvskp8es.pptx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\c9B91Yr5NnHGVSkP8ES.pptx.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\c9b91yr5nnhgvskp8es.pptx.paradox")) returned 1 [0124.029] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dAFINowb06QqRO4uOt.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0124.029] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dAFINowb06QqRO4uOt.docx", nBufferLength=0x38, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\dAFINowb06QqRO4uOt.docx", lpFilePart=0x0) returned 0x37 [0124.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0124.029] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dAFINowb06QqRO4uOt.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\dafinowb06qqro4uot.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.029] GetFileType (hFile=0x378) returned 0x1 [0124.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0124.029] GetFileType (hFile=0x378) returned 0x1 [0124.029] GetFileSize (in: hFile=0x378, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x72a [0124.029] ReadFile (in: hFile=0x378, lpBuffer=0x24308f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x24308f0*, lpNumberOfBytesRead=0x19ed40*=0x72a, lpOverlapped=0x0) returned 1 [0124.030] CloseHandle (hObject=0x378) returned 1 [0124.075] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0124.075] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0124.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0124.075] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0124.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0124.075] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dAFINowb06QqRO4uOt.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0124.075] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dAFINowb06QqRO4uOt.docx", nBufferLength=0x38, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\dAFINowb06QqRO4uOt.docx", lpFilePart=0x0) returned 0x37 [0124.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0124.075] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dAFINowb06QqRO4uOt.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\dafinowb06qqro4uot.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.077] GetFileType (hFile=0x378) returned 0x1 [0124.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0124.077] GetFileType (hFile=0x378) returned 0x1 [0124.077] WriteFile (in: hFile=0x378, lpBuffer=0x2480c4c*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x19ed08, lpOverlapped=0x0 | out: lpBuffer=0x2480c4c*, lpNumberOfBytesWritten=0x19ed08*=0x730, lpOverlapped=0x0) returned 1 [0124.078] CloseHandle (hObject=0x378) returned 1 [0124.079] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dAFINowb06QqRO4uOt.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0124.079] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dAFINowb06QqRO4uOt.docx", nBufferLength=0x38, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\dAFINowb06QqRO4uOt.docx", lpFilePart=0x0) returned 0x37 [0124.079] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dAFINowb06QqRO4uOt.docx.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0124.079] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dAFINowb06QqRO4uOt.docx.paradox", nBufferLength=0x40, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\dAFINowb06QqRO4uOt.docx.paradox", lpFilePart=0x0) returned 0x3f [0124.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0124.079] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dAFINowb06QqRO4uOt.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\dafinowb06qqro4uot.docx"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a0a3fb0, ftCreationTime.dwHighDateTime=0x1d84fd5, ftLastAccessTime.dwLowDateTime=0x52bd6510, ftLastAccessTime.dwHighDateTime=0x1d88b2e, ftLastWriteTime.dwLowDateTime=0xc21f5331, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x730)) returned 1 [0124.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0124.079] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dAFINowb06QqRO4uOt.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\dafinowb06qqro4uot.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dAFINowb06QqRO4uOt.docx.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\dafinowb06qqro4uot.docx.paradox")) returned 1 [0124.080] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DoE cR5.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0124.080] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DoE cR5.xlsx", nBufferLength=0x2d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\DoE cR5.xlsx", lpFilePart=0x0) returned 0x2c [0124.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0124.080] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DoE cR5.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\doe cr5.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.081] GetFileType (hFile=0x378) returned 0x1 [0124.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0124.081] GetFileType (hFile=0x378) returned 0x1 [0124.081] GetFileSize (in: hFile=0x378, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x9ea3 [0124.081] ReadFile (in: hFile=0x378, lpBuffer=0x2481d98, nNumberOfBytesToRead=0x9ea3, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x2481d98*, lpNumberOfBytesRead=0x19ed40*=0x9ea3, lpOverlapped=0x0) returned 1 [0124.081] CloseHandle (hObject=0x378) returned 1 [0124.120] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0124.120] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0124.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0124.121] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0124.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0124.121] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DoE cR5.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0124.121] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DoE cR5.xlsx", nBufferLength=0x2d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\DoE cR5.xlsx", lpFilePart=0x0) returned 0x2c [0124.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0124.121] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DoE cR5.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\doe cr5.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.122] GetFileType (hFile=0x378) returned 0x1 [0124.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0124.122] GetFileType (hFile=0x378) returned 0x1 [0124.123] WriteFile (in: hFile=0x378, lpBuffer=0x25004f4*, nNumberOfBytesToWrite=0x9eb0, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x25004f4*, lpNumberOfBytesWritten=0x19ed34*=0x9eb0, lpOverlapped=0x0) returned 1 [0124.124] CloseHandle (hObject=0x378) returned 1 [0124.126] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DoE cR5.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0124.129] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DoE cR5.xlsx", nBufferLength=0x2d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\DoE cR5.xlsx", lpFilePart=0x0) returned 0x2c [0124.129] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DoE cR5.xlsx.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0124.129] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DoE cR5.xlsx.paradox", nBufferLength=0x35, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\DoE cR5.xlsx.paradox", lpFilePart=0x0) returned 0x34 [0124.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0124.129] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DoE cR5.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\doe cr5.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccf91330, ftCreationTime.dwHighDateTime=0x1d8bd6d, ftLastAccessTime.dwLowDateTime=0x6e680b90, ftLastAccessTime.dwHighDateTime=0x1d8c0ac, ftLastWriteTime.dwLowDateTime=0xc22679c0, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x9eb0)) returned 1 [0124.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0124.129] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DoE cR5.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\doe cr5.xlsx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DoE cR5.xlsx.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\doe cr5.xlsx.paradox")) returned 1 [0124.130] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\equM7or1T3W19x6ke.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0124.130] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\equM7or1T3W19x6ke.docx", nBufferLength=0x37, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\equM7or1T3W19x6ke.docx", lpFilePart=0x0) returned 0x36 [0124.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0124.130] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\equM7or1T3W19x6ke.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\equm7or1t3w19x6ke.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.131] GetFileType (hFile=0x378) returned 0x1 [0124.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0124.131] GetFileType (hFile=0x378) returned 0x1 [0124.131] GetFileSize (in: hFile=0x378, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x1317a [0124.140] ReadFile (in: hFile=0x378, lpBuffer=0x230d0f4, nNumberOfBytesToRead=0x1317a, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x230d0f4*, lpNumberOfBytesRead=0x19ed40*=0x1317a, lpOverlapped=0x0) returned 1 [0124.141] CloseHandle (hObject=0x378) returned 1 [0124.243] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0124.243] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0124.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0124.243] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0124.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0124.243] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\equM7or1T3W19x6ke.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0124.243] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\equM7or1T3W19x6ke.docx", nBufferLength=0x37, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\equM7or1T3W19x6ke.docx", lpFilePart=0x0) returned 0x36 [0124.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0124.243] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\equM7or1T3W19x6ke.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\equm7or1t3w19x6ke.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.245] GetFileType (hFile=0x378) returned 0x1 [0124.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0124.245] GetFileType (hFile=0x378) returned 0x1 [0124.246] WriteFile (in: hFile=0x378, lpBuffer=0x23934d0*, nNumberOfBytesToWrite=0x13180, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x23934d0*, lpNumberOfBytesWritten=0x19ed34*=0x13180, lpOverlapped=0x0) returned 1 [0124.248] CloseHandle (hObject=0x378) returned 1 [0124.274] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\equM7or1T3W19x6ke.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0124.274] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\equM7or1T3W19x6ke.docx", nBufferLength=0x37, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\equM7or1T3W19x6ke.docx", lpFilePart=0x0) returned 0x36 [0124.274] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\equM7or1T3W19x6ke.docx.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0124.274] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\equM7or1T3W19x6ke.docx.paradox", nBufferLength=0x3f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\equM7or1T3W19x6ke.docx.paradox", lpFilePart=0x0) returned 0x3e [0124.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0124.274] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\equM7or1T3W19x6ke.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\equm7or1t3w19x6ke.docx"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcae8ded0, ftCreationTime.dwHighDateTime=0x1d8ba62, ftLastAccessTime.dwLowDateTime=0xb6d28800, ftLastAccessTime.dwHighDateTime=0x1d8bb53, ftLastWriteTime.dwLowDateTime=0xc23e8d4b, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x13180)) returned 1 [0124.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0124.274] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\equM7or1T3W19x6ke.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\equm7or1t3w19x6ke.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\equM7or1T3W19x6ke.docx.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\equm7or1t3w19x6ke.docx.paradox")) returned 1 [0124.275] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iBJ0lud-.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0124.275] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iBJ0lud-.docx", nBufferLength=0x2e, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\iBJ0lud-.docx", lpFilePart=0x0) returned 0x2d [0124.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0124.275] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iBJ0lud-.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ibj0lud-.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.275] GetFileType (hFile=0x378) returned 0x1 [0124.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0124.275] GetFileType (hFile=0x378) returned 0x1 [0124.276] GetFileSize (in: hFile=0x378, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x99da [0124.276] ReadFile (in: hFile=0x378, lpBuffer=0x23a68f4, nNumberOfBytesToRead=0x99da, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x23a68f4*, lpNumberOfBytesRead=0x19ed40*=0x99da, lpOverlapped=0x0) returned 1 [0124.276] CloseHandle (hObject=0x378) returned 1 [0124.321] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0124.321] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0124.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0124.321] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0124.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0124.321] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iBJ0lud-.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0124.321] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iBJ0lud-.docx", nBufferLength=0x2e, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\iBJ0lud-.docx", lpFilePart=0x0) returned 0x2d [0124.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0124.322] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iBJ0lud-.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ibj0lud-.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.323] GetFileType (hFile=0x378) returned 0x1 [0124.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0124.323] GetFileType (hFile=0x378) returned 0x1 [0124.323] WriteFile (in: hFile=0x378, lpBuffer=0x2423840*, nNumberOfBytesToWrite=0x99e0, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x2423840*, lpNumberOfBytesWritten=0x19ed34*=0x99e0, lpOverlapped=0x0) returned 1 [0124.325] CloseHandle (hObject=0x378) returned 1 [0124.326] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iBJ0lud-.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0124.327] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iBJ0lud-.docx", nBufferLength=0x2e, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\iBJ0lud-.docx", lpFilePart=0x0) returned 0x2d [0124.327] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iBJ0lud-.docx.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0124.327] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iBJ0lud-.docx.paradox", nBufferLength=0x36, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\iBJ0lud-.docx.paradox", lpFilePart=0x0) returned 0x35 [0124.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0124.327] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iBJ0lud-.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ibj0lud-.docx"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd203eb0, ftCreationTime.dwHighDateTime=0x1d88c7c, ftLastAccessTime.dwLowDateTime=0x3f148070, ftLastAccessTime.dwHighDateTime=0x1d8934e, ftLastWriteTime.dwLowDateTime=0xc245766d, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x99e0)) returned 1 [0124.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0124.327] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iBJ0lud-.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ibj0lud-.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iBJ0lud-.docx.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ibj0lud-.docx.paradox")) returned 1 [0124.328] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iXIBDT Gx.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0124.328] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iXIBDT Gx.docx", nBufferLength=0x2f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\iXIBDT Gx.docx", lpFilePart=0x0) returned 0x2e [0124.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0124.328] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iXIBDT Gx.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ixibdt gx.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.328] GetFileType (hFile=0x378) returned 0x1 [0124.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0124.328] GetFileType (hFile=0x378) returned 0x1 [0124.328] GetFileSize (in: hFile=0x378, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x994a [0124.328] ReadFile (in: hFile=0x378, lpBuffer=0x242d4a0, nNumberOfBytesToRead=0x994a, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x242d4a0*, lpNumberOfBytesRead=0x19ed40*=0x994a, lpOverlapped=0x0) returned 1 [0124.329] CloseHandle (hObject=0x378) returned 1 [0124.353] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0124.354] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0124.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0124.354] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0124.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0124.354] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iXIBDT Gx.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0124.354] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iXIBDT Gx.docx", nBufferLength=0x2f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\iXIBDT Gx.docx", lpFilePart=0x0) returned 0x2e [0124.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0124.354] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iXIBDT Gx.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ixibdt gx.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.356] GetFileType (hFile=0x378) returned 0x1 [0124.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0124.356] GetFileType (hFile=0x378) returned 0x1 [0124.356] WriteFile (in: hFile=0x378, lpBuffer=0x24aa11c*, nNumberOfBytesToWrite=0x9950, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x24aa11c*, lpNumberOfBytesWritten=0x19ed34*=0x9950, lpOverlapped=0x0) returned 1 [0124.358] CloseHandle (hObject=0x378) returned 1 [0124.360] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iXIBDT Gx.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0124.360] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iXIBDT Gx.docx", nBufferLength=0x2f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\iXIBDT Gx.docx", lpFilePart=0x0) returned 0x2e [0124.360] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iXIBDT Gx.docx.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0124.360] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iXIBDT Gx.docx.paradox", nBufferLength=0x37, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\iXIBDT Gx.docx.paradox", lpFilePart=0x0) returned 0x36 [0124.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0124.360] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iXIBDT Gx.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ixibdt gx.docx"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdaaac730, ftCreationTime.dwHighDateTime=0x1d85148, ftLastAccessTime.dwLowDateTime=0xdebba830, ftLastAccessTime.dwHighDateTime=0x1d86caa, ftLastWriteTime.dwLowDateTime=0xc24a3cea, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x9950)) returned 1 [0124.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0124.360] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iXIBDT Gx.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ixibdt gx.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iXIBDT Gx.docx.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ixibdt gx.docx.paradox")) returned 1 [0124.361] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\JVYZ5G.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0124.361] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\JVYZ5G.pptx", nBufferLength=0x2c, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\JVYZ5G.pptx", lpFilePart=0x0) returned 0x2b [0124.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0124.362] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\JVYZ5G.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\jvyz5g.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.362] GetFileType (hFile=0x378) returned 0x1 [0124.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0124.362] GetFileType (hFile=0x378) returned 0x1 [0124.362] GetFileSize (in: hFile=0x378, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x13db3 [0124.362] ReadFile (in: hFile=0x378, lpBuffer=0x24b3cec, nNumberOfBytesToRead=0x13db3, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x24b3cec*, lpNumberOfBytesRead=0x19ed40*=0x13db3, lpOverlapped=0x0) returned 1 [0124.363] CloseHandle (hObject=0x378) returned 1 [0124.433] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0124.433] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0124.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0124.433] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0124.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0124.433] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\JVYZ5G.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0124.433] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\JVYZ5G.pptx", nBufferLength=0x2c, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\JVYZ5G.pptx", lpFilePart=0x0) returned 0x2b [0124.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0124.433] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\JVYZ5G.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\jvyz5g.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.435] GetFileType (hFile=0x378) returned 0x1 [0124.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0124.435] GetFileType (hFile=0x378) returned 0x1 [0124.435] WriteFile (in: hFile=0x378, lpBuffer=0x23506fc*, nNumberOfBytesToWrite=0x13dc0, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x23506fc*, lpNumberOfBytesWritten=0x19ed34*=0x13dc0, lpOverlapped=0x0) returned 1 [0124.437] CloseHandle (hObject=0x378) returned 1 [0124.445] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\JVYZ5G.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0124.445] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\JVYZ5G.pptx", nBufferLength=0x2c, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\JVYZ5G.pptx", lpFilePart=0x0) returned 0x2b [0124.445] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\JVYZ5G.pptx.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0124.445] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\JVYZ5G.pptx.paradox", nBufferLength=0x34, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\JVYZ5G.pptx.paradox", lpFilePart=0x0) returned 0x33 [0124.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0124.445] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\JVYZ5G.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\jvyz5g.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb07022f0, ftCreationTime.dwHighDateTime=0x1d8703b, ftLastAccessTime.dwLowDateTime=0x926323f0, ftLastAccessTime.dwHighDateTime=0x1d88523, ftLastWriteTime.dwLowDateTime=0xc258ad9c, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x13dc0)) returned 1 [0124.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0124.446] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\JVYZ5G.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\jvyz5g.pptx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\JVYZ5G.pptx.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\jvyz5g.pptx.paradox")) returned 1 [0124.446] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LfdJxcUKnYmX.ppt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0124.446] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LfdJxcUKnYmX.ppt", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\LfdJxcUKnYmX.ppt", lpFilePart=0x0) returned 0x30 [0124.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0124.447] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LfdJxcUKnYmX.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lfdjxcuknymx.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.447] GetFileType (hFile=0x378) returned 0x1 [0124.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0124.447] GetFileType (hFile=0x378) returned 0x1 [0124.447] GetFileSize (in: hFile=0x378, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x14e47 [0124.448] ReadFile (in: hFile=0x378, lpBuffer=0x35ead70, nNumberOfBytesToRead=0x14e47, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x35ead70*, lpNumberOfBytesRead=0x19ed40*=0x14e47, lpOverlapped=0x0) returned 1 [0124.449] CloseHandle (hObject=0x378) returned 1 [0124.481] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0124.481] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0124.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0124.481] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0124.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0124.481] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LfdJxcUKnYmX.ppt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0124.481] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LfdJxcUKnYmX.ppt", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\LfdJxcUKnYmX.ppt", lpFilePart=0x0) returned 0x30 [0124.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0124.481] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LfdJxcUKnYmX.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lfdjxcuknymx.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.483] GetFileType (hFile=0x378) returned 0x1 [0124.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0124.483] GetFileType (hFile=0x378) returned 0x1 [0124.483] WriteFile (in: hFile=0x378, lpBuffer=0x334ce50*, nNumberOfBytesToWrite=0x14e50, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x334ce50*, lpNumberOfBytesWritten=0x19ed34*=0x14e50, lpOverlapped=0x0) returned 1 [0124.487] CloseHandle (hObject=0x378) returned 1 [0124.490] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LfdJxcUKnYmX.ppt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0124.490] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LfdJxcUKnYmX.ppt", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\LfdJxcUKnYmX.ppt", lpFilePart=0x0) returned 0x30 [0124.490] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LfdJxcUKnYmX.ppt.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0124.490] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LfdJxcUKnYmX.ppt.paradox", nBufferLength=0x39, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\LfdJxcUKnYmX.ppt.paradox", lpFilePart=0x0) returned 0x38 [0124.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0124.490] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LfdJxcUKnYmX.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lfdjxcuknymx.ppt"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x627ae760, ftCreationTime.dwHighDateTime=0x1d8c117, ftLastAccessTime.dwLowDateTime=0xa783b970, ftLastAccessTime.dwHighDateTime=0x1d8c128, ftLastWriteTime.dwLowDateTime=0xc25fb59f, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x14e50)) returned 1 [0124.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0124.490] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LfdJxcUKnYmX.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lfdjxcuknymx.ppt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LfdJxcUKnYmX.ppt.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lfdjxcuknymx.ppt.paradox")) returned 1 [0124.491] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lqRCFpqE87LzQN.ppt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0124.491] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lqRCFpqE87LzQN.ppt", nBufferLength=0x33, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\lqRCFpqE87LzQN.ppt", lpFilePart=0x0) returned 0x32 [0124.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0124.491] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lqRCFpqE87LzQN.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lqrcfpqe87lzqn.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.491] GetFileType (hFile=0x378) returned 0x1 [0124.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0124.491] GetFileType (hFile=0x378) returned 0x1 [0124.491] GetFileSize (in: hFile=0x378, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x128d0 [0124.492] ReadFile (in: hFile=0x378, lpBuffer=0x22e8f48, nNumberOfBytesToRead=0x128d0, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x22e8f48*, lpNumberOfBytesRead=0x19ed40*=0x128d0, lpOverlapped=0x0) returned 1 [0124.492] CloseHandle (hObject=0x378) returned 1 [0124.569] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0124.569] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0124.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0124.569] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0124.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0124.569] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lqRCFpqE87LzQN.ppt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0124.569] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lqRCFpqE87LzQN.ppt", nBufferLength=0x33, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\lqRCFpqE87LzQN.ppt", lpFilePart=0x0) returned 0x32 [0124.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0124.569] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lqRCFpqE87LzQN.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lqrcfpqe87lzqn.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.571] GetFileType (hFile=0x378) returned 0x1 [0124.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0124.571] GetFileType (hFile=0x378) returned 0x1 [0124.571] WriteFile (in: hFile=0x378, lpBuffer=0x236d940*, nNumberOfBytesToWrite=0x128e0, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x236d940*, lpNumberOfBytesWritten=0x19ed34*=0x128e0, lpOverlapped=0x0) returned 1 [0124.573] CloseHandle (hObject=0x378) returned 1 [0124.577] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lqRCFpqE87LzQN.ppt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0124.577] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lqRCFpqE87LzQN.ppt", nBufferLength=0x33, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\lqRCFpqE87LzQN.ppt", lpFilePart=0x0) returned 0x32 [0124.577] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lqRCFpqE87LzQN.ppt.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0124.577] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lqRCFpqE87LzQN.ppt.paradox", nBufferLength=0x3b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\lqRCFpqE87LzQN.ppt.paradox", lpFilePart=0x0) returned 0x3a [0124.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0124.577] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lqRCFpqE87LzQN.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lqrcfpqe87lzqn.ppt"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0fe8f30, ftCreationTime.dwHighDateTime=0x1d8b4dd, ftLastAccessTime.dwLowDateTime=0x3db8f3b0, ftLastAccessTime.dwHighDateTime=0x1d8bc01, ftLastWriteTime.dwLowDateTime=0xc26ba24c, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x128e0)) returned 1 [0124.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0124.577] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lqRCFpqE87LzQN.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lqrcfpqe87lzqn.ppt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lqRCFpqE87LzQN.ppt.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lqrcfpqe87lzqn.ppt.paradox")) returned 1 [0124.578] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\mQx7YPEejtyQadEX8L.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0124.578] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\mQx7YPEejtyQadEX8L.docx", nBufferLength=0x38, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\mQx7YPEejtyQadEX8L.docx", lpFilePart=0x0) returned 0x37 [0124.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0124.578] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\mQx7YPEejtyQadEX8L.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\mqx7ypeejtyqadex8l.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.578] GetFileType (hFile=0x378) returned 0x1 [0124.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0124.578] GetFileType (hFile=0x378) returned 0x1 [0124.578] GetFileSize (in: hFile=0x378, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x5fc1 [0124.579] ReadFile (in: hFile=0x378, lpBuffer=0x23804c8, nNumberOfBytesToRead=0x5fc1, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x23804c8*, lpNumberOfBytesRead=0x19ed40*=0x5fc1, lpOverlapped=0x0) returned 1 [0124.579] CloseHandle (hObject=0x378) returned 1 [0124.595] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0124.595] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0124.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0124.604] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0124.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0124.604] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\mQx7YPEejtyQadEX8L.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0124.604] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\mQx7YPEejtyQadEX8L.docx", nBufferLength=0x38, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\mQx7YPEejtyQadEX8L.docx", lpFilePart=0x0) returned 0x37 [0124.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0124.604] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\mQx7YPEejtyQadEX8L.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\mqx7ypeejtyqadex8l.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.605] GetFileType (hFile=0x378) returned 0x1 [0124.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0124.606] GetFileType (hFile=0x378) returned 0x1 [0124.606] WriteFile (in: hFile=0x378, lpBuffer=0x23eb1c4*, nNumberOfBytesToWrite=0x5fd0, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x23eb1c4*, lpNumberOfBytesWritten=0x19ed34*=0x5fd0, lpOverlapped=0x0) returned 1 [0124.607] CloseHandle (hObject=0x378) returned 1 [0124.609] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\mQx7YPEejtyQadEX8L.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0124.609] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\mQx7YPEejtyQadEX8L.docx", nBufferLength=0x38, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\mQx7YPEejtyQadEX8L.docx", lpFilePart=0x0) returned 0x37 [0124.609] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\mQx7YPEejtyQadEX8L.docx.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0124.609] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\mQx7YPEejtyQadEX8L.docx.paradox", nBufferLength=0x40, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\mQx7YPEejtyQadEX8L.docx.paradox", lpFilePart=0x0) returned 0x3f [0124.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0124.610] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\mQx7YPEejtyQadEX8L.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\mqx7ypeejtyqadex8l.docx"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60e689c0, ftCreationTime.dwHighDateTime=0x1d8b769, ftLastAccessTime.dwLowDateTime=0xa82be250, ftLastAccessTime.dwHighDateTime=0x1d8b9bf, ftLastWriteTime.dwLowDateTime=0xc2713279, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x5fd0)) returned 1 [0124.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0124.610] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\mQx7YPEejtyQadEX8L.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\mqx7ypeejtyqadex8l.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\mQx7YPEejtyQadEX8L.docx.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\mqx7ypeejtyqadex8l.docx.paradox")) returned 1 [0124.613] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pZRQ3ttLP58bKcO.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0124.613] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pZRQ3ttLP58bKcO.docx", nBufferLength=0x35, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\pZRQ3ttLP58bKcO.docx", lpFilePart=0x0) returned 0x34 [0124.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0124.614] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pZRQ3ttLP58bKcO.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\pzrq3ttlp58bkco.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.614] GetFileType (hFile=0x378) returned 0x1 [0124.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0124.614] GetFileType (hFile=0x378) returned 0x1 [0124.614] GetFileSize (in: hFile=0x378, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x9c61 [0124.615] ReadFile (in: hFile=0x378, lpBuffer=0x23f1460, nNumberOfBytesToRead=0x9c61, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x23f1460*, lpNumberOfBytesRead=0x19ed40*=0x9c61, lpOverlapped=0x0) returned 1 [0124.616] CloseHandle (hObject=0x378) returned 1 [0124.633] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0124.633] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0124.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0124.633] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0124.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0124.633] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pZRQ3ttLP58bKcO.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0124.633] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pZRQ3ttLP58bKcO.docx", nBufferLength=0x35, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\pZRQ3ttLP58bKcO.docx", lpFilePart=0x0) returned 0x34 [0124.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0124.633] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pZRQ3ttLP58bKcO.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\pzrq3ttlp58bkco.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.635] GetFileType (hFile=0x378) returned 0x1 [0124.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0124.635] GetFileType (hFile=0x378) returned 0x1 [0124.635] WriteFile (in: hFile=0x378, lpBuffer=0x246f07c*, nNumberOfBytesToWrite=0x9c70, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x246f07c*, lpNumberOfBytesWritten=0x19ed34*=0x9c70, lpOverlapped=0x0) returned 1 [0124.636] CloseHandle (hObject=0x378) returned 1 [0124.641] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pZRQ3ttLP58bKcO.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0124.641] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pZRQ3ttLP58bKcO.docx", nBufferLength=0x35, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\pZRQ3ttLP58bKcO.docx", lpFilePart=0x0) returned 0x34 [0124.641] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pZRQ3ttLP58bKcO.docx.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0124.641] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pZRQ3ttLP58bKcO.docx.paradox", nBufferLength=0x3d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\pZRQ3ttLP58bKcO.docx.paradox", lpFilePart=0x0) returned 0x3c [0124.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0124.641] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pZRQ3ttLP58bKcO.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\pzrq3ttlp58bkco.docx"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89df1000, ftCreationTime.dwHighDateTime=0x1d8638f, ftLastAccessTime.dwLowDateTime=0xb065950, ftLastAccessTime.dwHighDateTime=0x1d88bd5, ftLastWriteTime.dwLowDateTime=0xc2752781, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x9c70)) returned 1 [0124.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0124.641] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pZRQ3ttLP58bKcO.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\pzrq3ttlp58bkco.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pZRQ3ttLP58bKcO.docx.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\pzrq3ttlp58bkco.docx.paradox")) returned 1 [0124.642] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\rbYBf.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0124.642] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\rbYBf.xlsx", nBufferLength=0x2b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\rbYBf.xlsx", lpFilePart=0x0) returned 0x2a [0124.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0124.644] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\rbYBf.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\rbybf.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.644] GetFileType (hFile=0x378) returned 0x1 [0124.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0124.645] GetFileType (hFile=0x378) returned 0x1 [0124.645] GetFileSize (in: hFile=0x378, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x3a58 [0124.645] ReadFile (in: hFile=0x378, lpBuffer=0x2478f84, nNumberOfBytesToRead=0x3a58, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x2478f84*, lpNumberOfBytesRead=0x19ed40*=0x3a58, lpOverlapped=0x0) returned 1 [0124.645] CloseHandle (hObject=0x378) returned 1 [0124.665] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0124.665] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0124.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0124.665] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0124.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0124.666] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\rbYBf.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0124.666] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\rbYBf.xlsx", nBufferLength=0x2b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\rbYBf.xlsx", lpFilePart=0x0) returned 0x2a [0124.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0124.666] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\rbYBf.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\rbybf.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.667] GetFileType (hFile=0x378) returned 0x1 [0124.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0124.667] GetFileType (hFile=0x378) returned 0x1 [0124.668] WriteFile (in: hFile=0x378, lpBuffer=0x24d814c*, nNumberOfBytesToWrite=0x3a60, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x24d814c*, lpNumberOfBytesWritten=0x19ed34*=0x3a60, lpOverlapped=0x0) returned 1 [0124.669] CloseHandle (hObject=0x378) returned 1 [0124.670] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\rbYBf.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0124.670] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\rbYBf.xlsx", nBufferLength=0x2b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\rbYBf.xlsx", lpFilePart=0x0) returned 0x2a [0124.671] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\rbYBf.xlsx.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0124.671] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\rbYBf.xlsx.paradox", nBufferLength=0x33, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\rbYBf.xlsx.paradox", lpFilePart=0x0) returned 0x32 [0124.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0124.671] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\rbYBf.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\rbybf.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cf304c0, ftCreationTime.dwHighDateTime=0x1d85bb6, ftLastAccessTime.dwLowDateTime=0x33347c50, ftLastAccessTime.dwHighDateTime=0x1d85cea, ftLastWriteTime.dwLowDateTime=0xc279ec7f, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x3a60)) returned 1 [0124.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0124.671] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\rbYBf.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\rbybf.xlsx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\rbYBf.xlsx.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\rbybf.xlsx.paradox")) returned 1 [0124.672] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Udu1XE4Hd0I8gwhDhX2.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0124.672] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Udu1XE4Hd0I8gwhDhX2.odt", nBufferLength=0x38, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Udu1XE4Hd0I8gwhDhX2.odt", lpFilePart=0x0) returned 0x37 [0124.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0124.672] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Udu1XE4Hd0I8gwhDhX2.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\udu1xe4hd0i8gwhdhx2.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.672] GetFileType (hFile=0x378) returned 0x1 [0124.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0124.673] GetFileType (hFile=0x378) returned 0x1 [0124.673] GetFileSize (in: hFile=0x378, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x15c56 [0124.673] ReadFile (in: hFile=0x378, lpBuffer=0x3386e80, nNumberOfBytesToRead=0x15c56, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x3386e80*, lpNumberOfBytesRead=0x19ed40*=0x15c56, lpOverlapped=0x0) returned 1 [0124.675] CloseHandle (hObject=0x378) returned 1 [0124.766] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0124.766] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0124.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0124.766] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0124.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0124.766] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Udu1XE4Hd0I8gwhDhX2.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0124.766] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Udu1XE4Hd0I8gwhDhX2.odt", nBufferLength=0x38, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Udu1XE4Hd0I8gwhDhX2.odt", lpFilePart=0x0) returned 0x37 [0124.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0124.766] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Udu1XE4Hd0I8gwhDhX2.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\udu1xe4hd0i8gwhdhx2.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.768] GetFileType (hFile=0x378) returned 0x1 [0124.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0124.768] GetFileType (hFile=0x378) returned 0x1 [0124.768] WriteFile (in: hFile=0x378, lpBuffer=0x33f3c98*, nNumberOfBytesToWrite=0x15c60, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x33f3c98*, lpNumberOfBytesWritten=0x19ed34*=0x15c60, lpOverlapped=0x0) returned 1 [0124.771] CloseHandle (hObject=0x378) returned 1 [0124.773] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Udu1XE4Hd0I8gwhDhX2.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0124.773] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Udu1XE4Hd0I8gwhDhX2.odt", nBufferLength=0x38, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Udu1XE4Hd0I8gwhDhX2.odt", lpFilePart=0x0) returned 0x37 [0124.774] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Udu1XE4Hd0I8gwhDhX2.odt.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0124.774] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Udu1XE4Hd0I8gwhDhX2.odt.paradox", nBufferLength=0x40, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Udu1XE4Hd0I8gwhDhX2.odt.paradox", lpFilePart=0x0) returned 0x3f [0124.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0124.774] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Udu1XE4Hd0I8gwhDhX2.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\udu1xe4hd0i8gwhdhx2.odt"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba85cfe0, ftCreationTime.dwHighDateTime=0x1d8b55c, ftLastAccessTime.dwLowDateTime=0xf81b550, ftLastAccessTime.dwHighDateTime=0x1d8c038, ftLastWriteTime.dwLowDateTime=0xc28a9c50, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x15c60)) returned 1 [0124.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0124.774] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Udu1XE4Hd0I8gwhDhX2.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\udu1xe4hd0i8gwhdhx2.odt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Udu1XE4Hd0I8gwhDhX2.odt.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\udu1xe4hd0i8gwhdhx2.odt.paradox")) returned 1 [0124.775] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\VGfbvj_4ydSGlCX-gZ2F.doc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0124.775] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\VGfbvj_4ydSGlCX-gZ2F.doc", nBufferLength=0x39, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\VGfbvj_4ydSGlCX-gZ2F.doc", lpFilePart=0x0) returned 0x38 [0124.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0124.775] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\VGfbvj_4ydSGlCX-gZ2F.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\vgfbvj_4ydsglcx-gz2f.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.775] GetFileType (hFile=0x378) returned 0x1 [0124.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0124.775] GetFileType (hFile=0x378) returned 0x1 [0124.775] GetFileSize (in: hFile=0x378, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0xad1a [0124.775] ReadFile (in: hFile=0x378, lpBuffer=0x23294dc, nNumberOfBytesToRead=0xad1a, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x23294dc*, lpNumberOfBytesRead=0x19ed40*=0xad1a, lpOverlapped=0x0) returned 1 [0124.776] CloseHandle (hObject=0x378) returned 1 [0124.794] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0124.794] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0124.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0124.794] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0124.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0124.794] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\VGfbvj_4ydSGlCX-gZ2F.doc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0124.794] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\VGfbvj_4ydSGlCX-gZ2F.doc", nBufferLength=0x39, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\VGfbvj_4ydSGlCX-gZ2F.doc", lpFilePart=0x0) returned 0x38 [0124.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0124.794] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\VGfbvj_4ydSGlCX-gZ2F.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\vgfbvj_4ydsglcx-gz2f.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.796] GetFileType (hFile=0x378) returned 0x1 [0124.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0124.796] GetFileType (hFile=0x378) returned 0x1 [0124.796] WriteFile (in: hFile=0x378, lpBuffer=0x2396b98*, nNumberOfBytesToWrite=0xad20, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x2396b98*, lpNumberOfBytesWritten=0x19ed34*=0xad20, lpOverlapped=0x0) returned 1 [0124.797] CloseHandle (hObject=0x378) returned 1 [0124.819] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\VGfbvj_4ydSGlCX-gZ2F.doc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0124.819] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\VGfbvj_4ydSGlCX-gZ2F.doc", nBufferLength=0x39, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\VGfbvj_4ydSGlCX-gZ2F.doc", lpFilePart=0x0) returned 0x38 [0124.819] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\VGfbvj_4ydSGlCX-gZ2F.doc.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0124.819] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\VGfbvj_4ydSGlCX-gZ2F.doc.paradox", nBufferLength=0x41, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\VGfbvj_4ydSGlCX-gZ2F.doc.paradox", lpFilePart=0x0) returned 0x40 [0124.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0124.819] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\VGfbvj_4ydSGlCX-gZ2F.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\vgfbvj_4ydsglcx-gz2f.doc"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a3ea50, ftCreationTime.dwHighDateTime=0x1d8b8f4, ftLastAccessTime.dwLowDateTime=0x7910f5c0, ftLastAccessTime.dwHighDateTime=0x1d8bd69, ftLastWriteTime.dwLowDateTime=0xc291c398, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xad20)) returned 1 [0124.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0124.819] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\VGfbvj_4ydSGlCX-gZ2F.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\vgfbvj_4ydsglcx-gz2f.doc"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\VGfbvj_4ydSGlCX-gZ2F.doc.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\vgfbvj_4ydsglcx-gz2f.doc.paradox")) returned 1 [0124.820] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XIB 5.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0124.820] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XIB 5.pptx", nBufferLength=0x2b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\XIB 5.pptx", lpFilePart=0x0) returned 0x2a [0124.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0124.820] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XIB 5.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\xib 5.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.820] GetFileType (hFile=0x378) returned 0x1 [0124.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0124.820] GetFileType (hFile=0x378) returned 0x1 [0124.820] GetFileSize (in: hFile=0x378, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x6106 [0124.820] ReadFile (in: hFile=0x378, lpBuffer=0x23a1b60, nNumberOfBytesToRead=0x6106, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x23a1b60*, lpNumberOfBytesRead=0x19ed40*=0x6106, lpOverlapped=0x0) returned 1 [0124.821] CloseHandle (hObject=0x378) returned 1 [0124.837] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0124.837] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0124.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0124.837] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0124.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0124.837] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XIB 5.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0124.837] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XIB 5.pptx", nBufferLength=0x2b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\XIB 5.pptx", lpFilePart=0x0) returned 0x2a [0124.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0124.837] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XIB 5.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\xib 5.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.838] GetFileType (hFile=0x378) returned 0x1 [0124.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0124.839] GetFileType (hFile=0x378) returned 0x1 [0124.839] WriteFile (in: hFile=0x378, lpBuffer=0x240ce9c*, nNumberOfBytesToWrite=0x6110, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x240ce9c*, lpNumberOfBytesWritten=0x19ed34*=0x6110, lpOverlapped=0x0) returned 1 [0124.840] CloseHandle (hObject=0x378) returned 1 [0124.842] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XIB 5.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0124.842] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XIB 5.pptx", nBufferLength=0x2b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\XIB 5.pptx", lpFilePart=0x0) returned 0x2a [0124.842] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XIB 5.pptx.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0124.842] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XIB 5.pptx.paradox", nBufferLength=0x33, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\XIB 5.pptx.paradox", lpFilePart=0x0) returned 0x32 [0124.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0124.842] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XIB 5.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\xib 5.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52edee30, ftCreationTime.dwHighDateTime=0x1d8a067, ftLastAccessTime.dwLowDateTime=0x5f4f4a00, ftLastAccessTime.dwHighDateTime=0x1d8a307, ftLastWriteTime.dwLowDateTime=0xc29425af, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x6110)) returned 1 [0124.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0124.842] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XIB 5.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\xib 5.pptx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XIB 5.pptx.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\xib 5.pptx.paradox")) returned 1 [0124.843] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\_p4fCTIw.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0124.843] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\_p4fCTIw.xlsx", nBufferLength=0x2e, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\_p4fCTIw.xlsx", lpFilePart=0x0) returned 0x2d [0124.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0124.843] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\_p4fCTIw.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\_p4fctiw.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.843] GetFileType (hFile=0x378) returned 0x1 [0124.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0124.843] GetFileType (hFile=0x378) returned 0x1 [0124.843] GetFileSize (in: hFile=0x378, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x90c5 [0124.843] ReadFile (in: hFile=0x378, lpBuffer=0x2413220, nNumberOfBytesToRead=0x90c5, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x2413220*, lpNumberOfBytesRead=0x19ed40*=0x90c5, lpOverlapped=0x0) returned 1 [0124.844] CloseHandle (hObject=0x378) returned 1 [0124.869] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0124.869] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0124.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0124.869] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0124.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0124.869] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\_p4fCTIw.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0124.869] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\_p4fCTIw.xlsx", nBufferLength=0x2e, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\_p4fCTIw.xlsx", lpFilePart=0x0) returned 0x2d [0124.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0124.870] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\_p4fCTIw.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\_p4fctiw.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.871] GetFileType (hFile=0x378) returned 0x1 [0124.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0124.871] GetFileType (hFile=0x378) returned 0x1 [0124.871] WriteFile (in: hFile=0x378, lpBuffer=0x248d41c*, nNumberOfBytesToWrite=0x90d0, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x248d41c*, lpNumberOfBytesWritten=0x19ed34*=0x90d0, lpOverlapped=0x0) returned 1 [0124.873] CloseHandle (hObject=0x378) returned 1 [0124.875] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\_p4fCTIw.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0124.875] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\_p4fCTIw.xlsx", nBufferLength=0x2e, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\_p4fCTIw.xlsx", lpFilePart=0x0) returned 0x2d [0124.875] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\_p4fCTIw.xlsx.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0124.875] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\_p4fCTIw.xlsx.paradox", nBufferLength=0x36, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\_p4fCTIw.xlsx.paradox", lpFilePart=0x0) returned 0x35 [0124.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0124.875] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\_p4fCTIw.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\_p4fctiw.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc4bd550, ftCreationTime.dwHighDateTime=0x1d8524c, ftLastAccessTime.dwLowDateTime=0xd3d43440, ftLastAccessTime.dwHighDateTime=0x1d858c9, ftLastWriteTime.dwLowDateTime=0xc298e9a3, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x90d0)) returned 1 [0124.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0124.875] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\_p4fCTIw.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\_p4fctiw.xlsx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\_p4fCTIw.xlsx.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\_p4fctiw.xlsx.paradox")) returned 1 [0124.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed78) returned 1 [0124.876] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0124.878] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr", nBufferLength=0x28, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr", lpFilePart=0x0) returned 0x27 [0124.878] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\*"), lpFindFileData=0x19eaa0 | out: lpFindFileData=0x19eaa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa85ca1a0, ftCreationTime.dwHighDateTime=0x1d8be25, ftLastAccessTime.dwLowDateTime=0x36411ec0, ftLastAccessTime.dwHighDateTime=0x1d8c000, ftLastWriteTime.dwLowDateTime=0x36411ec0, ftLastWriteTime.dwHighDateTime=0x1d8c000, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688e50 [0124.879] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa85ca1a0, ftCreationTime.dwHighDateTime=0x1d8be25, ftLastAccessTime.dwLowDateTime=0x36411ec0, ftLastAccessTime.dwHighDateTime=0x1d8c000, ftLastWriteTime.dwLowDateTime=0x36411ec0, ftLastWriteTime.dwHighDateTime=0x1d8c000, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.879] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0b53070, ftCreationTime.dwHighDateTime=0x1d8bad9, ftLastAccessTime.dwLowDateTime=0xfa7a4620, ftLastAccessTime.dwHighDateTime=0x1d8bf17, ftLastWriteTime.dwLowDateTime=0xfa7a4620, ftLastWriteTime.dwHighDateTime=0x1d8bf17, nFileSizeHigh=0x0, nFileSizeLow=0x6168, dwReserved0=0x0, dwReserved1=0x0, cFileName="8 N3.docx", cAlternateFileName="8N3~1.DOC")) returned 1 [0124.879] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b1cfa70, ftCreationTime.dwHighDateTime=0x1d8c093, ftLastAccessTime.dwLowDateTime=0x1f6d0750, ftLastAccessTime.dwHighDateTime=0x1d8c0cc, ftLastWriteTime.dwLowDateTime=0x1f6d0750, ftLastWriteTime.dwHighDateTime=0x1d8c0cc, nFileSizeHigh=0x0, nFileSizeLow=0x1097f, dwReserved0=0x0, dwReserved1=0x0, cFileName="bV9qL.docx", cAlternateFileName="BV9QL~1.DOC")) returned 1 [0124.879] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb12cc520, ftCreationTime.dwHighDateTime=0x1d8b287, ftLastAccessTime.dwLowDateTime=0xd45746a0, ftLastAccessTime.dwHighDateTime=0x1d8bbd4, ftLastWriteTime.dwLowDateTime=0xd45746a0, ftLastWriteTime.dwHighDateTime=0x1d8bbd4, nFileSizeHigh=0x0, nFileSizeLow=0x12def, dwReserved0=0x0, dwReserved1=0x0, cFileName="D4afyfsf.pdf", cAlternateFileName="")) returned 1 [0124.880] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x682adcf0, ftCreationTime.dwHighDateTime=0x1d8bf2e, ftLastAccessTime.dwLowDateTime=0xa00c9340, ftLastAccessTime.dwHighDateTime=0x1d8c0b2, ftLastWriteTime.dwLowDateTime=0xa00c9340, ftLastWriteTime.dwHighDateTime=0x1d8c0b2, nFileSizeHigh=0x0, nFileSizeLow=0xfc51, dwReserved0=0x0, dwReserved1=0x0, cFileName="djpjSrI5fAs5Us3c5R.ots", cAlternateFileName="DJPJSR~1.OTS")) returned 1 [0124.880] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9547300, ftCreationTime.dwHighDateTime=0x1d8b919, ftLastAccessTime.dwLowDateTime=0x9e2a4720, ftLastAccessTime.dwHighDateTime=0x1d8bd6f, ftLastWriteTime.dwLowDateTime=0x9e2a4720, ftLastWriteTime.dwHighDateTime=0x1d8bd6f, nFileSizeHigh=0x0, nFileSizeLow=0x7710, dwReserved0=0x0, dwReserved1=0x0, cFileName="dS4XBpBC-ep0y3bD27.ots", cAlternateFileName="DS4XBP~1.OTS")) returned 1 [0124.880] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c702fa0, ftCreationTime.dwHighDateTime=0x1d8bd9f, ftLastAccessTime.dwLowDateTime=0x1579ec80, ftLastAccessTime.dwHighDateTime=0x1d8bf15, ftLastWriteTime.dwLowDateTime=0x1579ec80, ftLastWriteTime.dwHighDateTime=0x1d8bf15, nFileSizeHigh=0x0, nFileSizeLow=0x9cdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="I2-T7.pps", cAlternateFileName="")) returned 1 [0124.880] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e26f0, ftCreationTime.dwHighDateTime=0x1d8bffc, ftLastAccessTime.dwLowDateTime=0x42659030, ftLastAccessTime.dwHighDateTime=0x1d8c101, ftLastWriteTime.dwLowDateTime=0x42659030, ftLastWriteTime.dwHighDateTime=0x1d8c101, nFileSizeHigh=0x0, nFileSizeLow=0xe45a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NxW3d3OjYtrQDUX.pptx", cAlternateFileName="NXW3D3~1.PPT")) returned 1 [0124.880] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe190a900, ftCreationTime.dwHighDateTime=0x1d8b45a, ftLastAccessTime.dwLowDateTime=0x6135db90, ftLastAccessTime.dwHighDateTime=0x1d8c017, ftLastWriteTime.dwLowDateTime=0x6135db90, ftLastWriteTime.dwHighDateTime=0x1d8c017, nFileSizeHigh=0x0, nFileSizeLow=0x137cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pm-YXcrz5DLV.csv", cAlternateFileName="PM-YXC~1.CSV")) returned 1 [0124.880] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf125390, ftCreationTime.dwHighDateTime=0x1d8b4b1, ftLastAccessTime.dwLowDateTime=0xd291b2c0, ftLastAccessTime.dwHighDateTime=0x1d8bbdd, ftLastWriteTime.dwLowDateTime=0xd291b2c0, ftLastWriteTime.dwHighDateTime=0x1d8bbdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QHmblmZbO vDP", cAlternateFileName="QHMBLM~1")) returned 1 [0124.881] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed290a90, ftCreationTime.dwHighDateTime=0x1d8bb4f, ftLastAccessTime.dwLowDateTime=0xfa2c8d10, ftLastAccessTime.dwHighDateTime=0x1d8bddf, ftLastWriteTime.dwLowDateTime=0xfa2c8d10, ftLastWriteTime.dwHighDateTime=0x1d8bddf, nFileSizeHigh=0x0, nFileSizeLow=0x1d20, dwReserved0=0x0, dwReserved1=0x0, cFileName="tytNW8bILXFbQUU.pps", cAlternateFileName="TYTNW8~1.PPS")) returned 1 [0124.881] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2317f420, ftCreationTime.dwHighDateTime=0x1d8b0f8, ftLastAccessTime.dwLowDateTime=0xa2066db0, ftLastAccessTime.dwHighDateTime=0x1d8b12b, ftLastWriteTime.dwLowDateTime=0xa2066db0, ftLastWriteTime.dwHighDateTime=0x1d8b12b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uZvI-CUD-ZhA-", cAlternateFileName="UZVI-C~1")) returned 1 [0124.881] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabd17140, ftCreationTime.dwHighDateTime=0x1d8b299, ftLastAccessTime.dwLowDateTime=0x9903f5f0, ftLastAccessTime.dwHighDateTime=0x1d8ba60, ftLastWriteTime.dwLowDateTime=0x9903f5f0, ftLastWriteTime.dwHighDateTime=0x1d8ba60, nFileSizeHigh=0x0, nFileSizeLow=0x1372d, dwReserved0=0x0, dwReserved1=0x0, cFileName="yiWvX.xls", cAlternateFileName="")) returned 1 [0124.881] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a0e60, ftCreationTime.dwHighDateTime=0x1d8bd92, ftLastAccessTime.dwLowDateTime=0x19925710, ftLastAccessTime.dwHighDateTime=0x1d8bdb9, ftLastWriteTime.dwLowDateTime=0x19925710, ftLastWriteTime.dwHighDateTime=0x1d8bdb9, nFileSizeHigh=0x0, nFileSizeLow=0x18a63, dwReserved0=0x0, dwReserved1=0x0, cFileName="zl803n95eQJd1.doc", cAlternateFileName="ZL803N~1.DOC")) returned 1 [0124.881] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0124.881] FindClose (in: hFindFile=0x688e50 | out: hFindFile=0x688e50) returned 1 [0124.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed34) returned 1 [0124.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed40) returned 1 [0124.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed78) returned 1 [0124.882] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0124.882] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr", nBufferLength=0x28, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr", lpFilePart=0x0) returned 0x27 [0124.882] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\*"), lpFindFileData=0x19eaa0 | out: lpFindFileData=0x19eaa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa85ca1a0, ftCreationTime.dwHighDateTime=0x1d8be25, ftLastAccessTime.dwLowDateTime=0x36411ec0, ftLastAccessTime.dwHighDateTime=0x1d8c000, ftLastWriteTime.dwLowDateTime=0x36411ec0, ftLastWriteTime.dwHighDateTime=0x1d8c000, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688e50 [0124.882] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa85ca1a0, ftCreationTime.dwHighDateTime=0x1d8be25, ftLastAccessTime.dwLowDateTime=0x36411ec0, ftLastAccessTime.dwHighDateTime=0x1d8c000, ftLastWriteTime.dwLowDateTime=0x36411ec0, ftLastWriteTime.dwHighDateTime=0x1d8c000, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.882] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0b53070, ftCreationTime.dwHighDateTime=0x1d8bad9, ftLastAccessTime.dwLowDateTime=0xfa7a4620, ftLastAccessTime.dwHighDateTime=0x1d8bf17, ftLastWriteTime.dwLowDateTime=0xfa7a4620, ftLastWriteTime.dwHighDateTime=0x1d8bf17, nFileSizeHigh=0x0, nFileSizeLow=0x6168, dwReserved0=0x0, dwReserved1=0x0, cFileName="8 N3.docx", cAlternateFileName="8N3~1.DOC")) returned 1 [0124.882] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b1cfa70, ftCreationTime.dwHighDateTime=0x1d8c093, ftLastAccessTime.dwLowDateTime=0x1f6d0750, ftLastAccessTime.dwHighDateTime=0x1d8c0cc, ftLastWriteTime.dwLowDateTime=0x1f6d0750, ftLastWriteTime.dwHighDateTime=0x1d8c0cc, nFileSizeHigh=0x0, nFileSizeLow=0x1097f, dwReserved0=0x0, dwReserved1=0x0, cFileName="bV9qL.docx", cAlternateFileName="BV9QL~1.DOC")) returned 1 [0124.883] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb12cc520, ftCreationTime.dwHighDateTime=0x1d8b287, ftLastAccessTime.dwLowDateTime=0xd45746a0, ftLastAccessTime.dwHighDateTime=0x1d8bbd4, ftLastWriteTime.dwLowDateTime=0xd45746a0, ftLastWriteTime.dwHighDateTime=0x1d8bbd4, nFileSizeHigh=0x0, nFileSizeLow=0x12def, dwReserved0=0x0, dwReserved1=0x0, cFileName="D4afyfsf.pdf", cAlternateFileName="")) returned 1 [0124.883] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x682adcf0, ftCreationTime.dwHighDateTime=0x1d8bf2e, ftLastAccessTime.dwLowDateTime=0xa00c9340, ftLastAccessTime.dwHighDateTime=0x1d8c0b2, ftLastWriteTime.dwLowDateTime=0xa00c9340, ftLastWriteTime.dwHighDateTime=0x1d8c0b2, nFileSizeHigh=0x0, nFileSizeLow=0xfc51, dwReserved0=0x0, dwReserved1=0x0, cFileName="djpjSrI5fAs5Us3c5R.ots", cAlternateFileName="DJPJSR~1.OTS")) returned 1 [0124.883] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9547300, ftCreationTime.dwHighDateTime=0x1d8b919, ftLastAccessTime.dwLowDateTime=0x9e2a4720, ftLastAccessTime.dwHighDateTime=0x1d8bd6f, ftLastWriteTime.dwLowDateTime=0x9e2a4720, ftLastWriteTime.dwHighDateTime=0x1d8bd6f, nFileSizeHigh=0x0, nFileSizeLow=0x7710, dwReserved0=0x0, dwReserved1=0x0, cFileName="dS4XBpBC-ep0y3bD27.ots", cAlternateFileName="DS4XBP~1.OTS")) returned 1 [0124.883] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c702fa0, ftCreationTime.dwHighDateTime=0x1d8bd9f, ftLastAccessTime.dwLowDateTime=0x1579ec80, ftLastAccessTime.dwHighDateTime=0x1d8bf15, ftLastWriteTime.dwLowDateTime=0x1579ec80, ftLastWriteTime.dwHighDateTime=0x1d8bf15, nFileSizeHigh=0x0, nFileSizeLow=0x9cdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="I2-T7.pps", cAlternateFileName="")) returned 1 [0124.883] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e26f0, ftCreationTime.dwHighDateTime=0x1d8bffc, ftLastAccessTime.dwLowDateTime=0x42659030, ftLastAccessTime.dwHighDateTime=0x1d8c101, ftLastWriteTime.dwLowDateTime=0x42659030, ftLastWriteTime.dwHighDateTime=0x1d8c101, nFileSizeHigh=0x0, nFileSizeLow=0xe45a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NxW3d3OjYtrQDUX.pptx", cAlternateFileName="NXW3D3~1.PPT")) returned 1 [0124.883] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe190a900, ftCreationTime.dwHighDateTime=0x1d8b45a, ftLastAccessTime.dwLowDateTime=0x6135db90, ftLastAccessTime.dwHighDateTime=0x1d8c017, ftLastWriteTime.dwLowDateTime=0x6135db90, ftLastWriteTime.dwHighDateTime=0x1d8c017, nFileSizeHigh=0x0, nFileSizeLow=0x137cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pm-YXcrz5DLV.csv", cAlternateFileName="PM-YXC~1.CSV")) returned 1 [0124.884] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf125390, ftCreationTime.dwHighDateTime=0x1d8b4b1, ftLastAccessTime.dwLowDateTime=0xd291b2c0, ftLastAccessTime.dwHighDateTime=0x1d8bbdd, ftLastWriteTime.dwLowDateTime=0xd291b2c0, ftLastWriteTime.dwHighDateTime=0x1d8bbdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QHmblmZbO vDP", cAlternateFileName="QHMBLM~1")) returned 1 [0124.884] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed290a90, ftCreationTime.dwHighDateTime=0x1d8bb4f, ftLastAccessTime.dwLowDateTime=0xfa2c8d10, ftLastAccessTime.dwHighDateTime=0x1d8bddf, ftLastWriteTime.dwLowDateTime=0xfa2c8d10, ftLastWriteTime.dwHighDateTime=0x1d8bddf, nFileSizeHigh=0x0, nFileSizeLow=0x1d20, dwReserved0=0x0, dwReserved1=0x0, cFileName="tytNW8bILXFbQUU.pps", cAlternateFileName="TYTNW8~1.PPS")) returned 1 [0124.884] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2317f420, ftCreationTime.dwHighDateTime=0x1d8b0f8, ftLastAccessTime.dwLowDateTime=0xa2066db0, ftLastAccessTime.dwHighDateTime=0x1d8b12b, ftLastWriteTime.dwLowDateTime=0xa2066db0, ftLastWriteTime.dwHighDateTime=0x1d8b12b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uZvI-CUD-ZhA-", cAlternateFileName="UZVI-C~1")) returned 1 [0124.884] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabd17140, ftCreationTime.dwHighDateTime=0x1d8b299, ftLastAccessTime.dwLowDateTime=0x9903f5f0, ftLastAccessTime.dwHighDateTime=0x1d8ba60, ftLastWriteTime.dwLowDateTime=0x9903f5f0, ftLastWriteTime.dwHighDateTime=0x1d8ba60, nFileSizeHigh=0x0, nFileSizeLow=0x1372d, dwReserved0=0x0, dwReserved1=0x0, cFileName="yiWvX.xls", cAlternateFileName="")) returned 1 [0124.884] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a0e60, ftCreationTime.dwHighDateTime=0x1d8bd92, ftLastAccessTime.dwLowDateTime=0x19925710, ftLastAccessTime.dwHighDateTime=0x1d8bdb9, ftLastWriteTime.dwLowDateTime=0x19925710, ftLastWriteTime.dwHighDateTime=0x1d8bdb9, nFileSizeHigh=0x0, nFileSizeLow=0x18a63, dwReserved0=0x0, dwReserved1=0x0, cFileName="zl803n95eQJd1.doc", cAlternateFileName="ZL803N~1.DOC")) returned 1 [0124.885] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a0e60, ftCreationTime.dwHighDateTime=0x1d8bd92, ftLastAccessTime.dwLowDateTime=0x19925710, ftLastAccessTime.dwHighDateTime=0x1d8bdb9, ftLastWriteTime.dwLowDateTime=0x19925710, ftLastWriteTime.dwHighDateTime=0x1d8bdb9, nFileSizeHigh=0x0, nFileSizeLow=0x18a63, dwReserved0=0x0, dwReserved1=0x0, cFileName="zl803n95eQJd1.doc", cAlternateFileName="ZL803N~1.DOC")) returned 0 [0124.885] FindClose (in: hFindFile=0x688e50 | out: hFindFile=0x688e50) returned 1 [0124.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed34) returned 1 [0124.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed40) returned 1 [0124.885] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\8 N3.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0124.885] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\8 N3.docx", nBufferLength=0x32, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\8 N3.docx", lpFilePart=0x0) returned 0x31 [0124.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0124.885] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\8 N3.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\8 n3.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.885] GetFileType (hFile=0x378) returned 0x1 [0124.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0124.885] GetFileType (hFile=0x378) returned 0x1 [0124.885] GetFileSize (in: hFile=0x378, lpFileSizeHigh=0x19ed20 | out: lpFileSizeHigh=0x19ed20*=0x0) returned 0x6168 [0124.886] ReadFile (in: hFile=0x378, lpBuffer=0x249997c, nNumberOfBytesToRead=0x6168, lpNumberOfBytesRead=0x19eccc, lpOverlapped=0x0 | out: lpBuffer=0x249997c*, lpNumberOfBytesRead=0x19eccc*=0x6168, lpOverlapped=0x0) returned 1 [0124.886] CloseHandle (hObject=0x378) returned 1 [0124.981] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0124.981] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0124.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0124.981] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed14 | out: lpFileInformation=0x19ed14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0124.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0124.981] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\8 N3.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0124.982] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\8 N3.docx", nBufferLength=0x32, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\8 N3.docx", lpFilePart=0x0) returned 0x31 [0124.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec10) returned 1 [0124.982] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\8 N3.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\8 n3.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.983] GetFileType (hFile=0x378) returned 0x1 [0124.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec0c) returned 1 [0124.983] GetFileType (hFile=0x378) returned 0x1 [0124.983] WriteFile (in: hFile=0x378, lpBuffer=0x230be88*, nNumberOfBytesToWrite=0x6170, lpNumberOfBytesWritten=0x19ecc0, lpOverlapped=0x0 | out: lpBuffer=0x230be88*, lpNumberOfBytesWritten=0x19ecc0*=0x6170, lpOverlapped=0x0) returned 1 [0124.985] CloseHandle (hObject=0x378) returned 1 [0124.993] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\8 N3.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0124.993] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\8 N3.docx", nBufferLength=0x32, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\8 N3.docx", lpFilePart=0x0) returned 0x31 [0124.993] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\8 N3.docx.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0124.993] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\8 N3.docx.paradox", nBufferLength=0x3a, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\8 N3.docx.paradox", lpFilePart=0x0) returned 0x39 [0124.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eca4) returned 1 [0124.993] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\8 N3.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\8 n3.docx"), fInfoLevelId=0x0, lpFileInformation=0x19ed20 | out: lpFileInformation=0x19ed20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0b53070, ftCreationTime.dwHighDateTime=0x1d8bad9, ftLastAccessTime.dwLowDateTime=0xfa7a4620, ftLastAccessTime.dwHighDateTime=0x1d8bf17, ftLastWriteTime.dwLowDateTime=0xc2ac8ebd, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x6170)) returned 1 [0124.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eca0) returned 1 [0124.993] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\8 N3.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\8 n3.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\8 N3.docx.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\8 n3.docx.paradox")) returned 1 [0124.994] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\bV9qL.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0124.994] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\bV9qL.docx", nBufferLength=0x33, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\bV9qL.docx", lpFilePart=0x0) returned 0x32 [0124.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0124.995] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\bV9qL.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\bv9ql.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.995] GetFileType (hFile=0x378) returned 0x1 [0124.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0124.995] GetFileType (hFile=0x378) returned 0x1 [0124.995] GetFileSize (in: hFile=0x378, lpFileSizeHigh=0x19ed20 | out: lpFileSizeHigh=0x19ed20*=0x0) returned 0x1097f [0124.995] ReadFile (in: hFile=0x378, lpBuffer=0x2312270, nNumberOfBytesToRead=0x1097f, lpNumberOfBytesRead=0x19eccc, lpOverlapped=0x0 | out: lpBuffer=0x2312270*, lpNumberOfBytesRead=0x19eccc*=0x1097f, lpOverlapped=0x0) returned 1 [0124.996] CloseHandle (hObject=0x378) returned 1 [0125.015] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0125.015] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0125.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0125.015] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed14 | out: lpFileInformation=0x19ed14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0125.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0125.015] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\bV9qL.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0125.015] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\bV9qL.docx", nBufferLength=0x33, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\bV9qL.docx", lpFilePart=0x0) returned 0x32 [0125.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec10) returned 1 [0125.015] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\bV9qL.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\bv9ql.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0125.017] GetFileType (hFile=0x378) returned 0x1 [0125.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec0c) returned 1 [0125.017] GetFileType (hFile=0x378) returned 0x1 [0125.023] WriteFile (in: hFile=0x378, lpBuffer=0x2390e4c*, nNumberOfBytesToWrite=0x10980, lpNumberOfBytesWritten=0x19ecc0, lpOverlapped=0x0 | out: lpBuffer=0x2390e4c*, lpNumberOfBytesWritten=0x19ecc0*=0x10980, lpOverlapped=0x0) returned 1 [0125.025] CloseHandle (hObject=0x378) returned 1 [0125.031] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\bV9qL.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0125.031] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\bV9qL.docx", nBufferLength=0x33, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\bV9qL.docx", lpFilePart=0x0) returned 0x32 [0125.031] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\bV9qL.docx.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0125.031] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\bV9qL.docx.paradox", nBufferLength=0x3b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\bV9qL.docx.paradox", lpFilePart=0x0) returned 0x3a [0125.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eca4) returned 1 [0125.031] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\bV9qL.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\bv9ql.docx"), fInfoLevelId=0x0, lpFileInformation=0x19ed20 | out: lpFileInformation=0x19ed20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b1cfa70, ftCreationTime.dwHighDateTime=0x1d8c093, ftLastAccessTime.dwLowDateTime=0x1f6d0750, ftLastAccessTime.dwHighDateTime=0x1d8c0cc, ftLastWriteTime.dwLowDateTime=0xc2b0c1d5, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x10980)) returned 1 [0125.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eca0) returned 1 [0125.031] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\bV9qL.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\bv9ql.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\bV9qL.docx.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\bv9ql.docx.paradox")) returned 1 [0125.032] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\D4afyfsf.pdf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0125.032] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\D4afyfsf.pdf", nBufferLength=0x35, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\D4afyfsf.pdf", lpFilePart=0x0) returned 0x34 [0125.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0125.032] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\D4afyfsf.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\d4afyfsf.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0125.033] GetFileType (hFile=0x378) returned 0x1 [0125.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0125.033] GetFileType (hFile=0x378) returned 0x1 [0125.033] GetFileSize (in: hFile=0x378, lpFileSizeHigh=0x19ed20 | out: lpFileSizeHigh=0x19ed20*=0x0) returned 0x12def [0125.033] ReadFile (in: hFile=0x378, lpBuffer=0x23a1a50, nNumberOfBytesToRead=0x12def, lpNumberOfBytesRead=0x19eccc, lpOverlapped=0x0 | out: lpBuffer=0x23a1a50*, lpNumberOfBytesRead=0x19eccc*=0x12def, lpOverlapped=0x0) returned 1 [0125.034] CloseHandle (hObject=0x378) returned 1 [0125.055] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0125.055] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0125.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0125.055] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed14 | out: lpFileInformation=0x19ed14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0125.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0125.055] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\D4afyfsf.pdf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0125.056] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\D4afyfsf.pdf", nBufferLength=0x35, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\D4afyfsf.pdf", lpFilePart=0x0) returned 0x34 [0125.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec10) returned 1 [0125.056] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\D4afyfsf.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\d4afyfsf.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0125.057] GetFileType (hFile=0x378) returned 0x1 [0125.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec0c) returned 1 [0125.057] GetFileType (hFile=0x378) returned 0x1 [0125.057] WriteFile (in: hFile=0x378, lpBuffer=0x2427220*, nNumberOfBytesToWrite=0x12df0, lpNumberOfBytesWritten=0x19ecc0, lpOverlapped=0x0 | out: lpBuffer=0x2427220*, lpNumberOfBytesWritten=0x19ecc0*=0x12df0, lpOverlapped=0x0) returned 1 [0125.059] CloseHandle (hObject=0x378) returned 1 [0125.062] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\D4afyfsf.pdf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0125.062] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\D4afyfsf.pdf", nBufferLength=0x35, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\D4afyfsf.pdf", lpFilePart=0x0) returned 0x34 [0125.062] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\D4afyfsf.pdf.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0125.062] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\D4afyfsf.pdf.paradox", nBufferLength=0x3d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\D4afyfsf.pdf.paradox", lpFilePart=0x0) returned 0x3c [0125.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eca4) returned 1 [0125.062] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\D4afyfsf.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\d4afyfsf.pdf"), fInfoLevelId=0x0, lpFileInformation=0x19ed20 | out: lpFileInformation=0x19ed20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb12cc520, ftCreationTime.dwHighDateTime=0x1d8b287, ftLastAccessTime.dwLowDateTime=0xd45746a0, ftLastAccessTime.dwHighDateTime=0x1d8bbd4, ftLastWriteTime.dwLowDateTime=0xc2b587d3, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x12df0)) returned 1 [0125.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eca0) returned 1 [0125.062] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\D4afyfsf.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\d4afyfsf.pdf"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\D4afyfsf.pdf.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\d4afyfsf.pdf.paradox")) returned 1 [0125.063] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\NxW3d3OjYtrQDUX.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0125.063] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\NxW3d3OjYtrQDUX.pptx", nBufferLength=0x3d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\NxW3d3OjYtrQDUX.pptx", lpFilePart=0x0) returned 0x3c [0125.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0125.063] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\NxW3d3OjYtrQDUX.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\nxw3d3ojytrqdux.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0125.063] GetFileType (hFile=0x378) returned 0x1 [0125.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0125.063] GetFileType (hFile=0x378) returned 0x1 [0125.063] GetFileSize (in: hFile=0x378, lpFileSizeHigh=0x19ed20 | out: lpFileSizeHigh=0x19ed20*=0x0) returned 0xe45a [0125.063] ReadFile (in: hFile=0x378, lpBuffer=0x243a2f4, nNumberOfBytesToRead=0xe45a, lpNumberOfBytesRead=0x19eccc, lpOverlapped=0x0 | out: lpBuffer=0x243a2f4*, lpNumberOfBytesRead=0x19eccc*=0xe45a, lpOverlapped=0x0) returned 1 [0125.065] CloseHandle (hObject=0x378) returned 1 [0125.083] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0125.083] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0125.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0125.083] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed14 | out: lpFileInformation=0x19ed14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0125.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0125.083] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\NxW3d3OjYtrQDUX.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0125.083] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\NxW3d3OjYtrQDUX.pptx", nBufferLength=0x3d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\NxW3d3OjYtrQDUX.pptx", lpFilePart=0x0) returned 0x3c [0125.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec10) returned 1 [0125.083] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\NxW3d3OjYtrQDUX.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\nxw3d3ojytrqdux.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0125.085] GetFileType (hFile=0x378) returned 0x1 [0125.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec0c) returned 1 [0125.085] GetFileType (hFile=0x378) returned 0x1 [0125.085] WriteFile (in: hFile=0x378, lpBuffer=0x24b1e14*, nNumberOfBytesToWrite=0xe460, lpNumberOfBytesWritten=0x19ecc0, lpOverlapped=0x0 | out: lpBuffer=0x24b1e14*, lpNumberOfBytesWritten=0x19ecc0*=0xe460, lpOverlapped=0x0) returned 1 [0125.087] CloseHandle (hObject=0x378) returned 1 [0125.089] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\NxW3d3OjYtrQDUX.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0125.089] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\NxW3d3OjYtrQDUX.pptx", nBufferLength=0x3d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\NxW3d3OjYtrQDUX.pptx", lpFilePart=0x0) returned 0x3c [0125.089] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\NxW3d3OjYtrQDUX.pptx.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x45 [0125.089] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\NxW3d3OjYtrQDUX.pptx.paradox", nBufferLength=0x45, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\NxW3d3OjYtrQDUX.pptx.paradox", lpFilePart=0x0) returned 0x44 [0125.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eca4) returned 1 [0125.089] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\NxW3d3OjYtrQDUX.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\nxw3d3ojytrqdux.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19ed20 | out: lpFileInformation=0x19ed20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e26f0, ftCreationTime.dwHighDateTime=0x1d8bffc, ftLastAccessTime.dwLowDateTime=0x42659030, ftLastAccessTime.dwHighDateTime=0x1d8c101, ftLastWriteTime.dwLowDateTime=0xc2ba4f06, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xe460)) returned 1 [0125.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eca0) returned 1 [0125.089] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\NxW3d3OjYtrQDUX.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\nxw3d3ojytrqdux.pptx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\NxW3d3OjYtrQDUX.pptx.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\nxw3d3ojytrqdux.pptx.paradox")) returned 1 [0125.090] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\Pm-YXcrz5DLV.csv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0125.090] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\Pm-YXcrz5DLV.csv", nBufferLength=0x39, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\Pm-YXcrz5DLV.csv", lpFilePart=0x0) returned 0x38 [0125.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0125.090] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\Pm-YXcrz5DLV.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\pm-yxcrz5dlv.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0125.090] GetFileType (hFile=0x378) returned 0x1 [0125.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0125.090] GetFileType (hFile=0x378) returned 0x1 [0125.090] GetFileSize (in: hFile=0x378, lpFileSizeHigh=0x19ed20 | out: lpFileSizeHigh=0x19ed20*=0x0) returned 0x137cc [0125.091] ReadFile (in: hFile=0x378, lpBuffer=0x24c0528, nNumberOfBytesToRead=0x137cc, lpNumberOfBytesRead=0x19eccc, lpOverlapped=0x0 | out: lpBuffer=0x24c0528*, lpNumberOfBytesRead=0x19eccc*=0x137cc, lpOverlapped=0x0) returned 1 [0125.091] CloseHandle (hObject=0x378) returned 1 [0125.181] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0125.181] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0125.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0125.181] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed14 | out: lpFileInformation=0x19ed14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0125.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0125.182] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\Pm-YXcrz5DLV.csv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0125.182] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\Pm-YXcrz5DLV.csv", nBufferLength=0x39, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\Pm-YXcrz5DLV.csv", lpFilePart=0x0) returned 0x38 [0125.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec10) returned 1 [0125.182] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\Pm-YXcrz5DLV.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\pm-yxcrz5dlv.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0125.184] GetFileType (hFile=0x378) returned 0x1 [0125.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec0c) returned 1 [0125.184] GetFileType (hFile=0x378) returned 0x1 [0125.184] WriteFile (in: hFile=0x378, lpBuffer=0x2367b78*, nNumberOfBytesToWrite=0x137d0, lpNumberOfBytesWritten=0x19ecc0, lpOverlapped=0x0 | out: lpBuffer=0x2367b78*, lpNumberOfBytesWritten=0x19ecc0*=0x137d0, lpOverlapped=0x0) returned 1 [0125.187] CloseHandle (hObject=0x378) returned 1 [0125.300] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\Pm-YXcrz5DLV.csv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0125.300] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\Pm-YXcrz5DLV.csv", nBufferLength=0x39, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\Pm-YXcrz5DLV.csv", lpFilePart=0x0) returned 0x38 [0125.300] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\Pm-YXcrz5DLV.csv.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0125.300] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\Pm-YXcrz5DLV.csv.paradox", nBufferLength=0x41, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\Pm-YXcrz5DLV.csv.paradox", lpFilePart=0x0) returned 0x40 [0125.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eca4) returned 1 [0125.300] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\Pm-YXcrz5DLV.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\pm-yxcrz5dlv.csv"), fInfoLevelId=0x0, lpFileInformation=0x19ed20 | out: lpFileInformation=0x19ed20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe190a900, ftCreationTime.dwHighDateTime=0x1d8b45a, ftLastAccessTime.dwLowDateTime=0x6135db90, ftLastAccessTime.dwHighDateTime=0x1d8c017, ftLastWriteTime.dwLowDateTime=0xc2dbac43, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x137d0)) returned 1 [0125.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eca0) returned 1 [0125.301] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\Pm-YXcrz5DLV.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\pm-yxcrz5dlv.csv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\Pm-YXcrz5DLV.csv.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\pm-yxcrz5dlv.csv.paradox")) returned 1 [0125.301] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\yiWvX.xls", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0125.301] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\yiWvX.xls", nBufferLength=0x32, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\yiWvX.xls", lpFilePart=0x0) returned 0x31 [0125.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0125.302] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\yiWvX.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\yiwvx.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0125.302] GetFileType (hFile=0x378) returned 0x1 [0125.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0125.302] GetFileType (hFile=0x378) returned 0x1 [0125.302] GetFileSize (in: hFile=0x378, lpFileSizeHigh=0x19ed20 | out: lpFileSizeHigh=0x19ed20*=0x0) returned 0x1372d [0125.302] ReadFile (in: hFile=0x378, lpBuffer=0x237b5f4, nNumberOfBytesToRead=0x1372d, lpNumberOfBytesRead=0x19eccc, lpOverlapped=0x0 | out: lpBuffer=0x237b5f4*, lpNumberOfBytesRead=0x19eccc*=0x1372d, lpOverlapped=0x0) returned 1 [0125.303] CloseHandle (hObject=0x378) returned 1 [0125.323] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0125.323] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0125.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0125.323] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed14 | out: lpFileInformation=0x19ed14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0125.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0125.323] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\yiWvX.xls", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0125.323] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\yiWvX.xls", nBufferLength=0x32, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\yiWvX.xls", lpFilePart=0x0) returned 0x31 [0125.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec10) returned 1 [0125.323] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\yiWvX.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\yiwvx.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0125.325] GetFileType (hFile=0x378) returned 0x1 [0125.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec0c) returned 1 [0125.325] GetFileType (hFile=0x378) returned 0x1 [0125.325] WriteFile (in: hFile=0x378, lpBuffer=0x2402ae0*, nNumberOfBytesToWrite=0x13730, lpNumberOfBytesWritten=0x19ecc0, lpOverlapped=0x0 | out: lpBuffer=0x2402ae0*, lpNumberOfBytesWritten=0x19ecc0*=0x13730, lpOverlapped=0x0) returned 1 [0125.327] CloseHandle (hObject=0x378) returned 1 [0125.335] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\yiWvX.xls", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0125.335] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\yiWvX.xls", nBufferLength=0x32, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\yiWvX.xls", lpFilePart=0x0) returned 0x31 [0125.335] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\yiWvX.xls.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0125.335] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\yiWvX.xls.paradox", nBufferLength=0x3a, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\yiWvX.xls.paradox", lpFilePart=0x0) returned 0x39 [0125.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eca4) returned 1 [0125.335] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\yiWvX.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\yiwvx.xls"), fInfoLevelId=0x0, lpFileInformation=0x19ed20 | out: lpFileInformation=0x19ed20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabd17140, ftCreationTime.dwHighDateTime=0x1d8b299, ftLastAccessTime.dwLowDateTime=0x9903f5f0, ftLastAccessTime.dwHighDateTime=0x1d8ba60, ftLastWriteTime.dwLowDateTime=0xc2e0eaee, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x13730)) returned 1 [0125.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eca0) returned 1 [0125.336] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\yiWvX.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\yiwvx.xls"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\yiWvX.xls.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\yiwvx.xls.paradox")) returned 1 [0125.337] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\zl803n95eQJd1.doc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0125.337] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\zl803n95eQJd1.doc", nBufferLength=0x3a, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\zl803n95eQJd1.doc", lpFilePart=0x0) returned 0x39 [0125.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0125.337] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\zl803n95eQJd1.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\zl803n95eqjd1.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0125.337] GetFileType (hFile=0x378) returned 0x1 [0125.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0125.337] GetFileType (hFile=0x378) returned 0x1 [0125.337] GetFileSize (in: hFile=0x378, lpFileSizeHigh=0x19ed20 | out: lpFileSizeHigh=0x19ed20*=0x0) returned 0x18a63 [0125.337] ReadFile (in: hFile=0x378, lpBuffer=0x34d08f8, nNumberOfBytesToRead=0x18a63, lpNumberOfBytesRead=0x19eccc, lpOverlapped=0x0 | out: lpBuffer=0x34d08f8*, lpNumberOfBytesRead=0x19eccc*=0x18a63, lpOverlapped=0x0) returned 1 [0125.338] CloseHandle (hObject=0x378) returned 1 [0125.368] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0125.368] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0125.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0125.368] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed14 | out: lpFileInformation=0x19ed14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0125.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0125.368] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\zl803n95eQJd1.doc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0125.368] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\zl803n95eQJd1.doc", nBufferLength=0x3a, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\zl803n95eQJd1.doc", lpFilePart=0x0) returned 0x39 [0125.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec10) returned 1 [0125.369] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\zl803n95eQJd1.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\zl803n95eqjd1.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0125.371] GetFileType (hFile=0x378) returned 0x1 [0125.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec0c) returned 1 [0125.371] GetFileType (hFile=0x378) returned 0x1 [0125.371] WriteFile (in: hFile=0x378, lpBuffer=0x354bd58*, nNumberOfBytesToWrite=0x18a70, lpNumberOfBytesWritten=0x19ecc0, lpOverlapped=0x0 | out: lpBuffer=0x354bd58*, lpNumberOfBytesWritten=0x19ecc0*=0x18a70, lpOverlapped=0x0) returned 1 [0125.374] CloseHandle (hObject=0x378) returned 1 [0125.382] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\zl803n95eQJd1.doc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0125.382] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\zl803n95eQJd1.doc", nBufferLength=0x3a, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\zl803n95eQJd1.doc", lpFilePart=0x0) returned 0x39 [0125.382] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\zl803n95eQJd1.doc.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0125.382] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\zl803n95eQJd1.doc.paradox", nBufferLength=0x42, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\zl803n95eQJd1.doc.paradox", lpFilePart=0x0) returned 0x41 [0125.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eca4) returned 1 [0125.382] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\zl803n95eQJd1.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\zl803n95eqjd1.doc"), fInfoLevelId=0x0, lpFileInformation=0x19ed20 | out: lpFileInformation=0x19ed20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a0e60, ftCreationTime.dwHighDateTime=0x1d8bd92, ftLastAccessTime.dwLowDateTime=0x19925710, ftLastAccessTime.dwHighDateTime=0x1d8bdb9, ftLastWriteTime.dwLowDateTime=0xc2e82a6c, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x18a70)) returned 1 [0125.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eca0) returned 1 [0125.382] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\zl803n95eQJd1.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\zl803n95eqjd1.doc"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\zl803n95eQJd1.doc.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\zl803n95eqjd1.doc.paradox")) returned 1 [0125.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed04) returned 1 [0125.383] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\QHmblmZbO vDP", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0125.383] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\QHmblmZbO vDP", nBufferLength=0x36, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\QHmblmZbO vDP", lpFilePart=0x0) returned 0x35 [0125.383] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\QHmblmZbO vDP\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\qhmblmzbo vdp\\*"), lpFindFileData=0x19ea2c | out: lpFindFileData=0x19ea2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf125390, ftCreationTime.dwHighDateTime=0x1d8b4b1, ftLastAccessTime.dwLowDateTime=0xd291b2c0, ftLastAccessTime.dwHighDateTime=0x1d8bbdd, ftLastWriteTime.dwLowDateTime=0xd291b2c0, ftLastWriteTime.dwHighDateTime=0x1d8bbdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x689010 [0125.384] FindNextFileW (in: hFindFile=0x689010, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf125390, ftCreationTime.dwHighDateTime=0x1d8b4b1, ftLastAccessTime.dwLowDateTime=0xd291b2c0, ftLastAccessTime.dwHighDateTime=0x1d8bbdd, ftLastWriteTime.dwLowDateTime=0xd291b2c0, ftLastWriteTime.dwHighDateTime=0x1d8bbdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.384] FindNextFileW (in: hFindFile=0x689010, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f73e710, ftCreationTime.dwHighDateTime=0x1d8c041, ftLastAccessTime.dwLowDateTime=0xd3d38a90, ftLastAccessTime.dwHighDateTime=0x1d8c05c, ftLastWriteTime.dwLowDateTime=0xd3d38a90, ftLastWriteTime.dwHighDateTime=0x1d8c05c, nFileSizeHigh=0x0, nFileSizeLow=0xe9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="mSyv2w.xls", cAlternateFileName="")) returned 1 [0125.384] FindNextFileW (in: hFindFile=0x689010, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0125.384] FindClose (in: hFindFile=0x689010 | out: hFindFile=0x689010) returned 1 [0125.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0125.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eccc) returned 1 [0125.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed04) returned 1 [0125.385] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\QHmblmZbO vDP", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0125.385] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\QHmblmZbO vDP", nBufferLength=0x36, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\QHmblmZbO vDP", lpFilePart=0x0) returned 0x35 [0125.385] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\QHmblmZbO vDP\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\qhmblmzbo vdp\\*"), lpFindFileData=0x19ea2c | out: lpFindFileData=0x19ea2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf125390, ftCreationTime.dwHighDateTime=0x1d8b4b1, ftLastAccessTime.dwLowDateTime=0xd291b2c0, ftLastAccessTime.dwHighDateTime=0x1d8bbdd, ftLastWriteTime.dwLowDateTime=0xd291b2c0, ftLastWriteTime.dwHighDateTime=0x1d8bbdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x689290 [0125.385] FindNextFileW (in: hFindFile=0x689290, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf125390, ftCreationTime.dwHighDateTime=0x1d8b4b1, ftLastAccessTime.dwLowDateTime=0xd291b2c0, ftLastAccessTime.dwHighDateTime=0x1d8bbdd, ftLastWriteTime.dwLowDateTime=0xd291b2c0, ftLastWriteTime.dwHighDateTime=0x1d8bbdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.386] FindNextFileW (in: hFindFile=0x689290, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f73e710, ftCreationTime.dwHighDateTime=0x1d8c041, ftLastAccessTime.dwLowDateTime=0xd3d38a90, ftLastAccessTime.dwHighDateTime=0x1d8c05c, ftLastWriteTime.dwLowDateTime=0xd3d38a90, ftLastWriteTime.dwHighDateTime=0x1d8c05c, nFileSizeHigh=0x0, nFileSizeLow=0xe9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="mSyv2w.xls", cAlternateFileName="")) returned 1 [0125.386] FindNextFileW (in: hFindFile=0x689290, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f73e710, ftCreationTime.dwHighDateTime=0x1d8c041, ftLastAccessTime.dwLowDateTime=0xd3d38a90, ftLastAccessTime.dwHighDateTime=0x1d8c05c, ftLastWriteTime.dwLowDateTime=0xd3d38a90, ftLastWriteTime.dwHighDateTime=0x1d8c05c, nFileSizeHigh=0x0, nFileSizeLow=0xe9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="mSyv2w.xls", cAlternateFileName="")) returned 0 [0125.386] FindClose (in: hFindFile=0x689290 | out: hFindFile=0x689290) returned 1 [0125.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0125.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eccc) returned 1 [0125.386] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\QHmblmZbO vDP\\mSyv2w.xls", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0125.386] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\QHmblmZbO vDP\\mSyv2w.xls", nBufferLength=0x41, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\QHmblmZbO vDP\\mSyv2w.xls", lpFilePart=0x0) returned 0x40 [0125.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebb0) returned 1 [0125.386] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\QHmblmZbO vDP\\mSyv2w.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\qhmblmzbo vdp\\msyv2w.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0125.387] GetFileType (hFile=0x378) returned 0x1 [0125.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebac) returned 1 [0125.387] GetFileType (hFile=0x378) returned 0x1 [0125.387] GetFileSize (in: hFile=0x378, lpFileSizeHigh=0x19ecac | out: lpFileSizeHigh=0x19ecac*=0x0) returned 0xe9d [0125.387] ReadFile (in: hFile=0x378, lpBuffer=0x2465420, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ec58, lpOverlapped=0x0 | out: lpBuffer=0x2465420*, lpNumberOfBytesRead=0x19ec58*=0xe9d, lpOverlapped=0x0) returned 1 [0125.387] CloseHandle (hObject=0x378) returned 1 [0125.421] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0125.421] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0125.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0125.421] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19eca0 | out: lpFileInformation=0x19eca0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0125.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0125.421] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\QHmblmZbO vDP\\mSyv2w.xls", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0125.421] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\QHmblmZbO vDP\\mSyv2w.xls", nBufferLength=0x41, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\QHmblmZbO vDP\\mSyv2w.xls", lpFilePart=0x0) returned 0x40 [0125.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb9c) returned 1 [0125.421] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\QHmblmZbO vDP\\mSyv2w.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\qhmblmzbo vdp\\msyv2w.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0125.423] GetFileType (hFile=0x378) returned 0x1 [0125.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb98) returned 1 [0125.423] GetFileType (hFile=0x378) returned 0x1 [0125.423] WriteFile (in: hFile=0x378, lpBuffer=0x24b7c90*, nNumberOfBytesToWrite=0xea0, lpNumberOfBytesWritten=0x19ec20, lpOverlapped=0x0 | out: lpBuffer=0x24b7c90*, lpNumberOfBytesWritten=0x19ec20*=0xea0, lpOverlapped=0x0) returned 1 [0125.425] CloseHandle (hObject=0x378) returned 1 [0125.429] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\QHmblmZbO vDP\\mSyv2w.xls", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0125.429] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\QHmblmZbO vDP\\mSyv2w.xls", nBufferLength=0x41, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\QHmblmZbO vDP\\mSyv2w.xls", lpFilePart=0x0) returned 0x40 [0125.429] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\QHmblmZbO vDP\\mSyv2w.xls.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0125.429] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\QHmblmZbO vDP\\mSyv2w.xls.paradox", nBufferLength=0x49, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\QHmblmZbO vDP\\mSyv2w.xls.paradox", lpFilePart=0x0) returned 0x48 [0125.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0125.429] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\QHmblmZbO vDP\\mSyv2w.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\qhmblmzbo vdp\\msyv2w.xls"), fInfoLevelId=0x0, lpFileInformation=0x19ecac | out: lpFileInformation=0x19ecac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f73e710, ftCreationTime.dwHighDateTime=0x1d8c041, ftLastAccessTime.dwLowDateTime=0xd3d38a90, ftLastAccessTime.dwHighDateTime=0x1d8c05c, ftLastWriteTime.dwLowDateTime=0xc2eebf25, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xea0)) returned 1 [0125.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0125.430] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\QHmblmZbO vDP\\mSyv2w.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\qhmblmzbo vdp\\msyv2w.xls"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\QHmblmZbO vDP\\mSyv2w.xls.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\qhmblmzbo vdp\\msyv2w.xls.paradox")) returned 1 [0125.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed04) returned 1 [0125.432] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0125.432] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-", nBufferLength=0x36, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-", lpFilePart=0x0) returned 0x35 [0125.432] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\uzvi-cud-zha-\\*"), lpFindFileData=0x19ea2c | out: lpFindFileData=0x19ea2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2317f420, ftCreationTime.dwHighDateTime=0x1d8b0f8, ftLastAccessTime.dwLowDateTime=0xa2066db0, ftLastAccessTime.dwHighDateTime=0x1d8b12b, ftLastWriteTime.dwLowDateTime=0xa2066db0, ftLastWriteTime.dwHighDateTime=0x1d8b12b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x689210 [0125.433] FindNextFileW (in: hFindFile=0x689210, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2317f420, ftCreationTime.dwHighDateTime=0x1d8b0f8, ftLastAccessTime.dwLowDateTime=0xa2066db0, ftLastAccessTime.dwHighDateTime=0x1d8b12b, ftLastWriteTime.dwLowDateTime=0xa2066db0, ftLastWriteTime.dwHighDateTime=0x1d8b12b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.433] FindNextFileW (in: hFindFile=0x689210, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39ca8cc0, ftCreationTime.dwHighDateTime=0x1d8bc54, ftLastAccessTime.dwLowDateTime=0x3c25ed50, ftLastAccessTime.dwHighDateTime=0x1d8bdd2, ftLastWriteTime.dwLowDateTime=0x3c25ed50, ftLastWriteTime.dwHighDateTime=0x1d8bdd2, nFileSizeHigh=0x0, nFileSizeLow=0x12d1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="bja6A98x5vLWnQwUGJE4.ods", cAlternateFileName="BJA6A9~1.ODS")) returned 1 [0125.433] FindNextFileW (in: hFindFile=0x689210, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92050e40, ftCreationTime.dwHighDateTime=0x1d8c093, ftLastAccessTime.dwLowDateTime=0x93b62d50, ftLastAccessTime.dwHighDateTime=0x1d8c11a, ftLastWriteTime.dwLowDateTime=0x93b62d50, ftLastWriteTime.dwHighDateTime=0x1d8c11a, nFileSizeHigh=0x0, nFileSizeLow=0x6c23, dwReserved0=0x0, dwReserved1=0x0, cFileName="cJ_bSXLOkj9cwEm9dwPl.ods", cAlternateFileName="CJ_BSX~1.ODS")) returned 1 [0125.434] FindNextFileW (in: hFindFile=0x689210, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3053f0, ftCreationTime.dwHighDateTime=0x1d8b68c, ftLastAccessTime.dwLowDateTime=0x8b00610, ftLastAccessTime.dwHighDateTime=0x1d8bf42, ftLastWriteTime.dwLowDateTime=0x8b00610, ftLastWriteTime.dwHighDateTime=0x1d8bf42, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gXAZTSzU cdzSa7dD9", cAlternateFileName="GXAZTS~1")) returned 1 [0125.434] FindNextFileW (in: hFindFile=0x689210, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e6438a0, ftCreationTime.dwHighDateTime=0x1d8b63f, ftLastAccessTime.dwLowDateTime=0xe97021d0, ftLastAccessTime.dwHighDateTime=0x1d8b94d, ftLastWriteTime.dwLowDateTime=0xe97021d0, ftLastWriteTime.dwHighDateTime=0x1d8b94d, nFileSizeHigh=0x0, nFileSizeLow=0xa39e, dwReserved0=0x0, dwReserved1=0x0, cFileName="jSFIqQ1nu5x8HuYb.ods", cAlternateFileName="JSFIQQ~1.ODS")) returned 1 [0125.434] FindNextFileW (in: hFindFile=0x689210, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2b82cf0, ftCreationTime.dwHighDateTime=0x1d8bb21, ftLastAccessTime.dwLowDateTime=0x714b1230, ftLastAccessTime.dwHighDateTime=0x1d8c0f7, ftLastWriteTime.dwLowDateTime=0x714b1230, ftLastWriteTime.dwHighDateTime=0x1d8c0f7, nFileSizeHigh=0x0, nFileSizeLow=0xfe91, dwReserved0=0x0, dwReserved1=0x0, cFileName="MjBQf.csv", cAlternateFileName="")) returned 1 [0125.435] FindNextFileW (in: hFindFile=0x689210, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f2f5a80, ftCreationTime.dwHighDateTime=0x1d8b33c, ftLastAccessTime.dwLowDateTime=0x2e7301a0, ftLastAccessTime.dwHighDateTime=0x1d8be5b, ftLastWriteTime.dwLowDateTime=0x2e7301a0, ftLastWriteTime.dwHighDateTime=0x1d8be5b, nFileSizeHigh=0x0, nFileSizeLow=0xea58, dwReserved0=0x0, dwReserved1=0x0, cFileName="pKVXiSUB.odp", cAlternateFileName="")) returned 1 [0125.435] FindNextFileW (in: hFindFile=0x689210, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1e6fcf0, ftCreationTime.dwHighDateTime=0x1d8b49b, ftLastAccessTime.dwLowDateTime=0xd0ed9910, ftLastAccessTime.dwHighDateTime=0x1d8bc74, ftLastWriteTime.dwLowDateTime=0xd0ed9910, ftLastWriteTime.dwHighDateTime=0x1d8bc74, nFileSizeHigh=0x0, nFileSizeLow=0x53ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="WrmtmocH.rtf", cAlternateFileName="")) returned 1 [0125.435] FindNextFileW (in: hFindFile=0x689210, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0125.435] FindClose (in: hFindFile=0x689210 | out: hFindFile=0x689210) returned 1 [0125.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0125.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eccc) returned 1 [0125.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed04) returned 1 [0125.436] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0125.436] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-", nBufferLength=0x36, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-", lpFilePart=0x0) returned 0x35 [0125.436] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\uzvi-cud-zha-\\*"), lpFindFileData=0x19ea2c | out: lpFindFileData=0x19ea2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2317f420, ftCreationTime.dwHighDateTime=0x1d8b0f8, ftLastAccessTime.dwLowDateTime=0xa2066db0, ftLastAccessTime.dwHighDateTime=0x1d8b12b, ftLastWriteTime.dwLowDateTime=0xa2066db0, ftLastWriteTime.dwHighDateTime=0x1d8b12b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x689050 [0125.436] FindNextFileW (in: hFindFile=0x689050, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2317f420, ftCreationTime.dwHighDateTime=0x1d8b0f8, ftLastAccessTime.dwLowDateTime=0xa2066db0, ftLastAccessTime.dwHighDateTime=0x1d8b12b, ftLastWriteTime.dwLowDateTime=0xa2066db0, ftLastWriteTime.dwHighDateTime=0x1d8b12b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.437] FindNextFileW (in: hFindFile=0x689050, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39ca8cc0, ftCreationTime.dwHighDateTime=0x1d8bc54, ftLastAccessTime.dwLowDateTime=0x3c25ed50, ftLastAccessTime.dwHighDateTime=0x1d8bdd2, ftLastWriteTime.dwLowDateTime=0x3c25ed50, ftLastWriteTime.dwHighDateTime=0x1d8bdd2, nFileSizeHigh=0x0, nFileSizeLow=0x12d1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="bja6A98x5vLWnQwUGJE4.ods", cAlternateFileName="BJA6A9~1.ODS")) returned 1 [0125.437] FindNextFileW (in: hFindFile=0x689050, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92050e40, ftCreationTime.dwHighDateTime=0x1d8c093, ftLastAccessTime.dwLowDateTime=0x93b62d50, ftLastAccessTime.dwHighDateTime=0x1d8c11a, ftLastWriteTime.dwLowDateTime=0x93b62d50, ftLastWriteTime.dwHighDateTime=0x1d8c11a, nFileSizeHigh=0x0, nFileSizeLow=0x6c23, dwReserved0=0x0, dwReserved1=0x0, cFileName="cJ_bSXLOkj9cwEm9dwPl.ods", cAlternateFileName="CJ_BSX~1.ODS")) returned 1 [0125.437] FindNextFileW (in: hFindFile=0x689050, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3053f0, ftCreationTime.dwHighDateTime=0x1d8b68c, ftLastAccessTime.dwLowDateTime=0x8b00610, ftLastAccessTime.dwHighDateTime=0x1d8bf42, ftLastWriteTime.dwLowDateTime=0x8b00610, ftLastWriteTime.dwHighDateTime=0x1d8bf42, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gXAZTSzU cdzSa7dD9", cAlternateFileName="GXAZTS~1")) returned 1 [0125.437] FindNextFileW (in: hFindFile=0x689050, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e6438a0, ftCreationTime.dwHighDateTime=0x1d8b63f, ftLastAccessTime.dwLowDateTime=0xe97021d0, ftLastAccessTime.dwHighDateTime=0x1d8b94d, ftLastWriteTime.dwLowDateTime=0xe97021d0, ftLastWriteTime.dwHighDateTime=0x1d8b94d, nFileSizeHigh=0x0, nFileSizeLow=0xa39e, dwReserved0=0x0, dwReserved1=0x0, cFileName="jSFIqQ1nu5x8HuYb.ods", cAlternateFileName="JSFIQQ~1.ODS")) returned 1 [0125.438] FindNextFileW (in: hFindFile=0x689050, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2b82cf0, ftCreationTime.dwHighDateTime=0x1d8bb21, ftLastAccessTime.dwLowDateTime=0x714b1230, ftLastAccessTime.dwHighDateTime=0x1d8c0f7, ftLastWriteTime.dwLowDateTime=0x714b1230, ftLastWriteTime.dwHighDateTime=0x1d8c0f7, nFileSizeHigh=0x0, nFileSizeLow=0xfe91, dwReserved0=0x0, dwReserved1=0x0, cFileName="MjBQf.csv", cAlternateFileName="")) returned 1 [0125.438] FindNextFileW (in: hFindFile=0x689050, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f2f5a80, ftCreationTime.dwHighDateTime=0x1d8b33c, ftLastAccessTime.dwLowDateTime=0x2e7301a0, ftLastAccessTime.dwHighDateTime=0x1d8be5b, ftLastWriteTime.dwLowDateTime=0x2e7301a0, ftLastWriteTime.dwHighDateTime=0x1d8be5b, nFileSizeHigh=0x0, nFileSizeLow=0xea58, dwReserved0=0x0, dwReserved1=0x0, cFileName="pKVXiSUB.odp", cAlternateFileName="")) returned 1 [0125.438] FindNextFileW (in: hFindFile=0x689050, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1e6fcf0, ftCreationTime.dwHighDateTime=0x1d8b49b, ftLastAccessTime.dwLowDateTime=0xd0ed9910, ftLastAccessTime.dwHighDateTime=0x1d8bc74, ftLastWriteTime.dwLowDateTime=0xd0ed9910, ftLastWriteTime.dwHighDateTime=0x1d8bc74, nFileSizeHigh=0x0, nFileSizeLow=0x53ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="WrmtmocH.rtf", cAlternateFileName="")) returned 1 [0125.439] FindNextFileW (in: hFindFile=0x689050, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1e6fcf0, ftCreationTime.dwHighDateTime=0x1d8b49b, ftLastAccessTime.dwLowDateTime=0xd0ed9910, ftLastAccessTime.dwHighDateTime=0x1d8bc74, ftLastWriteTime.dwLowDateTime=0xd0ed9910, ftLastWriteTime.dwHighDateTime=0x1d8bc74, nFileSizeHigh=0x0, nFileSizeLow=0x53ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="WrmtmocH.rtf", cAlternateFileName="")) returned 0 [0125.462] FindClose (in: hFindFile=0x689050 | out: hFindFile=0x689050) returned 1 [0125.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0125.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eccc) returned 1 [0125.462] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\MjBQf.csv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0125.462] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\MjBQf.csv", nBufferLength=0x40, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\MjBQf.csv", lpFilePart=0x0) returned 0x3f [0125.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebb0) returned 1 [0125.462] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\MjBQf.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\uzvi-cud-zha-\\mjbqf.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0125.463] GetFileType (hFile=0x378) returned 0x1 [0125.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebac) returned 1 [0125.463] GetFileType (hFile=0x378) returned 0x1 [0125.463] GetFileSize (in: hFile=0x378, lpFileSizeHigh=0x19ecac | out: lpFileSizeHigh=0x19ecac*=0x0) returned 0xfe91 [0125.463] ReadFile (in: hFile=0x378, lpBuffer=0x24bb3c0, nNumberOfBytesToRead=0xfe91, lpNumberOfBytesRead=0x19ec58, lpOverlapped=0x0 | out: lpBuffer=0x24bb3c0*, lpNumberOfBytesRead=0x19ec58*=0xfe91, lpOverlapped=0x0) returned 1 [0125.463] CloseHandle (hObject=0x378) returned 1 [0125.491] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0125.491] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0125.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0125.491] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19eca0 | out: lpFileInformation=0x19eca0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0125.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0125.492] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\MjBQf.csv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0125.492] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\MjBQf.csv", nBufferLength=0x40, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\MjBQf.csv", lpFilePart=0x0) returned 0x3f [0125.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb9c) returned 1 [0125.492] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\MjBQf.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\uzvi-cud-zha-\\mjbqf.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0125.494] GetFileType (hFile=0x378) returned 0x1 [0125.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb98) returned 1 [0125.494] GetFileType (hFile=0x378) returned 0x1 [0125.494] WriteFile (in: hFile=0x378, lpBuffer=0x2537da0*, nNumberOfBytesToWrite=0xfea0, lpNumberOfBytesWritten=0x19ec4c, lpOverlapped=0x0 | out: lpBuffer=0x2537da0*, lpNumberOfBytesWritten=0x19ec4c*=0xfea0, lpOverlapped=0x0) returned 1 [0125.497] CloseHandle (hObject=0x378) returned 1 [0125.568] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\MjBQf.csv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0125.568] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\MjBQf.csv", nBufferLength=0x40, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\MjBQf.csv", lpFilePart=0x0) returned 0x3f [0125.568] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\MjBQf.csv.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x48 [0125.568] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\MjBQf.csv.paradox", nBufferLength=0x48, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\MjBQf.csv.paradox", lpFilePart=0x0) returned 0x47 [0125.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0125.568] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\MjBQf.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\uzvi-cud-zha-\\mjbqf.csv"), fInfoLevelId=0x0, lpFileInformation=0x19ecac | out: lpFileInformation=0x19ecac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2b82cf0, ftCreationTime.dwHighDateTime=0x1d8bb21, ftLastAccessTime.dwLowDateTime=0x714b1230, ftLastAccessTime.dwHighDateTime=0x1d8c0f7, ftLastWriteTime.dwLowDateTime=0xc3044a25, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xfea0)) returned 1 [0125.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0125.568] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\MjBQf.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\uzvi-cud-zha-\\mjbqf.csv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\MjBQf.csv.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\uzvi-cud-zha-\\mjbqf.csv.paradox")) returned 1 [0125.569] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\WrmtmocH.rtf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0125.569] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\WrmtmocH.rtf", nBufferLength=0x43, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\WrmtmocH.rtf", lpFilePart=0x0) returned 0x42 [0125.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebb0) returned 1 [0125.569] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\WrmtmocH.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\uzvi-cud-zha-\\wrmtmoch.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0125.569] GetFileType (hFile=0x378) returned 0x1 [0125.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebac) returned 1 [0125.570] GetFileType (hFile=0x378) returned 0x1 [0125.570] GetFileSize (in: hFile=0x378, lpFileSizeHigh=0x19ecac | out: lpFileSizeHigh=0x19ecac*=0x0) returned 0x53ce [0125.570] ReadFile (in: hFile=0x378, lpBuffer=0x2547ef0, nNumberOfBytesToRead=0x53ce, lpNumberOfBytesRead=0x19ec58, lpOverlapped=0x0 | out: lpBuffer=0x2547ef0*, lpNumberOfBytesRead=0x19ec58*=0x53ce, lpOverlapped=0x0) returned 1 [0125.570] CloseHandle (hObject=0x378) returned 1 [0125.646] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0125.647] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0125.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0125.647] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19eca0 | out: lpFileInformation=0x19eca0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0125.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0125.647] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\WrmtmocH.rtf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0125.647] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\WrmtmocH.rtf", nBufferLength=0x43, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\WrmtmocH.rtf", lpFilePart=0x0) returned 0x42 [0125.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb9c) returned 1 [0125.647] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\WrmtmocH.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\uzvi-cud-zha-\\wrmtmoch.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0125.648] GetFileType (hFile=0x378) returned 0x1 [0125.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb98) returned 1 [0125.649] GetFileType (hFile=0x378) returned 0x1 [0125.649] WriteFile (in: hFile=0x378, lpBuffer=0x234ae88*, nNumberOfBytesToWrite=0x53d0, lpNumberOfBytesWritten=0x19ec4c, lpOverlapped=0x0 | out: lpBuffer=0x234ae88*, lpNumberOfBytesWritten=0x19ec4c*=0x53d0, lpOverlapped=0x0) returned 1 [0125.650] CloseHandle (hObject=0x378) returned 1 [0125.651] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\WrmtmocH.rtf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0125.651] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\WrmtmocH.rtf", nBufferLength=0x43, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\WrmtmocH.rtf", lpFilePart=0x0) returned 0x42 [0125.651] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\WrmtmocH.rtf.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4b [0125.652] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\WrmtmocH.rtf.paradox", nBufferLength=0x4b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\WrmtmocH.rtf.paradox", lpFilePart=0x0) returned 0x4a [0125.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0125.652] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\WrmtmocH.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\uzvi-cud-zha-\\wrmtmoch.rtf"), fInfoLevelId=0x0, lpFileInformation=0x19ecac | out: lpFileInformation=0x19ecac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1e6fcf0, ftCreationTime.dwHighDateTime=0x1d8b49b, ftLastAccessTime.dwLowDateTime=0xd0ed9910, ftLastAccessTime.dwHighDateTime=0x1d8bc74, ftLastWriteTime.dwLowDateTime=0xc310232a, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x53d0)) returned 1 [0125.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0125.652] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\WrmtmocH.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\uzvi-cud-zha-\\wrmtmoch.rtf"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\WrmtmocH.rtf.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\uzvi-cud-zha-\\wrmtmoch.rtf.paradox")) returned 1 [0125.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec90) returned 1 [0125.653] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0125.653] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9", nBufferLength=0x49, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9", lpFilePart=0x0) returned 0x48 [0125.653] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\uzvi-cud-zha-\\gxaztszu cdzsa7dd9\\*"), lpFindFileData=0x19e9b8 | out: lpFindFileData=0x19e9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3053f0, ftCreationTime.dwHighDateTime=0x1d8b68c, ftLastAccessTime.dwLowDateTime=0x8b00610, ftLastAccessTime.dwHighDateTime=0x1d8bf42, ftLastWriteTime.dwLowDateTime=0x8b00610, ftLastWriteTime.dwHighDateTime=0x1d8bf42, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688e50 [0125.653] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3053f0, ftCreationTime.dwHighDateTime=0x1d8b68c, ftLastAccessTime.dwLowDateTime=0x8b00610, ftLastAccessTime.dwHighDateTime=0x1d8bf42, ftLastWriteTime.dwLowDateTime=0x8b00610, ftLastWriteTime.dwHighDateTime=0x1d8bf42, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.653] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x965f9360, ftCreationTime.dwHighDateTime=0x1d8bb30, ftLastAccessTime.dwLowDateTime=0xbd970c30, ftLastAccessTime.dwHighDateTime=0x1d8c04c, ftLastWriteTime.dwLowDateTime=0xbd970c30, ftLastWriteTime.dwHighDateTime=0x1d8c04c, nFileSizeHigh=0x0, nFileSizeLow=0xa5a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="474dRaXCBnxUR.odp", cAlternateFileName="474DRA~1.ODP")) returned 1 [0125.654] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ca2e30, ftCreationTime.dwHighDateTime=0x1d8b506, ftLastAccessTime.dwLowDateTime=0x8ddf11e0, ftLastAccessTime.dwHighDateTime=0x1d8bffc, ftLastWriteTime.dwLowDateTime=0x8ddf11e0, ftLastWriteTime.dwHighDateTime=0x1d8bffc, nFileSizeHigh=0x0, nFileSizeLow=0x13cca, dwReserved0=0x0, dwReserved1=0x0, cFileName="7WEpE5sgZriB.ods", cAlternateFileName="7WEPE5~1.ODS")) returned 1 [0125.654] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9df479d0, ftCreationTime.dwHighDateTime=0x1d8bd5e, ftLastAccessTime.dwLowDateTime=0x45c29780, ftLastAccessTime.dwHighDateTime=0x1d8be88, ftLastWriteTime.dwLowDateTime=0x45c29780, ftLastWriteTime.dwHighDateTime=0x1d8be88, nFileSizeHigh=0x0, nFileSizeLow=0x5420, dwReserved0=0x0, dwReserved1=0x0, cFileName="a2 sd.ots", cAlternateFileName="A2SD~1.OTS")) returned 1 [0125.654] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e21d7c0, ftCreationTime.dwHighDateTime=0x1d8c0ce, ftLastAccessTime.dwLowDateTime=0x155f36d0, ftLastAccessTime.dwHighDateTime=0x1d8c0fd, ftLastWriteTime.dwLowDateTime=0x155f36d0, ftLastWriteTime.dwHighDateTime=0x1d8c0fd, nFileSizeHigh=0x0, nFileSizeLow=0x3d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fd2XhevfRzd.odt", cAlternateFileName="FD2XHE~1.ODT")) returned 1 [0125.654] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68726cd0, ftCreationTime.dwHighDateTime=0x1d8b5e4, ftLastAccessTime.dwLowDateTime=0xa8283410, ftLastAccessTime.dwHighDateTime=0x1d8c0aa, ftLastWriteTime.dwLowDateTime=0xa8283410, ftLastWriteTime.dwHighDateTime=0x1d8c0aa, nFileSizeHigh=0x0, nFileSizeLow=0x13e9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="hAG8_BLENEWKevuN.pptx", cAlternateFileName="HAG8_B~1.PPT")) returned 1 [0125.654] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7d8ff90, ftCreationTime.dwHighDateTime=0x1d8b7f2, ftLastAccessTime.dwLowDateTime=0x1b375e80, ftLastAccessTime.dwHighDateTime=0x1d8bada, ftLastWriteTime.dwLowDateTime=0x1b375e80, ftLastWriteTime.dwHighDateTime=0x1d8bada, nFileSizeHigh=0x0, nFileSizeLow=0x14051, dwReserved0=0x0, dwReserved1=0x0, cFileName="moUsOGoAr.odt", cAlternateFileName="MOUSOG~1.ODT")) returned 1 [0125.654] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ae62ea0, ftCreationTime.dwHighDateTime=0x1d8c111, ftLastAccessTime.dwLowDateTime=0xd5dcc3d0, ftLastAccessTime.dwHighDateTime=0x1d8c127, ftLastWriteTime.dwLowDateTime=0xd5dcc3d0, ftLastWriteTime.dwHighDateTime=0x1d8c127, nFileSizeHigh=0x0, nFileSizeLow=0xf85f, dwReserved0=0x0, dwReserved1=0x0, cFileName="nYbgdcIRhW1rqJ.xls", cAlternateFileName="NYBGDC~1.XLS")) returned 1 [0125.654] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f0bee50, ftCreationTime.dwHighDateTime=0x1d8baf5, ftLastAccessTime.dwLowDateTime=0xee83fb20, ftLastAccessTime.dwHighDateTime=0x1d8bb59, ftLastWriteTime.dwLowDateTime=0xee83fb20, ftLastWriteTime.dwHighDateTime=0x1d8bb59, nFileSizeHigh=0x0, nFileSizeLow=0x9b39, dwReserved0=0x0, dwReserved1=0x0, cFileName="odKLOrBA1F3.pps", cAlternateFileName="ODKLOR~1.PPS")) returned 1 [0125.655] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0125.655] FindClose (in: hFindFile=0x688e50 | out: hFindFile=0x688e50) returned 1 [0125.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0125.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec58) returned 1 [0125.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec90) returned 1 [0125.655] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0125.655] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9", nBufferLength=0x49, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9", lpFilePart=0x0) returned 0x48 [0125.655] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\uzvi-cud-zha-\\gxaztszu cdzsa7dd9\\*"), lpFindFileData=0x19e9b8 | out: lpFindFileData=0x19e9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3053f0, ftCreationTime.dwHighDateTime=0x1d8b68c, ftLastAccessTime.dwLowDateTime=0x8b00610, ftLastAccessTime.dwHighDateTime=0x1d8bf42, ftLastWriteTime.dwLowDateTime=0x8b00610, ftLastWriteTime.dwHighDateTime=0x1d8bf42, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688e50 [0125.655] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3053f0, ftCreationTime.dwHighDateTime=0x1d8b68c, ftLastAccessTime.dwLowDateTime=0x8b00610, ftLastAccessTime.dwHighDateTime=0x1d8bf42, ftLastWriteTime.dwLowDateTime=0x8b00610, ftLastWriteTime.dwHighDateTime=0x1d8bf42, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.656] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x965f9360, ftCreationTime.dwHighDateTime=0x1d8bb30, ftLastAccessTime.dwLowDateTime=0xbd970c30, ftLastAccessTime.dwHighDateTime=0x1d8c04c, ftLastWriteTime.dwLowDateTime=0xbd970c30, ftLastWriteTime.dwHighDateTime=0x1d8c04c, nFileSizeHigh=0x0, nFileSizeLow=0xa5a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="474dRaXCBnxUR.odp", cAlternateFileName="474DRA~1.ODP")) returned 1 [0125.656] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ca2e30, ftCreationTime.dwHighDateTime=0x1d8b506, ftLastAccessTime.dwLowDateTime=0x8ddf11e0, ftLastAccessTime.dwHighDateTime=0x1d8bffc, ftLastWriteTime.dwLowDateTime=0x8ddf11e0, ftLastWriteTime.dwHighDateTime=0x1d8bffc, nFileSizeHigh=0x0, nFileSizeLow=0x13cca, dwReserved0=0x0, dwReserved1=0x0, cFileName="7WEpE5sgZriB.ods", cAlternateFileName="7WEPE5~1.ODS")) returned 1 [0125.656] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9df479d0, ftCreationTime.dwHighDateTime=0x1d8bd5e, ftLastAccessTime.dwLowDateTime=0x45c29780, ftLastAccessTime.dwHighDateTime=0x1d8be88, ftLastWriteTime.dwLowDateTime=0x45c29780, ftLastWriteTime.dwHighDateTime=0x1d8be88, nFileSizeHigh=0x0, nFileSizeLow=0x5420, dwReserved0=0x0, dwReserved1=0x0, cFileName="a2 sd.ots", cAlternateFileName="A2SD~1.OTS")) returned 1 [0125.656] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e21d7c0, ftCreationTime.dwHighDateTime=0x1d8c0ce, ftLastAccessTime.dwLowDateTime=0x155f36d0, ftLastAccessTime.dwHighDateTime=0x1d8c0fd, ftLastWriteTime.dwLowDateTime=0x155f36d0, ftLastWriteTime.dwHighDateTime=0x1d8c0fd, nFileSizeHigh=0x0, nFileSizeLow=0x3d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fd2XhevfRzd.odt", cAlternateFileName="FD2XHE~1.ODT")) returned 1 [0125.656] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68726cd0, ftCreationTime.dwHighDateTime=0x1d8b5e4, ftLastAccessTime.dwLowDateTime=0xa8283410, ftLastAccessTime.dwHighDateTime=0x1d8c0aa, ftLastWriteTime.dwLowDateTime=0xa8283410, ftLastWriteTime.dwHighDateTime=0x1d8c0aa, nFileSizeHigh=0x0, nFileSizeLow=0x13e9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="hAG8_BLENEWKevuN.pptx", cAlternateFileName="HAG8_B~1.PPT")) returned 1 [0125.657] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7d8ff90, ftCreationTime.dwHighDateTime=0x1d8b7f2, ftLastAccessTime.dwLowDateTime=0x1b375e80, ftLastAccessTime.dwHighDateTime=0x1d8bada, ftLastWriteTime.dwLowDateTime=0x1b375e80, ftLastWriteTime.dwHighDateTime=0x1d8bada, nFileSizeHigh=0x0, nFileSizeLow=0x14051, dwReserved0=0x0, dwReserved1=0x0, cFileName="moUsOGoAr.odt", cAlternateFileName="MOUSOG~1.ODT")) returned 1 [0125.657] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ae62ea0, ftCreationTime.dwHighDateTime=0x1d8c111, ftLastAccessTime.dwLowDateTime=0xd5dcc3d0, ftLastAccessTime.dwHighDateTime=0x1d8c127, ftLastWriteTime.dwLowDateTime=0xd5dcc3d0, ftLastWriteTime.dwHighDateTime=0x1d8c127, nFileSizeHigh=0x0, nFileSizeLow=0xf85f, dwReserved0=0x0, dwReserved1=0x0, cFileName="nYbgdcIRhW1rqJ.xls", cAlternateFileName="NYBGDC~1.XLS")) returned 1 [0125.657] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f0bee50, ftCreationTime.dwHighDateTime=0x1d8baf5, ftLastAccessTime.dwLowDateTime=0xee83fb20, ftLastAccessTime.dwHighDateTime=0x1d8bb59, ftLastWriteTime.dwLowDateTime=0xee83fb20, ftLastWriteTime.dwHighDateTime=0x1d8bb59, nFileSizeHigh=0x0, nFileSizeLow=0x9b39, dwReserved0=0x0, dwReserved1=0x0, cFileName="odKLOrBA1F3.pps", cAlternateFileName="ODKLOR~1.PPS")) returned 1 [0125.657] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f0bee50, ftCreationTime.dwHighDateTime=0x1d8baf5, ftLastAccessTime.dwLowDateTime=0xee83fb20, ftLastAccessTime.dwHighDateTime=0x1d8bb59, ftLastWriteTime.dwLowDateTime=0xee83fb20, ftLastWriteTime.dwHighDateTime=0x1d8bb59, nFileSizeHigh=0x0, nFileSizeLow=0x9b39, dwReserved0=0x0, dwReserved1=0x0, cFileName="odKLOrBA1F3.pps", cAlternateFileName="ODKLOR~1.PPS")) returned 0 [0125.657] FindClose (in: hFindFile=0x688e50 | out: hFindFile=0x688e50) returned 1 [0125.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0125.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec58) returned 1 [0125.659] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\Fd2XhevfRzd.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x59 [0125.659] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\Fd2XhevfRzd.odt", nBufferLength=0x59, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\Fd2XhevfRzd.odt", lpFilePart=0x0) returned 0x58 [0125.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb3c) returned 1 [0125.659] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\Fd2XhevfRzd.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\uzvi-cud-zha-\\gxaztszu cdzsa7dd9\\fd2xhevfrzd.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0125.659] GetFileType (hFile=0x378) returned 0x1 [0125.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb38) returned 1 [0125.659] GetFileType (hFile=0x378) returned 0x1 [0125.660] GetFileSize (in: hFile=0x378, lpFileSizeHigh=0x19ec38 | out: lpFileSizeHigh=0x19ec38*=0x0) returned 0x3d78 [0125.660] ReadFile (in: hFile=0x378, lpBuffer=0x2353664, nNumberOfBytesToRead=0x3d78, lpNumberOfBytesRead=0x19ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2353664*, lpNumberOfBytesRead=0x19ebe4*=0x3d78, lpOverlapped=0x0) returned 1 [0125.660] CloseHandle (hObject=0x378) returned 1 [0125.677] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0125.677] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0125.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebb0) returned 1 [0125.677] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ec2c | out: lpFileInformation=0x19ec2c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0125.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebac) returned 1 [0125.677] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\Fd2XhevfRzd.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x59 [0125.677] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\Fd2XhevfRzd.odt", nBufferLength=0x59, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\Fd2XhevfRzd.odt", lpFilePart=0x0) returned 0x58 [0125.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb28) returned 1 [0125.677] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\Fd2XhevfRzd.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\uzvi-cud-zha-\\gxaztszu cdzsa7dd9\\fd2xhevfrzd.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0125.679] GetFileType (hFile=0x378) returned 0x1 [0125.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb24) returned 1 [0125.679] GetFileType (hFile=0x378) returned 0x1 [0125.679] WriteFile (in: hFile=0x378, lpBuffer=0x23b3928*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x19ebd8, lpOverlapped=0x0 | out: lpBuffer=0x23b3928*, lpNumberOfBytesWritten=0x19ebd8*=0x3d80, lpOverlapped=0x0) returned 1 [0125.680] CloseHandle (hObject=0x378) returned 1 [0125.682] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\Fd2XhevfRzd.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x59 [0125.682] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\Fd2XhevfRzd.odt", nBufferLength=0x59, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\Fd2XhevfRzd.odt", lpFilePart=0x0) returned 0x58 [0125.682] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\Fd2XhevfRzd.odt.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x61 [0125.682] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\Fd2XhevfRzd.odt.paradox", nBufferLength=0x61, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\Fd2XhevfRzd.odt.paradox", lpFilePart=0x0) returned 0x60 [0125.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0125.682] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\Fd2XhevfRzd.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\uzvi-cud-zha-\\gxaztszu cdzsa7dd9\\fd2xhevfrzd.odt"), fInfoLevelId=0x0, lpFileInformation=0x19ec38 | out: lpFileInformation=0x19ec38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e21d7c0, ftCreationTime.dwHighDateTime=0x1d8c0ce, ftLastAccessTime.dwLowDateTime=0x155f36d0, ftLastAccessTime.dwHighDateTime=0x1d8c0fd, ftLastWriteTime.dwLowDateTime=0xc314e4ae, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x3d80)) returned 1 [0125.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0125.682] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\Fd2XhevfRzd.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\uzvi-cud-zha-\\gxaztszu cdzsa7dd9\\fd2xhevfrzd.odt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\Fd2XhevfRzd.odt.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\uzvi-cud-zha-\\gxaztszu cdzsa7dd9\\fd2xhevfrzd.odt.paradox")) returned 1 [0125.683] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\hAG8_BLENEWKevuN.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5f [0125.683] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\hAG8_BLENEWKevuN.pptx", nBufferLength=0x5f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\hAG8_BLENEWKevuN.pptx", lpFilePart=0x0) returned 0x5e [0125.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb3c) returned 1 [0125.683] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\hAG8_BLENEWKevuN.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\uzvi-cud-zha-\\gxaztszu cdzsa7dd9\\hag8_blenewkevun.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0125.683] GetFileType (hFile=0x378) returned 0x1 [0125.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb38) returned 1 [0125.683] GetFileType (hFile=0x378) returned 0x1 [0125.683] GetFileSize (in: hFile=0x378, lpFileSizeHigh=0x19ec38 | out: lpFileSizeHigh=0x19ec38*=0x0) returned 0x13e9a [0125.684] ReadFile (in: hFile=0x378, lpBuffer=0x23b7990, nNumberOfBytesToRead=0x13e9a, lpNumberOfBytesRead=0x19ebe4, lpOverlapped=0x0 | out: lpBuffer=0x23b7990*, lpNumberOfBytesRead=0x19ebe4*=0x13e9a, lpOverlapped=0x0) returned 1 [0125.684] CloseHandle (hObject=0x378) returned 1 [0125.704] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0125.704] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0125.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebb0) returned 1 [0125.705] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ec2c | out: lpFileInformation=0x19ec2c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0125.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebac) returned 1 [0125.705] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\hAG8_BLENEWKevuN.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5f [0125.705] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\hAG8_BLENEWKevuN.pptx", nBufferLength=0x5f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\hAG8_BLENEWKevuN.pptx", lpFilePart=0x0) returned 0x5e [0125.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb28) returned 1 [0125.705] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\hAG8_BLENEWKevuN.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\uzvi-cud-zha-\\gxaztszu cdzsa7dd9\\hag8_blenewkevun.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0125.726] GetFileType (hFile=0x378) returned 0x1 [0125.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb24) returned 1 [0125.726] GetFileType (hFile=0x378) returned 0x1 [0125.726] WriteFile (in: hFile=0x378, lpBuffer=0x2440370*, nNumberOfBytesToWrite=0x13ea0, lpNumberOfBytesWritten=0x19ebd8, lpOverlapped=0x0 | out: lpBuffer=0x2440370*, lpNumberOfBytesWritten=0x19ebd8*=0x13ea0, lpOverlapped=0x0) returned 1 [0125.729] CloseHandle (hObject=0x378) returned 1 [0125.731] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\hAG8_BLENEWKevuN.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5f [0125.731] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\hAG8_BLENEWKevuN.pptx", nBufferLength=0x5f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\hAG8_BLENEWKevuN.pptx", lpFilePart=0x0) returned 0x5e [0125.731] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\hAG8_BLENEWKevuN.pptx.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x67 [0125.731] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\hAG8_BLENEWKevuN.pptx.paradox", nBufferLength=0x67, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\hAG8_BLENEWKevuN.pptx.paradox", lpFilePart=0x0) returned 0x66 [0125.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0125.731] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\hAG8_BLENEWKevuN.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\uzvi-cud-zha-\\gxaztszu cdzsa7dd9\\hag8_blenewkevun.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19ec38 | out: lpFileInformation=0x19ec38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68726cd0, ftCreationTime.dwHighDateTime=0x1d8b5e4, ftLastAccessTime.dwLowDateTime=0xa8283410, ftLastAccessTime.dwHighDateTime=0x1d8c0aa, ftLastWriteTime.dwLowDateTime=0xc31c0be7, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x13ea0)) returned 1 [0125.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0125.732] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\hAG8_BLENEWKevuN.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\uzvi-cud-zha-\\gxaztszu cdzsa7dd9\\hag8_blenewkevun.pptx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\hAG8_BLENEWKevuN.pptx.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\uzvi-cud-zha-\\gxaztszu cdzsa7dd9\\hag8_blenewkevun.pptx.paradox")) returned 1 [0125.732] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\moUsOGoAr.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x57 [0125.732] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\moUsOGoAr.odt", nBufferLength=0x57, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\moUsOGoAr.odt", lpFilePart=0x0) returned 0x56 [0125.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb3c) returned 1 [0125.732] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\moUsOGoAr.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\uzvi-cud-zha-\\gxaztszu cdzsa7dd9\\mousogoar.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0125.733] GetFileType (hFile=0x378) returned 0x1 [0125.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb38) returned 1 [0125.733] GetFileType (hFile=0x378) returned 0x1 [0125.733] GetFileSize (in: hFile=0x378, lpFileSizeHigh=0x19ec38 | out: lpFileSizeHigh=0x19ec38*=0x0) returned 0x14051 [0125.733] ReadFile (in: hFile=0x378, lpBuffer=0x2454500, nNumberOfBytesToRead=0x14051, lpNumberOfBytesRead=0x19ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2454500*, lpNumberOfBytesRead=0x19ebe4*=0x14051, lpOverlapped=0x0) returned 1 [0125.733] CloseHandle (hObject=0x378) returned 1 [0125.754] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0125.754] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0125.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebb0) returned 1 [0125.754] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ec2c | out: lpFileInformation=0x19ec2c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0125.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebac) returned 1 [0125.754] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\moUsOGoAr.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x57 [0125.754] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\moUsOGoAr.odt", nBufferLength=0x57, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\moUsOGoAr.odt", lpFilePart=0x0) returned 0x56 [0125.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb28) returned 1 [0125.754] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\moUsOGoAr.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\uzvi-cud-zha-\\gxaztszu cdzsa7dd9\\mousogoar.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0125.756] GetFileType (hFile=0x378) returned 0x1 [0125.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb24) returned 1 [0125.756] GetFileType (hFile=0x378) returned 0x1 [0125.756] WriteFile (in: hFile=0x378, lpBuffer=0x24dd420*, nNumberOfBytesToWrite=0x14060, lpNumberOfBytesWritten=0x19ebd8, lpOverlapped=0x0 | out: lpBuffer=0x24dd420*, lpNumberOfBytesWritten=0x19ebd8*=0x14060, lpOverlapped=0x0) returned 1 [0125.759] CloseHandle (hObject=0x378) returned 1 [0125.765] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\moUsOGoAr.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x57 [0125.765] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\moUsOGoAr.odt", nBufferLength=0x57, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\moUsOGoAr.odt", lpFilePart=0x0) returned 0x56 [0125.765] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\moUsOGoAr.odt.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5f [0125.765] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\moUsOGoAr.odt.paradox", nBufferLength=0x5f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\moUsOGoAr.odt.paradox", lpFilePart=0x0) returned 0x5e [0125.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0125.765] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\moUsOGoAr.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\uzvi-cud-zha-\\gxaztszu cdzsa7dd9\\mousogoar.odt"), fInfoLevelId=0x0, lpFileInformation=0x19ec38 | out: lpFileInformation=0x19ec38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7d8ff90, ftCreationTime.dwHighDateTime=0x1d8b7f2, ftLastAccessTime.dwLowDateTime=0x1b375e80, ftLastAccessTime.dwHighDateTime=0x1d8bada, ftLastWriteTime.dwLowDateTime=0xc320d066, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x14060)) returned 1 [0125.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0125.765] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\moUsOGoAr.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\uzvi-cud-zha-\\gxaztszu cdzsa7dd9\\mousogoar.odt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\moUsOGoAr.odt.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\uzvi-cud-zha-\\gxaztszu cdzsa7dd9\\mousogoar.odt.paradox")) returned 1 [0125.766] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\nYbgdcIRhW1rqJ.xls", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0125.766] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\nYbgdcIRhW1rqJ.xls", nBufferLength=0x5c, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\nYbgdcIRhW1rqJ.xls", lpFilePart=0x0) returned 0x5b [0125.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb3c) returned 1 [0125.766] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\nYbgdcIRhW1rqJ.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\uzvi-cud-zha-\\gxaztszu cdzsa7dd9\\nybgdcirhw1rqj.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0125.766] GetFileType (hFile=0x378) returned 0x1 [0125.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb38) returned 1 [0125.766] GetFileType (hFile=0x378) returned 0x1 [0125.767] GetFileSize (in: hFile=0x378, lpFileSizeHigh=0x19ec38 | out: lpFileSizeHigh=0x19ec38*=0x0) returned 0xf85f [0125.767] ReadFile (in: hFile=0x378, lpBuffer=0x24f175c, nNumberOfBytesToRead=0xf85f, lpNumberOfBytesRead=0x19ebe4, lpOverlapped=0x0 | out: lpBuffer=0x24f175c*, lpNumberOfBytesRead=0x19ebe4*=0xf85f, lpOverlapped=0x0) returned 1 [0125.772] CloseHandle (hObject=0x378) returned 1 [0125.856] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0125.856] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0125.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebb0) returned 1 [0125.856] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ec2c | out: lpFileInformation=0x19ec2c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0125.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebac) returned 1 [0125.857] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\nYbgdcIRhW1rqJ.xls", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0125.857] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\nYbgdcIRhW1rqJ.xls", nBufferLength=0x5c, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\nYbgdcIRhW1rqJ.xls", lpFilePart=0x0) returned 0x5b [0125.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb28) returned 1 [0125.857] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\nYbgdcIRhW1rqJ.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\uzvi-cud-zha-\\gxaztszu cdzsa7dd9\\nybgdcirhw1rqj.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0125.859] GetFileType (hFile=0x378) returned 0x1 [0125.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb24) returned 1 [0125.859] GetFileType (hFile=0x378) returned 0x1 [0125.859] WriteFile (in: hFile=0x378, lpBuffer=0x2377a90*, nNumberOfBytesToWrite=0xf860, lpNumberOfBytesWritten=0x19ebd8, lpOverlapped=0x0 | out: lpBuffer=0x2377a90*, lpNumberOfBytesWritten=0x19ebd8*=0xf860, lpOverlapped=0x0) returned 1 [0125.876] CloseHandle (hObject=0x378) returned 1 [0125.885] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\nYbgdcIRhW1rqJ.xls", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0125.885] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\nYbgdcIRhW1rqJ.xls", nBufferLength=0x5c, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\nYbgdcIRhW1rqJ.xls", lpFilePart=0x0) returned 0x5b [0125.885] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\nYbgdcIRhW1rqJ.xls.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x64 [0125.885] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\nYbgdcIRhW1rqJ.xls.paradox", nBufferLength=0x64, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\nYbgdcIRhW1rqJ.xls.paradox", lpFilePart=0x0) returned 0x63 [0125.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0125.886] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\nYbgdcIRhW1rqJ.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\uzvi-cud-zha-\\gxaztszu cdzsa7dd9\\nybgdcirhw1rqj.xls"), fInfoLevelId=0x0, lpFileInformation=0x19ec38 | out: lpFileInformation=0x19ec38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ae62ea0, ftCreationTime.dwHighDateTime=0x1d8c111, ftLastAccessTime.dwLowDateTime=0xd5dcc3d0, ftLastAccessTime.dwHighDateTime=0x1d8c127, ftLastWriteTime.dwLowDateTime=0xc333e3e2, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xf860)) returned 1 [0125.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0125.886] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\nYbgdcIRhW1rqJ.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\uzvi-cud-zha-\\gxaztszu cdzsa7dd9\\nybgdcirhw1rqj.xls"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\IhO0bQr\\uZvI-CUD-ZhA-\\gXAZTSzU cdzSa7dD9\\nYbgdcIRhW1rqJ.xls.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\iho0bqr\\uzvi-cud-zha-\\gxaztszu cdzsa7dd9\\nybgdcirhw1rqj.xls.paradox")) returned 1 [0125.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed78) returned 1 [0125.887] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Music", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0125.887] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Music", nBufferLength=0x29, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Music", lpFilePart=0x0) returned 0x28 [0125.887] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Music\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\my music\\*"), lpFindFileData=0x19eaa0 | out: lpFindFileData=0x19eaa0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0125.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed3c) returned 1 [0125.910] EtwEventRegister (in: ProviderId=0x23899a0, EnableCallback=0x96060e, CallbackContext=0x0, RegHandle=0x238997c | out: RegHandle=0x238997c) returned 0x0 [0125.912] EtwEventSetInformation (RegHandle=0x6ace18, InformationClass=0x48, EventInformation=0x2, InformationLength=0x2389940) returned 0x0 [0125.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed78) returned 1 [0125.963] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Pictures", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0125.963] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Pictures", nBufferLength=0x2c, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Pictures", lpFilePart=0x0) returned 0x2b [0125.963] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Pictures\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\my pictures\\*"), lpFindFileData=0x19eaa0 | out: lpFindFileData=0x19eaa0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0125.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed3c) returned 1 [0125.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed78) returned 1 [0125.965] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Videos", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0125.965] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Videos", nBufferLength=0x2a, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Videos", lpFilePart=0x0) returned 0x29 [0125.966] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Videos\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\my videos\\*"), lpFindFileData=0x19eaa0 | out: lpFindFileData=0x19eaa0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0125.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed3c) returned 1 [0125.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed78) returned 1 [0125.973] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0125.973] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files", nBufferLength=0x2e, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x2d [0125.973] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\outlook files\\*"), lpFindFileData=0x19eaa0 | out: lpFindFileData=0x19eaa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63954f0d, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x839084fb, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x886727b4, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x689290 [0125.974] FindNextFileW (in: hFindFile=0x689290, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63954f0d, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x839084fb, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x886727b4, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.974] FindNextFileW (in: hFindFile=0x689290, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6397affd, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x6397affd, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x8866b39a, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="achoo@gdllo.de.pst", cAlternateFileName="ACHOO@~1.PST")) returned 1 [0125.974] FindNextFileW (in: hFindFile=0x689290, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0125.974] FindClose (in: hFindFile=0x689290 | out: hFindFile=0x689290) returned 1 [0125.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed34) returned 1 [0125.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed40) returned 1 [0125.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed78) returned 1 [0125.975] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0125.975] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files", nBufferLength=0x2e, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x2d [0125.975] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\outlook files\\*"), lpFindFileData=0x19eaa0 | out: lpFindFileData=0x19eaa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63954f0d, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x839084fb, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x886727b4, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688f90 [0125.975] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63954f0d, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x839084fb, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x886727b4, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.976] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6397affd, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x6397affd, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x8866b39a, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="achoo@gdllo.de.pst", cAlternateFileName="ACHOO@~1.PST")) returned 1 [0125.976] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6397affd, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x6397affd, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x8866b39a, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="achoo@gdllo.de.pst", cAlternateFileName="ACHOO@~1.PST")) returned 0 [0125.976] FindClose (in: hFindFile=0x688f90 | out: hFindFile=0x688f90) returned 1 [0125.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed34) returned 1 [0125.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed40) returned 1 [0125.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edec) returned 1 [0125.977] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Downloads", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x20 [0125.977] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Downloads", nBufferLength=0x20, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Downloads", lpFilePart=0x0) returned 0x1f [0125.977] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Downloads\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\downloads\\*"), lpFindFileData=0x19eb14 | out: lpFindFileData=0x19eb14*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688f90 [0125.977] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.977] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x436bc315, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.978] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0125.978] FindClose (in: hFindFile=0x688f90 | out: hFindFile=0x688f90) returned 1 [0125.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda8) returned 1 [0125.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb4) returned 1 [0125.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edec) returned 1 [0125.978] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Downloads", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x20 [0125.978] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Downloads", nBufferLength=0x20, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Downloads", lpFilePart=0x0) returned 0x1f [0125.978] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Downloads\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\downloads\\*"), lpFindFileData=0x19eb14 | out: lpFindFileData=0x19eb14*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688f90 [0125.979] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.979] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x436bc315, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.979] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x436bc315, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0125.979] FindClose (in: hFindFile=0x688f90 | out: hFindFile=0x688f90) returned 1 [0125.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda8) returned 1 [0125.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb4) returned 1 [0125.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edec) returned 1 [0125.980] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1f [0125.980] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures", nBufferLength=0x1f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures", lpFilePart=0x0) returned 0x1e [0125.980] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\*"), lpFindFileData=0x19eb14 | out: lpFindFileData=0x19eb14*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x725e8925, ftLastAccessTime.dwHighDateTime=0x1d8c12e, ftLastWriteTime.dwLowDateTime=0x725e8925, ftLastWriteTime.dwHighDateTime=0x1d8c12e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688f90 [0125.980] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x725e8925, ftLastAccessTime.dwHighDateTime=0x1d8c12e, ftLastWriteTime.dwLowDateTime=0x725e8925, ftLastWriteTime.dwHighDateTime=0x1d8c12e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.981] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f043470, ftCreationTime.dwHighDateTime=0x1d8b3ef, ftLastAccessTime.dwLowDateTime=0xe636c360, ftLastAccessTime.dwHighDateTime=0x1d8bbab, ftLastWriteTime.dwLowDateTime=0xe636c360, ftLastWriteTime.dwHighDateTime=0x1d8bbab, nFileSizeHigh=0x0, nFileSizeLow=0x107b, dwReserved0=0x0, dwReserved1=0x0, cFileName="7-_3FISfXYvwe.gif", cAlternateFileName="7-_3FI~1.GIF")) returned 1 [0125.981] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b0e752d, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0125.981] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf7108a0, ftCreationTime.dwHighDateTime=0x1d8b760, ftLastAccessTime.dwLowDateTime=0x88ed8c60, ftLastAccessTime.dwHighDateTime=0x1d8bc29, ftLastWriteTime.dwLowDateTime=0x88ed8c60, ftLastWriteTime.dwHighDateTime=0x1d8bc29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CDvSbna", cAlternateFileName="")) returned 1 [0125.981] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.982] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3f50580, ftCreationTime.dwHighDateTime=0x1d8b808, ftLastAccessTime.dwLowDateTime=0x7d540210, ftLastAccessTime.dwHighDateTime=0x1d8bee7, ftLastWriteTime.dwLowDateTime=0x7d540210, ftLastWriteTime.dwHighDateTime=0x1d8bee7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gRG40lzkz", cAlternateFileName="GRG40L~1")) returned 1 [0125.982] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe267a660, ftCreationTime.dwHighDateTime=0x1d8b30d, ftLastAccessTime.dwLowDateTime=0xccb0ae30, ftLastAccessTime.dwHighDateTime=0x1d8bb6d, ftLastWriteTime.dwLowDateTime=0xccb0ae30, ftLastWriteTime.dwHighDateTime=0x1d8bb6d, nFileSizeHigh=0x0, nFileSizeLow=0x5b40, dwReserved0=0x0, dwReserved1=0x0, cFileName="qwlzS.bmp", cAlternateFileName="")) returned 1 [0125.982] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0125.982] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e053fc0, ftCreationTime.dwHighDateTime=0x1d8bc1f, ftLastAccessTime.dwLowDateTime=0x80785c80, ftLastAccessTime.dwHighDateTime=0x1d8c0a8, ftLastWriteTime.dwLowDateTime=0x80785c80, ftLastWriteTime.dwHighDateTime=0x1d8c0a8, nFileSizeHigh=0x0, nFileSizeLow=0xe2fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="SsvA9Xc4 h39.jpg", cAlternateFileName="SSVA9X~1.JPG")) returned 1 [0125.982] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8459d70, ftCreationTime.dwHighDateTime=0x1d8b184, ftLastAccessTime.dwLowDateTime=0xe7c01550, ftLastAccessTime.dwHighDateTime=0x1d8b251, ftLastWriteTime.dwLowDateTime=0xe7c01550, ftLastWriteTime.dwHighDateTime=0x1d8b251, nFileSizeHigh=0x0, nFileSizeLow=0xb1fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="zCX5BPWOl.gif", cAlternateFileName="ZCX5BP~1.GIF")) returned 1 [0125.983] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0125.983] FindClose (in: hFindFile=0x688f90 | out: hFindFile=0x688f90) returned 1 [0125.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda8) returned 1 [0125.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb4) returned 1 [0125.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edec) returned 1 [0125.983] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1f [0125.983] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures", nBufferLength=0x1f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures", lpFilePart=0x0) returned 0x1e [0125.983] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\*"), lpFindFileData=0x19eb14 | out: lpFindFileData=0x19eb14*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x725e8925, ftLastAccessTime.dwHighDateTime=0x1d8c12e, ftLastWriteTime.dwLowDateTime=0x725e8925, ftLastWriteTime.dwHighDateTime=0x1d8c12e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688f90 [0125.984] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x725e8925, ftLastAccessTime.dwHighDateTime=0x1d8c12e, ftLastWriteTime.dwLowDateTime=0x725e8925, ftLastWriteTime.dwHighDateTime=0x1d8c12e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.984] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f043470, ftCreationTime.dwHighDateTime=0x1d8b3ef, ftLastAccessTime.dwLowDateTime=0xe636c360, ftLastAccessTime.dwHighDateTime=0x1d8bbab, ftLastWriteTime.dwLowDateTime=0xe636c360, ftLastWriteTime.dwHighDateTime=0x1d8bbab, nFileSizeHigh=0x0, nFileSizeLow=0x107b, dwReserved0=0x0, dwReserved1=0x0, cFileName="7-_3FISfXYvwe.gif", cAlternateFileName="7-_3FI~1.GIF")) returned 1 [0125.984] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b0e752d, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0125.985] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf7108a0, ftCreationTime.dwHighDateTime=0x1d8b760, ftLastAccessTime.dwLowDateTime=0x88ed8c60, ftLastAccessTime.dwHighDateTime=0x1d8bc29, ftLastWriteTime.dwLowDateTime=0x88ed8c60, ftLastWriteTime.dwHighDateTime=0x1d8bc29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CDvSbna", cAlternateFileName="")) returned 1 [0125.985] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.985] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3f50580, ftCreationTime.dwHighDateTime=0x1d8b808, ftLastAccessTime.dwLowDateTime=0x7d540210, ftLastAccessTime.dwHighDateTime=0x1d8bee7, ftLastWriteTime.dwLowDateTime=0x7d540210, ftLastWriteTime.dwHighDateTime=0x1d8bee7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gRG40lzkz", cAlternateFileName="GRG40L~1")) returned 1 [0125.985] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe267a660, ftCreationTime.dwHighDateTime=0x1d8b30d, ftLastAccessTime.dwLowDateTime=0xccb0ae30, ftLastAccessTime.dwHighDateTime=0x1d8bb6d, ftLastWriteTime.dwLowDateTime=0xccb0ae30, ftLastWriteTime.dwHighDateTime=0x1d8bb6d, nFileSizeHigh=0x0, nFileSizeLow=0x5b40, dwReserved0=0x0, dwReserved1=0x0, cFileName="qwlzS.bmp", cAlternateFileName="")) returned 1 [0125.985] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0125.986] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e053fc0, ftCreationTime.dwHighDateTime=0x1d8bc1f, ftLastAccessTime.dwLowDateTime=0x80785c80, ftLastAccessTime.dwHighDateTime=0x1d8c0a8, ftLastWriteTime.dwLowDateTime=0x80785c80, ftLastWriteTime.dwHighDateTime=0x1d8c0a8, nFileSizeHigh=0x0, nFileSizeLow=0xe2fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="SsvA9Xc4 h39.jpg", cAlternateFileName="SSVA9X~1.JPG")) returned 1 [0126.016] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8459d70, ftCreationTime.dwHighDateTime=0x1d8b184, ftLastAccessTime.dwLowDateTime=0xe7c01550, ftLastAccessTime.dwHighDateTime=0x1d8b251, ftLastWriteTime.dwLowDateTime=0xe7c01550, ftLastWriteTime.dwHighDateTime=0x1d8b251, nFileSizeHigh=0x0, nFileSizeLow=0xb1fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="zCX5BPWOl.gif", cAlternateFileName="ZCX5BP~1.GIF")) returned 1 [0126.016] FindNextFileW (in: hFindFile=0x688f90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8459d70, ftCreationTime.dwHighDateTime=0x1d8b184, ftLastAccessTime.dwLowDateTime=0xe7c01550, ftLastAccessTime.dwHighDateTime=0x1d8b251, ftLastWriteTime.dwLowDateTime=0xe7c01550, ftLastWriteTime.dwHighDateTime=0x1d8b251, nFileSizeHigh=0x0, nFileSizeLow=0xb1fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="zCX5BPWOl.gif", cAlternateFileName="ZCX5BP~1.GIF")) returned 0 [0126.016] FindClose (in: hFindFile=0x688f90 | out: hFindFile=0x688f90) returned 1 [0126.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda8) returned 1 [0126.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb4) returned 1 [0126.017] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qwlzS.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0126.017] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qwlzS.bmp", nBufferLength=0x29, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qwlzS.bmp", lpFilePart=0x0) returned 0x28 [0126.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0126.018] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qwlzS.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\qwlzs.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0126.018] GetFileType (hFile=0x37c) returned 0x1 [0126.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0126.018] GetFileType (hFile=0x37c) returned 0x1 [0126.018] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x5b40 [0126.018] ReadFile (in: hFile=0x37c, lpBuffer=0x238fbb0, nNumberOfBytesToRead=0x5b40, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x238fbb0*, lpNumberOfBytesRead=0x19ed40*=0x5b40, lpOverlapped=0x0) returned 1 [0126.019] CloseHandle (hObject=0x37c) returned 1 [0126.104] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0126.104] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0126.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0126.105] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0126.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0126.105] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qwlzS.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0126.105] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qwlzS.bmp", nBufferLength=0x29, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qwlzS.bmp", lpFilePart=0x0) returned 0x28 [0126.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0126.105] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qwlzS.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\qwlzs.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0126.107] GetFileType (hFile=0x37c) returned 0x1 [0126.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0126.107] GetFileType (hFile=0x37c) returned 0x1 [0126.107] WriteFile (in: hFile=0x37c, lpBuffer=0x23f9384*, nNumberOfBytesToWrite=0x5b50, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x23f9384*, lpNumberOfBytesWritten=0x19ed34*=0x5b50, lpOverlapped=0x0) returned 1 [0126.109] CloseHandle (hObject=0x37c) returned 1 [0126.114] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qwlzS.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0126.115] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qwlzS.bmp", nBufferLength=0x29, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qwlzS.bmp", lpFilePart=0x0) returned 0x28 [0126.115] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qwlzS.bmp.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0126.115] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qwlzS.bmp.paradox", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qwlzS.bmp.paradox", lpFilePart=0x0) returned 0x30 [0126.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0126.115] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qwlzS.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\qwlzs.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe267a660, ftCreationTime.dwHighDateTime=0x1d8b30d, ftLastAccessTime.dwLowDateTime=0xccb0ae30, ftLastAccessTime.dwHighDateTime=0x1d8bb6d, ftLastWriteTime.dwLowDateTime=0xc357eef3, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x5b50)) returned 1 [0126.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0126.115] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qwlzS.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\qwlzs.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qwlzS.bmp.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\qwlzs.bmp.paradox")) returned 1 [0126.116] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\SsvA9Xc4 h39.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0126.116] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\SsvA9Xc4 h39.jpg", nBufferLength=0x30, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\SsvA9Xc4 h39.jpg", lpFilePart=0x0) returned 0x2f [0126.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0126.116] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\SsvA9Xc4 h39.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ssva9xc4 h39.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0126.116] GetFileType (hFile=0x37c) returned 0x1 [0126.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0126.117] GetFileType (hFile=0x37c) returned 0x1 [0126.117] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0xe2fd [0126.117] ReadFile (in: hFile=0x37c, lpBuffer=0x23ff148, nNumberOfBytesToRead=0xe2fd, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x23ff148*, lpNumberOfBytesRead=0x19ed40*=0xe2fd, lpOverlapped=0x0) returned 1 [0126.117] CloseHandle (hObject=0x37c) returned 1 [0126.147] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0126.147] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0126.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0126.147] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0126.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0126.147] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\SsvA9Xc4 h39.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0126.147] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\SsvA9Xc4 h39.jpg", nBufferLength=0x30, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\SsvA9Xc4 h39.jpg", lpFilePart=0x0) returned 0x2f [0126.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0126.148] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\SsvA9Xc4 h39.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ssva9xc4 h39.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0126.149] GetFileType (hFile=0x37c) returned 0x1 [0126.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0126.149] GetFileType (hFile=0x37c) returned 0x1 [0126.150] WriteFile (in: hFile=0x37c, lpBuffer=0x2476848*, nNumberOfBytesToWrite=0xe300, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x2476848*, lpNumberOfBytesWritten=0x19ed34*=0xe300, lpOverlapped=0x0) returned 1 [0126.152] CloseHandle (hObject=0x37c) returned 1 [0126.157] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\SsvA9Xc4 h39.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0126.157] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\SsvA9Xc4 h39.jpg", nBufferLength=0x30, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\SsvA9Xc4 h39.jpg", lpFilePart=0x0) returned 0x2f [0126.157] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\SsvA9Xc4 h39.jpg.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0126.157] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\SsvA9Xc4 h39.jpg.paradox", nBufferLength=0x38, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\SsvA9Xc4 h39.jpg.paradox", lpFilePart=0x0) returned 0x37 [0126.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0126.157] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\SsvA9Xc4 h39.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ssva9xc4 h39.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e053fc0, ftCreationTime.dwHighDateTime=0x1d8bc1f, ftLastAccessTime.dwLowDateTime=0x80785c80, ftLastAccessTime.dwHighDateTime=0x1d8c0a8, ftLastWriteTime.dwLowDateTime=0xc35c6be1, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xe300)) returned 1 [0126.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0126.157] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\SsvA9Xc4 h39.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ssva9xc4 h39.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\SsvA9Xc4 h39.jpg.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ssva9xc4 h39.jpg.paradox")) returned 1 [0126.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed78) returned 1 [0126.189] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0126.189] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll", nBufferLength=0x2b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll", lpFilePart=0x0) returned 0x2a [0126.189] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\camera roll\\*"), lpFindFileData=0x19eaa0 | out: lpFindFileData=0x19eaa0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b0e752d, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x689010 [0126.191] FindNextFileW (in: hFindFile=0x689010, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b0e752d, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.191] FindNextFileW (in: hFindFile=0x689010, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x2b10dbc5, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0126.191] FindNextFileW (in: hFindFile=0x689010, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0126.192] FindClose (in: hFindFile=0x689010 | out: hFindFile=0x689010) returned 1 [0126.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed34) returned 1 [0126.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed40) returned 1 [0126.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed78) returned 1 [0126.192] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0126.192] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll", nBufferLength=0x2b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll", lpFilePart=0x0) returned 0x2a [0126.192] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\camera roll\\*"), lpFindFileData=0x19eaa0 | out: lpFindFileData=0x19eaa0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b0e752d, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x689010 [0126.192] FindNextFileW (in: hFindFile=0x689010, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b0e752d, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.193] FindNextFileW (in: hFindFile=0x689010, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x2b10dbc5, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0126.193] FindNextFileW (in: hFindFile=0x689010, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x2b10dbc5, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0126.193] FindClose (in: hFindFile=0x689010 | out: hFindFile=0x689010) returned 1 [0126.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed34) returned 1 [0126.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed40) returned 1 [0126.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed78) returned 1 [0126.193] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0126.193] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna", nBufferLength=0x27, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna", lpFilePart=0x0) returned 0x26 [0126.194] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\*"), lpFindFileData=0x19eaa0 | out: lpFindFileData=0x19eaa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf7108a0, ftCreationTime.dwHighDateTime=0x1d8b760, ftLastAccessTime.dwLowDateTime=0x88ed8c60, ftLastAccessTime.dwHighDateTime=0x1d8bc29, ftLastWriteTime.dwLowDateTime=0x88ed8c60, ftLastWriteTime.dwHighDateTime=0x1d8bc29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x689010 [0126.194] FindNextFileW (in: hFindFile=0x689010, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf7108a0, ftCreationTime.dwHighDateTime=0x1d8b760, ftLastAccessTime.dwLowDateTime=0x88ed8c60, ftLastAccessTime.dwHighDateTime=0x1d8bc29, ftLastWriteTime.dwLowDateTime=0x88ed8c60, ftLastWriteTime.dwHighDateTime=0x1d8bc29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.194] FindNextFileW (in: hFindFile=0x689010, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b9bb110, ftCreationTime.dwHighDateTime=0x1d8be54, ftLastAccessTime.dwLowDateTime=0x38560940, ftLastAccessTime.dwHighDateTime=0x1d8be85, ftLastWriteTime.dwLowDateTime=0x38560940, ftLastWriteTime.dwHighDateTime=0x1d8be85, nFileSizeHigh=0x0, nFileSizeLow=0xdc77, dwReserved0=0x0, dwReserved1=0x0, cFileName="dXYm4 e1-8H.jpg", cAlternateFileName="DXYM4E~1.JPG")) returned 1 [0126.194] FindNextFileW (in: hFindFile=0x689010, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6672f10, ftCreationTime.dwHighDateTime=0x1d8bccb, ftLastAccessTime.dwLowDateTime=0xe0d9be00, ftLastAccessTime.dwHighDateTime=0x1d8c0f0, ftLastWriteTime.dwLowDateTime=0xe0d9be00, ftLastWriteTime.dwHighDateTime=0x1d8c0f0, nFileSizeHigh=0x0, nFileSizeLow=0xe5c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Iu7q0Vmc Z_G6Dq.bmp", cAlternateFileName="IU7Q0V~1.BMP")) returned 1 [0126.195] FindNextFileW (in: hFindFile=0x689010, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9cd8300, ftCreationTime.dwHighDateTime=0x1d8c121, ftLastAccessTime.dwLowDateTime=0x799322f0, ftLastAccessTime.dwHighDateTime=0x1d8c12b, ftLastWriteTime.dwLowDateTime=0x799322f0, ftLastWriteTime.dwHighDateTime=0x1d8c12b, nFileSizeHigh=0x0, nFileSizeLow=0x139c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="LbG_ zixT9ffs2A.bmp", cAlternateFileName="LBG_ZI~1.BMP")) returned 1 [0126.195] FindNextFileW (in: hFindFile=0x689010, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d800630, ftCreationTime.dwHighDateTime=0x1d8bc99, ftLastAccessTime.dwLowDateTime=0xc8c041b0, ftLastAccessTime.dwHighDateTime=0x1d8c071, ftLastWriteTime.dwLowDateTime=0xc8c041b0, ftLastWriteTime.dwHighDateTime=0x1d8c071, nFileSizeHigh=0x0, nFileSizeLow=0x1c28, dwReserved0=0x0, dwReserved1=0x0, cFileName="qmD8S.jpg", cAlternateFileName="")) returned 1 [0126.195] FindNextFileW (in: hFindFile=0x689010, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bcdde0, ftCreationTime.dwHighDateTime=0x1d8ba7e, ftLastAccessTime.dwLowDateTime=0x34fca700, ftLastAccessTime.dwHighDateTime=0x1d8bcc2, ftLastWriteTime.dwLowDateTime=0x34fca700, ftLastWriteTime.dwHighDateTime=0x1d8bcc2, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="sipKm5LRX D_iepz2cq.jpg", cAlternateFileName="SIPKM5~1.JPG")) returned 1 [0126.195] FindNextFileW (in: hFindFile=0x689010, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaeef2420, ftCreationTime.dwHighDateTime=0x1d8b3da, ftLastAccessTime.dwLowDateTime=0xbd989c30, ftLastAccessTime.dwHighDateTime=0x1d8b3fe, ftLastWriteTime.dwLowDateTime=0xbd989c30, ftLastWriteTime.dwHighDateTime=0x1d8b3fe, nFileSizeHigh=0x0, nFileSizeLow=0xc3cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIm5.png", cAlternateFileName="")) returned 1 [0126.195] FindNextFileW (in: hFindFile=0x689010, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd3d6df0, ftCreationTime.dwHighDateTime=0x1d8bb7f, ftLastAccessTime.dwLowDateTime=0x229e0f10, ftLastAccessTime.dwHighDateTime=0x1d8be73, ftLastWriteTime.dwLowDateTime=0x229e0f10, ftLastWriteTime.dwHighDateTime=0x1d8be73, nFileSizeHigh=0x0, nFileSizeLow=0x13e8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="w2yJe78igCw.bmp", cAlternateFileName="W2YJE7~1.BMP")) returned 1 [0126.195] FindNextFileW (in: hFindFile=0x689010, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42a8a5a0, ftCreationTime.dwHighDateTime=0x1d8b62a, ftLastAccessTime.dwLowDateTime=0x3fbbd5a0, ftLastAccessTime.dwHighDateTime=0x1d8bf90, ftLastWriteTime.dwLowDateTime=0x3fbbd5a0, ftLastWriteTime.dwHighDateTime=0x1d8bf90, nFileSizeHigh=0x0, nFileSizeLow=0x6c23, dwReserved0=0x0, dwReserved1=0x0, cFileName="YsW39t6L-TWGKe-iuT8K.jpg", cAlternateFileName="YSW39T~1.JPG")) returned 1 [0126.196] FindNextFileW (in: hFindFile=0x689010, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0126.196] FindClose (in: hFindFile=0x689010 | out: hFindFile=0x689010) returned 1 [0126.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed34) returned 1 [0126.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed40) returned 1 [0126.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed78) returned 1 [0126.196] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0126.196] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna", nBufferLength=0x27, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna", lpFilePart=0x0) returned 0x26 [0126.196] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\*"), lpFindFileData=0x19eaa0 | out: lpFindFileData=0x19eaa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf7108a0, ftCreationTime.dwHighDateTime=0x1d8b760, ftLastAccessTime.dwLowDateTime=0x88ed8c60, ftLastAccessTime.dwHighDateTime=0x1d8bc29, ftLastWriteTime.dwLowDateTime=0x88ed8c60, ftLastWriteTime.dwHighDateTime=0x1d8bc29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x689010 [0126.197] FindNextFileW (in: hFindFile=0x689010, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf7108a0, ftCreationTime.dwHighDateTime=0x1d8b760, ftLastAccessTime.dwLowDateTime=0x88ed8c60, ftLastAccessTime.dwHighDateTime=0x1d8bc29, ftLastWriteTime.dwLowDateTime=0x88ed8c60, ftLastWriteTime.dwHighDateTime=0x1d8bc29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.197] FindNextFileW (in: hFindFile=0x689010, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b9bb110, ftCreationTime.dwHighDateTime=0x1d8be54, ftLastAccessTime.dwLowDateTime=0x38560940, ftLastAccessTime.dwHighDateTime=0x1d8be85, ftLastWriteTime.dwLowDateTime=0x38560940, ftLastWriteTime.dwHighDateTime=0x1d8be85, nFileSizeHigh=0x0, nFileSizeLow=0xdc77, dwReserved0=0x0, dwReserved1=0x0, cFileName="dXYm4 e1-8H.jpg", cAlternateFileName="DXYM4E~1.JPG")) returned 1 [0126.197] FindNextFileW (in: hFindFile=0x689010, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6672f10, ftCreationTime.dwHighDateTime=0x1d8bccb, ftLastAccessTime.dwLowDateTime=0xe0d9be00, ftLastAccessTime.dwHighDateTime=0x1d8c0f0, ftLastWriteTime.dwLowDateTime=0xe0d9be00, ftLastWriteTime.dwHighDateTime=0x1d8c0f0, nFileSizeHigh=0x0, nFileSizeLow=0xe5c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Iu7q0Vmc Z_G6Dq.bmp", cAlternateFileName="IU7Q0V~1.BMP")) returned 1 [0126.197] FindNextFileW (in: hFindFile=0x689010, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9cd8300, ftCreationTime.dwHighDateTime=0x1d8c121, ftLastAccessTime.dwLowDateTime=0x799322f0, ftLastAccessTime.dwHighDateTime=0x1d8c12b, ftLastWriteTime.dwLowDateTime=0x799322f0, ftLastWriteTime.dwHighDateTime=0x1d8c12b, nFileSizeHigh=0x0, nFileSizeLow=0x139c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="LbG_ zixT9ffs2A.bmp", cAlternateFileName="LBG_ZI~1.BMP")) returned 1 [0126.198] FindNextFileW (in: hFindFile=0x689010, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d800630, ftCreationTime.dwHighDateTime=0x1d8bc99, ftLastAccessTime.dwLowDateTime=0xc8c041b0, ftLastAccessTime.dwHighDateTime=0x1d8c071, ftLastWriteTime.dwLowDateTime=0xc8c041b0, ftLastWriteTime.dwHighDateTime=0x1d8c071, nFileSizeHigh=0x0, nFileSizeLow=0x1c28, dwReserved0=0x0, dwReserved1=0x0, cFileName="qmD8S.jpg", cAlternateFileName="")) returned 1 [0126.198] FindNextFileW (in: hFindFile=0x689010, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bcdde0, ftCreationTime.dwHighDateTime=0x1d8ba7e, ftLastAccessTime.dwLowDateTime=0x34fca700, ftLastAccessTime.dwHighDateTime=0x1d8bcc2, ftLastWriteTime.dwLowDateTime=0x34fca700, ftLastWriteTime.dwHighDateTime=0x1d8bcc2, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="sipKm5LRX D_iepz2cq.jpg", cAlternateFileName="SIPKM5~1.JPG")) returned 1 [0126.198] FindNextFileW (in: hFindFile=0x689010, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaeef2420, ftCreationTime.dwHighDateTime=0x1d8b3da, ftLastAccessTime.dwLowDateTime=0xbd989c30, ftLastAccessTime.dwHighDateTime=0x1d8b3fe, ftLastWriteTime.dwLowDateTime=0xbd989c30, ftLastWriteTime.dwHighDateTime=0x1d8b3fe, nFileSizeHigh=0x0, nFileSizeLow=0xc3cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIm5.png", cAlternateFileName="")) returned 1 [0126.198] FindNextFileW (in: hFindFile=0x689010, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd3d6df0, ftCreationTime.dwHighDateTime=0x1d8bb7f, ftLastAccessTime.dwLowDateTime=0x229e0f10, ftLastAccessTime.dwHighDateTime=0x1d8be73, ftLastWriteTime.dwLowDateTime=0x229e0f10, ftLastWriteTime.dwHighDateTime=0x1d8be73, nFileSizeHigh=0x0, nFileSizeLow=0x13e8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="w2yJe78igCw.bmp", cAlternateFileName="W2YJE7~1.BMP")) returned 1 [0126.198] FindNextFileW (in: hFindFile=0x689010, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42a8a5a0, ftCreationTime.dwHighDateTime=0x1d8b62a, ftLastAccessTime.dwLowDateTime=0x3fbbd5a0, ftLastAccessTime.dwHighDateTime=0x1d8bf90, ftLastWriteTime.dwLowDateTime=0x3fbbd5a0, ftLastWriteTime.dwHighDateTime=0x1d8bf90, nFileSizeHigh=0x0, nFileSizeLow=0x6c23, dwReserved0=0x0, dwReserved1=0x0, cFileName="YsW39t6L-TWGKe-iuT8K.jpg", cAlternateFileName="YSW39T~1.JPG")) returned 1 [0126.199] FindNextFileW (in: hFindFile=0x689010, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42a8a5a0, ftCreationTime.dwHighDateTime=0x1d8b62a, ftLastAccessTime.dwLowDateTime=0x3fbbd5a0, ftLastAccessTime.dwHighDateTime=0x1d8bf90, ftLastWriteTime.dwLowDateTime=0x3fbbd5a0, ftLastWriteTime.dwHighDateTime=0x1d8bf90, nFileSizeHigh=0x0, nFileSizeLow=0x6c23, dwReserved0=0x0, dwReserved1=0x0, cFileName="YsW39t6L-TWGKe-iuT8K.jpg", cAlternateFileName="YSW39T~1.JPG")) returned 0 [0126.199] FindClose (in: hFindFile=0x689010 | out: hFindFile=0x689010) returned 1 [0126.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed34) returned 1 [0126.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed40) returned 1 [0126.199] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\dXYm4 e1-8H.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0126.199] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\dXYm4 e1-8H.jpg", nBufferLength=0x37, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\dXYm4 e1-8H.jpg", lpFilePart=0x0) returned 0x36 [0126.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0126.199] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\dXYm4 e1-8H.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\dxym4 e1-8h.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0126.200] GetFileType (hFile=0x37c) returned 0x1 [0126.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0126.200] GetFileType (hFile=0x37c) returned 0x1 [0126.200] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed20 | out: lpFileSizeHigh=0x19ed20*=0x0) returned 0xdc77 [0126.200] ReadFile (in: hFile=0x37c, lpBuffer=0x2488034, nNumberOfBytesToRead=0xdc77, lpNumberOfBytesRead=0x19eccc, lpOverlapped=0x0 | out: lpBuffer=0x2488034*, lpNumberOfBytesRead=0x19eccc*=0xdc77, lpOverlapped=0x0) returned 1 [0126.200] CloseHandle (hObject=0x37c) returned 1 [0126.271] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0126.271] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0126.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0126.271] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed14 | out: lpFileInformation=0x19ed14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0126.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0126.271] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\dXYm4 e1-8H.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0126.271] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\dXYm4 e1-8H.jpg", nBufferLength=0x37, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\dXYm4 e1-8H.jpg", lpFilePart=0x0) returned 0x36 [0126.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec10) returned 1 [0126.271] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\dXYm4 e1-8H.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\dxym4 e1-8h.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0126.273] GetFileType (hFile=0x37c) returned 0x1 [0126.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec0c) returned 1 [0126.273] GetFileType (hFile=0x37c) returned 0x1 [0126.273] WriteFile (in: hFile=0x37c, lpBuffer=0x23067b8*, nNumberOfBytesToWrite=0xdc80, lpNumberOfBytesWritten=0x19ecc0, lpOverlapped=0x0 | out: lpBuffer=0x23067b8*, lpNumberOfBytesWritten=0x19ecc0*=0xdc80, lpOverlapped=0x0) returned 1 [0126.276] CloseHandle (hObject=0x37c) returned 1 [0126.279] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\dXYm4 e1-8H.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0126.279] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\dXYm4 e1-8H.jpg", nBufferLength=0x37, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\dXYm4 e1-8H.jpg", lpFilePart=0x0) returned 0x36 [0126.279] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\dXYm4 e1-8H.jpg.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0126.279] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\dXYm4 e1-8H.jpg.paradox", nBufferLength=0x3f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\dXYm4 e1-8H.jpg.paradox", lpFilePart=0x0) returned 0x3e [0126.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eca4) returned 1 [0126.279] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\dXYm4 e1-8H.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\dxym4 e1-8h.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ed20 | out: lpFileInformation=0x19ed20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b9bb110, ftCreationTime.dwHighDateTime=0x1d8be54, ftLastAccessTime.dwLowDateTime=0x38560940, ftLastAccessTime.dwHighDateTime=0x1d8be85, ftLastWriteTime.dwLowDateTime=0xc36f7e57, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xdc80)) returned 1 [0126.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eca0) returned 1 [0126.280] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\dXYm4 e1-8H.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\dxym4 e1-8h.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\dXYm4 e1-8H.jpg.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\dxym4 e1-8h.jpg.paradox")) returned 1 [0126.280] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\Iu7q0Vmc Z_G6Dq.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0126.281] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\Iu7q0Vmc Z_G6Dq.bmp", nBufferLength=0x3b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\Iu7q0Vmc Z_G6Dq.bmp", lpFilePart=0x0) returned 0x3a [0126.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0126.281] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\Iu7q0Vmc Z_G6Dq.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\iu7q0vmc z_g6dq.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0126.281] GetFileType (hFile=0x37c) returned 0x1 [0126.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0126.281] GetFileType (hFile=0x37c) returned 0x1 [0126.281] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed20 | out: lpFileSizeHigh=0x19ed20*=0x0) returned 0xe5c2 [0126.281] ReadFile (in: hFile=0x37c, lpBuffer=0x23146d8, nNumberOfBytesToRead=0xe5c2, lpNumberOfBytesRead=0x19eccc, lpOverlapped=0x0 | out: lpBuffer=0x23146d8*, lpNumberOfBytesRead=0x19eccc*=0xe5c2, lpOverlapped=0x0) returned 1 [0126.282] CloseHandle (hObject=0x37c) returned 1 [0126.357] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0126.357] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0126.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0126.357] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed14 | out: lpFileInformation=0x19ed14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0126.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0126.357] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\Iu7q0Vmc Z_G6Dq.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0126.357] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\Iu7q0Vmc Z_G6Dq.bmp", nBufferLength=0x3b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\Iu7q0Vmc Z_G6Dq.bmp", lpFilePart=0x0) returned 0x3a [0126.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec10) returned 1 [0126.357] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\Iu7q0Vmc Z_G6Dq.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\iu7q0vmc z_g6dq.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0126.359] GetFileType (hFile=0x37c) returned 0x1 [0126.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec0c) returned 1 [0126.359] GetFileType (hFile=0x37c) returned 0x1 [0126.359] WriteFile (in: hFile=0x37c, lpBuffer=0x238c7a4*, nNumberOfBytesToWrite=0xe5d0, lpNumberOfBytesWritten=0x19ecc0, lpOverlapped=0x0 | out: lpBuffer=0x238c7a4*, lpNumberOfBytesWritten=0x19ecc0*=0xe5d0, lpOverlapped=0x0) returned 1 [0126.362] CloseHandle (hObject=0x37c) returned 1 [0126.365] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\Iu7q0Vmc Z_G6Dq.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0126.365] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\Iu7q0Vmc Z_G6Dq.bmp", nBufferLength=0x3b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\Iu7q0Vmc Z_G6Dq.bmp", lpFilePart=0x0) returned 0x3a [0126.365] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\Iu7q0Vmc Z_G6Dq.bmp.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0126.365] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\Iu7q0Vmc Z_G6Dq.bmp.paradox", nBufferLength=0x43, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\Iu7q0Vmc Z_G6Dq.bmp.paradox", lpFilePart=0x0) returned 0x42 [0126.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eca4) returned 1 [0126.365] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\Iu7q0Vmc Z_G6Dq.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\iu7q0vmc z_g6dq.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ed20 | out: lpFileInformation=0x19ed20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6672f10, ftCreationTime.dwHighDateTime=0x1d8bccb, ftLastAccessTime.dwLowDateTime=0xe0d9be00, ftLastAccessTime.dwHighDateTime=0x1d8c0f0, ftLastWriteTime.dwLowDateTime=0xc37e6199, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xe5d0)) returned 1 [0126.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eca0) returned 1 [0126.366] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\Iu7q0Vmc Z_G6Dq.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\iu7q0vmc z_g6dq.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\Iu7q0Vmc Z_G6Dq.bmp.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\iu7q0vmc z_g6dq.bmp.paradox")) returned 1 [0126.401] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\LbG_ zixT9ffs2A.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0126.401] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\LbG_ zixT9ffs2A.bmp", nBufferLength=0x3b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\LbG_ zixT9ffs2A.bmp", lpFilePart=0x0) returned 0x3a [0126.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0126.401] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\LbG_ zixT9ffs2A.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\lbg_ zixt9ffs2a.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0126.402] GetFileType (hFile=0x37c) returned 0x1 [0126.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0126.402] GetFileType (hFile=0x37c) returned 0x1 [0126.402] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed20 | out: lpFileSizeHigh=0x19ed20*=0x0) returned 0x139c3 [0126.402] ReadFile (in: hFile=0x37c, lpBuffer=0x239b024, nNumberOfBytesToRead=0x139c3, lpNumberOfBytesRead=0x19eccc, lpOverlapped=0x0 | out: lpBuffer=0x239b024*, lpNumberOfBytesRead=0x19eccc*=0x139c3, lpOverlapped=0x0) returned 1 [0126.403] CloseHandle (hObject=0x37c) returned 1 [0126.439] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0126.439] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0126.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0126.439] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed14 | out: lpFileInformation=0x19ed14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0126.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0126.440] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\LbG_ zixT9ffs2A.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0126.440] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\LbG_ zixT9ffs2A.bmp", nBufferLength=0x3b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\LbG_ zixT9ffs2A.bmp", lpFilePart=0x0) returned 0x3a [0126.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec10) returned 1 [0126.440] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\LbG_ zixT9ffs2A.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\lbg_ zixt9ffs2a.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0126.441] GetFileType (hFile=0x37c) returned 0x1 [0126.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec0c) returned 1 [0126.441] GetFileType (hFile=0x37c) returned 0x1 [0126.441] WriteFile (in: hFile=0x37c, lpBuffer=0x2422b94*, nNumberOfBytesToWrite=0x139d0, lpNumberOfBytesWritten=0x19ecc0, lpOverlapped=0x0 | out: lpBuffer=0x2422b94*, lpNumberOfBytesWritten=0x19ecc0*=0x139d0, lpOverlapped=0x0) returned 1 [0126.443] CloseHandle (hObject=0x37c) returned 1 [0126.446] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\LbG_ zixT9ffs2A.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0126.446] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\LbG_ zixT9ffs2A.bmp", nBufferLength=0x3b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\LbG_ zixT9ffs2A.bmp", lpFilePart=0x0) returned 0x3a [0126.446] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\LbG_ zixT9ffs2A.bmp.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0126.446] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\LbG_ zixT9ffs2A.bmp.paradox", nBufferLength=0x43, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\LbG_ zixT9ffs2A.bmp.paradox", lpFilePart=0x0) returned 0x42 [0126.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eca4) returned 1 [0126.446] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\LbG_ zixT9ffs2A.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\lbg_ zixt9ffs2a.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ed20 | out: lpFileInformation=0x19ed20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9cd8300, ftCreationTime.dwHighDateTime=0x1d8c121, ftLastAccessTime.dwLowDateTime=0x799322f0, ftLastAccessTime.dwHighDateTime=0x1d8c12b, ftLastWriteTime.dwLowDateTime=0xc3894ce0, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x139d0)) returned 1 [0126.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eca0) returned 1 [0126.446] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\LbG_ zixT9ffs2A.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\lbg_ zixt9ffs2a.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\LbG_ zixT9ffs2A.bmp.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\lbg_ zixt9ffs2a.bmp.paradox")) returned 1 [0126.447] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\qmD8S.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0126.447] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\qmD8S.jpg", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\qmD8S.jpg", lpFilePart=0x0) returned 0x30 [0126.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0126.447] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\qmD8S.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\qmd8s.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0126.447] GetFileType (hFile=0x37c) returned 0x1 [0126.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0126.448] GetFileType (hFile=0x37c) returned 0x1 [0126.448] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed20 | out: lpFileSizeHigh=0x19ed20*=0x0) returned 0x1c28 [0126.448] ReadFile (in: hFile=0x37c, lpBuffer=0x2436800, nNumberOfBytesToRead=0x1c28, lpNumberOfBytesRead=0x19eccc, lpOverlapped=0x0 | out: lpBuffer=0x2436800*, lpNumberOfBytesRead=0x19eccc*=0x1c28, lpOverlapped=0x0) returned 1 [0126.448] CloseHandle (hObject=0x37c) returned 1 [0126.470] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0126.470] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0126.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0126.471] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed14 | out: lpFileInformation=0x19ed14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0126.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0126.471] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\qmD8S.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0126.471] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\qmD8S.jpg", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\qmD8S.jpg", lpFilePart=0x0) returned 0x30 [0126.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec10) returned 1 [0126.471] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\qmD8S.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\qmd8s.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0126.472] GetFileType (hFile=0x37c) returned 0x1 [0126.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec0c) returned 1 [0126.472] GetFileType (hFile=0x37c) returned 0x1 [0126.472] WriteFile (in: hFile=0x37c, lpBuffer=0x248c2d8*, nNumberOfBytesToWrite=0x1c30, lpNumberOfBytesWritten=0x19ecc0, lpOverlapped=0x0 | out: lpBuffer=0x248c2d8*, lpNumberOfBytesWritten=0x19ecc0*=0x1c30, lpOverlapped=0x0) returned 1 [0126.473] CloseHandle (hObject=0x37c) returned 1 [0126.474] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\qmD8S.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0126.474] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\qmD8S.jpg", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\qmD8S.jpg", lpFilePart=0x0) returned 0x30 [0126.474] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\qmD8S.jpg.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0126.474] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\qmD8S.jpg.paradox", nBufferLength=0x39, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\qmD8S.jpg.paradox", lpFilePart=0x0) returned 0x38 [0126.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eca4) returned 1 [0126.474] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\qmD8S.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\qmd8s.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ed20 | out: lpFileInformation=0x19ed20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d800630, ftCreationTime.dwHighDateTime=0x1d8bc99, ftLastAccessTime.dwLowDateTime=0xc8c041b0, ftLastAccessTime.dwHighDateTime=0x1d8c071, ftLastWriteTime.dwLowDateTime=0xc38e11be, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x1c30)) returned 1 [0126.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eca0) returned 1 [0126.475] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\qmD8S.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\qmd8s.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\qmD8S.jpg.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\qmd8s.jpg.paradox")) returned 1 [0126.475] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\sipKm5LRX D_iepz2cq.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0126.475] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\sipKm5LRX D_iepz2cq.jpg", nBufferLength=0x3f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\sipKm5LRX D_iepz2cq.jpg", lpFilePart=0x0) returned 0x3e [0126.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0126.475] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\sipKm5LRX D_iepz2cq.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\sipkm5lrx d_iepz2cq.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0126.475] GetFileType (hFile=0x37c) returned 0x1 [0126.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0126.476] GetFileType (hFile=0x37c) returned 0x1 [0126.476] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed20 | out: lpFileSizeHigh=0x19ed20*=0x0) returned 0x15e40 [0126.476] ReadFile (in: hFile=0x37c, lpBuffer=0x3358d30, nNumberOfBytesToRead=0x15e40, lpNumberOfBytesRead=0x19eccc, lpOverlapped=0x0 | out: lpBuffer=0x3358d30*, lpNumberOfBytesRead=0x19eccc*=0x15e40, lpOverlapped=0x0) returned 1 [0126.478] CloseHandle (hObject=0x37c) returned 1 [0126.508] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0126.508] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0126.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0126.508] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed14 | out: lpFileInformation=0x19ed14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0126.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0126.508] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\sipKm5LRX D_iepz2cq.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0126.509] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\sipKm5LRX D_iepz2cq.jpg", nBufferLength=0x3f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\sipKm5LRX D_iepz2cq.jpg", lpFilePart=0x0) returned 0x3e [0126.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec10) returned 1 [0126.509] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\sipKm5LRX D_iepz2cq.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\sipkm5lrx d_iepz2cq.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0126.510] GetFileType (hFile=0x37c) returned 0x1 [0126.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec0c) returned 1 [0126.510] GetFileType (hFile=0x37c) returned 0x1 [0126.510] WriteFile (in: hFile=0x37c, lpBuffer=0x33c64f0*, nNumberOfBytesToWrite=0x15e50, lpNumberOfBytesWritten=0x19ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33c64f0*, lpNumberOfBytesWritten=0x19ecc0*=0x15e50, lpOverlapped=0x0) returned 1 [0126.512] CloseHandle (hObject=0x37c) returned 1 [0126.515] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\sipKm5LRX D_iepz2cq.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0126.515] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\sipKm5LRX D_iepz2cq.jpg", nBufferLength=0x3f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\sipKm5LRX D_iepz2cq.jpg", lpFilePart=0x0) returned 0x3e [0126.515] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\sipKm5LRX D_iepz2cq.jpg.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0126.515] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\sipKm5LRX D_iepz2cq.jpg.paradox", nBufferLength=0x47, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\sipKm5LRX D_iepz2cq.jpg.paradox", lpFilePart=0x0) returned 0x46 [0126.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eca4) returned 1 [0126.515] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\sipKm5LRX D_iepz2cq.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\sipkm5lrx d_iepz2cq.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ed20 | out: lpFileInformation=0x19ed20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bcdde0, ftCreationTime.dwHighDateTime=0x1d8ba7e, ftLastAccessTime.dwLowDateTime=0x34fca700, ftLastAccessTime.dwHighDateTime=0x1d8bcc2, ftLastWriteTime.dwLowDateTime=0xc3954ab8, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x15e50)) returned 1 [0126.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eca0) returned 1 [0126.516] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\sipKm5LRX D_iepz2cq.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\sipkm5lrx d_iepz2cq.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\sipKm5LRX D_iepz2cq.jpg.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\sipkm5lrx d_iepz2cq.jpg.paradox")) returned 1 [0126.516] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\UIm5.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0126.516] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\UIm5.png", nBufferLength=0x30, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\UIm5.png", lpFilePart=0x0) returned 0x2f [0126.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0126.516] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\UIm5.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\uim5.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0126.517] GetFileType (hFile=0x37c) returned 0x1 [0126.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0126.517] GetFileType (hFile=0x37c) returned 0x1 [0126.517] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed20 | out: lpFileSizeHigh=0x19ed20*=0x0) returned 0xc3cc [0126.517] ReadFile (in: hFile=0x37c, lpBuffer=0x24db240, nNumberOfBytesToRead=0xc3cc, lpNumberOfBytesRead=0x19eccc, lpOverlapped=0x0 | out: lpBuffer=0x24db240*, lpNumberOfBytesRead=0x19eccc*=0xc3cc, lpOverlapped=0x0) returned 1 [0126.517] CloseHandle (hObject=0x37c) returned 1 [0126.536] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0126.536] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0126.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0126.536] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed14 | out: lpFileInformation=0x19ed14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0126.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0126.536] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\UIm5.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0126.537] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\UIm5.png", nBufferLength=0x30, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\UIm5.png", lpFilePart=0x0) returned 0x2f [0126.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec10) returned 1 [0126.537] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\UIm5.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\uim5.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0126.538] GetFileType (hFile=0x37c) returned 0x1 [0126.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec0c) returned 1 [0126.538] GetFileType (hFile=0x37c) returned 0x1 [0126.538] WriteFile (in: hFile=0x37c, lpBuffer=0x254cbac*, nNumberOfBytesToWrite=0xc3d0, lpNumberOfBytesWritten=0x19ecc0, lpOverlapped=0x0 | out: lpBuffer=0x254cbac*, lpNumberOfBytesWritten=0x19ecc0*=0xc3d0, lpOverlapped=0x0) returned 1 [0126.541] CloseHandle (hObject=0x37c) returned 1 [0126.543] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\UIm5.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0126.543] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\UIm5.png", nBufferLength=0x30, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\UIm5.png", lpFilePart=0x0) returned 0x2f [0126.543] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\UIm5.png.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0126.543] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\UIm5.png.paradox", nBufferLength=0x38, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\UIm5.png.paradox", lpFilePart=0x0) returned 0x37 [0126.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eca4) returned 1 [0126.543] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\UIm5.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\uim5.png"), fInfoLevelId=0x0, lpFileInformation=0x19ed20 | out: lpFileInformation=0x19ed20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaeef2420, ftCreationTime.dwHighDateTime=0x1d8b3da, ftLastAccessTime.dwLowDateTime=0xbd989c30, ftLastAccessTime.dwHighDateTime=0x1d8b3fe, ftLastWriteTime.dwLowDateTime=0xc397bf20, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xc3d0)) returned 1 [0126.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eca0) returned 1 [0126.543] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\UIm5.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\uim5.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\UIm5.png.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\uim5.png.paradox")) returned 1 [0126.544] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\w2yJe78igCw.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0126.544] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\w2yJe78igCw.bmp", nBufferLength=0x37, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\w2yJe78igCw.bmp", lpFilePart=0x0) returned 0x36 [0126.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0126.544] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\w2yJe78igCw.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\w2yje78igcw.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0126.544] GetFileType (hFile=0x37c) returned 0x1 [0126.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0126.544] GetFileType (hFile=0x37c) returned 0x1 [0126.544] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed20 | out: lpFileSizeHigh=0x19ed20*=0x0) returned 0x13e8b [0126.544] ReadFile (in: hFile=0x37c, lpBuffer=0x25591f8, nNumberOfBytesToRead=0x13e8b, lpNumberOfBytesRead=0x19eccc, lpOverlapped=0x0 | out: lpBuffer=0x25591f8*, lpNumberOfBytesRead=0x19eccc*=0x13e8b, lpOverlapped=0x0) returned 1 [0126.545] CloseHandle (hObject=0x37c) returned 1 [0126.660] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0126.660] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0126.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0126.660] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed14 | out: lpFileInformation=0x19ed14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0126.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0126.660] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\w2yJe78igCw.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0126.660] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\w2yJe78igCw.bmp", nBufferLength=0x37, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\w2yJe78igCw.bmp", lpFilePart=0x0) returned 0x36 [0126.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec10) returned 1 [0126.660] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\w2yJe78igCw.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\w2yje78igcw.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0126.662] GetFileType (hFile=0x37c) returned 0x1 [0126.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec0c) returned 1 [0126.662] GetFileType (hFile=0x37c) returned 0x1 [0126.662] WriteFile (in: hFile=0x37c, lpBuffer=0x238de88*, nNumberOfBytesToWrite=0x13e90, lpNumberOfBytesWritten=0x19ecc0, lpOverlapped=0x0 | out: lpBuffer=0x238de88*, lpNumberOfBytesWritten=0x19ecc0*=0x13e90, lpOverlapped=0x0) returned 1 [0126.665] CloseHandle (hObject=0x37c) returned 1 [0126.668] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\w2yJe78igCw.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0126.668] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\w2yJe78igCw.bmp", nBufferLength=0x37, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\w2yJe78igCw.bmp", lpFilePart=0x0) returned 0x36 [0126.668] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\w2yJe78igCw.bmp.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0126.669] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\w2yJe78igCw.bmp.paradox", nBufferLength=0x3f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\w2yJe78igCw.bmp.paradox", lpFilePart=0x0) returned 0x3e [0126.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eca4) returned 1 [0126.669] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\w2yJe78igCw.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\w2yje78igcw.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ed20 | out: lpFileInformation=0x19ed20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd3d6df0, ftCreationTime.dwHighDateTime=0x1d8bb7f, ftLastAccessTime.dwLowDateTime=0x229e0f10, ftLastAccessTime.dwHighDateTime=0x1d8be73, ftLastWriteTime.dwLowDateTime=0xc3aaae9e, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x13e90)) returned 1 [0126.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eca0) returned 1 [0126.669] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\w2yJe78igCw.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\w2yje78igcw.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\w2yJe78igCw.bmp.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\w2yje78igcw.bmp.paradox")) returned 1 [0126.670] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\YsW39t6L-TWGKe-iuT8K.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0126.670] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\YsW39t6L-TWGKe-iuT8K.jpg", nBufferLength=0x40, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\YsW39t6L-TWGKe-iuT8K.jpg", lpFilePart=0x0) returned 0x3f [0126.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0126.670] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\YsW39t6L-TWGKe-iuT8K.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\ysw39t6l-twgke-iut8k.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0126.670] GetFileType (hFile=0x37c) returned 0x1 [0126.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0126.670] GetFileType (hFile=0x37c) returned 0x1 [0126.670] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed20 | out: lpFileSizeHigh=0x19ed20*=0x0) returned 0x6c23 [0126.671] ReadFile (in: hFile=0x37c, lpBuffer=0x23a1fc4, nNumberOfBytesToRead=0x6c23, lpNumberOfBytesRead=0x19eccc, lpOverlapped=0x0 | out: lpBuffer=0x23a1fc4*, lpNumberOfBytesRead=0x19eccc*=0x6c23, lpOverlapped=0x0) returned 1 [0126.671] CloseHandle (hObject=0x37c) returned 1 [0126.720] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0126.721] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0126.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0126.721] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed14 | out: lpFileInformation=0x19ed14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0126.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0126.721] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\YsW39t6L-TWGKe-iuT8K.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0126.721] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\YsW39t6L-TWGKe-iuT8K.jpg", nBufferLength=0x40, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\YsW39t6L-TWGKe-iuT8K.jpg", lpFilePart=0x0) returned 0x3f [0126.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec10) returned 1 [0126.721] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\YsW39t6L-TWGKe-iuT8K.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\ysw39t6l-twgke-iut8k.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0126.723] GetFileType (hFile=0x37c) returned 0x1 [0126.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec0c) returned 1 [0126.723] GetFileType (hFile=0x37c) returned 0x1 [0126.723] WriteFile (in: hFile=0x37c, lpBuffer=0x2410bfc*, nNumberOfBytesToWrite=0x6c30, lpNumberOfBytesWritten=0x19ecc0, lpOverlapped=0x0 | out: lpBuffer=0x2410bfc*, lpNumberOfBytesWritten=0x19ecc0*=0x6c30, lpOverlapped=0x0) returned 1 [0126.724] CloseHandle (hObject=0x37c) returned 1 [0126.726] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\YsW39t6L-TWGKe-iuT8K.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0126.726] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\YsW39t6L-TWGKe-iuT8K.jpg", nBufferLength=0x40, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\YsW39t6L-TWGKe-iuT8K.jpg", lpFilePart=0x0) returned 0x3f [0126.726] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\YsW39t6L-TWGKe-iuT8K.jpg.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x48 [0126.726] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\YsW39t6L-TWGKe-iuT8K.jpg.paradox", nBufferLength=0x48, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\YsW39t6L-TWGKe-iuT8K.jpg.paradox", lpFilePart=0x0) returned 0x47 [0126.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eca4) returned 1 [0126.726] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\YsW39t6L-TWGKe-iuT8K.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\ysw39t6l-twgke-iut8k.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ed20 | out: lpFileInformation=0x19ed20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42a8a5a0, ftCreationTime.dwHighDateTime=0x1d8b62a, ftLastAccessTime.dwLowDateTime=0x3fbbd5a0, ftLastAccessTime.dwHighDateTime=0x1d8bf90, ftLastWriteTime.dwLowDateTime=0xc3b43799, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x6c30)) returned 1 [0126.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eca0) returned 1 [0126.727] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\YsW39t6L-TWGKe-iuT8K.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\ysw39t6l-twgke-iut8k.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\CDvSbna\\YsW39t6L-TWGKe-iuT8K.jpg.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\cdvsbna\\ysw39t6l-twgke-iut8k.jpg.paradox")) returned 1 [0126.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed78) returned 1 [0126.728] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0126.728] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz", nBufferLength=0x29, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz", lpFilePart=0x0) returned 0x28 [0126.728] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\*"), lpFindFileData=0x19eaa0 | out: lpFindFileData=0x19eaa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3f50580, ftCreationTime.dwHighDateTime=0x1d8b808, ftLastAccessTime.dwLowDateTime=0x7d540210, ftLastAccessTime.dwHighDateTime=0x1d8bee7, ftLastWriteTime.dwLowDateTime=0x7d540210, ftLastWriteTime.dwHighDateTime=0x1d8bee7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x689090 [0126.729] FindNextFileW (in: hFindFile=0x689090, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3f50580, ftCreationTime.dwHighDateTime=0x1d8b808, ftLastAccessTime.dwLowDateTime=0x7d540210, ftLastAccessTime.dwHighDateTime=0x1d8bee7, ftLastWriteTime.dwLowDateTime=0x7d540210, ftLastWriteTime.dwHighDateTime=0x1d8bee7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.729] FindNextFileW (in: hFindFile=0x689090, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x671cd460, ftCreationTime.dwHighDateTime=0x1d8bde6, ftLastAccessTime.dwLowDateTime=0xf87d33e0, ftLastAccessTime.dwHighDateTime=0x1d8bee6, ftLastWriteTime.dwLowDateTime=0xf87d33e0, ftLastWriteTime.dwHighDateTime=0x1d8bee6, nFileSizeHigh=0x0, nFileSizeLow=0xe882, dwReserved0=0x0, dwReserved1=0x0, cFileName="3 PBELo2SufC.png", cAlternateFileName="3PBELO~1.PNG")) returned 1 [0126.729] FindNextFileW (in: hFindFile=0x689090, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a8d8e80, ftCreationTime.dwHighDateTime=0x1d8b8fa, ftLastAccessTime.dwLowDateTime=0x29f45940, ftLastAccessTime.dwHighDateTime=0x1d8bf09, ftLastWriteTime.dwLowDateTime=0x29f45940, ftLastWriteTime.dwHighDateTime=0x1d8bf09, nFileSizeHigh=0x0, nFileSizeLow=0x145ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="93rPWrjGSl.jpg", cAlternateFileName="93RPWR~1.JPG")) returned 1 [0126.730] FindNextFileW (in: hFindFile=0x689090, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda3c2310, ftCreationTime.dwHighDateTime=0x1d8b823, ftLastAccessTime.dwLowDateTime=0xbf85fd50, ftLastAccessTime.dwHighDateTime=0x1d8bebf, ftLastWriteTime.dwLowDateTime=0xbf85fd50, ftLastWriteTime.dwHighDateTime=0x1d8bebf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AriYdsq9H1hLtWY2vHG", cAlternateFileName="ARIYDS~1")) returned 1 [0126.730] FindNextFileW (in: hFindFile=0x689090, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd49ee000, ftCreationTime.dwHighDateTime=0x1d8baad, ftLastAccessTime.dwLowDateTime=0x1bffd210, ftLastAccessTime.dwHighDateTime=0x1d8bd60, ftLastWriteTime.dwLowDateTime=0x1bffd210, ftLastWriteTime.dwHighDateTime=0x1d8bd60, nFileSizeHigh=0x0, nFileSizeLow=0x5453, dwReserved0=0x0, dwReserved1=0x0, cFileName="D6g892W9EJAoQh6UBp3.bmp", cAlternateFileName="D6G892~1.BMP")) returned 1 [0126.730] FindNextFileW (in: hFindFile=0x689090, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaed60c80, ftCreationTime.dwHighDateTime=0x1d8b92d, ftLastAccessTime.dwLowDateTime=0x39367a70, ftLastAccessTime.dwHighDateTime=0x1d8c083, ftLastWriteTime.dwLowDateTime=0x39367a70, ftLastWriteTime.dwHighDateTime=0x1d8c083, nFileSizeHigh=0x0, nFileSizeLow=0x10db1, dwReserved0=0x0, dwReserved1=0x0, cFileName="gJ7ZisxgU3qt22qTqMQ3.bmp", cAlternateFileName="GJ7ZIS~1.BMP")) returned 1 [0126.731] FindNextFileW (in: hFindFile=0x689090, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9e1e8c0, ftCreationTime.dwHighDateTime=0x1d8b5c5, ftLastAccessTime.dwLowDateTime=0xb4df18f0, ftLastAccessTime.dwHighDateTime=0x1d8ba41, ftLastWriteTime.dwLowDateTime=0xb4df18f0, ftLastWriteTime.dwHighDateTime=0x1d8ba41, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MEHNk_Kk", cAlternateFileName="")) returned 1 [0126.731] FindNextFileW (in: hFindFile=0x689090, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x189c630, ftCreationTime.dwHighDateTime=0x1d8bea4, ftLastAccessTime.dwLowDateTime=0x4d9d5130, ftLastAccessTime.dwHighDateTime=0x1d8c111, ftLastWriteTime.dwLowDateTime=0x4d9d5130, ftLastWriteTime.dwHighDateTime=0x1d8c111, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OoloEAyY 74Zgh4", cAlternateFileName="OOLOEA~1")) returned 1 [0126.731] FindNextFileW (in: hFindFile=0x689090, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b6f22b0, ftCreationTime.dwHighDateTime=0x1d8bb21, ftLastAccessTime.dwLowDateTime=0x3d1cb040, ftLastAccessTime.dwHighDateTime=0x1d8bf0d, ftLastWriteTime.dwLowDateTime=0x3d1cb040, ftLastWriteTime.dwHighDateTime=0x1d8bf0d, nFileSizeHigh=0x0, nFileSizeLow=0x2493, dwReserved0=0x0, dwReserved1=0x0, cFileName="xS_92T-iMJ.bmp", cAlternateFileName="XS_92T~1.BMP")) returned 1 [0126.731] FindNextFileW (in: hFindFile=0x689090, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0126.732] FindClose (in: hFindFile=0x689090 | out: hFindFile=0x689090) returned 1 [0126.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed34) returned 1 [0126.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed40) returned 1 [0126.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed78) returned 1 [0126.732] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0126.732] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz", nBufferLength=0x29, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz", lpFilePart=0x0) returned 0x28 [0126.732] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\*"), lpFindFileData=0x19eaa0 | out: lpFindFileData=0x19eaa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3f50580, ftCreationTime.dwHighDateTime=0x1d8b808, ftLastAccessTime.dwLowDateTime=0x7d540210, ftLastAccessTime.dwHighDateTime=0x1d8bee7, ftLastWriteTime.dwLowDateTime=0x7d540210, ftLastWriteTime.dwHighDateTime=0x1d8bee7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x689110 [0126.733] FindNextFileW (in: hFindFile=0x689110, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3f50580, ftCreationTime.dwHighDateTime=0x1d8b808, ftLastAccessTime.dwLowDateTime=0x7d540210, ftLastAccessTime.dwHighDateTime=0x1d8bee7, ftLastWriteTime.dwLowDateTime=0x7d540210, ftLastWriteTime.dwHighDateTime=0x1d8bee7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.739] FindNextFileW (in: hFindFile=0x689110, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x671cd460, ftCreationTime.dwHighDateTime=0x1d8bde6, ftLastAccessTime.dwLowDateTime=0xf87d33e0, ftLastAccessTime.dwHighDateTime=0x1d8bee6, ftLastWriteTime.dwLowDateTime=0xf87d33e0, ftLastWriteTime.dwHighDateTime=0x1d8bee6, nFileSizeHigh=0x0, nFileSizeLow=0xe882, dwReserved0=0x0, dwReserved1=0x0, cFileName="3 PBELo2SufC.png", cAlternateFileName="3PBELO~1.PNG")) returned 1 [0126.739] FindNextFileW (in: hFindFile=0x689110, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a8d8e80, ftCreationTime.dwHighDateTime=0x1d8b8fa, ftLastAccessTime.dwLowDateTime=0x29f45940, ftLastAccessTime.dwHighDateTime=0x1d8bf09, ftLastWriteTime.dwLowDateTime=0x29f45940, ftLastWriteTime.dwHighDateTime=0x1d8bf09, nFileSizeHigh=0x0, nFileSizeLow=0x145ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="93rPWrjGSl.jpg", cAlternateFileName="93RPWR~1.JPG")) returned 1 [0126.740] FindNextFileW (in: hFindFile=0x689110, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda3c2310, ftCreationTime.dwHighDateTime=0x1d8b823, ftLastAccessTime.dwLowDateTime=0xbf85fd50, ftLastAccessTime.dwHighDateTime=0x1d8bebf, ftLastWriteTime.dwLowDateTime=0xbf85fd50, ftLastWriteTime.dwHighDateTime=0x1d8bebf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AriYdsq9H1hLtWY2vHG", cAlternateFileName="ARIYDS~1")) returned 1 [0126.740] FindNextFileW (in: hFindFile=0x689110, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd49ee000, ftCreationTime.dwHighDateTime=0x1d8baad, ftLastAccessTime.dwLowDateTime=0x1bffd210, ftLastAccessTime.dwHighDateTime=0x1d8bd60, ftLastWriteTime.dwLowDateTime=0x1bffd210, ftLastWriteTime.dwHighDateTime=0x1d8bd60, nFileSizeHigh=0x0, nFileSizeLow=0x5453, dwReserved0=0x0, dwReserved1=0x0, cFileName="D6g892W9EJAoQh6UBp3.bmp", cAlternateFileName="D6G892~1.BMP")) returned 1 [0126.740] FindNextFileW (in: hFindFile=0x689110, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaed60c80, ftCreationTime.dwHighDateTime=0x1d8b92d, ftLastAccessTime.dwLowDateTime=0x39367a70, ftLastAccessTime.dwHighDateTime=0x1d8c083, ftLastWriteTime.dwLowDateTime=0x39367a70, ftLastWriteTime.dwHighDateTime=0x1d8c083, nFileSizeHigh=0x0, nFileSizeLow=0x10db1, dwReserved0=0x0, dwReserved1=0x0, cFileName="gJ7ZisxgU3qt22qTqMQ3.bmp", cAlternateFileName="GJ7ZIS~1.BMP")) returned 1 [0126.740] FindNextFileW (in: hFindFile=0x689110, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9e1e8c0, ftCreationTime.dwHighDateTime=0x1d8b5c5, ftLastAccessTime.dwLowDateTime=0xb4df18f0, ftLastAccessTime.dwHighDateTime=0x1d8ba41, ftLastWriteTime.dwLowDateTime=0xb4df18f0, ftLastWriteTime.dwHighDateTime=0x1d8ba41, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MEHNk_Kk", cAlternateFileName="")) returned 1 [0126.741] FindNextFileW (in: hFindFile=0x689110, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x189c630, ftCreationTime.dwHighDateTime=0x1d8bea4, ftLastAccessTime.dwLowDateTime=0x4d9d5130, ftLastAccessTime.dwHighDateTime=0x1d8c111, ftLastWriteTime.dwLowDateTime=0x4d9d5130, ftLastWriteTime.dwHighDateTime=0x1d8c111, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OoloEAyY 74Zgh4", cAlternateFileName="OOLOEA~1")) returned 1 [0126.741] FindNextFileW (in: hFindFile=0x689110, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b6f22b0, ftCreationTime.dwHighDateTime=0x1d8bb21, ftLastAccessTime.dwLowDateTime=0x3d1cb040, ftLastAccessTime.dwHighDateTime=0x1d8bf0d, ftLastWriteTime.dwLowDateTime=0x3d1cb040, ftLastWriteTime.dwHighDateTime=0x1d8bf0d, nFileSizeHigh=0x0, nFileSizeLow=0x2493, dwReserved0=0x0, dwReserved1=0x0, cFileName="xS_92T-iMJ.bmp", cAlternateFileName="XS_92T~1.BMP")) returned 1 [0126.741] FindNextFileW (in: hFindFile=0x689110, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b6f22b0, ftCreationTime.dwHighDateTime=0x1d8bb21, ftLastAccessTime.dwLowDateTime=0x3d1cb040, ftLastAccessTime.dwHighDateTime=0x1d8bf0d, ftLastWriteTime.dwLowDateTime=0x3d1cb040, ftLastWriteTime.dwHighDateTime=0x1d8bf0d, nFileSizeHigh=0x0, nFileSizeLow=0x2493, dwReserved0=0x0, dwReserved1=0x0, cFileName="xS_92T-iMJ.bmp", cAlternateFileName="XS_92T~1.BMP")) returned 0 [0126.741] FindClose (in: hFindFile=0x689110 | out: hFindFile=0x689110) returned 1 [0126.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed34) returned 1 [0126.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed40) returned 1 [0126.742] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\3 PBELo2SufC.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0126.742] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\3 PBELo2SufC.png", nBufferLength=0x3a, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\3 PBELo2SufC.png", lpFilePart=0x0) returned 0x39 [0126.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0126.742] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\3 PBELo2SufC.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\3 pbelo2sufc.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0126.742] GetFileType (hFile=0x37c) returned 0x1 [0126.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0126.742] GetFileType (hFile=0x37c) returned 0x1 [0126.742] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed20 | out: lpFileSizeHigh=0x19ed20*=0x0) returned 0xe882 [0126.743] ReadFile (in: hFile=0x37c, lpBuffer=0x2419f98, nNumberOfBytesToRead=0xe882, lpNumberOfBytesRead=0x19eccc, lpOverlapped=0x0 | out: lpBuffer=0x2419f98*, lpNumberOfBytesRead=0x19eccc*=0xe882, lpOverlapped=0x0) returned 1 [0126.743] CloseHandle (hObject=0x37c) returned 1 [0126.773] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0126.773] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0126.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0126.774] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed14 | out: lpFileInformation=0x19ed14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0126.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0126.774] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\3 PBELo2SufC.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0126.774] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\3 PBELo2SufC.png", nBufferLength=0x3a, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\3 PBELo2SufC.png", lpFilePart=0x0) returned 0x39 [0126.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec10) returned 1 [0126.774] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\3 PBELo2SufC.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\3 pbelo2sufc.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0126.776] GetFileType (hFile=0x37c) returned 0x1 [0126.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec0c) returned 1 [0126.776] GetFileType (hFile=0x37c) returned 0x1 [0126.776] WriteFile (in: hFile=0x37c, lpBuffer=0x2492748*, nNumberOfBytesToWrite=0xe890, lpNumberOfBytesWritten=0x19ecc0, lpOverlapped=0x0 | out: lpBuffer=0x2492748*, lpNumberOfBytesWritten=0x19ecc0*=0xe890, lpOverlapped=0x0) returned 1 [0126.779] CloseHandle (hObject=0x37c) returned 1 [0126.783] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\3 PBELo2SufC.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0126.783] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\3 PBELo2SufC.png", nBufferLength=0x3a, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\3 PBELo2SufC.png", lpFilePart=0x0) returned 0x39 [0126.783] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\3 PBELo2SufC.png.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0126.783] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\3 PBELo2SufC.png.paradox", nBufferLength=0x42, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\3 PBELo2SufC.png.paradox", lpFilePart=0x0) returned 0x41 [0126.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eca4) returned 1 [0126.783] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\3 PBELo2SufC.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\3 pbelo2sufc.png"), fInfoLevelId=0x0, lpFileInformation=0x19ed20 | out: lpFileInformation=0x19ed20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x671cd460, ftCreationTime.dwHighDateTime=0x1d8bde6, ftLastAccessTime.dwLowDateTime=0xf87d33e0, ftLastAccessTime.dwHighDateTime=0x1d8bee6, ftLastWriteTime.dwLowDateTime=0xc3bdc0d6, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xe890)) returned 1 [0126.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eca0) returned 1 [0126.783] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\3 PBELo2SufC.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\3 pbelo2sufc.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\3 PBELo2SufC.png.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\3 pbelo2sufc.png.paradox")) returned 1 [0126.785] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\93rPWrjGSl.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0126.785] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\93rPWrjGSl.jpg", nBufferLength=0x38, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\93rPWrjGSl.jpg", lpFilePart=0x0) returned 0x37 [0126.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0126.785] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\93rPWrjGSl.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\93rpwrjgsl.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0126.785] GetFileType (hFile=0x37c) returned 0x1 [0126.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0126.785] GetFileType (hFile=0x37c) returned 0x1 [0126.785] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed20 | out: lpFileSizeHigh=0x19ed20*=0x0) returned 0x145ac [0126.785] ReadFile (in: hFile=0x37c, lpBuffer=0x24a1278, nNumberOfBytesToRead=0x145ac, lpNumberOfBytesRead=0x19eccc, lpOverlapped=0x0 | out: lpBuffer=0x24a1278*, lpNumberOfBytesRead=0x19eccc*=0x145ac, lpOverlapped=0x0) returned 1 [0126.786] CloseHandle (hObject=0x37c) returned 1 [0126.822] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0126.822] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0126.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0126.823] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed14 | out: lpFileInformation=0x19ed14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0126.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0126.823] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\93rPWrjGSl.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0126.823] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\93rPWrjGSl.jpg", nBufferLength=0x38, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\93rPWrjGSl.jpg", lpFilePart=0x0) returned 0x37 [0126.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec10) returned 1 [0126.823] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\93rPWrjGSl.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\93rpwrjgsl.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0126.825] GetFileType (hFile=0x37c) returned 0x1 [0126.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec0c) returned 1 [0126.825] GetFileType (hFile=0x37c) returned 0x1 [0126.825] WriteFile (in: hFile=0x37c, lpBuffer=0x231bc3c*, nNumberOfBytesToWrite=0x145b0, lpNumberOfBytesWritten=0x19ecc0, lpOverlapped=0x0 | out: lpBuffer=0x231bc3c*, lpNumberOfBytesWritten=0x19ecc0*=0x145b0, lpOverlapped=0x0) returned 1 [0126.830] CloseHandle (hObject=0x37c) returned 1 [0126.834] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\93rPWrjGSl.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0126.834] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\93rPWrjGSl.jpg", nBufferLength=0x38, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\93rPWrjGSl.jpg", lpFilePart=0x0) returned 0x37 [0126.834] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\93rPWrjGSl.jpg.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0126.834] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\93rPWrjGSl.jpg.paradox", nBufferLength=0x40, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\93rPWrjGSl.jpg.paradox", lpFilePart=0x0) returned 0x3f [0126.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eca4) returned 1 [0126.834] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\93rPWrjGSl.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\93rpwrjgsl.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ed20 | out: lpFileInformation=0x19ed20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a8d8e80, ftCreationTime.dwHighDateTime=0x1d8b8fa, ftLastAccessTime.dwLowDateTime=0x29f45940, ftLastAccessTime.dwHighDateTime=0x1d8bf09, ftLastWriteTime.dwLowDateTime=0xc3c4e875, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x145b0)) returned 1 [0126.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eca0) returned 1 [0126.835] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\93rPWrjGSl.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\93rpwrjgsl.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\93rPWrjGSl.jpg.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\93rpwrjgsl.jpg.paradox")) returned 1 [0126.836] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\D6g892W9EJAoQh6UBp3.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0126.836] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\D6g892W9EJAoQh6UBp3.bmp", nBufferLength=0x41, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\D6g892W9EJAoQh6UBp3.bmp", lpFilePart=0x0) returned 0x40 [0126.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0126.836] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\D6g892W9EJAoQh6UBp3.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\d6g892w9ejaoqh6ubp3.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0126.836] GetFileType (hFile=0x37c) returned 0x1 [0126.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0126.836] GetFileType (hFile=0x37c) returned 0x1 [0126.836] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed20 | out: lpFileSizeHigh=0x19ed20*=0x0) returned 0x5453 [0126.836] ReadFile (in: hFile=0x37c, lpBuffer=0x2330494, nNumberOfBytesToRead=0x5453, lpNumberOfBytesRead=0x19eccc, lpOverlapped=0x0 | out: lpBuffer=0x2330494*, lpNumberOfBytesRead=0x19eccc*=0x5453, lpOverlapped=0x0) returned 1 [0126.837] CloseHandle (hObject=0x37c) returned 1 [0126.962] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0126.962] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0126.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0126.962] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed14 | out: lpFileInformation=0x19ed14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0126.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0126.963] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\D6g892W9EJAoQh6UBp3.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0126.963] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\D6g892W9EJAoQh6UBp3.bmp", nBufferLength=0x41, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\D6g892W9EJAoQh6UBp3.bmp", lpFilePart=0x0) returned 0x40 [0126.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec10) returned 1 [0126.963] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\D6g892W9EJAoQh6UBp3.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\d6g892w9ejaoqh6ubp3.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0126.965] GetFileType (hFile=0x37c) returned 0x1 [0126.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec0c) returned 1 [0126.965] GetFileType (hFile=0x37c) returned 0x1 [0126.965] WriteFile (in: hFile=0x37c, lpBuffer=0x23979bc*, nNumberOfBytesToWrite=0x5460, lpNumberOfBytesWritten=0x19ecc0, lpOverlapped=0x0 | out: lpBuffer=0x23979bc*, lpNumberOfBytesWritten=0x19ecc0*=0x5460, lpOverlapped=0x0) returned 1 [0126.967] CloseHandle (hObject=0x37c) returned 1 [0126.969] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\D6g892W9EJAoQh6UBp3.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0126.969] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\D6g892W9EJAoQh6UBp3.bmp", nBufferLength=0x41, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\D6g892W9EJAoQh6UBp3.bmp", lpFilePart=0x0) returned 0x40 [0126.969] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\D6g892W9EJAoQh6UBp3.bmp.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0126.969] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\D6g892W9EJAoQh6UBp3.bmp.paradox", nBufferLength=0x49, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\D6g892W9EJAoQh6UBp3.bmp.paradox", lpFilePart=0x0) returned 0x48 [0126.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eca4) returned 1 [0126.969] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\D6g892W9EJAoQh6UBp3.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\d6g892w9ejaoqh6ubp3.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ed20 | out: lpFileInformation=0x19ed20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd49ee000, ftCreationTime.dwHighDateTime=0x1d8baad, ftLastAccessTime.dwLowDateTime=0x1bffd210, ftLastAccessTime.dwHighDateTime=0x1d8bd60, ftLastWriteTime.dwLowDateTime=0xc3da7ca1, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x5460)) returned 1 [0126.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eca0) returned 1 [0126.970] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\D6g892W9EJAoQh6UBp3.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\d6g892w9ejaoqh6ubp3.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\D6g892W9EJAoQh6UBp3.bmp.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\d6g892w9ejaoqh6ubp3.bmp.paradox")) returned 1 [0126.971] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\gJ7ZisxgU3qt22qTqMQ3.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0126.971] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\gJ7ZisxgU3qt22qTqMQ3.bmp", nBufferLength=0x42, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\gJ7ZisxgU3qt22qTqMQ3.bmp", lpFilePart=0x0) returned 0x41 [0126.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0126.971] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\gJ7ZisxgU3qt22qTqMQ3.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\gj7zisxgu3qt22qtqmq3.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0126.971] GetFileType (hFile=0x37c) returned 0x1 [0126.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0126.971] GetFileType (hFile=0x37c) returned 0x1 [0126.971] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed20 | out: lpFileSizeHigh=0x19ed20*=0x0) returned 0x10db1 [0126.971] ReadFile (in: hFile=0x37c, lpBuffer=0x239d0ec, nNumberOfBytesToRead=0x10db1, lpNumberOfBytesRead=0x19eccc, lpOverlapped=0x0 | out: lpBuffer=0x239d0ec*, lpNumberOfBytesRead=0x19eccc*=0x10db1, lpOverlapped=0x0) returned 1 [0126.972] CloseHandle (hObject=0x37c) returned 1 [0127.003] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0127.004] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0127.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0127.004] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed14 | out: lpFileInformation=0x19ed14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0127.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0127.004] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\gJ7ZisxgU3qt22qTqMQ3.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0127.004] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\gJ7ZisxgU3qt22qTqMQ3.bmp", nBufferLength=0x42, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\gJ7ZisxgU3qt22qTqMQ3.bmp", lpFilePart=0x0) returned 0x41 [0127.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec10) returned 1 [0127.004] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\gJ7ZisxgU3qt22qTqMQ3.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\gj7zisxgu3qt22qtqmq3.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0127.006] GetFileType (hFile=0x37c) returned 0x1 [0127.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec0c) returned 1 [0127.006] GetFileType (hFile=0x37c) returned 0x1 [0127.006] WriteFile (in: hFile=0x37c, lpBuffer=0x241c82c*, nNumberOfBytesToWrite=0x10dc0, lpNumberOfBytesWritten=0x19ecc0, lpOverlapped=0x0 | out: lpBuffer=0x241c82c*, lpNumberOfBytesWritten=0x19ecc0*=0x10dc0, lpOverlapped=0x0) returned 1 [0127.009] CloseHandle (hObject=0x37c) returned 1 [0127.013] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\gJ7ZisxgU3qt22qTqMQ3.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0127.013] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\gJ7ZisxgU3qt22qTqMQ3.bmp", nBufferLength=0x42, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\gJ7ZisxgU3qt22qTqMQ3.bmp", lpFilePart=0x0) returned 0x41 [0127.013] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\gJ7ZisxgU3qt22qTqMQ3.bmp.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0127.013] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\gJ7ZisxgU3qt22qTqMQ3.bmp.paradox", nBufferLength=0x4a, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\gJ7ZisxgU3qt22qTqMQ3.bmp.paradox", lpFilePart=0x0) returned 0x49 [0127.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eca4) returned 1 [0127.013] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\gJ7ZisxgU3qt22qTqMQ3.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\gj7zisxgu3qt22qtqmq3.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ed20 | out: lpFileInformation=0x19ed20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaed60c80, ftCreationTime.dwHighDateTime=0x1d8b92d, ftLastAccessTime.dwLowDateTime=0x39367a70, ftLastAccessTime.dwHighDateTime=0x1d8c083, ftLastWriteTime.dwLowDateTime=0xc3df2287, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x10dc0)) returned 1 [0127.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eca0) returned 1 [0127.014] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\gJ7ZisxgU3qt22qTqMQ3.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\gj7zisxgu3qt22qtqmq3.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\gJ7ZisxgU3qt22qTqMQ3.bmp.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\gj7zisxgu3qt22qtqmq3.bmp.paradox")) returned 1 [0127.015] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\xS_92T-iMJ.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0127.015] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\xS_92T-iMJ.bmp", nBufferLength=0x38, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\xS_92T-iMJ.bmp", lpFilePart=0x0) returned 0x37 [0127.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0127.015] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\xS_92T-iMJ.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\xs_92t-imj.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0127.016] GetFileType (hFile=0x37c) returned 0x1 [0127.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0127.016] GetFileType (hFile=0x37c) returned 0x1 [0127.016] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed20 | out: lpFileSizeHigh=0x19ed20*=0x0) returned 0x2493 [0127.016] ReadFile (in: hFile=0x37c, lpBuffer=0x242d8ac, nNumberOfBytesToRead=0x2493, lpNumberOfBytesRead=0x19eccc, lpOverlapped=0x0 | out: lpBuffer=0x242d8ac*, lpNumberOfBytesRead=0x19eccc*=0x2493, lpOverlapped=0x0) returned 1 [0127.016] CloseHandle (hObject=0x37c) returned 1 [0127.068] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0127.068] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0127.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0127.068] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed14 | out: lpFileInformation=0x19ed14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0127.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0127.068] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\xS_92T-iMJ.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0127.068] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\xS_92T-iMJ.bmp", nBufferLength=0x38, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\xS_92T-iMJ.bmp", lpFilePart=0x0) returned 0x37 [0127.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec10) returned 1 [0127.069] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\xS_92T-iMJ.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\xs_92t-imj.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0127.070] GetFileType (hFile=0x37c) returned 0x1 [0127.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec0c) returned 1 [0127.070] GetFileType (hFile=0x37c) returned 0x1 [0127.070] WriteFile (in: hFile=0x37c, lpBuffer=0x2485db8*, nNumberOfBytesToWrite=0x24a0, lpNumberOfBytesWritten=0x19ecc0, lpOverlapped=0x0 | out: lpBuffer=0x2485db8*, lpNumberOfBytesWritten=0x19ecc0*=0x24a0, lpOverlapped=0x0) returned 1 [0127.072] CloseHandle (hObject=0x37c) returned 1 [0127.077] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\xS_92T-iMJ.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0127.080] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\xS_92T-iMJ.bmp", nBufferLength=0x38, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\xS_92T-iMJ.bmp", lpFilePart=0x0) returned 0x37 [0127.080] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\xS_92T-iMJ.bmp.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0127.080] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\xS_92T-iMJ.bmp.paradox", nBufferLength=0x40, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\xS_92T-iMJ.bmp.paradox", lpFilePart=0x0) returned 0x3f [0127.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eca4) returned 1 [0127.080] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\xS_92T-iMJ.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\xs_92t-imj.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ed20 | out: lpFileInformation=0x19ed20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b6f22b0, ftCreationTime.dwHighDateTime=0x1d8bb21, ftLastAccessTime.dwLowDateTime=0x3d1cb040, ftLastAccessTime.dwHighDateTime=0x1d8bf0d, ftLastWriteTime.dwLowDateTime=0xc3e8ab92, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x24a0)) returned 1 [0127.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eca0) returned 1 [0127.080] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\xS_92T-iMJ.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\xs_92t-imj.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\xS_92T-iMJ.bmp.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\xs_92t-imj.bmp.paradox")) returned 1 [0127.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed04) returned 1 [0127.081] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0127.081] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG", nBufferLength=0x3d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG", lpFilePart=0x0) returned 0x3c [0127.081] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\*"), lpFindFileData=0x19ea2c | out: lpFindFileData=0x19ea2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda3c2310, ftCreationTime.dwHighDateTime=0x1d8b823, ftLastAccessTime.dwLowDateTime=0xbf85fd50, ftLastAccessTime.dwHighDateTime=0x1d8bebf, ftLastWriteTime.dwLowDateTime=0xbf85fd50, ftLastWriteTime.dwHighDateTime=0x1d8bebf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688d10 [0127.082] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda3c2310, ftCreationTime.dwHighDateTime=0x1d8b823, ftLastAccessTime.dwLowDateTime=0xbf85fd50, ftLastAccessTime.dwHighDateTime=0x1d8bebf, ftLastWriteTime.dwLowDateTime=0xbf85fd50, ftLastWriteTime.dwHighDateTime=0x1d8bebf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0127.082] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf35128c0, ftCreationTime.dwHighDateTime=0x1d8ba97, ftLastAccessTime.dwLowDateTime=0xf21ca150, ftLastAccessTime.dwHighDateTime=0x1d8bb50, ftLastWriteTime.dwLowDateTime=0xf21ca150, ftLastWriteTime.dwHighDateTime=0x1d8bb50, nFileSizeHigh=0x0, nFileSizeLow=0xd413, dwReserved0=0x0, dwReserved1=0x0, cFileName="5EFkJZZxsJD.bmp", cAlternateFileName="5EFKJZ~1.BMP")) returned 1 [0127.082] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7000070, ftCreationTime.dwHighDateTime=0x1d8b8e4, ftLastAccessTime.dwLowDateTime=0x8f721410, ftLastAccessTime.dwHighDateTime=0x1d8be32, ftLastWriteTime.dwLowDateTime=0x8f721410, ftLastWriteTime.dwHighDateTime=0x1d8be32, nFileSizeHigh=0x0, nFileSizeLow=0x7d3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="8MdVti1_bQ.bmp", cAlternateFileName="8MDVTI~1.BMP")) returned 1 [0127.083] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb92f1c00, ftCreationTime.dwHighDateTime=0x1d8b679, ftLastAccessTime.dwLowDateTime=0x3f979d70, ftLastAccessTime.dwHighDateTime=0x1d8bfe0, ftLastWriteTime.dwLowDateTime=0x3f979d70, ftLastWriteTime.dwHighDateTime=0x1d8bfe0, nFileSizeHigh=0x0, nFileSizeLow=0x2146, dwReserved0=0x0, dwReserved1=0x0, cFileName="afV1uedQpAS.jpg", cAlternateFileName="AFV1UE~1.JPG")) returned 1 [0127.083] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x142d59c0, ftCreationTime.dwHighDateTime=0x1d8baab, ftLastAccessTime.dwLowDateTime=0x46738700, ftLastAccessTime.dwHighDateTime=0x1d8bcd2, ftLastWriteTime.dwLowDateTime=0x46738700, ftLastWriteTime.dwHighDateTime=0x1d8bcd2, nFileSizeHigh=0x0, nFileSizeLow=0x6d81, dwReserved0=0x0, dwReserved1=0x0, cFileName="hD6 t-A2anl.jpg", cAlternateFileName="HD6T-A~1.JPG")) returned 1 [0127.083] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91923c0, ftCreationTime.dwHighDateTime=0x1d8b7d1, ftLastAccessTime.dwLowDateTime=0xdb6f87c0, ftLastAccessTime.dwHighDateTime=0x1d8b988, ftLastWriteTime.dwLowDateTime=0xdb6f87c0, ftLastWriteTime.dwHighDateTime=0x1d8b988, nFileSizeHigh=0x0, nFileSizeLow=0x11147, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tq-PzJp1KCl6FsIt9az.jpg", cAlternateFileName="TQ-PZJ~1.JPG")) returned 1 [0127.083] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dab850, ftCreationTime.dwHighDateTime=0x1d8b19e, ftLastAccessTime.dwLowDateTime=0x502e9a0, ftLastAccessTime.dwHighDateTime=0x1d8b42b, ftLastWriteTime.dwLowDateTime=0x502e9a0, ftLastWriteTime.dwHighDateTime=0x1d8b42b, nFileSizeHigh=0x0, nFileSizeLow=0x930b, dwReserved0=0x0, dwReserved1=0x0, cFileName="TzuwSEu8vz6tC.gif", cAlternateFileName="TZUWSE~1.GIF")) returned 1 [0127.083] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa339ac00, ftCreationTime.dwHighDateTime=0x1d8bdac, ftLastAccessTime.dwLowDateTime=0x1f752410, ftLastAccessTime.dwHighDateTime=0x1d8c010, ftLastWriteTime.dwLowDateTime=0x1f752410, ftLastWriteTime.dwHighDateTime=0x1d8c010, nFileSizeHigh=0x0, nFileSizeLow=0x16309, dwReserved0=0x0, dwReserved1=0x0, cFileName="uG 0XjLM.jpg", cAlternateFileName="UG0XJL~1.JPG")) returned 1 [0127.084] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6042e080, ftCreationTime.dwHighDateTime=0x1d8c04d, ftLastAccessTime.dwLowDateTime=0xf7c50980, ftLastAccessTime.dwHighDateTime=0x1d8c07d, ftLastWriteTime.dwLowDateTime=0xf7c50980, ftLastWriteTime.dwHighDateTime=0x1d8c07d, nFileSizeHigh=0x0, nFileSizeLow=0x13cbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="xbnzj.bmp", cAlternateFileName="")) returned 1 [0127.084] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0127.084] FindClose (in: hFindFile=0x688d10 | out: hFindFile=0x688d10) returned 1 [0127.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0127.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eccc) returned 1 [0127.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed04) returned 1 [0127.084] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0127.084] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG", nBufferLength=0x3d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG", lpFilePart=0x0) returned 0x3c [0127.085] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\*"), lpFindFileData=0x19ea2c | out: lpFindFileData=0x19ea2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda3c2310, ftCreationTime.dwHighDateTime=0x1d8b823, ftLastAccessTime.dwLowDateTime=0xbf85fd50, ftLastAccessTime.dwHighDateTime=0x1d8bebf, ftLastWriteTime.dwLowDateTime=0xbf85fd50, ftLastWriteTime.dwHighDateTime=0x1d8bebf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688b10 [0127.085] FindNextFileW (in: hFindFile=0x688b10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda3c2310, ftCreationTime.dwHighDateTime=0x1d8b823, ftLastAccessTime.dwLowDateTime=0xbf85fd50, ftLastAccessTime.dwHighDateTime=0x1d8bebf, ftLastWriteTime.dwLowDateTime=0xbf85fd50, ftLastWriteTime.dwHighDateTime=0x1d8bebf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0127.085] FindNextFileW (in: hFindFile=0x688b10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf35128c0, ftCreationTime.dwHighDateTime=0x1d8ba97, ftLastAccessTime.dwLowDateTime=0xf21ca150, ftLastAccessTime.dwHighDateTime=0x1d8bb50, ftLastWriteTime.dwLowDateTime=0xf21ca150, ftLastWriteTime.dwHighDateTime=0x1d8bb50, nFileSizeHigh=0x0, nFileSizeLow=0xd413, dwReserved0=0x0, dwReserved1=0x0, cFileName="5EFkJZZxsJD.bmp", cAlternateFileName="5EFKJZ~1.BMP")) returned 1 [0127.085] FindNextFileW (in: hFindFile=0x688b10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7000070, ftCreationTime.dwHighDateTime=0x1d8b8e4, ftLastAccessTime.dwLowDateTime=0x8f721410, ftLastAccessTime.dwHighDateTime=0x1d8be32, ftLastWriteTime.dwLowDateTime=0x8f721410, ftLastWriteTime.dwHighDateTime=0x1d8be32, nFileSizeHigh=0x0, nFileSizeLow=0x7d3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="8MdVti1_bQ.bmp", cAlternateFileName="8MDVTI~1.BMP")) returned 1 [0127.086] FindNextFileW (in: hFindFile=0x688b10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb92f1c00, ftCreationTime.dwHighDateTime=0x1d8b679, ftLastAccessTime.dwLowDateTime=0x3f979d70, ftLastAccessTime.dwHighDateTime=0x1d8bfe0, ftLastWriteTime.dwLowDateTime=0x3f979d70, ftLastWriteTime.dwHighDateTime=0x1d8bfe0, nFileSizeHigh=0x0, nFileSizeLow=0x2146, dwReserved0=0x0, dwReserved1=0x0, cFileName="afV1uedQpAS.jpg", cAlternateFileName="AFV1UE~1.JPG")) returned 1 [0127.086] FindNextFileW (in: hFindFile=0x688b10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x142d59c0, ftCreationTime.dwHighDateTime=0x1d8baab, ftLastAccessTime.dwLowDateTime=0x46738700, ftLastAccessTime.dwHighDateTime=0x1d8bcd2, ftLastWriteTime.dwLowDateTime=0x46738700, ftLastWriteTime.dwHighDateTime=0x1d8bcd2, nFileSizeHigh=0x0, nFileSizeLow=0x6d81, dwReserved0=0x0, dwReserved1=0x0, cFileName="hD6 t-A2anl.jpg", cAlternateFileName="HD6T-A~1.JPG")) returned 1 [0127.086] FindNextFileW (in: hFindFile=0x688b10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91923c0, ftCreationTime.dwHighDateTime=0x1d8b7d1, ftLastAccessTime.dwLowDateTime=0xdb6f87c0, ftLastAccessTime.dwHighDateTime=0x1d8b988, ftLastWriteTime.dwLowDateTime=0xdb6f87c0, ftLastWriteTime.dwHighDateTime=0x1d8b988, nFileSizeHigh=0x0, nFileSizeLow=0x11147, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tq-PzJp1KCl6FsIt9az.jpg", cAlternateFileName="TQ-PZJ~1.JPG")) returned 1 [0127.086] FindNextFileW (in: hFindFile=0x688b10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dab850, ftCreationTime.dwHighDateTime=0x1d8b19e, ftLastAccessTime.dwLowDateTime=0x502e9a0, ftLastAccessTime.dwHighDateTime=0x1d8b42b, ftLastWriteTime.dwLowDateTime=0x502e9a0, ftLastWriteTime.dwHighDateTime=0x1d8b42b, nFileSizeHigh=0x0, nFileSizeLow=0x930b, dwReserved0=0x0, dwReserved1=0x0, cFileName="TzuwSEu8vz6tC.gif", cAlternateFileName="TZUWSE~1.GIF")) returned 1 [0127.086] FindNextFileW (in: hFindFile=0x688b10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa339ac00, ftCreationTime.dwHighDateTime=0x1d8bdac, ftLastAccessTime.dwLowDateTime=0x1f752410, ftLastAccessTime.dwHighDateTime=0x1d8c010, ftLastWriteTime.dwLowDateTime=0x1f752410, ftLastWriteTime.dwHighDateTime=0x1d8c010, nFileSizeHigh=0x0, nFileSizeLow=0x16309, dwReserved0=0x0, dwReserved1=0x0, cFileName="uG 0XjLM.jpg", cAlternateFileName="UG0XJL~1.JPG")) returned 1 [0127.087] FindNextFileW (in: hFindFile=0x688b10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6042e080, ftCreationTime.dwHighDateTime=0x1d8c04d, ftLastAccessTime.dwLowDateTime=0xf7c50980, ftLastAccessTime.dwHighDateTime=0x1d8c07d, ftLastWriteTime.dwLowDateTime=0xf7c50980, ftLastWriteTime.dwHighDateTime=0x1d8c07d, nFileSizeHigh=0x0, nFileSizeLow=0x13cbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="xbnzj.bmp", cAlternateFileName="")) returned 1 [0127.087] FindNextFileW (in: hFindFile=0x688b10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6042e080, ftCreationTime.dwHighDateTime=0x1d8c04d, ftLastAccessTime.dwLowDateTime=0xf7c50980, ftLastAccessTime.dwHighDateTime=0x1d8c07d, ftLastWriteTime.dwLowDateTime=0xf7c50980, ftLastWriteTime.dwHighDateTime=0x1d8c07d, nFileSizeHigh=0x0, nFileSizeLow=0x13cbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="xbnzj.bmp", cAlternateFileName="")) returned 0 [0127.087] FindClose (in: hFindFile=0x688b10 | out: hFindFile=0x688b10) returned 1 [0127.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0127.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eccc) returned 1 [0127.087] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\5EFkJZZxsJD.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0127.088] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\5EFkJZZxsJD.bmp", nBufferLength=0x4d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\5EFkJZZxsJD.bmp", lpFilePart=0x0) returned 0x4c [0127.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebb0) returned 1 [0127.088] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\5EFkJZZxsJD.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\5efkjzzxsjd.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0127.088] GetFileType (hFile=0x37c) returned 0x1 [0127.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebac) returned 1 [0127.088] GetFileType (hFile=0x37c) returned 0x1 [0127.088] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ecac | out: lpFileSizeHigh=0x19ecac*=0x0) returned 0xd413 [0127.088] ReadFile (in: hFile=0x37c, lpBuffer=0x248b0ac, nNumberOfBytesToRead=0xd413, lpNumberOfBytesRead=0x19ec58, lpOverlapped=0x0 | out: lpBuffer=0x248b0ac*, lpNumberOfBytesRead=0x19ec58*=0xd413, lpOverlapped=0x0) returned 1 [0127.089] CloseHandle (hObject=0x37c) returned 1 [0127.183] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0127.183] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0127.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0127.183] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19eca0 | out: lpFileInformation=0x19eca0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0127.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0127.183] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\5EFkJZZxsJD.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0127.183] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\5EFkJZZxsJD.bmp", nBufferLength=0x4d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\5EFkJZZxsJD.bmp", lpFilePart=0x0) returned 0x4c [0127.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb9c) returned 1 [0127.183] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\5EFkJZZxsJD.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\5efkjzzxsjd.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0127.188] GetFileType (hFile=0x37c) returned 0x1 [0127.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb98) returned 1 [0127.188] GetFileType (hFile=0x37c) returned 0x1 [0127.190] WriteFile (in: hFile=0x37c, lpBuffer=0x24ffb0c*, nNumberOfBytesToWrite=0xd420, lpNumberOfBytesWritten=0x19ec4c, lpOverlapped=0x0 | out: lpBuffer=0x24ffb0c*, lpNumberOfBytesWritten=0x19ec4c*=0xd420, lpOverlapped=0x0) returned 1 [0127.193] CloseHandle (hObject=0x37c) returned 1 [0127.196] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\5EFkJZZxsJD.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0127.196] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\5EFkJZZxsJD.bmp", nBufferLength=0x4d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\5EFkJZZxsJD.bmp", lpFilePart=0x0) returned 0x4c [0127.196] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\5EFkJZZxsJD.bmp.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0127.196] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\5EFkJZZxsJD.bmp.paradox", nBufferLength=0x55, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\5EFkJZZxsJD.bmp.paradox", lpFilePart=0x0) returned 0x54 [0127.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0127.196] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\5EFkJZZxsJD.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\5efkjzzxsjd.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ecac | out: lpFileInformation=0x19ecac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf35128c0, ftCreationTime.dwHighDateTime=0x1d8ba97, ftLastAccessTime.dwLowDateTime=0xf21ca150, ftLastAccessTime.dwHighDateTime=0x1d8bb50, ftLastWriteTime.dwLowDateTime=0xc3fc10a9, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xd420)) returned 1 [0127.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0127.196] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\5EFkJZZxsJD.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\5efkjzzxsjd.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\5EFkJZZxsJD.bmp.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\5efkjzzxsjd.bmp.paradox")) returned 1 [0127.197] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\8MdVti1_bQ.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4c [0127.197] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\8MdVti1_bQ.bmp", nBufferLength=0x4c, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\8MdVti1_bQ.bmp", lpFilePart=0x0) returned 0x4b [0127.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebb0) returned 1 [0127.198] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\8MdVti1_bQ.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\8mdvti1_bq.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0127.198] GetFileType (hFile=0x37c) returned 0x1 [0127.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebac) returned 1 [0127.198] GetFileType (hFile=0x37c) returned 0x1 [0127.198] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ecac | out: lpFileSizeHigh=0x19ecac*=0x0) returned 0x7d3b [0127.198] ReadFile (in: hFile=0x37c, lpBuffer=0x250d1f0, nNumberOfBytesToRead=0x7d3b, lpNumberOfBytesRead=0x19ec58, lpOverlapped=0x0 | out: lpBuffer=0x250d1f0*, lpNumberOfBytesRead=0x19ec58*=0x7d3b, lpOverlapped=0x0) returned 1 [0127.199] CloseHandle (hObject=0x37c) returned 1 [0127.229] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0127.229] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0127.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0127.230] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19eca0 | out: lpFileInformation=0x19eca0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0127.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0127.230] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\8MdVti1_bQ.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4c [0127.230] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\8MdVti1_bQ.bmp", nBufferLength=0x4c, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\8MdVti1_bQ.bmp", lpFilePart=0x0) returned 0x4b [0127.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb9c) returned 1 [0127.230] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\8MdVti1_bQ.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\8mdvti1_bq.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0127.232] GetFileType (hFile=0x37c) returned 0x1 [0127.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb98) returned 1 [0127.232] GetFileType (hFile=0x37c) returned 0x1 [0127.232] WriteFile (in: hFile=0x37c, lpBuffer=0x2374d50*, nNumberOfBytesToWrite=0x7d40, lpNumberOfBytesWritten=0x19ec4c, lpOverlapped=0x0 | out: lpBuffer=0x2374d50*, lpNumberOfBytesWritten=0x19ec4c*=0x7d40, lpOverlapped=0x0) returned 1 [0127.235] CloseHandle (hObject=0x37c) returned 1 [0127.241] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\8MdVti1_bQ.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4c [0127.241] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\8MdVti1_bQ.bmp", nBufferLength=0x4c, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\8MdVti1_bQ.bmp", lpFilePart=0x0) returned 0x4b [0127.241] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\8MdVti1_bQ.bmp.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0127.241] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\8MdVti1_bQ.bmp.paradox", nBufferLength=0x54, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\8MdVti1_bQ.bmp.paradox", lpFilePart=0x0) returned 0x53 [0127.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0127.241] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\8MdVti1_bQ.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\8mdvti1_bq.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ecac | out: lpFileInformation=0x19ecac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7000070, ftCreationTime.dwHighDateTime=0x1d8b8e4, ftLastAccessTime.dwLowDateTime=0x8f721410, ftLastAccessTime.dwHighDateTime=0x1d8be32, ftLastWriteTime.dwLowDateTime=0xc402e54f, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x7d40)) returned 1 [0127.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0127.241] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\8MdVti1_bQ.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\8mdvti1_bq.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\8MdVti1_bQ.bmp.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\8mdvti1_bq.bmp.paradox")) returned 1 [0127.242] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\afV1uedQpAS.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0127.243] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\afV1uedQpAS.jpg", nBufferLength=0x4d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\afV1uedQpAS.jpg", lpFilePart=0x0) returned 0x4c [0127.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebb0) returned 1 [0127.243] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\afV1uedQpAS.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\afv1uedqpas.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0127.243] GetFileType (hFile=0x37c) returned 0x1 [0127.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebac) returned 1 [0127.243] GetFileType (hFile=0x37c) returned 0x1 [0127.243] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ecac | out: lpFileSizeHigh=0x19ecac*=0x0) returned 0x2146 [0127.243] ReadFile (in: hFile=0x37c, lpBuffer=0x237cd50, nNumberOfBytesToRead=0x2146, lpNumberOfBytesRead=0x19ec58, lpOverlapped=0x0 | out: lpBuffer=0x237cd50*, lpNumberOfBytesRead=0x19ec58*=0x2146, lpOverlapped=0x0) returned 1 [0127.243] CloseHandle (hObject=0x37c) returned 1 [0127.342] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0127.347] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0127.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0127.347] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19eca0 | out: lpFileInformation=0x19eca0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0127.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0127.347] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\afV1uedQpAS.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0127.347] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\afV1uedQpAS.jpg", nBufferLength=0x4d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\afV1uedQpAS.jpg", lpFilePart=0x0) returned 0x4c [0127.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb9c) returned 1 [0127.348] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\afV1uedQpAS.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\afv1uedqpas.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0127.350] GetFileType (hFile=0x37c) returned 0x1 [0127.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb98) returned 1 [0127.350] GetFileType (hFile=0x37c) returned 0x1 [0127.350] WriteFile (in: hFile=0x37c, lpBuffer=0x23d4328*, nNumberOfBytesToWrite=0x2150, lpNumberOfBytesWritten=0x19ec4c, lpOverlapped=0x0 | out: lpBuffer=0x23d4328*, lpNumberOfBytesWritten=0x19ec4c*=0x2150, lpOverlapped=0x0) returned 1 [0127.352] CloseHandle (hObject=0x37c) returned 1 [0127.353] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\afV1uedQpAS.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0127.353] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\afV1uedQpAS.jpg", nBufferLength=0x4d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\afV1uedQpAS.jpg", lpFilePart=0x0) returned 0x4c [0127.353] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\afV1uedQpAS.jpg.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0127.354] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\afV1uedQpAS.jpg.paradox", nBufferLength=0x55, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\afV1uedQpAS.jpg.paradox", lpFilePart=0x0) returned 0x54 [0127.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0127.354] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\afV1uedQpAS.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\afv1uedqpas.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ecac | out: lpFileInformation=0x19ecac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb92f1c00, ftCreationTime.dwHighDateTime=0x1d8b679, ftLastAccessTime.dwLowDateTime=0x3f979d70, ftLastAccessTime.dwHighDateTime=0x1d8bfe0, ftLastWriteTime.dwLowDateTime=0xc4139965, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x2150)) returned 1 [0127.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0127.354] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\afV1uedQpAS.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\afv1uedqpas.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\afV1uedQpAS.jpg.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\afv1uedqpas.jpg.paradox")) returned 1 [0127.371] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\hD6 t-A2anl.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0127.371] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\hD6 t-A2anl.jpg", nBufferLength=0x4d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\hD6 t-A2anl.jpg", lpFilePart=0x0) returned 0x4c [0127.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebb0) returned 1 [0127.371] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\hD6 t-A2anl.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\hd6 t-a2anl.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0127.371] GetFileType (hFile=0x37c) returned 0x1 [0127.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebac) returned 1 [0127.371] GetFileType (hFile=0x37c) returned 0x1 [0127.371] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ecac | out: lpFileSizeHigh=0x19ecac*=0x0) returned 0x6d81 [0127.372] ReadFile (in: hFile=0x37c, lpBuffer=0x23d673c, nNumberOfBytesToRead=0x6d81, lpNumberOfBytesRead=0x19ec58, lpOverlapped=0x0 | out: lpBuffer=0x23d673c*, lpNumberOfBytesRead=0x19ec58*=0x6d81, lpOverlapped=0x0) returned 1 [0127.372] CloseHandle (hObject=0x37c) returned 1 [0127.404] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0127.404] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0127.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0127.404] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19eca0 | out: lpFileInformation=0x19eca0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0127.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0127.405] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\hD6 t-A2anl.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0127.405] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\hD6 t-A2anl.jpg", nBufferLength=0x4d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\hD6 t-A2anl.jpg", lpFilePart=0x0) returned 0x4c [0127.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb9c) returned 1 [0127.405] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\hD6 t-A2anl.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\hd6 t-a2anl.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0127.408] GetFileType (hFile=0x37c) returned 0x1 [0127.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb98) returned 1 [0127.408] GetFileType (hFile=0x37c) returned 0x1 [0127.408] WriteFile (in: hFile=0x37c, lpBuffer=0x24458f8*, nNumberOfBytesToWrite=0x6d90, lpNumberOfBytesWritten=0x19ec4c, lpOverlapped=0x0 | out: lpBuffer=0x24458f8*, lpNumberOfBytesWritten=0x19ec4c*=0x6d90, lpOverlapped=0x0) returned 1 [0127.410] CloseHandle (hObject=0x37c) returned 1 [0127.412] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\hD6 t-A2anl.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0127.412] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\hD6 t-A2anl.jpg", nBufferLength=0x4d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\hD6 t-A2anl.jpg", lpFilePart=0x0) returned 0x4c [0127.412] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\hD6 t-A2anl.jpg.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0127.412] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\hD6 t-A2anl.jpg.paradox", nBufferLength=0x55, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\hD6 t-A2anl.jpg.paradox", lpFilePart=0x0) returned 0x54 [0127.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0127.413] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\hD6 t-A2anl.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\hd6 t-a2anl.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ecac | out: lpFileInformation=0x19ecac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x142d59c0, ftCreationTime.dwHighDateTime=0x1d8baab, ftLastAccessTime.dwLowDateTime=0x46738700, ftLastAccessTime.dwHighDateTime=0x1d8bcd2, ftLastWriteTime.dwLowDateTime=0xc41d1efa, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x6d90)) returned 1 [0127.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0127.413] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\hD6 t-A2anl.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\hd6 t-a2anl.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\hD6 t-A2anl.jpg.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\hd6 t-a2anl.jpg.paradox")) returned 1 [0127.414] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\Tq-PzJp1KCl6FsIt9az.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0127.414] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\Tq-PzJp1KCl6FsIt9az.jpg", nBufferLength=0x55, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\Tq-PzJp1KCl6FsIt9az.jpg", lpFilePart=0x0) returned 0x54 [0127.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebb0) returned 1 [0127.414] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\Tq-PzJp1KCl6FsIt9az.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\tq-pzjp1kcl6fsit9az.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0127.414] GetFileType (hFile=0x37c) returned 0x1 [0127.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebac) returned 1 [0127.415] GetFileType (hFile=0x37c) returned 0x1 [0127.415] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ecac | out: lpFileSizeHigh=0x19ecac*=0x0) returned 0x11147 [0127.415] ReadFile (in: hFile=0x37c, lpBuffer=0x244c95c, nNumberOfBytesToRead=0x11147, lpNumberOfBytesRead=0x19ec58, lpOverlapped=0x0 | out: lpBuffer=0x244c95c*, lpNumberOfBytesRead=0x19ec58*=0x11147, lpOverlapped=0x0) returned 1 [0127.415] CloseHandle (hObject=0x37c) returned 1 [0127.462] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0127.462] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0127.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0127.463] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19eca0 | out: lpFileInformation=0x19eca0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0127.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0127.463] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\Tq-PzJp1KCl6FsIt9az.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0127.463] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\Tq-PzJp1KCl6FsIt9az.jpg", nBufferLength=0x55, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\Tq-PzJp1KCl6FsIt9az.jpg", lpFilePart=0x0) returned 0x54 [0127.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb9c) returned 1 [0127.463] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\Tq-PzJp1KCl6FsIt9az.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\tq-pzjp1kcl6fsit9az.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0127.465] GetFileType (hFile=0x37c) returned 0x1 [0127.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb98) returned 1 [0127.465] GetFileType (hFile=0x37c) returned 0x1 [0127.465] WriteFile (in: hFile=0x37c, lpBuffer=0x24ccb4c*, nNumberOfBytesToWrite=0x11150, lpNumberOfBytesWritten=0x19ec4c, lpOverlapped=0x0 | out: lpBuffer=0x24ccb4c*, lpNumberOfBytesWritten=0x19ec4c*=0x11150, lpOverlapped=0x0) returned 1 [0127.470] CloseHandle (hObject=0x37c) returned 1 [0127.473] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\Tq-PzJp1KCl6FsIt9az.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0127.473] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\Tq-PzJp1KCl6FsIt9az.jpg", nBufferLength=0x55, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\Tq-PzJp1KCl6FsIt9az.jpg", lpFilePart=0x0) returned 0x54 [0127.473] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\Tq-PzJp1KCl6FsIt9az.jpg.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5d [0127.474] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\Tq-PzJp1KCl6FsIt9az.jpg.paradox", nBufferLength=0x5d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\Tq-PzJp1KCl6FsIt9az.jpg.paradox", lpFilePart=0x0) returned 0x5c [0127.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0127.474] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\Tq-PzJp1KCl6FsIt9az.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\tq-pzjp1kcl6fsit9az.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ecac | out: lpFileInformation=0x19ecac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91923c0, ftCreationTime.dwHighDateTime=0x1d8b7d1, ftLastAccessTime.dwLowDateTime=0xdb6f87c0, ftLastAccessTime.dwHighDateTime=0x1d8b988, ftLastWriteTime.dwLowDateTime=0xc426a8b5, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x11150)) returned 1 [0127.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0127.474] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\Tq-PzJp1KCl6FsIt9az.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\tq-pzjp1kcl6fsit9az.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\Tq-PzJp1KCl6FsIt9az.jpg.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\tq-pzjp1kcl6fsit9az.jpg.paradox")) returned 1 [0127.475] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\uG 0XjLM.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0127.475] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\uG 0XjLM.jpg", nBufferLength=0x4a, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\uG 0XjLM.jpg", lpFilePart=0x0) returned 0x49 [0127.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebb0) returned 1 [0127.475] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\uG 0XjLM.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\ug 0xjlm.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0127.476] GetFileType (hFile=0x37c) returned 0x1 [0127.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebac) returned 1 [0127.476] GetFileType (hFile=0x37c) returned 0x1 [0127.476] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ecac | out: lpFileSizeHigh=0x19ecac*=0x0) returned 0x16309 [0127.477] ReadFile (in: hFile=0x37c, lpBuffer=0x34c0b00, nNumberOfBytesToRead=0x16309, lpNumberOfBytesRead=0x19ec58, lpOverlapped=0x0 | out: lpBuffer=0x34c0b00*, lpNumberOfBytesRead=0x19ec58*=0x16309, lpOverlapped=0x0) returned 1 [0127.479] CloseHandle (hObject=0x37c) returned 1 [0127.614] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0127.614] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0127.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0127.614] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19eca0 | out: lpFileInformation=0x19eca0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0127.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0127.615] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\uG 0XjLM.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0127.615] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\uG 0XjLM.jpg", nBufferLength=0x4a, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\uG 0XjLM.jpg", lpFilePart=0x0) returned 0x49 [0127.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb9c) returned 1 [0127.615] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\uG 0XjLM.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\ug 0xjlm.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0127.617] GetFileType (hFile=0x37c) returned 0x1 [0127.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb98) returned 1 [0127.617] GetFileType (hFile=0x37c) returned 0x1 [0127.617] WriteFile (in: hFile=0x37c, lpBuffer=0x352fa88*, nNumberOfBytesToWrite=0x16310, lpNumberOfBytesWritten=0x19ec4c, lpOverlapped=0x0 | out: lpBuffer=0x352fa88*, lpNumberOfBytesWritten=0x19ec4c*=0x16310, lpOverlapped=0x0) returned 1 [0127.620] CloseHandle (hObject=0x37c) returned 1 [0127.626] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\uG 0XjLM.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0127.626] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\uG 0XjLM.jpg", nBufferLength=0x4a, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\uG 0XjLM.jpg", lpFilePart=0x0) returned 0x49 [0127.626] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\uG 0XjLM.jpg.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0127.626] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\uG 0XjLM.jpg.paradox", nBufferLength=0x52, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\uG 0XjLM.jpg.paradox", lpFilePart=0x0) returned 0x51 [0127.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0127.627] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\uG 0XjLM.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\ug 0xjlm.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ecac | out: lpFileInformation=0x19ecac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa339ac00, ftCreationTime.dwHighDateTime=0x1d8bdac, ftLastAccessTime.dwLowDateTime=0x1f752410, ftLastAccessTime.dwHighDateTime=0x1d8c010, ftLastWriteTime.dwLowDateTime=0xc43ea5b1, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x16310)) returned 1 [0127.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0127.627] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\uG 0XjLM.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\ug 0xjlm.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\uG 0XjLM.jpg.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\ug 0xjlm.jpg.paradox")) returned 1 [0127.628] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\xbnzj.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0127.628] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\xbnzj.bmp", nBufferLength=0x47, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\xbnzj.bmp", lpFilePart=0x0) returned 0x46 [0127.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebb0) returned 1 [0127.628] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\xbnzj.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\xbnzj.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0127.628] GetFileType (hFile=0x37c) returned 0x1 [0127.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebac) returned 1 [0127.628] GetFileType (hFile=0x37c) returned 0x1 [0127.628] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ecac | out: lpFileSizeHigh=0x19ecac*=0x0) returned 0x13cbe [0127.629] ReadFile (in: hFile=0x37c, lpBuffer=0x23232b8, nNumberOfBytesToRead=0x13cbe, lpNumberOfBytesRead=0x19ec58, lpOverlapped=0x0 | out: lpBuffer=0x23232b8*, lpNumberOfBytesRead=0x19ec58*=0x13cbe, lpOverlapped=0x0) returned 1 [0127.629] CloseHandle (hObject=0x37c) returned 1 [0127.649] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0127.649] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0127.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0127.650] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19eca0 | out: lpFileInformation=0x19eca0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0127.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0127.650] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\xbnzj.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0127.650] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\xbnzj.bmp", nBufferLength=0x47, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\xbnzj.bmp", lpFilePart=0x0) returned 0x46 [0127.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb9c) returned 1 [0127.650] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\xbnzj.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\xbnzj.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0127.651] GetFileType (hFile=0x37c) returned 0x1 [0127.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb98) returned 1 [0127.652] GetFileType (hFile=0x37c) returned 0x1 [0127.652] WriteFile (in: hFile=0x37c, lpBuffer=0x23ab854*, nNumberOfBytesToWrite=0x13cc0, lpNumberOfBytesWritten=0x19ec4c, lpOverlapped=0x0 | out: lpBuffer=0x23ab854*, lpNumberOfBytesWritten=0x19ec4c*=0x13cc0, lpOverlapped=0x0) returned 1 [0127.654] CloseHandle (hObject=0x37c) returned 1 [0127.657] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\xbnzj.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0127.657] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\xbnzj.bmp", nBufferLength=0x47, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\xbnzj.bmp", lpFilePart=0x0) returned 0x46 [0127.657] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\xbnzj.bmp.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0127.658] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\xbnzj.bmp.paradox", nBufferLength=0x4f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\xbnzj.bmp.paradox", lpFilePart=0x0) returned 0x4e [0127.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0127.658] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\xbnzj.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\xbnzj.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ecac | out: lpFileInformation=0x19ecac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6042e080, ftCreationTime.dwHighDateTime=0x1d8c04d, ftLastAccessTime.dwLowDateTime=0xf7c50980, ftLastAccessTime.dwHighDateTime=0x1d8c07d, ftLastWriteTime.dwLowDateTime=0xc44344a2, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x13cc0)) returned 1 [0127.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0127.658] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\xbnzj.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\xbnzj.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\AriYdsq9H1hLtWY2vHG\\xbnzj.bmp.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ariydsq9h1hltwy2vhg\\xbnzj.bmp.paradox")) returned 1 [0127.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed04) returned 1 [0127.659] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0127.659] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk", nBufferLength=0x32, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk", lpFilePart=0x0) returned 0x31 [0127.659] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\mehnk_kk\\*"), lpFindFileData=0x19ea2c | out: lpFindFileData=0x19ea2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9e1e8c0, ftCreationTime.dwHighDateTime=0x1d8b5c5, ftLastAccessTime.dwLowDateTime=0xb4df18f0, ftLastAccessTime.dwHighDateTime=0x1d8ba41, ftLastWriteTime.dwLowDateTime=0xb4df18f0, ftLastWriteTime.dwHighDateTime=0x1d8ba41, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688e50 [0127.659] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9e1e8c0, ftCreationTime.dwHighDateTime=0x1d8b5c5, ftLastAccessTime.dwLowDateTime=0xb4df18f0, ftLastAccessTime.dwHighDateTime=0x1d8ba41, ftLastWriteTime.dwLowDateTime=0xb4df18f0, ftLastWriteTime.dwHighDateTime=0x1d8ba41, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0127.659] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf552ee60, ftCreationTime.dwHighDateTime=0x1d8bd17, ftLastAccessTime.dwLowDateTime=0x464f1040, ftLastAccessTime.dwHighDateTime=0x1d8bf5d, ftLastWriteTime.dwLowDateTime=0x464f1040, ftLastWriteTime.dwHighDateTime=0x1d8bf5d, nFileSizeHigh=0x0, nFileSizeLow=0xd51d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BPMBU1cQ.gif", cAlternateFileName="")) returned 1 [0127.659] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78fa2960, ftCreationTime.dwHighDateTime=0x1d8bc6c, ftLastAccessTime.dwLowDateTime=0xd1a418a0, ftLastAccessTime.dwHighDateTime=0x1d8c126, ftLastWriteTime.dwLowDateTime=0xd1a418a0, ftLastWriteTime.dwHighDateTime=0x1d8c126, nFileSizeHigh=0x0, nFileSizeLow=0x17630, dwReserved0=0x0, dwReserved1=0x0, cFileName="g-JrStVI0xFW.bmp", cAlternateFileName="G-JRST~1.BMP")) returned 1 [0127.660] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc200ba90, ftCreationTime.dwHighDateTime=0x1d8b4a9, ftLastAccessTime.dwLowDateTime=0xb609dd80, ftLastAccessTime.dwHighDateTime=0x1d8bcd7, ftLastWriteTime.dwLowDateTime=0xb609dd80, ftLastWriteTime.dwHighDateTime=0x1d8bcd7, nFileSizeHigh=0x0, nFileSizeLow=0x2431, dwReserved0=0x0, dwReserved1=0x0, cFileName="opi06vAZKoAlH.gif", cAlternateFileName="OPI06V~1.GIF")) returned 1 [0127.660] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23fa6150, ftCreationTime.dwHighDateTime=0x1d8bcdf, ftLastAccessTime.dwLowDateTime=0x551e6860, ftLastAccessTime.dwHighDateTime=0x1d8bf98, ftLastWriteTime.dwLowDateTime=0x551e6860, ftLastWriteTime.dwHighDateTime=0x1d8bf98, nFileSizeHigh=0x0, nFileSizeLow=0x11b20, dwReserved0=0x0, dwReserved1=0x0, cFileName="otYR0bcDOHhVdwK.jpg", cAlternateFileName="OTYR0B~1.JPG")) returned 1 [0127.660] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x253bd180, ftCreationTime.dwHighDateTime=0x1d8b509, ftLastAccessTime.dwLowDateTime=0xac2a96c0, ftLastAccessTime.dwHighDateTime=0x1d8c0dc, ftLastWriteTime.dwLowDateTime=0xac2a96c0, ftLastWriteTime.dwHighDateTime=0x1d8c0dc, nFileSizeHigh=0x0, nFileSizeLow=0x1428b, dwReserved0=0x0, dwReserved1=0x0, cFileName="UHDX3YLANEuAlZ.gif", cAlternateFileName="UHDX3Y~1.GIF")) returned 1 [0127.660] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5bb16c0, ftCreationTime.dwHighDateTime=0x1d8b534, ftLastAccessTime.dwLowDateTime=0x7ff25500, ftLastAccessTime.dwHighDateTime=0x1d8ba44, ftLastWriteTime.dwLowDateTime=0x7ff25500, ftLastWriteTime.dwHighDateTime=0x1d8ba44, nFileSizeHigh=0x0, nFileSizeLow=0xb270, dwReserved0=0x0, dwReserved1=0x0, cFileName="VhaO6ty0ympGCIm7Uw.gif", cAlternateFileName="VHAO6T~1.GIF")) returned 1 [0127.660] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbceadf20, ftCreationTime.dwHighDateTime=0x1d8bb95, ftLastAccessTime.dwLowDateTime=0xaade7af0, ftLastAccessTime.dwHighDateTime=0x1d8bcfb, ftLastWriteTime.dwLowDateTime=0xaade7af0, ftLastWriteTime.dwHighDateTime=0x1d8bcfb, nFileSizeHigh=0x0, nFileSizeLow=0x1382f, dwReserved0=0x0, dwReserved1=0x0, cFileName="XzYboTZ.png", cAlternateFileName="")) returned 1 [0127.660] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0127.661] FindClose (in: hFindFile=0x688e50 | out: hFindFile=0x688e50) returned 1 [0127.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0127.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eccc) returned 1 [0127.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed04) returned 1 [0127.661] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0127.661] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk", nBufferLength=0x32, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk", lpFilePart=0x0) returned 0x31 [0127.661] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\mehnk_kk\\*"), lpFindFileData=0x19ea2c | out: lpFindFileData=0x19ea2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9e1e8c0, ftCreationTime.dwHighDateTime=0x1d8b5c5, ftLastAccessTime.dwLowDateTime=0xb4df18f0, ftLastAccessTime.dwHighDateTime=0x1d8ba41, ftLastWriteTime.dwLowDateTime=0xb4df18f0, ftLastWriteTime.dwHighDateTime=0x1d8ba41, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688d10 [0127.661] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9e1e8c0, ftCreationTime.dwHighDateTime=0x1d8b5c5, ftLastAccessTime.dwLowDateTime=0xb4df18f0, ftLastAccessTime.dwHighDateTime=0x1d8ba41, ftLastWriteTime.dwLowDateTime=0xb4df18f0, ftLastWriteTime.dwHighDateTime=0x1d8ba41, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0127.661] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf552ee60, ftCreationTime.dwHighDateTime=0x1d8bd17, ftLastAccessTime.dwLowDateTime=0x464f1040, ftLastAccessTime.dwHighDateTime=0x1d8bf5d, ftLastWriteTime.dwLowDateTime=0x464f1040, ftLastWriteTime.dwHighDateTime=0x1d8bf5d, nFileSizeHigh=0x0, nFileSizeLow=0xd51d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BPMBU1cQ.gif", cAlternateFileName="")) returned 1 [0127.662] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78fa2960, ftCreationTime.dwHighDateTime=0x1d8bc6c, ftLastAccessTime.dwLowDateTime=0xd1a418a0, ftLastAccessTime.dwHighDateTime=0x1d8c126, ftLastWriteTime.dwLowDateTime=0xd1a418a0, ftLastWriteTime.dwHighDateTime=0x1d8c126, nFileSizeHigh=0x0, nFileSizeLow=0x17630, dwReserved0=0x0, dwReserved1=0x0, cFileName="g-JrStVI0xFW.bmp", cAlternateFileName="G-JRST~1.BMP")) returned 1 [0127.662] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc200ba90, ftCreationTime.dwHighDateTime=0x1d8b4a9, ftLastAccessTime.dwLowDateTime=0xb609dd80, ftLastAccessTime.dwHighDateTime=0x1d8bcd7, ftLastWriteTime.dwLowDateTime=0xb609dd80, ftLastWriteTime.dwHighDateTime=0x1d8bcd7, nFileSizeHigh=0x0, nFileSizeLow=0x2431, dwReserved0=0x0, dwReserved1=0x0, cFileName="opi06vAZKoAlH.gif", cAlternateFileName="OPI06V~1.GIF")) returned 1 [0127.662] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23fa6150, ftCreationTime.dwHighDateTime=0x1d8bcdf, ftLastAccessTime.dwLowDateTime=0x551e6860, ftLastAccessTime.dwHighDateTime=0x1d8bf98, ftLastWriteTime.dwLowDateTime=0x551e6860, ftLastWriteTime.dwHighDateTime=0x1d8bf98, nFileSizeHigh=0x0, nFileSizeLow=0x11b20, dwReserved0=0x0, dwReserved1=0x0, cFileName="otYR0bcDOHhVdwK.jpg", cAlternateFileName="OTYR0B~1.JPG")) returned 1 [0127.662] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x253bd180, ftCreationTime.dwHighDateTime=0x1d8b509, ftLastAccessTime.dwLowDateTime=0xac2a96c0, ftLastAccessTime.dwHighDateTime=0x1d8c0dc, ftLastWriteTime.dwLowDateTime=0xac2a96c0, ftLastWriteTime.dwHighDateTime=0x1d8c0dc, nFileSizeHigh=0x0, nFileSizeLow=0x1428b, dwReserved0=0x0, dwReserved1=0x0, cFileName="UHDX3YLANEuAlZ.gif", cAlternateFileName="UHDX3Y~1.GIF")) returned 1 [0127.662] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5bb16c0, ftCreationTime.dwHighDateTime=0x1d8b534, ftLastAccessTime.dwLowDateTime=0x7ff25500, ftLastAccessTime.dwHighDateTime=0x1d8ba44, ftLastWriteTime.dwLowDateTime=0x7ff25500, ftLastWriteTime.dwHighDateTime=0x1d8ba44, nFileSizeHigh=0x0, nFileSizeLow=0xb270, dwReserved0=0x0, dwReserved1=0x0, cFileName="VhaO6ty0ympGCIm7Uw.gif", cAlternateFileName="VHAO6T~1.GIF")) returned 1 [0127.663] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbceadf20, ftCreationTime.dwHighDateTime=0x1d8bb95, ftLastAccessTime.dwLowDateTime=0xaade7af0, ftLastAccessTime.dwHighDateTime=0x1d8bcfb, ftLastWriteTime.dwLowDateTime=0xaade7af0, ftLastWriteTime.dwHighDateTime=0x1d8bcfb, nFileSizeHigh=0x0, nFileSizeLow=0x1382f, dwReserved0=0x0, dwReserved1=0x0, cFileName="XzYboTZ.png", cAlternateFileName="")) returned 1 [0127.663] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbceadf20, ftCreationTime.dwHighDateTime=0x1d8bb95, ftLastAccessTime.dwLowDateTime=0xaade7af0, ftLastAccessTime.dwHighDateTime=0x1d8bcfb, ftLastWriteTime.dwLowDateTime=0xaade7af0, ftLastWriteTime.dwHighDateTime=0x1d8bcfb, nFileSizeHigh=0x0, nFileSizeLow=0x1382f, dwReserved0=0x0, dwReserved1=0x0, cFileName="XzYboTZ.png", cAlternateFileName="")) returned 0 [0127.663] FindClose (in: hFindFile=0x688d10 | out: hFindFile=0x688d10) returned 1 [0127.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0127.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eccc) returned 1 [0127.663] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\g-JrStVI0xFW.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0127.663] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\g-JrStVI0xFW.bmp", nBufferLength=0x43, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\g-JrStVI0xFW.bmp", lpFilePart=0x0) returned 0x42 [0127.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebb0) returned 1 [0127.663] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\g-JrStVI0xFW.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\mehnk_kk\\g-jrstvi0xfw.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0127.663] GetFileType (hFile=0x37c) returned 0x1 [0127.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebac) returned 1 [0127.663] GetFileType (hFile=0x37c) returned 0x1 [0127.663] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ecac | out: lpFileSizeHigh=0x19ecac*=0x0) returned 0x17630 [0127.664] ReadFile (in: hFile=0x37c, lpBuffer=0x356d738, nNumberOfBytesToRead=0x17630, lpNumberOfBytesRead=0x19ec58, lpOverlapped=0x0 | out: lpBuffer=0x356d738*, lpNumberOfBytesRead=0x19ec58*=0x17630, lpOverlapped=0x0) returned 1 [0127.666] CloseHandle (hObject=0x37c) returned 1 [0127.694] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0127.695] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0127.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0127.695] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19eca0 | out: lpFileInformation=0x19eca0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0127.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0127.695] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\g-JrStVI0xFW.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0127.695] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\g-JrStVI0xFW.bmp", nBufferLength=0x43, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\g-JrStVI0xFW.bmp", lpFilePart=0x0) returned 0x42 [0127.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb9c) returned 1 [0127.695] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\g-JrStVI0xFW.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\mehnk_kk\\g-jrstvi0xfw.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0127.697] GetFileType (hFile=0x37c) returned 0x1 [0127.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb98) returned 1 [0127.697] GetFileType (hFile=0x37c) returned 0x1 [0127.697] WriteFile (in: hFile=0x37c, lpBuffer=0x35e26a8*, nNumberOfBytesToWrite=0x17640, lpNumberOfBytesWritten=0x19ec4c, lpOverlapped=0x0 | out: lpBuffer=0x35e26a8*, lpNumberOfBytesWritten=0x19ec4c*=0x17640, lpOverlapped=0x0) returned 1 [0127.700] CloseHandle (hObject=0x37c) returned 1 [0127.706] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\g-JrStVI0xFW.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0127.706] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\g-JrStVI0xFW.bmp", nBufferLength=0x43, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\g-JrStVI0xFW.bmp", lpFilePart=0x0) returned 0x42 [0127.706] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\g-JrStVI0xFW.bmp.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4b [0127.706] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\g-JrStVI0xFW.bmp.paradox", nBufferLength=0x4b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\g-JrStVI0xFW.bmp.paradox", lpFilePart=0x0) returned 0x4a [0127.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0127.706] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\g-JrStVI0xFW.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\mehnk_kk\\g-jrstvi0xfw.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ecac | out: lpFileInformation=0x19ecac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78fa2960, ftCreationTime.dwHighDateTime=0x1d8bc6c, ftLastAccessTime.dwLowDateTime=0xd1a418a0, ftLastAccessTime.dwHighDateTime=0x1d8c126, ftLastWriteTime.dwLowDateTime=0xc44ad80f, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x17640)) returned 1 [0127.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0127.707] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\g-JrStVI0xFW.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\mehnk_kk\\g-jrstvi0xfw.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\g-JrStVI0xFW.bmp.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\mehnk_kk\\g-jrstvi0xfw.bmp.paradox")) returned 1 [0127.708] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\otYR0bcDOHhVdwK.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0127.708] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\otYR0bcDOHhVdwK.jpg", nBufferLength=0x46, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\otYR0bcDOHhVdwK.jpg", lpFilePart=0x0) returned 0x45 [0127.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebb0) returned 1 [0127.708] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\otYR0bcDOHhVdwK.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\mehnk_kk\\otyr0bcdohhvdwk.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0127.709] GetFileType (hFile=0x37c) returned 0x1 [0127.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebac) returned 1 [0127.709] GetFileType (hFile=0x37c) returned 0x1 [0127.709] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ecac | out: lpFileSizeHigh=0x19ecac*=0x0) returned 0x11b20 [0127.709] ReadFile (in: hFile=0x37c, lpBuffer=0x240ecdc, nNumberOfBytesToRead=0x11b20, lpNumberOfBytesRead=0x19ec58, lpOverlapped=0x0 | out: lpBuffer=0x240ecdc*, lpNumberOfBytesRead=0x19ec58*=0x11b20, lpOverlapped=0x0) returned 1 [0127.710] CloseHandle (hObject=0x37c) returned 1 [0127.773] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0127.773] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0127.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0127.773] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19eca0 | out: lpFileInformation=0x19eca0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0127.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0127.773] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\otYR0bcDOHhVdwK.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0127.773] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\otYR0bcDOHhVdwK.jpg", nBufferLength=0x46, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\otYR0bcDOHhVdwK.jpg", lpFilePart=0x0) returned 0x45 [0127.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb9c) returned 1 [0127.773] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\otYR0bcDOHhVdwK.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\mehnk_kk\\otyr0bcdohhvdwk.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0127.775] GetFileType (hFile=0x37c) returned 0x1 [0127.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb98) returned 1 [0127.775] GetFileType (hFile=0x37c) returned 0x1 [0127.775] WriteFile (in: hFile=0x37c, lpBuffer=0x230ea38*, nNumberOfBytesToWrite=0x11b30, lpNumberOfBytesWritten=0x19ec4c, lpOverlapped=0x0 | out: lpBuffer=0x230ea38*, lpNumberOfBytesWritten=0x19ec4c*=0x11b30, lpOverlapped=0x0) returned 1 [0127.778] CloseHandle (hObject=0x37c) returned 1 [0127.784] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\otYR0bcDOHhVdwK.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0127.784] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\otYR0bcDOHhVdwK.jpg", nBufferLength=0x46, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\otYR0bcDOHhVdwK.jpg", lpFilePart=0x0) returned 0x45 [0127.784] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\otYR0bcDOHhVdwK.jpg.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0127.784] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\otYR0bcDOHhVdwK.jpg.paradox", nBufferLength=0x4e, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\otYR0bcDOHhVdwK.jpg.paradox", lpFilePart=0x0) returned 0x4d [0127.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0127.784] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\otYR0bcDOHhVdwK.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\mehnk_kk\\otyr0bcdohhvdwk.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ecac | out: lpFileInformation=0x19ecac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23fa6150, ftCreationTime.dwHighDateTime=0x1d8bcdf, ftLastAccessTime.dwLowDateTime=0x551e6860, ftLastAccessTime.dwHighDateTime=0x1d8bf98, ftLastWriteTime.dwLowDateTime=0xc4566c72, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x11b30)) returned 1 [0127.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0127.785] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\otYR0bcDOHhVdwK.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\mehnk_kk\\otyr0bcdohhvdwk.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\otYR0bcDOHhVdwK.jpg.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\mehnk_kk\\otyr0bcdohhvdwk.jpg.paradox")) returned 1 [0127.785] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\XzYboTZ.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0127.785] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\XzYboTZ.png", nBufferLength=0x3e, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\XzYboTZ.png", lpFilePart=0x0) returned 0x3d [0127.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebb0) returned 1 [0127.786] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\XzYboTZ.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\mehnk_kk\\xzybotz.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0127.786] GetFileType (hFile=0x37c) returned 0x1 [0127.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebac) returned 1 [0127.786] GetFileType (hFile=0x37c) returned 0x1 [0127.786] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ecac | out: lpFileSizeHigh=0x19ecac*=0x0) returned 0x1382f [0127.786] ReadFile (in: hFile=0x37c, lpBuffer=0x232084c, nNumberOfBytesToRead=0x1382f, lpNumberOfBytesRead=0x19ec58, lpOverlapped=0x0 | out: lpBuffer=0x232084c*, lpNumberOfBytesRead=0x19ec58*=0x1382f, lpOverlapped=0x0) returned 1 [0127.787] CloseHandle (hObject=0x37c) returned 1 [0127.956] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0127.956] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0127.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0127.957] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19eca0 | out: lpFileInformation=0x19eca0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0127.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0127.957] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\XzYboTZ.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0127.957] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\XzYboTZ.png", nBufferLength=0x3e, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\XzYboTZ.png", lpFilePart=0x0) returned 0x3d [0127.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb9c) returned 1 [0127.957] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\XzYboTZ.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\mehnk_kk\\xzybotz.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0127.959] GetFileType (hFile=0x37c) returned 0x1 [0127.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb98) returned 1 [0127.959] GetFileType (hFile=0x37c) returned 0x1 [0127.959] WriteFile (in: hFile=0x37c, lpBuffer=0x23a8038*, nNumberOfBytesToWrite=0x13830, lpNumberOfBytesWritten=0x19ec4c, lpOverlapped=0x0 | out: lpBuffer=0x23a8038*, lpNumberOfBytesWritten=0x19ec4c*=0x13830, lpOverlapped=0x0) returned 1 [0127.962] CloseHandle (hObject=0x37c) returned 1 [0127.966] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\XzYboTZ.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0127.966] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\XzYboTZ.png", nBufferLength=0x3e, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\XzYboTZ.png", lpFilePart=0x0) returned 0x3d [0127.966] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\XzYboTZ.png.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0127.966] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\XzYboTZ.png.paradox", nBufferLength=0x46, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\XzYboTZ.png.paradox", lpFilePart=0x0) returned 0x45 [0127.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0127.966] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\XzYboTZ.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\mehnk_kk\\xzybotz.png"), fInfoLevelId=0x0, lpFileInformation=0x19ecac | out: lpFileInformation=0x19ecac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbceadf20, ftCreationTime.dwHighDateTime=0x1d8bb95, ftLastAccessTime.dwLowDateTime=0xaade7af0, ftLastAccessTime.dwHighDateTime=0x1d8bcfb, ftLastWriteTime.dwLowDateTime=0xc470749f, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x13830)) returned 1 [0127.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0127.966] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\XzYboTZ.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\mehnk_kk\\xzybotz.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\MEHNk_Kk\\XzYboTZ.png.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\mehnk_kk\\xzybotz.png.paradox")) returned 1 [0127.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed04) returned 1 [0127.968] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0127.968] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4", nBufferLength=0x39, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4", lpFilePart=0x0) returned 0x38 [0127.968] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ooloeayy 74zgh4\\*"), lpFindFileData=0x19ea2c | out: lpFindFileData=0x19ea2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x189c630, ftCreationTime.dwHighDateTime=0x1d8bea4, ftLastAccessTime.dwLowDateTime=0x4d9d5130, ftLastAccessTime.dwHighDateTime=0x1d8c111, ftLastWriteTime.dwLowDateTime=0x4d9d5130, ftLastWriteTime.dwHighDateTime=0x1d8c111, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x689190 [0127.969] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x189c630, ftCreationTime.dwHighDateTime=0x1d8bea4, ftLastAccessTime.dwLowDateTime=0x4d9d5130, ftLastAccessTime.dwHighDateTime=0x1d8c111, ftLastWriteTime.dwLowDateTime=0x4d9d5130, ftLastWriteTime.dwHighDateTime=0x1d8c111, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0127.969] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77f9740, ftCreationTime.dwHighDateTime=0x1d8b1be, ftLastAccessTime.dwLowDateTime=0xbccea740, ftLastAccessTime.dwHighDateTime=0x1d8bf48, ftLastWriteTime.dwLowDateTime=0xbccea740, ftLastWriteTime.dwHighDateTime=0x1d8bf48, nFileSizeHigh=0x0, nFileSizeLow=0x113e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="0gPNtabbl3ZU6Tj.png", cAlternateFileName="0GPNTA~1.PNG")) returned 1 [0127.969] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbe34560, ftCreationTime.dwHighDateTime=0x1d8b5ea, ftLastAccessTime.dwLowDateTime=0xfab6f4a0, ftLastAccessTime.dwHighDateTime=0x1d8b7fe, ftLastWriteTime.dwLowDateTime=0xfab6f4a0, ftLastWriteTime.dwHighDateTime=0x1d8b7fe, nFileSizeHigh=0x0, nFileSizeLow=0x127fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="1Q19rG6lPi7qsUr.jpg", cAlternateFileName="1Q19RG~1.JPG")) returned 1 [0127.969] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c9d7840, ftCreationTime.dwHighDateTime=0x1d8bcc9, ftLastAccessTime.dwLowDateTime=0xec684540, ftLastAccessTime.dwHighDateTime=0x1d8be05, ftLastWriteTime.dwLowDateTime=0xec684540, ftLastWriteTime.dwHighDateTime=0x1d8be05, nFileSizeHigh=0x0, nFileSizeLow=0x139db, dwReserved0=0x0, dwReserved1=0x0, cFileName="On _Q970XJbNE6EtRfPN.bmp", cAlternateFileName="ON_Q97~1.BMP")) returned 1 [0127.970] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ee470b0, ftCreationTime.dwHighDateTime=0x1d8b65c, ftLastAccessTime.dwLowDateTime=0xf69c0f80, ftLastAccessTime.dwHighDateTime=0x1d8b94e, ftLastWriteTime.dwLowDateTime=0xf69c0f80, ftLastWriteTime.dwHighDateTime=0x1d8b94e, nFileSizeHigh=0x0, nFileSizeLow=0x3b21, dwReserved0=0x0, dwReserved1=0x0, cFileName="WQWnpehTBFCALVb.bmp", cAlternateFileName="WQWNPE~1.BMP")) returned 1 [0127.970] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0127.970] FindClose (in: hFindFile=0x689190 | out: hFindFile=0x689190) returned 1 [0127.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0127.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eccc) returned 1 [0127.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed04) returned 1 [0127.970] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0127.970] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4", nBufferLength=0x39, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4", lpFilePart=0x0) returned 0x38 [0127.970] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ooloeayy 74zgh4\\*"), lpFindFileData=0x19ea2c | out: lpFindFileData=0x19ea2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x189c630, ftCreationTime.dwHighDateTime=0x1d8bea4, ftLastAccessTime.dwLowDateTime=0x4d9d5130, ftLastAccessTime.dwHighDateTime=0x1d8c111, ftLastWriteTime.dwLowDateTime=0x4d9d5130, ftLastWriteTime.dwHighDateTime=0x1d8c111, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688f10 [0127.971] FindNextFileW (in: hFindFile=0x688f10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x189c630, ftCreationTime.dwHighDateTime=0x1d8bea4, ftLastAccessTime.dwLowDateTime=0x4d9d5130, ftLastAccessTime.dwHighDateTime=0x1d8c111, ftLastWriteTime.dwLowDateTime=0x4d9d5130, ftLastWriteTime.dwHighDateTime=0x1d8c111, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0127.971] FindNextFileW (in: hFindFile=0x688f10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77f9740, ftCreationTime.dwHighDateTime=0x1d8b1be, ftLastAccessTime.dwLowDateTime=0xbccea740, ftLastAccessTime.dwHighDateTime=0x1d8bf48, ftLastWriteTime.dwLowDateTime=0xbccea740, ftLastWriteTime.dwHighDateTime=0x1d8bf48, nFileSizeHigh=0x0, nFileSizeLow=0x113e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="0gPNtabbl3ZU6Tj.png", cAlternateFileName="0GPNTA~1.PNG")) returned 1 [0127.971] FindNextFileW (in: hFindFile=0x688f10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbe34560, ftCreationTime.dwHighDateTime=0x1d8b5ea, ftLastAccessTime.dwLowDateTime=0xfab6f4a0, ftLastAccessTime.dwHighDateTime=0x1d8b7fe, ftLastWriteTime.dwLowDateTime=0xfab6f4a0, ftLastWriteTime.dwHighDateTime=0x1d8b7fe, nFileSizeHigh=0x0, nFileSizeLow=0x127fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="1Q19rG6lPi7qsUr.jpg", cAlternateFileName="1Q19RG~1.JPG")) returned 1 [0127.972] FindNextFileW (in: hFindFile=0x688f10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c9d7840, ftCreationTime.dwHighDateTime=0x1d8bcc9, ftLastAccessTime.dwLowDateTime=0xec684540, ftLastAccessTime.dwHighDateTime=0x1d8be05, ftLastWriteTime.dwLowDateTime=0xec684540, ftLastWriteTime.dwHighDateTime=0x1d8be05, nFileSizeHigh=0x0, nFileSizeLow=0x139db, dwReserved0=0x0, dwReserved1=0x0, cFileName="On _Q970XJbNE6EtRfPN.bmp", cAlternateFileName="ON_Q97~1.BMP")) returned 1 [0127.972] FindNextFileW (in: hFindFile=0x688f10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ee470b0, ftCreationTime.dwHighDateTime=0x1d8b65c, ftLastAccessTime.dwLowDateTime=0xf69c0f80, ftLastAccessTime.dwHighDateTime=0x1d8b94e, ftLastWriteTime.dwLowDateTime=0xf69c0f80, ftLastWriteTime.dwHighDateTime=0x1d8b94e, nFileSizeHigh=0x0, nFileSizeLow=0x3b21, dwReserved0=0x0, dwReserved1=0x0, cFileName="WQWnpehTBFCALVb.bmp", cAlternateFileName="WQWNPE~1.BMP")) returned 1 [0127.972] FindNextFileW (in: hFindFile=0x688f10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ee470b0, ftCreationTime.dwHighDateTime=0x1d8b65c, ftLastAccessTime.dwLowDateTime=0xf69c0f80, ftLastAccessTime.dwHighDateTime=0x1d8b94e, ftLastWriteTime.dwLowDateTime=0xf69c0f80, ftLastWriteTime.dwHighDateTime=0x1d8b94e, nFileSizeHigh=0x0, nFileSizeLow=0x3b21, dwReserved0=0x0, dwReserved1=0x0, cFileName="WQWnpehTBFCALVb.bmp", cAlternateFileName="WQWNPE~1.BMP")) returned 0 [0127.972] FindClose (in: hFindFile=0x688f10 | out: hFindFile=0x688f10) returned 1 [0127.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0127.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eccc) returned 1 [0127.973] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\0gPNtabbl3ZU6Tj.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0127.973] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\0gPNtabbl3ZU6Tj.png", nBufferLength=0x4d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\0gPNtabbl3ZU6Tj.png", lpFilePart=0x0) returned 0x4c [0127.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebb0) returned 1 [0127.973] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\0gPNtabbl3ZU6Tj.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ooloeayy 74zgh4\\0gpntabbl3zu6tj.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0127.973] GetFileType (hFile=0x37c) returned 0x1 [0127.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebac) returned 1 [0127.973] GetFileType (hFile=0x37c) returned 0x1 [0127.973] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ecac | out: lpFileSizeHigh=0x19ecac*=0x0) returned 0x113e6 [0127.973] ReadFile (in: hFile=0x37c, lpBuffer=0x23bd858, nNumberOfBytesToRead=0x113e6, lpNumberOfBytesRead=0x19ec58, lpOverlapped=0x0 | out: lpBuffer=0x23bd858*, lpNumberOfBytesRead=0x19ec58*=0x113e6, lpOverlapped=0x0) returned 1 [0127.974] CloseHandle (hObject=0x37c) returned 1 [0128.007] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0128.007] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0128.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0128.007] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19eca0 | out: lpFileInformation=0x19eca0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0128.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0128.008] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\0gPNtabbl3ZU6Tj.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0128.008] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\0gPNtabbl3ZU6Tj.png", nBufferLength=0x4d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\0gPNtabbl3ZU6Tj.png", lpFilePart=0x0) returned 0x4c [0128.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb9c) returned 1 [0128.008] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\0gPNtabbl3ZU6Tj.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ooloeayy 74zgh4\\0gpntabbl3zu6tj.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0128.010] GetFileType (hFile=0x37c) returned 0x1 [0128.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb98) returned 1 [0128.010] GetFileType (hFile=0x37c) returned 0x1 [0128.010] WriteFile (in: hFile=0x37c, lpBuffer=0x243e228*, nNumberOfBytesToWrite=0x113f0, lpNumberOfBytesWritten=0x19ec4c, lpOverlapped=0x0 | out: lpBuffer=0x243e228*, lpNumberOfBytesWritten=0x19ec4c*=0x113f0, lpOverlapped=0x0) returned 1 [0128.012] CloseHandle (hObject=0x37c) returned 1 [0128.022] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\0gPNtabbl3ZU6Tj.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0128.022] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\0gPNtabbl3ZU6Tj.png", nBufferLength=0x4d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\0gPNtabbl3ZU6Tj.png", lpFilePart=0x0) returned 0x4c [0128.022] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\0gPNtabbl3ZU6Tj.png.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0128.022] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\0gPNtabbl3ZU6Tj.png.paradox", nBufferLength=0x55, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\0gPNtabbl3ZU6Tj.png.paradox", lpFilePart=0x0) returned 0x54 [0128.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0128.022] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\0gPNtabbl3ZU6Tj.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ooloeayy 74zgh4\\0gpntabbl3zu6tj.png"), fInfoLevelId=0x0, lpFileInformation=0x19ecac | out: lpFileInformation=0x19ecac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77f9740, ftCreationTime.dwHighDateTime=0x1d8b1be, ftLastAccessTime.dwLowDateTime=0xbccea740, ftLastAccessTime.dwHighDateTime=0x1d8bf48, ftLastWriteTime.dwLowDateTime=0xc479fdeb, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x113f0)) returned 1 [0128.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0128.022] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\0gPNtabbl3ZU6Tj.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ooloeayy 74zgh4\\0gpntabbl3zu6tj.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\0gPNtabbl3ZU6Tj.png.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ooloeayy 74zgh4\\0gpntabbl3zu6tj.png.paradox")) returned 1 [0128.023] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\1Q19rG6lPi7qsUr.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0128.023] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\1Q19rG6lPi7qsUr.jpg", nBufferLength=0x4d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\1Q19rG6lPi7qsUr.jpg", lpFilePart=0x0) returned 0x4c [0128.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebb0) returned 1 [0128.023] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\1Q19rG6lPi7qsUr.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ooloeayy 74zgh4\\1q19rg6lpi7qsur.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0128.024] GetFileType (hFile=0x37c) returned 0x1 [0128.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebac) returned 1 [0128.024] GetFileType (hFile=0x37c) returned 0x1 [0128.024] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ecac | out: lpFileSizeHigh=0x19ecac*=0x0) returned 0x127fe [0128.024] ReadFile (in: hFile=0x37c, lpBuffer=0x244f8ec, nNumberOfBytesToRead=0x127fe, lpNumberOfBytesRead=0x19ec58, lpOverlapped=0x0 | out: lpBuffer=0x244f8ec*, lpNumberOfBytesRead=0x19ec58*=0x127fe, lpOverlapped=0x0) returned 1 [0128.025] CloseHandle (hObject=0x37c) returned 1 [0128.088] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0128.088] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0128.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0128.088] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19eca0 | out: lpFileInformation=0x19eca0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0128.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0128.088] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\1Q19rG6lPi7qsUr.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0128.088] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\1Q19rG6lPi7qsUr.jpg", nBufferLength=0x4d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\1Q19rG6lPi7qsUr.jpg", lpFilePart=0x0) returned 0x4c [0128.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb9c) returned 1 [0128.088] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\1Q19rG6lPi7qsUr.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ooloeayy 74zgh4\\1q19rg6lpi7qsur.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0128.090] GetFileType (hFile=0x37c) returned 0x1 [0128.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb98) returned 1 [0128.090] GetFileType (hFile=0x37c) returned 0x1 [0128.091] WriteFile (in: hFile=0x37c, lpBuffer=0x24d3eec*, nNumberOfBytesToWrite=0x12800, lpNumberOfBytesWritten=0x19ec4c, lpOverlapped=0x0 | out: lpBuffer=0x24d3eec*, lpNumberOfBytesWritten=0x19ec4c*=0x12800, lpOverlapped=0x0) returned 1 [0128.093] CloseHandle (hObject=0x37c) returned 1 [0128.096] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\1Q19rG6lPi7qsUr.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0128.096] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\1Q19rG6lPi7qsUr.jpg", nBufferLength=0x4d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\1Q19rG6lPi7qsUr.jpg", lpFilePart=0x0) returned 0x4c [0128.096] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\1Q19rG6lPi7qsUr.jpg.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0128.097] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\1Q19rG6lPi7qsUr.jpg.paradox", nBufferLength=0x55, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\1Q19rG6lPi7qsUr.jpg.paradox", lpFilePart=0x0) returned 0x54 [0128.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0128.097] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\1Q19rG6lPi7qsUr.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ooloeayy 74zgh4\\1q19rg6lpi7qsur.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ecac | out: lpFileInformation=0x19ecac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbe34560, ftCreationTime.dwHighDateTime=0x1d8b5ea, ftLastAccessTime.dwLowDateTime=0xfab6f4a0, ftLastAccessTime.dwHighDateTime=0x1d8b7fe, ftLastWriteTime.dwLowDateTime=0xc4847f6c, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x12800)) returned 1 [0128.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0128.097] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\1Q19rG6lPi7qsUr.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ooloeayy 74zgh4\\1q19rg6lpi7qsur.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\1Q19rG6lPi7qsUr.jpg.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ooloeayy 74zgh4\\1q19rg6lpi7qsur.jpg.paradox")) returned 1 [0128.098] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\On _Q970XJbNE6EtRfPN.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0128.098] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\On _Q970XJbNE6EtRfPN.bmp", nBufferLength=0x52, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\On _Q970XJbNE6EtRfPN.bmp", lpFilePart=0x0) returned 0x51 [0128.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebb0) returned 1 [0128.098] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\On _Q970XJbNE6EtRfPN.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ooloeayy 74zgh4\\on _q970xjbne6etrfpn.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0128.099] GetFileType (hFile=0x37c) returned 0x1 [0128.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebac) returned 1 [0128.099] GetFileType (hFile=0x37c) returned 0x1 [0128.099] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ecac | out: lpFileSizeHigh=0x19ecac*=0x0) returned 0x139db [0128.099] ReadFile (in: hFile=0x37c, lpBuffer=0x24e69cc, nNumberOfBytesToRead=0x139db, lpNumberOfBytesRead=0x19ec58, lpOverlapped=0x0 | out: lpBuffer=0x24e69cc*, lpNumberOfBytesRead=0x19ec58*=0x139db, lpOverlapped=0x0) returned 1 [0128.100] CloseHandle (hObject=0x37c) returned 1 [0128.134] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0128.134] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0128.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0128.134] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19eca0 | out: lpFileInformation=0x19eca0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0128.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0128.134] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\On _Q970XJbNE6EtRfPN.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0128.134] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\On _Q970XJbNE6EtRfPN.bmp", nBufferLength=0x52, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\On _Q970XJbNE6EtRfPN.bmp", lpFilePart=0x0) returned 0x51 [0128.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb9c) returned 1 [0128.134] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\On _Q970XJbNE6EtRfPN.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ooloeayy 74zgh4\\on _q970xjbne6etrfpn.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0128.136] GetFileType (hFile=0x37c) returned 0x1 [0128.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb98) returned 1 [0128.137] GetFileType (hFile=0x37c) returned 0x1 [0128.137] WriteFile (in: hFile=0x37c, lpBuffer=0x256e56c*, nNumberOfBytesToWrite=0x139e0, lpNumberOfBytesWritten=0x19ec4c, lpOverlapped=0x0 | out: lpBuffer=0x256e56c*, lpNumberOfBytesWritten=0x19ec4c*=0x139e0, lpOverlapped=0x0) returned 1 [0128.139] CloseHandle (hObject=0x37c) returned 1 [0128.143] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\On _Q970XJbNE6EtRfPN.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0128.143] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\On _Q970XJbNE6EtRfPN.bmp", nBufferLength=0x52, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\On _Q970XJbNE6EtRfPN.bmp", lpFilePart=0x0) returned 0x51 [0128.143] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\On _Q970XJbNE6EtRfPN.bmp.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0128.143] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\On _Q970XJbNE6EtRfPN.bmp.paradox", nBufferLength=0x5a, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\On _Q970XJbNE6EtRfPN.bmp.paradox", lpFilePart=0x0) returned 0x59 [0128.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0128.143] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\On _Q970XJbNE6EtRfPN.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ooloeayy 74zgh4\\on _q970xjbne6etrfpn.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ecac | out: lpFileInformation=0x19ecac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c9d7840, ftCreationTime.dwHighDateTime=0x1d8bcc9, ftLastAccessTime.dwLowDateTime=0xec684540, ftLastAccessTime.dwHighDateTime=0x1d8be05, ftLastWriteTime.dwLowDateTime=0xc48bb394, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x139e0)) returned 1 [0128.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0128.143] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\On _Q970XJbNE6EtRfPN.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ooloeayy 74zgh4\\on _q970xjbne6etrfpn.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\On _Q970XJbNE6EtRfPN.bmp.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ooloeayy 74zgh4\\on _q970xjbne6etrfpn.bmp.paradox")) returned 1 [0128.144] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\WQWnpehTBFCALVb.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0128.145] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\WQWnpehTBFCALVb.bmp", nBufferLength=0x4d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\WQWnpehTBFCALVb.bmp", lpFilePart=0x0) returned 0x4c [0128.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebb0) returned 1 [0128.145] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\WQWnpehTBFCALVb.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ooloeayy 74zgh4\\wqwnpehtbfcalvb.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0128.145] GetFileType (hFile=0x37c) returned 0x1 [0128.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebac) returned 1 [0128.145] GetFileType (hFile=0x37c) returned 0x1 [0128.145] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ecac | out: lpFileSizeHigh=0x19ecac*=0x0) returned 0x3b21 [0128.146] ReadFile (in: hFile=0x37c, lpBuffer=0x2582234, nNumberOfBytesToRead=0x3b21, lpNumberOfBytesRead=0x19ec58, lpOverlapped=0x0 | out: lpBuffer=0x2582234*, lpNumberOfBytesRead=0x19ec58*=0x3b21, lpOverlapped=0x0) returned 1 [0128.146] CloseHandle (hObject=0x37c) returned 1 [0128.221] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0128.221] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0128.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0128.221] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19eca0 | out: lpFileInformation=0x19eca0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0128.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0128.221] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\WQWnpehTBFCALVb.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0128.221] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\WQWnpehTBFCALVb.bmp", nBufferLength=0x4d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\WQWnpehTBFCALVb.bmp", lpFilePart=0x0) returned 0x4c [0128.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb9c) returned 1 [0128.221] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\WQWnpehTBFCALVb.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ooloeayy 74zgh4\\wqwnpehtbfcalvb.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0128.222] GetFileType (hFile=0x37c) returned 0x1 [0128.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb98) returned 1 [0128.223] GetFileType (hFile=0x37c) returned 0x1 [0128.223] WriteFile (in: hFile=0x37c, lpBuffer=0x233bcd0*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x19ec4c, lpOverlapped=0x0 | out: lpBuffer=0x233bcd0*, lpNumberOfBytesWritten=0x19ec4c*=0x3b30, lpOverlapped=0x0) returned 1 [0128.224] CloseHandle (hObject=0x37c) returned 1 [0128.226] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\WQWnpehTBFCALVb.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0128.226] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\WQWnpehTBFCALVb.bmp", nBufferLength=0x4d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\WQWnpehTBFCALVb.bmp", lpFilePart=0x0) returned 0x4c [0128.226] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\WQWnpehTBFCALVb.bmp.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0128.226] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\WQWnpehTBFCALVb.bmp.paradox", nBufferLength=0x55, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\WQWnpehTBFCALVb.bmp.paradox", lpFilePart=0x0) returned 0x54 [0128.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0128.226] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\WQWnpehTBFCALVb.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ooloeayy 74zgh4\\wqwnpehtbfcalvb.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ecac | out: lpFileInformation=0x19ecac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ee470b0, ftCreationTime.dwHighDateTime=0x1d8b65c, ftLastAccessTime.dwLowDateTime=0xf69c0f80, ftLastAccessTime.dwHighDateTime=0x1d8b94e, ftLastWriteTime.dwLowDateTime=0xc499f9cf, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x3b30)) returned 1 [0128.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0128.226] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\WQWnpehTBFCALVb.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ooloeayy 74zgh4\\wqwnpehtbfcalvb.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gRG40lzkz\\OoloEAyY 74Zgh4\\WQWnpehTBFCALVb.bmp.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\grg40lzkz\\ooloeayy 74zgh4\\wqwnpehtbfcalvb.bmp.paradox")) returned 1 [0128.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed78) returned 1 [0128.227] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0128.227] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures", nBufferLength=0x2e, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures", lpFilePart=0x0) returned 0x2d [0128.227] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\saved pictures\\*"), lpFindFileData=0x19eaa0 | out: lpFindFileData=0x19eaa0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688c10 [0128.227] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.228] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0128.228] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0128.228] FindClose (in: hFindFile=0x688c10 | out: hFindFile=0x688c10) returned 1 [0128.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed34) returned 1 [0128.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed40) returned 1 [0128.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed78) returned 1 [0128.228] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0128.228] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures", nBufferLength=0x2e, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures", lpFilePart=0x0) returned 0x2d [0128.228] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\saved pictures\\*"), lpFindFileData=0x19eaa0 | out: lpFindFileData=0x19eaa0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x689290 [0128.229] FindNextFileW (in: hFindFile=0x689290, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.229] FindNextFileW (in: hFindFile=0x689290, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0128.229] FindNextFileW (in: hFindFile=0x689290, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0128.229] FindClose (in: hFindFile=0x689290 | out: hFindFile=0x689290) returned 1 [0128.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed34) returned 1 [0128.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed40) returned 1 [0128.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edec) returned 1 [0128.229] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1c [0128.229] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music", nBufferLength=0x1c, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music", lpFilePart=0x0) returned 0x1b [0128.229] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\*"), lpFindFileData=0x19eb14 | out: lpFindFileData=0x19eb14*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x723a1954, ftLastAccessTime.dwHighDateTime=0x1d8c12e, ftLastWriteTime.dwLowDateTime=0x723a1954, ftLastWriteTime.dwHighDateTime=0x1d8c12e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x689050 [0128.230] FindNextFileW (in: hFindFile=0x689050, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x723a1954, ftLastAccessTime.dwHighDateTime=0x1d8c12e, ftLastWriteTime.dwLowDateTime=0x723a1954, ftLastWriteTime.dwHighDateTime=0x1d8c12e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.230] FindNextFileW (in: hFindFile=0x689050, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9aa7e070, ftCreationTime.dwHighDateTime=0x1d8b6c7, ftLastAccessTime.dwLowDateTime=0x3bdd2770, ftLastAccessTime.dwHighDateTime=0x1d8b993, ftLastWriteTime.dwLowDateTime=0x3bdd2770, ftLastWriteTime.dwHighDateTime=0x1d8b993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7KmDfrDw", cAlternateFileName="")) returned 1 [0128.230] FindNextFileW (in: hFindFile=0x689050, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43649a85, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43649a85, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0128.230] FindNextFileW (in: hFindFile=0x689050, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52b215c0, ftCreationTime.dwHighDateTime=0x1d8b112, ftLastAccessTime.dwLowDateTime=0xfd81d7c0, ftLastAccessTime.dwHighDateTime=0x1d8bb5c, ftLastWriteTime.dwLowDateTime=0xfd81d7c0, ftLastWriteTime.dwHighDateTime=0x1d8bb5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOcciO2KhP5kfwX 2op", cAlternateFileName="LOCCIO~1")) returned 1 [0128.230] FindNextFileW (in: hFindFile=0x689050, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8d0c740, ftCreationTime.dwHighDateTime=0x1d8b377, ftLastAccessTime.dwLowDateTime=0x3269030, ftLastAccessTime.dwHighDateTime=0x1d8b536, ftLastWriteTime.dwLowDateTime=0x3269030, ftLastWriteTime.dwHighDateTime=0x1d8b536, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="mME0S.wav", cAlternateFileName="")) returned 1 [0128.231] FindNextFileW (in: hFindFile=0x689050, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x610a8ca0, ftCreationTime.dwHighDateTime=0x1d8b370, ftLastAccessTime.dwLowDateTime=0xa4ff18e0, ftLastAccessTime.dwHighDateTime=0x1d8bcdf, ftLastWriteTime.dwLowDateTime=0xa4ff18e0, ftLastWriteTime.dwHighDateTime=0x1d8bcdf, nFileSizeHigh=0x0, nFileSizeLow=0x28b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="TiGQ6KlN.m4a", cAlternateFileName="")) returned 1 [0128.231] FindNextFileW (in: hFindFile=0x689050, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe600b6e0, ftCreationTime.dwHighDateTime=0x1d8c09b, ftLastAccessTime.dwLowDateTime=0x6112f5f0, ftLastAccessTime.dwHighDateTime=0x1d8c0f6, ftLastWriteTime.dwLowDateTime=0x6112f5f0, ftLastWriteTime.dwHighDateTime=0x1d8c0f6, nFileSizeHigh=0x0, nFileSizeLow=0x5ffd, dwReserved0=0x0, dwReserved1=0x0, cFileName="_5Pa6GJR9B.m4a", cAlternateFileName="_5PA6G~1.M4A")) returned 1 [0128.231] FindNextFileW (in: hFindFile=0x689050, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0128.231] FindClose (in: hFindFile=0x689050 | out: hFindFile=0x689050) returned 1 [0128.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda8) returned 1 [0128.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb4) returned 1 [0128.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edec) returned 1 [0128.231] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1c [0128.231] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music", nBufferLength=0x1c, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music", lpFilePart=0x0) returned 0x1b [0128.232] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\*"), lpFindFileData=0x19eb14 | out: lpFindFileData=0x19eb14*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x723a1954, ftLastAccessTime.dwHighDateTime=0x1d8c12e, ftLastWriteTime.dwLowDateTime=0x723a1954, ftLastWriteTime.dwHighDateTime=0x1d8c12e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688e50 [0128.232] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x723a1954, ftLastAccessTime.dwHighDateTime=0x1d8c12e, ftLastWriteTime.dwLowDateTime=0x723a1954, ftLastWriteTime.dwHighDateTime=0x1d8c12e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.232] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9aa7e070, ftCreationTime.dwHighDateTime=0x1d8b6c7, ftLastAccessTime.dwLowDateTime=0x3bdd2770, ftLastAccessTime.dwHighDateTime=0x1d8b993, ftLastWriteTime.dwLowDateTime=0x3bdd2770, ftLastWriteTime.dwHighDateTime=0x1d8b993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7KmDfrDw", cAlternateFileName="")) returned 1 [0128.232] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43649a85, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43649a85, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0128.233] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52b215c0, ftCreationTime.dwHighDateTime=0x1d8b112, ftLastAccessTime.dwLowDateTime=0xfd81d7c0, ftLastAccessTime.dwHighDateTime=0x1d8bb5c, ftLastWriteTime.dwLowDateTime=0xfd81d7c0, ftLastWriteTime.dwHighDateTime=0x1d8bb5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOcciO2KhP5kfwX 2op", cAlternateFileName="LOCCIO~1")) returned 1 [0128.233] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8d0c740, ftCreationTime.dwHighDateTime=0x1d8b377, ftLastAccessTime.dwLowDateTime=0x3269030, ftLastAccessTime.dwHighDateTime=0x1d8b536, ftLastWriteTime.dwLowDateTime=0x3269030, ftLastWriteTime.dwHighDateTime=0x1d8b536, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="mME0S.wav", cAlternateFileName="")) returned 1 [0128.233] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x610a8ca0, ftCreationTime.dwHighDateTime=0x1d8b370, ftLastAccessTime.dwLowDateTime=0xa4ff18e0, ftLastAccessTime.dwHighDateTime=0x1d8bcdf, ftLastWriteTime.dwLowDateTime=0xa4ff18e0, ftLastWriteTime.dwHighDateTime=0x1d8bcdf, nFileSizeHigh=0x0, nFileSizeLow=0x28b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="TiGQ6KlN.m4a", cAlternateFileName="")) returned 1 [0128.233] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe600b6e0, ftCreationTime.dwHighDateTime=0x1d8c09b, ftLastAccessTime.dwLowDateTime=0x6112f5f0, ftLastAccessTime.dwHighDateTime=0x1d8c0f6, ftLastWriteTime.dwLowDateTime=0x6112f5f0, ftLastWriteTime.dwHighDateTime=0x1d8c0f6, nFileSizeHigh=0x0, nFileSizeLow=0x5ffd, dwReserved0=0x0, dwReserved1=0x0, cFileName="_5Pa6GJR9B.m4a", cAlternateFileName="_5PA6G~1.M4A")) returned 1 [0128.233] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe600b6e0, ftCreationTime.dwHighDateTime=0x1d8c09b, ftLastAccessTime.dwLowDateTime=0x6112f5f0, ftLastAccessTime.dwHighDateTime=0x1d8c0f6, ftLastWriteTime.dwLowDateTime=0x6112f5f0, ftLastWriteTime.dwHighDateTime=0x1d8c0f6, nFileSizeHigh=0x0, nFileSizeLow=0x5ffd, dwReserved0=0x0, dwReserved1=0x0, cFileName="_5Pa6GJR9B.m4a", cAlternateFileName="_5PA6G~1.M4A")) returned 0 [0128.233] FindClose (in: hFindFile=0x688e50 | out: hFindFile=0x688e50) returned 1 [0128.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda8) returned 1 [0128.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb4) returned 1 [0128.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed78) returned 1 [0128.234] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0128.234] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw", nBufferLength=0x25, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw", lpFilePart=0x0) returned 0x24 [0128.234] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\*"), lpFindFileData=0x19eaa0 | out: lpFindFileData=0x19eaa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9aa7e070, ftCreationTime.dwHighDateTime=0x1d8b6c7, ftLastAccessTime.dwLowDateTime=0x3bdd2770, ftLastAccessTime.dwHighDateTime=0x1d8b993, ftLastWriteTime.dwLowDateTime=0x3bdd2770, ftLastWriteTime.dwHighDateTime=0x1d8b993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688c10 [0128.234] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9aa7e070, ftCreationTime.dwHighDateTime=0x1d8b6c7, ftLastAccessTime.dwLowDateTime=0x3bdd2770, ftLastAccessTime.dwHighDateTime=0x1d8b993, ftLastWriteTime.dwLowDateTime=0x3bdd2770, ftLastWriteTime.dwHighDateTime=0x1d8b993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.234] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda759b50, ftCreationTime.dwHighDateTime=0x1d8bc91, ftLastAccessTime.dwLowDateTime=0xdfabaec0, ftLastAccessTime.dwHighDateTime=0x1d8bc91, ftLastWriteTime.dwLowDateTime=0xdfabaec0, ftLastWriteTime.dwHighDateTime=0x1d8bc91, nFileSizeHigh=0x0, nFileSizeLow=0x5dd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8uC8KGTO2.mp3", cAlternateFileName="8UC8KG~1.MP3")) returned 1 [0128.235] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda1f6430, ftCreationTime.dwHighDateTime=0x1d8b2fd, ftLastAccessTime.dwLowDateTime=0x9feefc70, ftLastAccessTime.dwHighDateTime=0x1d8bf2e, ftLastWriteTime.dwLowDateTime=0x9feefc70, ftLastWriteTime.dwHighDateTime=0x1d8bf2e, nFileSizeHigh=0x0, nFileSizeLow=0x88d, dwReserved0=0x0, dwReserved1=0x0, cFileName="jVtBof WtNrnU.m4a", cAlternateFileName="JVTBOF~1.M4A")) returned 1 [0128.235] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb25a150, ftCreationTime.dwHighDateTime=0x1d8bcce, ftLastAccessTime.dwLowDateTime=0x73a85f10, ftLastAccessTime.dwHighDateTime=0x1d8bf76, ftLastWriteTime.dwLowDateTime=0x73a85f10, ftLastWriteTime.dwHighDateTime=0x1d8bf76, nFileSizeHigh=0x0, nFileSizeLow=0x2ed7, dwReserved0=0x0, dwReserved1=0x0, cFileName="s0ULSN.wav", cAlternateFileName="")) returned 1 [0128.235] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b14a240, ftCreationTime.dwHighDateTime=0x1d8bb51, ftLastAccessTime.dwLowDateTime=0x3dfec420, ftLastAccessTime.dwHighDateTime=0x1d8bca2, ftLastWriteTime.dwLowDateTime=0x3dfec420, ftLastWriteTime.dwHighDateTime=0x1d8bca2, nFileSizeHigh=0x0, nFileSizeLow=0x55fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="S_688IBFbtNy-2TnWi8B.m4a", cAlternateFileName="S_688I~1.M4A")) returned 1 [0128.235] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd418f690, ftCreationTime.dwHighDateTime=0x1d8bbff, ftLastAccessTime.dwLowDateTime=0x247b7730, ftLastAccessTime.dwHighDateTime=0x1d8bf5b, ftLastWriteTime.dwLowDateTime=0x247b7730, ftLastWriteTime.dwHighDateTime=0x1d8bf5b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zJcxa5nxH", cAlternateFileName="ZJCXA5~1")) returned 1 [0128.235] FindNextFileW (in: hFindFile=0x688c10, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd418f690, ftCreationTime.dwHighDateTime=0x1d8bbff, ftLastAccessTime.dwLowDateTime=0x247b7730, ftLastAccessTime.dwHighDateTime=0x1d8bf5b, ftLastWriteTime.dwLowDateTime=0x247b7730, ftLastWriteTime.dwHighDateTime=0x1d8bf5b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zJcxa5nxH", cAlternateFileName="ZJCXA5~1")) returned 0 [0128.235] FindClose (in: hFindFile=0x688c10 | out: hFindFile=0x688c10) returned 1 [0128.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed34) returned 1 [0128.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed40) returned 1 [0128.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed78) returned 1 [0128.236] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0128.236] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw", nBufferLength=0x25, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw", lpFilePart=0x0) returned 0x24 [0128.236] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\*"), lpFindFileData=0x19eaa0 | out: lpFindFileData=0x19eaa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9aa7e070, ftCreationTime.dwHighDateTime=0x1d8b6c7, ftLastAccessTime.dwLowDateTime=0x3bdd2770, ftLastAccessTime.dwHighDateTime=0x1d8b993, ftLastWriteTime.dwLowDateTime=0x3bdd2770, ftLastWriteTime.dwHighDateTime=0x1d8b993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x689090 [0128.236] FindNextFileW (in: hFindFile=0x689090, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9aa7e070, ftCreationTime.dwHighDateTime=0x1d8b6c7, ftLastAccessTime.dwLowDateTime=0x3bdd2770, ftLastAccessTime.dwHighDateTime=0x1d8b993, ftLastWriteTime.dwLowDateTime=0x3bdd2770, ftLastWriteTime.dwHighDateTime=0x1d8b993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.236] FindNextFileW (in: hFindFile=0x689090, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda759b50, ftCreationTime.dwHighDateTime=0x1d8bc91, ftLastAccessTime.dwLowDateTime=0xdfabaec0, ftLastAccessTime.dwHighDateTime=0x1d8bc91, ftLastWriteTime.dwLowDateTime=0xdfabaec0, ftLastWriteTime.dwHighDateTime=0x1d8bc91, nFileSizeHigh=0x0, nFileSizeLow=0x5dd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8uC8KGTO2.mp3", cAlternateFileName="8UC8KG~1.MP3")) returned 1 [0128.237] FindNextFileW (in: hFindFile=0x689090, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda1f6430, ftCreationTime.dwHighDateTime=0x1d8b2fd, ftLastAccessTime.dwLowDateTime=0x9feefc70, ftLastAccessTime.dwHighDateTime=0x1d8bf2e, ftLastWriteTime.dwLowDateTime=0x9feefc70, ftLastWriteTime.dwHighDateTime=0x1d8bf2e, nFileSizeHigh=0x0, nFileSizeLow=0x88d, dwReserved0=0x0, dwReserved1=0x0, cFileName="jVtBof WtNrnU.m4a", cAlternateFileName="JVTBOF~1.M4A")) returned 1 [0128.237] FindNextFileW (in: hFindFile=0x689090, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb25a150, ftCreationTime.dwHighDateTime=0x1d8bcce, ftLastAccessTime.dwLowDateTime=0x73a85f10, ftLastAccessTime.dwHighDateTime=0x1d8bf76, ftLastWriteTime.dwLowDateTime=0x73a85f10, ftLastWriteTime.dwHighDateTime=0x1d8bf76, nFileSizeHigh=0x0, nFileSizeLow=0x2ed7, dwReserved0=0x0, dwReserved1=0x0, cFileName="s0ULSN.wav", cAlternateFileName="")) returned 1 [0128.237] FindNextFileW (in: hFindFile=0x689090, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b14a240, ftCreationTime.dwHighDateTime=0x1d8bb51, ftLastAccessTime.dwLowDateTime=0x3dfec420, ftLastAccessTime.dwHighDateTime=0x1d8bca2, ftLastWriteTime.dwLowDateTime=0x3dfec420, ftLastWriteTime.dwHighDateTime=0x1d8bca2, nFileSizeHigh=0x0, nFileSizeLow=0x55fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="S_688IBFbtNy-2TnWi8B.m4a", cAlternateFileName="S_688I~1.M4A")) returned 1 [0128.237] FindNextFileW (in: hFindFile=0x689090, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd418f690, ftCreationTime.dwHighDateTime=0x1d8bbff, ftLastAccessTime.dwLowDateTime=0x247b7730, ftLastAccessTime.dwHighDateTime=0x1d8bf5b, ftLastWriteTime.dwLowDateTime=0x247b7730, ftLastWriteTime.dwHighDateTime=0x1d8bf5b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zJcxa5nxH", cAlternateFileName="ZJCXA5~1")) returned 1 [0128.237] FindNextFileW (in: hFindFile=0x689090, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0128.238] FindClose (in: hFindFile=0x689090 | out: hFindFile=0x689090) returned 1 [0128.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed34) returned 1 [0128.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed40) returned 1 [0128.238] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\8uC8KGTO2.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0128.238] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\8uC8KGTO2.mp3", nBufferLength=0x33, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\8uC8KGTO2.mp3", lpFilePart=0x0) returned 0x32 [0128.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0128.238] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\8uC8KGTO2.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\8uc8kgto2.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0128.238] GetFileType (hFile=0x37c) returned 0x1 [0128.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0128.238] GetFileType (hFile=0x37c) returned 0x1 [0128.239] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed20 | out: lpFileSizeHigh=0x19ed20*=0x0) returned 0x5dd0 [0128.239] ReadFile (in: hFile=0x37c, lpBuffer=0x2343b68, nNumberOfBytesToRead=0x5dd0, lpNumberOfBytesRead=0x19eccc, lpOverlapped=0x0 | out: lpBuffer=0x2343b68*, lpNumberOfBytesRead=0x19eccc*=0x5dd0, lpOverlapped=0x0) returned 1 [0128.239] CloseHandle (hObject=0x37c) returned 1 [0128.329] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0128.329] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0128.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0128.329] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed14 | out: lpFileInformation=0x19ed14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0128.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0128.329] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\8uC8KGTO2.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0128.329] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\8uC8KGTO2.mp3", nBufferLength=0x33, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\8uC8KGTO2.mp3", lpFilePart=0x0) returned 0x32 [0128.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec10) returned 1 [0128.329] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\8uC8KGTO2.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\8uc8kgto2.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0128.331] GetFileType (hFile=0x37c) returned 0x1 [0128.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec0c) returned 1 [0128.331] GetFileType (hFile=0x37c) returned 0x1 [0128.331] WriteFile (in: hFile=0x37c, lpBuffer=0x23ae00c*, nNumberOfBytesToWrite=0x5de0, lpNumberOfBytesWritten=0x19ecc0, lpOverlapped=0x0 | out: lpBuffer=0x23ae00c*, lpNumberOfBytesWritten=0x19ecc0*=0x5de0, lpOverlapped=0x0) returned 1 [0128.333] CloseHandle (hObject=0x37c) returned 1 [0128.337] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\8uC8KGTO2.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0128.337] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\8uC8KGTO2.mp3", nBufferLength=0x33, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\8uC8KGTO2.mp3", lpFilePart=0x0) returned 0x32 [0128.337] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\8uC8KGTO2.mp3.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0128.337] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\8uC8KGTO2.mp3.paradox", nBufferLength=0x3b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\8uC8KGTO2.mp3.paradox", lpFilePart=0x0) returned 0x3a [0128.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eca4) returned 1 [0128.337] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\8uC8KGTO2.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\8uc8kgto2.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19ed20 | out: lpFileInformation=0x19ed20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda759b50, ftCreationTime.dwHighDateTime=0x1d8bc91, ftLastAccessTime.dwLowDateTime=0xdfabaec0, ftLastAccessTime.dwHighDateTime=0x1d8bc91, ftLastWriteTime.dwLowDateTime=0xc4aaa973, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x5de0)) returned 1 [0128.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eca0) returned 1 [0128.338] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\8uC8KGTO2.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\8uc8kgto2.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\8uC8KGTO2.mp3.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\8uc8kgto2.mp3.paradox")) returned 1 [0128.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed04) returned 1 [0128.339] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0128.339] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH", nBufferLength=0x2f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH", lpFilePart=0x0) returned 0x2e [0128.339] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\*"), lpFindFileData=0x19ea2c | out: lpFindFileData=0x19ea2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd418f690, ftCreationTime.dwHighDateTime=0x1d8bbff, ftLastAccessTime.dwLowDateTime=0x247b7730, ftLastAccessTime.dwHighDateTime=0x1d8bf5b, ftLastWriteTime.dwLowDateTime=0x247b7730, ftLastWriteTime.dwHighDateTime=0x1d8bf5b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688dd0 [0128.339] FindNextFileW (in: hFindFile=0x688dd0, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd418f690, ftCreationTime.dwHighDateTime=0x1d8bbff, ftLastAccessTime.dwLowDateTime=0x247b7730, ftLastAccessTime.dwHighDateTime=0x1d8bf5b, ftLastWriteTime.dwLowDateTime=0x247b7730, ftLastWriteTime.dwHighDateTime=0x1d8bf5b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.339] FindNextFileW (in: hFindFile=0x688dd0, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd42be700, ftCreationTime.dwHighDateTime=0x1d8b5d8, ftLastAccessTime.dwLowDateTime=0x61b5a880, ftLastAccessTime.dwHighDateTime=0x1d8b788, ftLastWriteTime.dwLowDateTime=0x61b5a880, ftLastWriteTime.dwHighDateTime=0x1d8b788, nFileSizeHigh=0x0, nFileSizeLow=0x14d02, dwReserved0=0x0, dwReserved1=0x0, cFileName="34K8hu-8.mp3", cAlternateFileName="")) returned 1 [0128.340] FindNextFileW (in: hFindFile=0x688dd0, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd94da230, ftCreationTime.dwHighDateTime=0x1d8b332, ftLastAccessTime.dwLowDateTime=0x373d3330, ftLastAccessTime.dwHighDateTime=0x1d8bda9, ftLastWriteTime.dwLowDateTime=0x373d3330, ftLastWriteTime.dwHighDateTime=0x1d8bda9, nFileSizeHigh=0x0, nFileSizeLow=0x8d70, dwReserved0=0x0, dwReserved1=0x0, cFileName="IAP12woj4crIPnJO.wav", cAlternateFileName="IAP12W~1.WAV")) returned 1 [0128.340] FindNextFileW (in: hFindFile=0x688dd0, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ca8b5d0, ftCreationTime.dwHighDateTime=0x1d8b25c, ftLastAccessTime.dwLowDateTime=0x60575960, ftLastAccessTime.dwHighDateTime=0x1d8b509, ftLastWriteTime.dwLowDateTime=0x60575960, ftLastWriteTime.dwHighDateTime=0x1d8b509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KbKeXzFPaOL6PVtTCqk", cAlternateFileName="KBKEXZ~1")) returned 1 [0128.340] FindNextFileW (in: hFindFile=0x688dd0, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1484ea0, ftCreationTime.dwHighDateTime=0x1d8b122, ftLastAccessTime.dwLowDateTime=0x15204c80, ftLastAccessTime.dwHighDateTime=0x1d8b74e, ftLastWriteTime.dwLowDateTime=0x15204c80, ftLastWriteTime.dwHighDateTime=0x1d8b74e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NB7uoxXXE8jGPi9mjkAl", cAlternateFileName="NB7UOX~1")) returned 1 [0128.340] FindNextFileW (in: hFindFile=0x688dd0, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc076d20, ftCreationTime.dwHighDateTime=0x1d8b935, ftLastAccessTime.dwLowDateTime=0x2242c080, ftLastAccessTime.dwHighDateTime=0x1d8bc82, ftLastWriteTime.dwLowDateTime=0x2242c080, ftLastWriteTime.dwHighDateTime=0x1d8bc82, nFileSizeHigh=0x0, nFileSizeLow=0x1307, dwReserved0=0x0, dwReserved1=0x0, cFileName="NvTI 7f.m4a", cAlternateFileName="NVTI7F~1.M4A")) returned 1 [0128.341] FindNextFileW (in: hFindFile=0x688dd0, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47f3e310, ftCreationTime.dwHighDateTime=0x1d8bc9e, ftLastAccessTime.dwLowDateTime=0xa9262970, ftLastAccessTime.dwHighDateTime=0x1d8c065, ftLastWriteTime.dwLowDateTime=0xa9262970, ftLastWriteTime.dwHighDateTime=0x1d8c065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="xow2-jtbjjD9", cAlternateFileName="XOW2-J~1")) returned 1 [0128.341] FindNextFileW (in: hFindFile=0x688dd0, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47f3e310, ftCreationTime.dwHighDateTime=0x1d8bc9e, ftLastAccessTime.dwLowDateTime=0xa9262970, ftLastAccessTime.dwHighDateTime=0x1d8c065, ftLastWriteTime.dwLowDateTime=0xa9262970, ftLastWriteTime.dwHighDateTime=0x1d8c065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="xow2-jtbjjD9", cAlternateFileName="XOW2-J~1")) returned 0 [0128.341] FindClose (in: hFindFile=0x688dd0 | out: hFindFile=0x688dd0) returned 1 [0128.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0128.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eccc) returned 1 [0128.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed04) returned 1 [0128.342] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0128.342] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH", nBufferLength=0x2f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH", lpFilePart=0x0) returned 0x2e [0128.342] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\*"), lpFindFileData=0x19ea2c | out: lpFindFileData=0x19ea2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd418f690, ftCreationTime.dwHighDateTime=0x1d8bbff, ftLastAccessTime.dwLowDateTime=0x247b7730, ftLastAccessTime.dwHighDateTime=0x1d8bf5b, ftLastWriteTime.dwLowDateTime=0x247b7730, ftLastWriteTime.dwHighDateTime=0x1d8bf5b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688dd0 [0128.342] FindNextFileW (in: hFindFile=0x688dd0, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd418f690, ftCreationTime.dwHighDateTime=0x1d8bbff, ftLastAccessTime.dwLowDateTime=0x247b7730, ftLastAccessTime.dwHighDateTime=0x1d8bf5b, ftLastWriteTime.dwLowDateTime=0x247b7730, ftLastWriteTime.dwHighDateTime=0x1d8bf5b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.343] FindNextFileW (in: hFindFile=0x688dd0, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd42be700, ftCreationTime.dwHighDateTime=0x1d8b5d8, ftLastAccessTime.dwLowDateTime=0x61b5a880, ftLastAccessTime.dwHighDateTime=0x1d8b788, ftLastWriteTime.dwLowDateTime=0x61b5a880, ftLastWriteTime.dwHighDateTime=0x1d8b788, nFileSizeHigh=0x0, nFileSizeLow=0x14d02, dwReserved0=0x0, dwReserved1=0x0, cFileName="34K8hu-8.mp3", cAlternateFileName="")) returned 1 [0128.343] FindNextFileW (in: hFindFile=0x688dd0, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd94da230, ftCreationTime.dwHighDateTime=0x1d8b332, ftLastAccessTime.dwLowDateTime=0x373d3330, ftLastAccessTime.dwHighDateTime=0x1d8bda9, ftLastWriteTime.dwLowDateTime=0x373d3330, ftLastWriteTime.dwHighDateTime=0x1d8bda9, nFileSizeHigh=0x0, nFileSizeLow=0x8d70, dwReserved0=0x0, dwReserved1=0x0, cFileName="IAP12woj4crIPnJO.wav", cAlternateFileName="IAP12W~1.WAV")) returned 1 [0128.343] FindNextFileW (in: hFindFile=0x688dd0, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ca8b5d0, ftCreationTime.dwHighDateTime=0x1d8b25c, ftLastAccessTime.dwLowDateTime=0x60575960, ftLastAccessTime.dwHighDateTime=0x1d8b509, ftLastWriteTime.dwLowDateTime=0x60575960, ftLastWriteTime.dwHighDateTime=0x1d8b509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KbKeXzFPaOL6PVtTCqk", cAlternateFileName="KBKEXZ~1")) returned 1 [0128.343] FindNextFileW (in: hFindFile=0x688dd0, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1484ea0, ftCreationTime.dwHighDateTime=0x1d8b122, ftLastAccessTime.dwLowDateTime=0x15204c80, ftLastAccessTime.dwHighDateTime=0x1d8b74e, ftLastWriteTime.dwLowDateTime=0x15204c80, ftLastWriteTime.dwHighDateTime=0x1d8b74e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NB7uoxXXE8jGPi9mjkAl", cAlternateFileName="NB7UOX~1")) returned 1 [0128.344] FindNextFileW (in: hFindFile=0x688dd0, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc076d20, ftCreationTime.dwHighDateTime=0x1d8b935, ftLastAccessTime.dwLowDateTime=0x2242c080, ftLastAccessTime.dwHighDateTime=0x1d8bc82, ftLastWriteTime.dwLowDateTime=0x2242c080, ftLastWriteTime.dwHighDateTime=0x1d8bc82, nFileSizeHigh=0x0, nFileSizeLow=0x1307, dwReserved0=0x0, dwReserved1=0x0, cFileName="NvTI 7f.m4a", cAlternateFileName="NVTI7F~1.M4A")) returned 1 [0128.344] FindNextFileW (in: hFindFile=0x688dd0, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47f3e310, ftCreationTime.dwHighDateTime=0x1d8bc9e, ftLastAccessTime.dwLowDateTime=0xa9262970, ftLastAccessTime.dwHighDateTime=0x1d8c065, ftLastWriteTime.dwLowDateTime=0xa9262970, ftLastWriteTime.dwHighDateTime=0x1d8c065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="xow2-jtbjjD9", cAlternateFileName="XOW2-J~1")) returned 1 [0128.344] FindNextFileW (in: hFindFile=0x688dd0, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0128.344] FindClose (in: hFindFile=0x688dd0 | out: hFindFile=0x688dd0) returned 1 [0128.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0128.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eccc) returned 1 [0128.345] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\34K8hu-8.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0128.345] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\34K8hu-8.mp3", nBufferLength=0x3c, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\34K8hu-8.mp3", lpFilePart=0x0) returned 0x3b [0128.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebb0) returned 1 [0128.345] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\34K8hu-8.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\34k8hu-8.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0128.345] GetFileType (hFile=0x37c) returned 0x1 [0128.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebac) returned 1 [0128.345] GetFileType (hFile=0x37c) returned 0x1 [0128.345] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ecac | out: lpFileSizeHigh=0x19ecac*=0x0) returned 0x14d02 [0128.346] ReadFile (in: hFile=0x37c, lpBuffer=0x33b2750, nNumberOfBytesToRead=0x14d02, lpNumberOfBytesRead=0x19ec58, lpOverlapped=0x0 | out: lpBuffer=0x33b2750*, lpNumberOfBytesRead=0x19ec58*=0x14d02, lpOverlapped=0x0) returned 1 [0128.347] CloseHandle (hObject=0x37c) returned 1 [0128.382] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0128.382] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0128.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0128.382] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19eca0 | out: lpFileInformation=0x19eca0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0128.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0128.383] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\34K8hu-8.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0128.383] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\34K8hu-8.mp3", nBufferLength=0x3c, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\34K8hu-8.mp3", lpFilePart=0x0) returned 0x3b [0128.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb9c) returned 1 [0128.383] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\34K8hu-8.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\34k8hu-8.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0128.384] GetFileType (hFile=0x37c) returned 0x1 [0128.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb98) returned 1 [0128.384] GetFileType (hFile=0x37c) returned 0x1 [0128.385] WriteFile (in: hFile=0x37c, lpBuffer=0x341a8d0*, nNumberOfBytesToWrite=0x14d10, lpNumberOfBytesWritten=0x19ec4c, lpOverlapped=0x0 | out: lpBuffer=0x341a8d0*, lpNumberOfBytesWritten=0x19ec4c*=0x14d10, lpOverlapped=0x0) returned 1 [0128.387] CloseHandle (hObject=0x37c) returned 1 [0128.390] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\34K8hu-8.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0128.390] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\34K8hu-8.mp3", nBufferLength=0x3c, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\34K8hu-8.mp3", lpFilePart=0x0) returned 0x3b [0128.390] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\34K8hu-8.mp3.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0128.390] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\34K8hu-8.mp3.paradox", nBufferLength=0x44, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\34K8hu-8.mp3.paradox", lpFilePart=0x0) returned 0x43 [0128.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0128.390] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\34K8hu-8.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\34k8hu-8.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19ecac | out: lpFileInformation=0x19ecac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd42be700, ftCreationTime.dwHighDateTime=0x1d8b5d8, ftLastAccessTime.dwLowDateTime=0x61b5a880, ftLastAccessTime.dwHighDateTime=0x1d8b788, ftLastWriteTime.dwLowDateTime=0xc4b1d001, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x14d10)) returned 1 [0128.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0128.391] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\34K8hu-8.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\34k8hu-8.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\34K8hu-8.mp3.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\34k8hu-8.mp3.paradox")) returned 1 [0128.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec90) returned 1 [0128.391] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\KbKeXzFPaOL6PVtTCqk", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0128.391] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\KbKeXzFPaOL6PVtTCqk", nBufferLength=0x43, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\KbKeXzFPaOL6PVtTCqk", lpFilePart=0x0) returned 0x42 [0128.392] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\KbKeXzFPaOL6PVtTCqk\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\kbkexzfpaol6pvttcqk\\*"), lpFindFileData=0x19e9b8 | out: lpFindFileData=0x19e9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ca8b5d0, ftCreationTime.dwHighDateTime=0x1d8b25c, ftLastAccessTime.dwLowDateTime=0x60575960, ftLastAccessTime.dwHighDateTime=0x1d8b509, ftLastWriteTime.dwLowDateTime=0x60575960, ftLastWriteTime.dwHighDateTime=0x1d8b509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688e50 [0128.392] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ca8b5d0, ftCreationTime.dwHighDateTime=0x1d8b25c, ftLastAccessTime.dwLowDateTime=0x60575960, ftLastAccessTime.dwHighDateTime=0x1d8b509, ftLastWriteTime.dwLowDateTime=0x60575960, ftLastWriteTime.dwHighDateTime=0x1d8b509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.392] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb52d9730, ftCreationTime.dwHighDateTime=0x1d8b327, ftLastAccessTime.dwLowDateTime=0xb97da4b0, ftLastAccessTime.dwHighDateTime=0x1d8b359, ftLastWriteTime.dwLowDateTime=0xb97da4b0, ftLastWriteTime.dwHighDateTime=0x1d8b359, nFileSizeHigh=0x0, nFileSizeLow=0x8233, dwReserved0=0x0, dwReserved1=0x0, cFileName="1SseotWVArY.m4a", cAlternateFileName="1SSEOT~1.M4A")) returned 1 [0128.392] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c10280, ftCreationTime.dwHighDateTime=0x1d8b15e, ftLastAccessTime.dwLowDateTime=0x46e37530, ftLastAccessTime.dwHighDateTime=0x1d8c117, ftLastWriteTime.dwLowDateTime=0x46e37530, ftLastWriteTime.dwHighDateTime=0x1d8c117, nFileSizeHigh=0x0, nFileSizeLow=0x19f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIHGIizt9V.mp3", cAlternateFileName="GIHGII~1.MP3")) returned 1 [0128.392] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0128.392] FindClose (in: hFindFile=0x688e50 | out: hFindFile=0x688e50) returned 1 [0128.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0128.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec58) returned 1 [0128.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec90) returned 1 [0128.393] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\KbKeXzFPaOL6PVtTCqk", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0128.393] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\KbKeXzFPaOL6PVtTCqk", nBufferLength=0x43, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\KbKeXzFPaOL6PVtTCqk", lpFilePart=0x0) returned 0x42 [0128.393] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\KbKeXzFPaOL6PVtTCqk\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\kbkexzfpaol6pvttcqk\\*"), lpFindFileData=0x19e9b8 | out: lpFindFileData=0x19e9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ca8b5d0, ftCreationTime.dwHighDateTime=0x1d8b25c, ftLastAccessTime.dwLowDateTime=0x60575960, ftLastAccessTime.dwHighDateTime=0x1d8b509, ftLastWriteTime.dwLowDateTime=0x60575960, ftLastWriteTime.dwHighDateTime=0x1d8b509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688dd0 [0128.393] FindNextFileW (in: hFindFile=0x688dd0, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ca8b5d0, ftCreationTime.dwHighDateTime=0x1d8b25c, ftLastAccessTime.dwLowDateTime=0x60575960, ftLastAccessTime.dwHighDateTime=0x1d8b509, ftLastWriteTime.dwLowDateTime=0x60575960, ftLastWriteTime.dwHighDateTime=0x1d8b509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.393] FindNextFileW (in: hFindFile=0x688dd0, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb52d9730, ftCreationTime.dwHighDateTime=0x1d8b327, ftLastAccessTime.dwLowDateTime=0xb97da4b0, ftLastAccessTime.dwHighDateTime=0x1d8b359, ftLastWriteTime.dwLowDateTime=0xb97da4b0, ftLastWriteTime.dwHighDateTime=0x1d8b359, nFileSizeHigh=0x0, nFileSizeLow=0x8233, dwReserved0=0x0, dwReserved1=0x0, cFileName="1SseotWVArY.m4a", cAlternateFileName="1SSEOT~1.M4A")) returned 1 [0128.394] FindNextFileW (in: hFindFile=0x688dd0, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c10280, ftCreationTime.dwHighDateTime=0x1d8b15e, ftLastAccessTime.dwLowDateTime=0x46e37530, ftLastAccessTime.dwHighDateTime=0x1d8c117, ftLastWriteTime.dwLowDateTime=0x46e37530, ftLastWriteTime.dwHighDateTime=0x1d8c117, nFileSizeHigh=0x0, nFileSizeLow=0x19f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIHGIizt9V.mp3", cAlternateFileName="GIHGII~1.MP3")) returned 1 [0128.394] FindNextFileW (in: hFindFile=0x688dd0, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c10280, ftCreationTime.dwHighDateTime=0x1d8b15e, ftLastAccessTime.dwLowDateTime=0x46e37530, ftLastAccessTime.dwHighDateTime=0x1d8c117, ftLastWriteTime.dwLowDateTime=0x46e37530, ftLastWriteTime.dwHighDateTime=0x1d8c117, nFileSizeHigh=0x0, nFileSizeLow=0x19f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIHGIizt9V.mp3", cAlternateFileName="GIHGII~1.MP3")) returned 0 [0128.394] FindClose (in: hFindFile=0x688dd0 | out: hFindFile=0x688dd0) returned 1 [0128.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0128.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec58) returned 1 [0128.394] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\KbKeXzFPaOL6PVtTCqk\\GIHGIizt9V.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0128.394] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\KbKeXzFPaOL6PVtTCqk\\GIHGIizt9V.mp3", nBufferLength=0x52, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\KbKeXzFPaOL6PVtTCqk\\GIHGIizt9V.mp3", lpFilePart=0x0) returned 0x51 [0128.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb3c) returned 1 [0128.394] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\KbKeXzFPaOL6PVtTCqk\\GIHGIizt9V.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\kbkexzfpaol6pvttcqk\\gihgiizt9v.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0128.394] GetFileType (hFile=0x37c) returned 0x1 [0128.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb38) returned 1 [0128.395] GetFileType (hFile=0x37c) returned 0x1 [0128.395] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ec38 | out: lpFileSizeHigh=0x19ec38*=0x0) returned 0x19f7 [0128.395] ReadFile (in: hFile=0x37c, lpBuffer=0x2404894, nNumberOfBytesToRead=0x19f7, lpNumberOfBytesRead=0x19ebe4, lpOverlapped=0x0 | out: lpBuffer=0x2404894*, lpNumberOfBytesRead=0x19ebe4*=0x19f7, lpOverlapped=0x0) returned 1 [0128.395] CloseHandle (hObject=0x37c) returned 1 [0128.410] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0128.410] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0128.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebb0) returned 1 [0128.411] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ec2c | out: lpFileInformation=0x19ec2c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0128.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebac) returned 1 [0128.412] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\KbKeXzFPaOL6PVtTCqk\\GIHGIizt9V.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0128.412] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\KbKeXzFPaOL6PVtTCqk\\GIHGIizt9V.mp3", nBufferLength=0x52, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\KbKeXzFPaOL6PVtTCqk\\GIHGIizt9V.mp3", lpFilePart=0x0) returned 0x51 [0128.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb28) returned 1 [0128.412] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\KbKeXzFPaOL6PVtTCqk\\GIHGIizt9V.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\kbkexzfpaol6pvttcqk\\gihgiizt9v.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0128.414] GetFileType (hFile=0x37c) returned 0x1 [0128.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb24) returned 1 [0128.414] GetFileType (hFile=0x37c) returned 0x1 [0128.414] WriteFile (in: hFile=0x37c, lpBuffer=0x2459880*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x19ebd8, lpOverlapped=0x0 | out: lpBuffer=0x2459880*, lpNumberOfBytesWritten=0x19ebd8*=0x1a00, lpOverlapped=0x0) returned 1 [0128.415] CloseHandle (hObject=0x37c) returned 1 [0128.416] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\KbKeXzFPaOL6PVtTCqk\\GIHGIizt9V.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0128.416] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\KbKeXzFPaOL6PVtTCqk\\GIHGIizt9V.mp3", nBufferLength=0x52, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\KbKeXzFPaOL6PVtTCqk\\GIHGIizt9V.mp3", lpFilePart=0x0) returned 0x51 [0128.416] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\KbKeXzFPaOL6PVtTCqk\\GIHGIizt9V.mp3.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0128.416] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\KbKeXzFPaOL6PVtTCqk\\GIHGIizt9V.mp3.paradox", nBufferLength=0x5a, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\KbKeXzFPaOL6PVtTCqk\\GIHGIizt9V.mp3.paradox", lpFilePart=0x0) returned 0x59 [0128.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0128.416] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\KbKeXzFPaOL6PVtTCqk\\GIHGIizt9V.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\kbkexzfpaol6pvttcqk\\gihgiizt9v.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19ec38 | out: lpFileInformation=0x19ec38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c10280, ftCreationTime.dwHighDateTime=0x1d8b15e, ftLastAccessTime.dwLowDateTime=0x46e37530, ftLastAccessTime.dwHighDateTime=0x1d8c117, ftLastWriteTime.dwLowDateTime=0xc4b69475, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x1a00)) returned 1 [0128.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0128.416] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\KbKeXzFPaOL6PVtTCqk\\GIHGIizt9V.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\kbkexzfpaol6pvttcqk\\gihgiizt9v.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\KbKeXzFPaOL6PVtTCqk\\GIHGIizt9V.mp3.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\kbkexzfpaol6pvttcqk\\gihgiizt9v.mp3.paradox")) returned 1 [0128.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec90) returned 1 [0128.417] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0128.417] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl", nBufferLength=0x44, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl", lpFilePart=0x0) returned 0x43 [0128.417] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\nb7uoxxxe8jgpi9mjkal\\*"), lpFindFileData=0x19e9b8 | out: lpFindFileData=0x19e9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1484ea0, ftCreationTime.dwHighDateTime=0x1d8b122, ftLastAccessTime.dwLowDateTime=0x15204c80, ftLastAccessTime.dwHighDateTime=0x1d8b74e, ftLastWriteTime.dwLowDateTime=0x15204c80, ftLastWriteTime.dwHighDateTime=0x1d8b74e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x689090 [0128.417] FindNextFileW (in: hFindFile=0x689090, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1484ea0, ftCreationTime.dwHighDateTime=0x1d8b122, ftLastAccessTime.dwLowDateTime=0x15204c80, ftLastAccessTime.dwHighDateTime=0x1d8b74e, ftLastWriteTime.dwLowDateTime=0x15204c80, ftLastWriteTime.dwHighDateTime=0x1d8b74e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.418] FindNextFileW (in: hFindFile=0x689090, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabc95b40, ftCreationTime.dwHighDateTime=0x1d8b136, ftLastAccessTime.dwLowDateTime=0x8ca1ed90, ftLastAccessTime.dwHighDateTime=0x1d8beb5, ftLastWriteTime.dwLowDateTime=0x8ca1ed90, ftLastWriteTime.dwHighDateTime=0x1d8beb5, nFileSizeHigh=0x0, nFileSizeLow=0x9724, dwReserved0=0x0, dwReserved1=0x0, cFileName="3Cu_VD7Q5R2mLdu_OS.wav", cAlternateFileName="3CU_VD~1.WAV")) returned 1 [0128.418] FindNextFileW (in: hFindFile=0x689090, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ff2a50, ftCreationTime.dwHighDateTime=0x1d8bc9e, ftLastAccessTime.dwLowDateTime=0x88a070e0, ftLastAccessTime.dwHighDateTime=0x1d8c0d6, ftLastWriteTime.dwLowDateTime=0x88a070e0, ftLastWriteTime.dwHighDateTime=0x1d8c0d6, nFileSizeHigh=0x0, nFileSizeLow=0x15f76, dwReserved0=0x0, dwReserved1=0x0, cFileName="BuigcJeTpJO.mp3", cAlternateFileName="BUIGCJ~1.MP3")) returned 1 [0128.418] FindNextFileW (in: hFindFile=0x689090, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab03850, ftCreationTime.dwHighDateTime=0x1d8b68e, ftLastAccessTime.dwLowDateTime=0x29631e10, ftLastAccessTime.dwHighDateTime=0x1d8b86c, ftLastWriteTime.dwLowDateTime=0x29631e10, ftLastWriteTime.dwHighDateTime=0x1d8b86c, nFileSizeHigh=0x0, nFileSizeLow=0xfdd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="KpnjbpIUiF0W.m4a", cAlternateFileName="KPNJBP~1.M4A")) returned 1 [0128.418] FindNextFileW (in: hFindFile=0x689090, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb56bb20, ftCreationTime.dwHighDateTime=0x1d8bb54, ftLastAccessTime.dwLowDateTime=0xc761eea0, ftLastAccessTime.dwHighDateTime=0x1d8bfcb, ftLastWriteTime.dwLowDateTime=0xc761eea0, ftLastWriteTime.dwHighDateTime=0x1d8bfcb, nFileSizeHigh=0x0, nFileSizeLow=0x4ea3, dwReserved0=0x0, dwReserved1=0x0, cFileName="kTMgOL.wav", cAlternateFileName="")) returned 1 [0128.418] FindNextFileW (in: hFindFile=0x689090, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x546d21a0, ftCreationTime.dwHighDateTime=0x1d8b493, ftLastAccessTime.dwLowDateTime=0x80944e90, ftLastAccessTime.dwHighDateTime=0x1d8bb3a, ftLastWriteTime.dwLowDateTime=0x80944e90, ftLastWriteTime.dwHighDateTime=0x1d8bb3a, nFileSizeHigh=0x0, nFileSizeLow=0xce04, dwReserved0=0x0, dwReserved1=0x0, cFileName="rn24CHm54i6g7xc2B.wav", cAlternateFileName="RN24CH~1.WAV")) returned 1 [0128.418] FindNextFileW (in: hFindFile=0x689090, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf46b8640, ftCreationTime.dwHighDateTime=0x1d8b3f0, ftLastAccessTime.dwLowDateTime=0x21801720, ftLastAccessTime.dwHighDateTime=0x1d8b50b, ftLastWriteTime.dwLowDateTime=0x21801720, ftLastWriteTime.dwHighDateTime=0x1d8b50b, nFileSizeHigh=0x0, nFileSizeLow=0xee35, dwReserved0=0x0, dwReserved1=0x0, cFileName="X-s1lcrQ8YRADHirKDU.mp3", cAlternateFileName="X-S1LC~1.MP3")) returned 1 [0128.419] FindNextFileW (in: hFindFile=0x689090, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0128.419] FindClose (in: hFindFile=0x689090 | out: hFindFile=0x689090) returned 1 [0128.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0128.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec58) returned 1 [0128.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec90) returned 1 [0128.419] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0128.419] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl", nBufferLength=0x44, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl", lpFilePart=0x0) returned 0x43 [0128.419] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\nb7uoxxxe8jgpi9mjkal\\*"), lpFindFileData=0x19e9b8 | out: lpFindFileData=0x19e9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1484ea0, ftCreationTime.dwHighDateTime=0x1d8b122, ftLastAccessTime.dwLowDateTime=0x15204c80, ftLastAccessTime.dwHighDateTime=0x1d8b74e, ftLastWriteTime.dwLowDateTime=0x15204c80, ftLastWriteTime.dwHighDateTime=0x1d8b74e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x689090 [0128.419] FindNextFileW (in: hFindFile=0x689090, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1484ea0, ftCreationTime.dwHighDateTime=0x1d8b122, ftLastAccessTime.dwLowDateTime=0x15204c80, ftLastAccessTime.dwHighDateTime=0x1d8b74e, ftLastWriteTime.dwLowDateTime=0x15204c80, ftLastWriteTime.dwHighDateTime=0x1d8b74e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.420] FindNextFileW (in: hFindFile=0x689090, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabc95b40, ftCreationTime.dwHighDateTime=0x1d8b136, ftLastAccessTime.dwLowDateTime=0x8ca1ed90, ftLastAccessTime.dwHighDateTime=0x1d8beb5, ftLastWriteTime.dwLowDateTime=0x8ca1ed90, ftLastWriteTime.dwHighDateTime=0x1d8beb5, nFileSizeHigh=0x0, nFileSizeLow=0x9724, dwReserved0=0x0, dwReserved1=0x0, cFileName="3Cu_VD7Q5R2mLdu_OS.wav", cAlternateFileName="3CU_VD~1.WAV")) returned 1 [0128.420] FindNextFileW (in: hFindFile=0x689090, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ff2a50, ftCreationTime.dwHighDateTime=0x1d8bc9e, ftLastAccessTime.dwLowDateTime=0x88a070e0, ftLastAccessTime.dwHighDateTime=0x1d8c0d6, ftLastWriteTime.dwLowDateTime=0x88a070e0, ftLastWriteTime.dwHighDateTime=0x1d8c0d6, nFileSizeHigh=0x0, nFileSizeLow=0x15f76, dwReserved0=0x0, dwReserved1=0x0, cFileName="BuigcJeTpJO.mp3", cAlternateFileName="BUIGCJ~1.MP3")) returned 1 [0128.420] FindNextFileW (in: hFindFile=0x689090, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ab03850, ftCreationTime.dwHighDateTime=0x1d8b68e, ftLastAccessTime.dwLowDateTime=0x29631e10, ftLastAccessTime.dwHighDateTime=0x1d8b86c, ftLastWriteTime.dwLowDateTime=0x29631e10, ftLastWriteTime.dwHighDateTime=0x1d8b86c, nFileSizeHigh=0x0, nFileSizeLow=0xfdd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="KpnjbpIUiF0W.m4a", cAlternateFileName="KPNJBP~1.M4A")) returned 1 [0128.420] FindNextFileW (in: hFindFile=0x689090, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb56bb20, ftCreationTime.dwHighDateTime=0x1d8bb54, ftLastAccessTime.dwLowDateTime=0xc761eea0, ftLastAccessTime.dwHighDateTime=0x1d8bfcb, ftLastWriteTime.dwLowDateTime=0xc761eea0, ftLastWriteTime.dwHighDateTime=0x1d8bfcb, nFileSizeHigh=0x0, nFileSizeLow=0x4ea3, dwReserved0=0x0, dwReserved1=0x0, cFileName="kTMgOL.wav", cAlternateFileName="")) returned 1 [0128.420] FindNextFileW (in: hFindFile=0x689090, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x546d21a0, ftCreationTime.dwHighDateTime=0x1d8b493, ftLastAccessTime.dwLowDateTime=0x80944e90, ftLastAccessTime.dwHighDateTime=0x1d8bb3a, ftLastWriteTime.dwLowDateTime=0x80944e90, ftLastWriteTime.dwHighDateTime=0x1d8bb3a, nFileSizeHigh=0x0, nFileSizeLow=0xce04, dwReserved0=0x0, dwReserved1=0x0, cFileName="rn24CHm54i6g7xc2B.wav", cAlternateFileName="RN24CH~1.WAV")) returned 1 [0128.421] FindNextFileW (in: hFindFile=0x689090, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf46b8640, ftCreationTime.dwHighDateTime=0x1d8b3f0, ftLastAccessTime.dwLowDateTime=0x21801720, ftLastAccessTime.dwHighDateTime=0x1d8b50b, ftLastWriteTime.dwLowDateTime=0x21801720, ftLastWriteTime.dwHighDateTime=0x1d8b50b, nFileSizeHigh=0x0, nFileSizeLow=0xee35, dwReserved0=0x0, dwReserved1=0x0, cFileName="X-s1lcrQ8YRADHirKDU.mp3", cAlternateFileName="X-S1LC~1.MP3")) returned 1 [0128.421] FindNextFileW (in: hFindFile=0x689090, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf46b8640, ftCreationTime.dwHighDateTime=0x1d8b3f0, ftLastAccessTime.dwLowDateTime=0x21801720, ftLastAccessTime.dwHighDateTime=0x1d8b50b, ftLastWriteTime.dwLowDateTime=0x21801720, ftLastWriteTime.dwHighDateTime=0x1d8b50b, nFileSizeHigh=0x0, nFileSizeLow=0xee35, dwReserved0=0x0, dwReserved1=0x0, cFileName="X-s1lcrQ8YRADHirKDU.mp3", cAlternateFileName="X-S1LC~1.MP3")) returned 0 [0128.421] FindClose (in: hFindFile=0x689090 | out: hFindFile=0x689090) returned 1 [0128.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0128.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec58) returned 1 [0128.421] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\BuigcJeTpJO.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0128.421] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\BuigcJeTpJO.mp3", nBufferLength=0x54, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\BuigcJeTpJO.mp3", lpFilePart=0x0) returned 0x53 [0128.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb3c) returned 1 [0128.421] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\BuigcJeTpJO.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\nb7uoxxxe8jgpi9mjkal\\buigcjetpjo.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0128.422] GetFileType (hFile=0x37c) returned 0x1 [0128.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb38) returned 1 [0128.423] GetFileType (hFile=0x37c) returned 0x1 [0128.423] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ec38 | out: lpFileSizeHigh=0x19ec38*=0x0) returned 0x15f76 [0128.423] ReadFile (in: hFile=0x37c, lpBuffer=0x342f600, nNumberOfBytesToRead=0x15f76, lpNumberOfBytesRead=0x19ebe4, lpOverlapped=0x0 | out: lpBuffer=0x342f600*, lpNumberOfBytesRead=0x19ebe4*=0x15f76, lpOverlapped=0x0) returned 1 [0128.425] CloseHandle (hObject=0x37c) returned 1 [0128.539] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0128.539] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0128.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebb0) returned 1 [0128.540] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ec2c | out: lpFileInformation=0x19ec2c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0128.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebac) returned 1 [0128.540] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\BuigcJeTpJO.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0128.540] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\BuigcJeTpJO.mp3", nBufferLength=0x54, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\BuigcJeTpJO.mp3", lpFilePart=0x0) returned 0x53 [0128.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb28) returned 1 [0128.540] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\BuigcJeTpJO.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\nb7uoxxxe8jgpi9mjkal\\buigcjetpjo.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0128.542] GetFileType (hFile=0x37c) returned 0x1 [0128.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb24) returned 1 [0128.542] GetFileType (hFile=0x37c) returned 0x1 [0128.542] WriteFile (in: hFile=0x37c, lpBuffer=0x349d3b8*, nNumberOfBytesToWrite=0x15f80, lpNumberOfBytesWritten=0x19ebd8, lpOverlapped=0x0 | out: lpBuffer=0x349d3b8*, lpNumberOfBytesWritten=0x19ebd8*=0x15f80, lpOverlapped=0x0) returned 1 [0128.545] CloseHandle (hObject=0x37c) returned 1 [0128.549] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\BuigcJeTpJO.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0128.549] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\BuigcJeTpJO.mp3", nBufferLength=0x54, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\BuigcJeTpJO.mp3", lpFilePart=0x0) returned 0x53 [0128.549] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\BuigcJeTpJO.mp3.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0128.549] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\BuigcJeTpJO.mp3.paradox", nBufferLength=0x5c, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\BuigcJeTpJO.mp3.paradox", lpFilePart=0x0) returned 0x5b [0128.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0128.549] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\BuigcJeTpJO.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\nb7uoxxxe8jgpi9mjkal\\buigcjetpjo.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19ec38 | out: lpFileInformation=0x19ec38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ff2a50, ftCreationTime.dwHighDateTime=0x1d8bc9e, ftLastAccessTime.dwLowDateTime=0x88a070e0, ftLastAccessTime.dwHighDateTime=0x1d8c0d6, ftLastWriteTime.dwLowDateTime=0xc4c9a7c3, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x15f80)) returned 1 [0128.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0128.550] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\BuigcJeTpJO.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\nb7uoxxxe8jgpi9mjkal\\buigcjetpjo.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\BuigcJeTpJO.mp3.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\nb7uoxxxe8jgpi9mjkal\\buigcjetpjo.mp3.paradox")) returned 1 [0128.551] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\X-s1lcrQ8YRADHirKDU.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0128.551] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\X-s1lcrQ8YRADHirKDU.mp3", nBufferLength=0x5c, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\X-s1lcrQ8YRADHirKDU.mp3", lpFilePart=0x0) returned 0x5b [0128.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb3c) returned 1 [0128.551] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\X-s1lcrQ8YRADHirKDU.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\nb7uoxxxe8jgpi9mjkal\\x-s1lcrq8yradhirkdu.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0128.551] GetFileType (hFile=0x37c) returned 0x1 [0128.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb38) returned 1 [0128.554] GetFileType (hFile=0x37c) returned 0x1 [0128.554] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ec38 | out: lpFileSizeHigh=0x19ec38*=0x0) returned 0xee35 [0128.554] ReadFile (in: hFile=0x37c, lpBuffer=0x24aae24, nNumberOfBytesToRead=0xee35, lpNumberOfBytesRead=0x19ebe4, lpOverlapped=0x0 | out: lpBuffer=0x24aae24*, lpNumberOfBytesRead=0x19ebe4*=0xee35, lpOverlapped=0x0) returned 1 [0128.555] CloseHandle (hObject=0x37c) returned 1 [0128.594] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0128.594] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0128.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebb0) returned 1 [0128.595] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ec2c | out: lpFileInformation=0x19ec2c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0128.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebac) returned 1 [0128.595] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\X-s1lcrQ8YRADHirKDU.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0128.595] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\X-s1lcrQ8YRADHirKDU.mp3", nBufferLength=0x5c, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\X-s1lcrQ8YRADHirKDU.mp3", lpFilePart=0x0) returned 0x5b [0128.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb28) returned 1 [0128.595] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\X-s1lcrQ8YRADHirKDU.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\nb7uoxxxe8jgpi9mjkal\\x-s1lcrq8yradhirkdu.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0128.597] GetFileType (hFile=0x37c) returned 0x1 [0128.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb24) returned 1 [0128.597] GetFileType (hFile=0x37c) returned 0x1 [0128.597] WriteFile (in: hFile=0x37c, lpBuffer=0x233d12c*, nNumberOfBytesToWrite=0xee40, lpNumberOfBytesWritten=0x19ebd8, lpOverlapped=0x0 | out: lpBuffer=0x233d12c*, lpNumberOfBytesWritten=0x19ebd8*=0xee40, lpOverlapped=0x0) returned 1 [0128.600] CloseHandle (hObject=0x37c) returned 1 [0128.604] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\X-s1lcrQ8YRADHirKDU.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0128.604] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\X-s1lcrQ8YRADHirKDU.mp3", nBufferLength=0x5c, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\X-s1lcrQ8YRADHirKDU.mp3", lpFilePart=0x0) returned 0x5b [0128.604] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\X-s1lcrQ8YRADHirKDU.mp3.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x64 [0128.604] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\X-s1lcrQ8YRADHirKDU.mp3.paradox", nBufferLength=0x64, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\X-s1lcrQ8YRADHirKDU.mp3.paradox", lpFilePart=0x0) returned 0x63 [0128.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0128.604] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\X-s1lcrQ8YRADHirKDU.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\nb7uoxxxe8jgpi9mjkal\\x-s1lcrq8yradhirkdu.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19ec38 | out: lpFileInformation=0x19ec38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf46b8640, ftCreationTime.dwHighDateTime=0x1d8b3f0, ftLastAccessTime.dwLowDateTime=0x21801720, ftLastAccessTime.dwHighDateTime=0x1d8b50b, ftLastWriteTime.dwLowDateTime=0xc4d33171, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xee40)) returned 1 [0128.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0128.605] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\X-s1lcrQ8YRADHirKDU.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\nb7uoxxxe8jgpi9mjkal\\x-s1lcrq8yradhirkdu.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\NB7uoxXXE8jGPi9mjkAl\\X-s1lcrQ8YRADHirKDU.mp3.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\nb7uoxxxe8jgpi9mjkal\\x-s1lcrq8yradhirkdu.mp3.paradox")) returned 1 [0128.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec90) returned 1 [0128.606] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\xow2-jtbjjD9", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0128.606] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\xow2-jtbjjD9", nBufferLength=0x3c, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\xow2-jtbjjD9", lpFilePart=0x0) returned 0x3b [0128.606] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\xow2-jtbjjD9\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\xow2-jtbjjd9\\*"), lpFindFileData=0x19e9b8 | out: lpFindFileData=0x19e9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47f3e310, ftCreationTime.dwHighDateTime=0x1d8bc9e, ftLastAccessTime.dwLowDateTime=0xa9262970, ftLastAccessTime.dwHighDateTime=0x1d8c065, ftLastWriteTime.dwLowDateTime=0xa9262970, ftLastWriteTime.dwHighDateTime=0x1d8c065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x689190 [0128.607] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47f3e310, ftCreationTime.dwHighDateTime=0x1d8bc9e, ftLastAccessTime.dwLowDateTime=0xa9262970, ftLastAccessTime.dwHighDateTime=0x1d8c065, ftLastWriteTime.dwLowDateTime=0xa9262970, ftLastWriteTime.dwHighDateTime=0x1d8c065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.607] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd5418e0, ftCreationTime.dwHighDateTime=0x1d8b75c, ftLastAccessTime.dwLowDateTime=0xc73b9980, ftLastAccessTime.dwHighDateTime=0x1d8b94a, ftLastWriteTime.dwLowDateTime=0xc73b9980, ftLastWriteTime.dwHighDateTime=0x1d8b94a, nFileSizeHigh=0x0, nFileSizeLow=0x4ddb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ij9YhUNH.wav", cAlternateFileName="")) returned 1 [0128.607] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ff005b0, ftCreationTime.dwHighDateTime=0x1d8b947, ftLastAccessTime.dwLowDateTime=0x8140700, ftLastAccessTime.dwHighDateTime=0x1d8bd3b, ftLastWriteTime.dwLowDateTime=0x8140700, ftLastWriteTime.dwHighDateTime=0x1d8bd3b, nFileSizeHigh=0x0, nFileSizeLow=0x110c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="uFm6gFL_KjdhgP.mp3", cAlternateFileName="UFM6GF~1.MP3")) returned 1 [0128.607] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc07b180, ftCreationTime.dwHighDateTime=0x1d8bb27, ftLastAccessTime.dwLowDateTime=0x143e0270, ftLastAccessTime.dwHighDateTime=0x1d8be57, ftLastWriteTime.dwLowDateTime=0x143e0270, ftLastWriteTime.dwHighDateTime=0x1d8be57, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wegB", cAlternateFileName="")) returned 1 [0128.608] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc07b180, ftCreationTime.dwHighDateTime=0x1d8bb27, ftLastAccessTime.dwLowDateTime=0x143e0270, ftLastAccessTime.dwHighDateTime=0x1d8be57, ftLastWriteTime.dwLowDateTime=0x143e0270, ftLastWriteTime.dwHighDateTime=0x1d8be57, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wegB", cAlternateFileName="")) returned 0 [0128.608] FindClose (in: hFindFile=0x689190 | out: hFindFile=0x689190) returned 1 [0128.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0128.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec58) returned 1 [0128.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec90) returned 1 [0128.608] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\xow2-jtbjjD9", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0128.608] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\xow2-jtbjjD9", nBufferLength=0x3c, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\xow2-jtbjjD9", lpFilePart=0x0) returned 0x3b [0128.609] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\xow2-jtbjjD9\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\xow2-jtbjjd9\\*"), lpFindFileData=0x19e9b8 | out: lpFindFileData=0x19e9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47f3e310, ftCreationTime.dwHighDateTime=0x1d8bc9e, ftLastAccessTime.dwLowDateTime=0xa9262970, ftLastAccessTime.dwHighDateTime=0x1d8c065, ftLastWriteTime.dwLowDateTime=0xa9262970, ftLastWriteTime.dwHighDateTime=0x1d8c065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688d10 [0128.609] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47f3e310, ftCreationTime.dwHighDateTime=0x1d8bc9e, ftLastAccessTime.dwLowDateTime=0xa9262970, ftLastAccessTime.dwHighDateTime=0x1d8c065, ftLastWriteTime.dwLowDateTime=0xa9262970, ftLastWriteTime.dwHighDateTime=0x1d8c065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.609] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd5418e0, ftCreationTime.dwHighDateTime=0x1d8b75c, ftLastAccessTime.dwLowDateTime=0xc73b9980, ftLastAccessTime.dwHighDateTime=0x1d8b94a, ftLastWriteTime.dwLowDateTime=0xc73b9980, ftLastWriteTime.dwHighDateTime=0x1d8b94a, nFileSizeHigh=0x0, nFileSizeLow=0x4ddb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ij9YhUNH.wav", cAlternateFileName="")) returned 1 [0128.609] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ff005b0, ftCreationTime.dwHighDateTime=0x1d8b947, ftLastAccessTime.dwLowDateTime=0x8140700, ftLastAccessTime.dwHighDateTime=0x1d8bd3b, ftLastWriteTime.dwLowDateTime=0x8140700, ftLastWriteTime.dwHighDateTime=0x1d8bd3b, nFileSizeHigh=0x0, nFileSizeLow=0x110c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="uFm6gFL_KjdhgP.mp3", cAlternateFileName="UFM6GF~1.MP3")) returned 1 [0128.610] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc07b180, ftCreationTime.dwHighDateTime=0x1d8bb27, ftLastAccessTime.dwLowDateTime=0x143e0270, ftLastAccessTime.dwHighDateTime=0x1d8be57, ftLastWriteTime.dwLowDateTime=0x143e0270, ftLastWriteTime.dwHighDateTime=0x1d8be57, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wegB", cAlternateFileName="")) returned 1 [0128.610] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19e9c4 | out: lpFindFileData=0x19e9c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0128.610] FindClose (in: hFindFile=0x688d10 | out: hFindFile=0x688d10) returned 1 [0128.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec4c) returned 1 [0128.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec58) returned 1 [0128.610] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\xow2-jtbjjD9\\uFm6gFL_KjdhgP.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0128.611] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\xow2-jtbjjD9\\uFm6gFL_KjdhgP.mp3", nBufferLength=0x4f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\xow2-jtbjjD9\\uFm6gFL_KjdhgP.mp3", lpFilePart=0x0) returned 0x4e [0128.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb3c) returned 1 [0128.611] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\xow2-jtbjjD9\\uFm6gFL_KjdhgP.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\xow2-jtbjjd9\\ufm6gfl_kjdhgp.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0128.611] GetFileType (hFile=0x37c) returned 0x1 [0128.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb38) returned 1 [0128.611] GetFileType (hFile=0x37c) returned 0x1 [0128.611] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ec38 | out: lpFileSizeHigh=0x19ec38*=0x0) returned 0x110c1 [0128.611] ReadFile (in: hFile=0x37c, lpBuffer=0x234daa0, nNumberOfBytesToRead=0x110c1, lpNumberOfBytesRead=0x19ebe4, lpOverlapped=0x0 | out: lpBuffer=0x234daa0*, lpNumberOfBytesRead=0x19ebe4*=0x110c1, lpOverlapped=0x0) returned 1 [0128.612] CloseHandle (hObject=0x37c) returned 1 [0128.696] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0128.696] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0128.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebb0) returned 1 [0128.696] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ec2c | out: lpFileInformation=0x19ec2c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0128.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebac) returned 1 [0128.696] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\xow2-jtbjjD9\\uFm6gFL_KjdhgP.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0128.696] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\xow2-jtbjjD9\\uFm6gFL_KjdhgP.mp3", nBufferLength=0x4f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\xow2-jtbjjD9\\uFm6gFL_KjdhgP.mp3", lpFilePart=0x0) returned 0x4e [0128.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb28) returned 1 [0128.697] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\xow2-jtbjjD9\\uFm6gFL_KjdhgP.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\xow2-jtbjjd9\\ufm6gfl_kjdhgp.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0128.698] GetFileType (hFile=0x37c) returned 0x1 [0128.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb24) returned 1 [0128.698] GetFileType (hFile=0x37c) returned 0x1 [0128.699] WriteFile (in: hFile=0x37c, lpBuffer=0x23cdc6c*, nNumberOfBytesToWrite=0x110d0, lpNumberOfBytesWritten=0x19ebd8, lpOverlapped=0x0 | out: lpBuffer=0x23cdc6c*, lpNumberOfBytesWritten=0x19ebd8*=0x110d0, lpOverlapped=0x0) returned 1 [0128.701] CloseHandle (hObject=0x37c) returned 1 [0128.703] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\xow2-jtbjjD9\\uFm6gFL_KjdhgP.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0128.703] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\xow2-jtbjjD9\\uFm6gFL_KjdhgP.mp3", nBufferLength=0x4f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\xow2-jtbjjD9\\uFm6gFL_KjdhgP.mp3", lpFilePart=0x0) returned 0x4e [0128.703] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\xow2-jtbjjD9\\uFm6gFL_KjdhgP.mp3.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x57 [0128.703] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\xow2-jtbjjD9\\uFm6gFL_KjdhgP.mp3.paradox", nBufferLength=0x57, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\xow2-jtbjjD9\\uFm6gFL_KjdhgP.mp3.paradox", lpFilePart=0x0) returned 0x56 [0128.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebbc) returned 1 [0128.703] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\xow2-jtbjjD9\\uFm6gFL_KjdhgP.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\xow2-jtbjjd9\\ufm6gfl_kjdhgp.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19ec38 | out: lpFileInformation=0x19ec38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ff005b0, ftCreationTime.dwHighDateTime=0x1d8b947, ftLastAccessTime.dwLowDateTime=0x8140700, ftLastAccessTime.dwHighDateTime=0x1d8bd3b, ftLastWriteTime.dwLowDateTime=0xc4e18103, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x110d0)) returned 1 [0128.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebb8) returned 1 [0128.704] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\xow2-jtbjjD9\\uFm6gFL_KjdhgP.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\xow2-jtbjjd9\\ufm6gfl_kjdhgp.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\xow2-jtbjjD9\\uFm6gFL_KjdhgP.mp3.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\xow2-jtbjjd9\\ufm6gfl_kjdhgp.mp3.paradox")) returned 1 [0128.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec1c) returned 1 [0128.705] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\xow2-jtbjjD9\\wegB", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0128.705] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\xow2-jtbjjD9\\wegB", nBufferLength=0x41, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\xow2-jtbjjD9\\wegB", lpFilePart=0x0) returned 0x40 [0128.705] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\xow2-jtbjjD9\\wegB\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\xow2-jtbjjd9\\wegb\\*"), lpFindFileData=0x19e944 | out: lpFindFileData=0x19e944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc07b180, ftCreationTime.dwHighDateTime=0x1d8bb27, ftLastAccessTime.dwLowDateTime=0x143e0270, ftLastAccessTime.dwHighDateTime=0x1d8be57, ftLastWriteTime.dwLowDateTime=0x143e0270, ftLastWriteTime.dwHighDateTime=0x1d8be57, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6891d0 [0128.705] FindNextFileW (in: hFindFile=0x6891d0, lpFindFileData=0x19e950 | out: lpFindFileData=0x19e950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc07b180, ftCreationTime.dwHighDateTime=0x1d8bb27, ftLastAccessTime.dwLowDateTime=0x143e0270, ftLastAccessTime.dwHighDateTime=0x1d8be57, ftLastWriteTime.dwLowDateTime=0x143e0270, ftLastWriteTime.dwHighDateTime=0x1d8be57, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.706] FindNextFileW (in: hFindFile=0x6891d0, lpFindFileData=0x19e950 | out: lpFindFileData=0x19e950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc07b180, ftCreationTime.dwHighDateTime=0x1d8bb27, ftLastAccessTime.dwLowDateTime=0x143e0270, ftLastAccessTime.dwHighDateTime=0x1d8be57, ftLastWriteTime.dwLowDateTime=0x143e0270, ftLastWriteTime.dwHighDateTime=0x1d8be57, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0128.706] FindClose (in: hFindFile=0x6891d0 | out: hFindFile=0x6891d0) returned 1 [0128.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebd8) returned 1 [0128.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebe4) returned 1 [0128.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec1c) returned 1 [0128.706] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\xow2-jtbjjD9\\wegB", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0128.706] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\xow2-jtbjjD9\\wegB", nBufferLength=0x41, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\xow2-jtbjjD9\\wegB", lpFilePart=0x0) returned 0x40 [0128.706] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7KmDfrDw\\zJcxa5nxH\\xow2-jtbjjD9\\wegB\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7kmdfrdw\\zjcxa5nxh\\xow2-jtbjjd9\\wegb\\*"), lpFindFileData=0x19e944 | out: lpFindFileData=0x19e944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc07b180, ftCreationTime.dwHighDateTime=0x1d8bb27, ftLastAccessTime.dwLowDateTime=0x143e0270, ftLastAccessTime.dwHighDateTime=0x1d8be57, ftLastWriteTime.dwLowDateTime=0x143e0270, ftLastWriteTime.dwHighDateTime=0x1d8be57, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688f10 [0128.706] FindNextFileW (in: hFindFile=0x688f10, lpFindFileData=0x19e950 | out: lpFindFileData=0x19e950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc07b180, ftCreationTime.dwHighDateTime=0x1d8bb27, ftLastAccessTime.dwLowDateTime=0x143e0270, ftLastAccessTime.dwHighDateTime=0x1d8be57, ftLastWriteTime.dwLowDateTime=0x143e0270, ftLastWriteTime.dwHighDateTime=0x1d8be57, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.707] FindNextFileW (in: hFindFile=0x688f10, lpFindFileData=0x19e950 | out: lpFindFileData=0x19e950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc07b180, ftCreationTime.dwHighDateTime=0x1d8bb27, ftLastAccessTime.dwLowDateTime=0x143e0270, ftLastAccessTime.dwHighDateTime=0x1d8be57, ftLastWriteTime.dwLowDateTime=0x143e0270, ftLastWriteTime.dwHighDateTime=0x1d8be57, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0128.707] FindClose (in: hFindFile=0x688f10 | out: hFindFile=0x688f10) returned 1 [0128.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebd8) returned 1 [0128.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebe4) returned 1 [0128.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed78) returned 1 [0128.707] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0128.707] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op", nBufferLength=0x30, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op", lpFilePart=0x0) returned 0x2f [0128.707] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\loccio2khp5kfwx 2op\\*"), lpFindFileData=0x19eaa0 | out: lpFindFileData=0x19eaa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52b215c0, ftCreationTime.dwHighDateTime=0x1d8b112, ftLastAccessTime.dwLowDateTime=0xfd81d7c0, ftLastAccessTime.dwHighDateTime=0x1d8bb5c, ftLastWriteTime.dwLowDateTime=0xfd81d7c0, ftLastWriteTime.dwHighDateTime=0x1d8bb5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688cd0 [0128.707] FindNextFileW (in: hFindFile=0x688cd0, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52b215c0, ftCreationTime.dwHighDateTime=0x1d8b112, ftLastAccessTime.dwLowDateTime=0xfd81d7c0, ftLastAccessTime.dwHighDateTime=0x1d8bb5c, ftLastWriteTime.dwLowDateTime=0xfd81d7c0, ftLastWriteTime.dwHighDateTime=0x1d8bb5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.709] FindNextFileW (in: hFindFile=0x688cd0, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaaf06900, ftCreationTime.dwHighDateTime=0x1d8b56b, ftLastAccessTime.dwLowDateTime=0xc68fa8a0, ftLastAccessTime.dwHighDateTime=0x1d8b977, ftLastWriteTime.dwLowDateTime=0xc68fa8a0, ftLastWriteTime.dwHighDateTime=0x1d8b977, nFileSizeHigh=0x0, nFileSizeLow=0x7c34, dwReserved0=0x0, dwReserved1=0x0, cFileName="0Pp_pAx5qCK3UNauCkSF.m4a", cAlternateFileName="0PP_PA~1.M4A")) returned 1 [0128.709] FindNextFileW (in: hFindFile=0x688cd0, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6744dd0, ftCreationTime.dwHighDateTime=0x1d8bd20, ftLastAccessTime.dwLowDateTime=0x2a4b0850, ftLastAccessTime.dwHighDateTime=0x1d8bf57, ftLastWriteTime.dwLowDateTime=0x2a4b0850, ftLastWriteTime.dwHighDateTime=0x1d8bf57, nFileSizeHigh=0x0, nFileSizeLow=0x78f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="1ROq9hne6mLb99aMi0h4.m4a", cAlternateFileName="1ROQ9H~1.M4A")) returned 1 [0128.709] FindNextFileW (in: hFindFile=0x688cd0, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0a781c0, ftCreationTime.dwHighDateTime=0x1d8ba72, ftLastAccessTime.dwLowDateTime=0xda803a90, ftLastAccessTime.dwHighDateTime=0x1d8bebe, ftLastWriteTime.dwLowDateTime=0xda803a90, ftLastWriteTime.dwHighDateTime=0x1d8bebe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bhpdCMF2_qxg", cAlternateFileName="BHPDCM~1")) returned 1 [0128.710] FindNextFileW (in: hFindFile=0x688cd0, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5cc9760, ftCreationTime.dwHighDateTime=0x1d8b73a, ftLastAccessTime.dwLowDateTime=0x52b667e0, ftLastAccessTime.dwHighDateTime=0x1d8b82b, ftLastWriteTime.dwLowDateTime=0x52b667e0, ftLastWriteTime.dwHighDateTime=0x1d8b82b, nFileSizeHigh=0x0, nFileSizeLow=0x16704, dwReserved0=0x0, dwReserved1=0x0, cFileName="cHZujdWB.mp3", cAlternateFileName="")) returned 1 [0128.710] FindNextFileW (in: hFindFile=0x688cd0, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x659e5770, ftCreationTime.dwHighDateTime=0x1d8b6a3, ftLastAccessTime.dwLowDateTime=0xd9a4ded0, ftLastAccessTime.dwHighDateTime=0x1d8bc86, ftLastWriteTime.dwLowDateTime=0xd9a4ded0, ftLastWriteTime.dwHighDateTime=0x1d8bc86, nFileSizeHigh=0x0, nFileSizeLow=0x104a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="L7 AC.m4a", cAlternateFileName="L7AC~1.M4A")) returned 1 [0128.710] FindNextFileW (in: hFindFile=0x688cd0, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37bc8260, ftCreationTime.dwHighDateTime=0x1d8b503, ftLastAccessTime.dwLowDateTime=0x5ddffb60, ftLastAccessTime.dwHighDateTime=0x1d8b6b7, ftLastWriteTime.dwLowDateTime=0x5ddffb60, ftLastWriteTime.dwHighDateTime=0x1d8b6b7, nFileSizeHigh=0x0, nFileSizeLow=0xeb95, dwReserved0=0x0, dwReserved1=0x0, cFileName="reZ9jFlAXiPY.mp3", cAlternateFileName="REZ9JF~1.MP3")) returned 1 [0128.710] FindNextFileW (in: hFindFile=0x688cd0, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacb04bd0, ftCreationTime.dwHighDateTime=0x1d8b2d6, ftLastAccessTime.dwLowDateTime=0x283690, ftLastAccessTime.dwHighDateTime=0x1d8ba13, ftLastWriteTime.dwLowDateTime=0x283690, ftLastWriteTime.dwHighDateTime=0x1d8ba13, nFileSizeHigh=0x0, nFileSizeLow=0x65c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="vGQxR.wav", cAlternateFileName="")) returned 1 [0128.710] FindNextFileW (in: hFindFile=0x688cd0, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebd827f0, ftCreationTime.dwHighDateTime=0x1d8b188, ftLastAccessTime.dwLowDateTime=0x57d42030, ftLastAccessTime.dwHighDateTime=0x1d8bb7f, ftLastWriteTime.dwLowDateTime=0x57d42030, ftLastWriteTime.dwHighDateTime=0x1d8bb7f, nFileSizeHigh=0x0, nFileSizeLow=0x2214, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vxx1vR6KrqxFVGqkI.mp3", cAlternateFileName="VXX1VR~1.MP3")) returned 1 [0128.710] FindNextFileW (in: hFindFile=0x688cd0, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52c86b90, ftCreationTime.dwHighDateTime=0x1d8be05, ftLastAccessTime.dwLowDateTime=0x2fb6e4d0, ftLastAccessTime.dwHighDateTime=0x1d8c033, ftLastWriteTime.dwLowDateTime=0x2fb6e4d0, ftLastWriteTime.dwHighDateTime=0x1d8c033, nFileSizeHigh=0x0, nFileSizeLow=0x62bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="zd8OWmAflBR1Psse.m4a", cAlternateFileName="ZD8OWM~1.M4A")) returned 1 [0128.711] FindNextFileW (in: hFindFile=0x688cd0, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0128.711] FindClose (in: hFindFile=0x688cd0 | out: hFindFile=0x688cd0) returned 1 [0128.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed34) returned 1 [0128.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed40) returned 1 [0128.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed78) returned 1 [0128.711] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0128.711] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op", nBufferLength=0x30, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op", lpFilePart=0x0) returned 0x2f [0128.711] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\loccio2khp5kfwx 2op\\*"), lpFindFileData=0x19eaa0 | out: lpFindFileData=0x19eaa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52b215c0, ftCreationTime.dwHighDateTime=0x1d8b112, ftLastAccessTime.dwLowDateTime=0xfd81d7c0, ftLastAccessTime.dwHighDateTime=0x1d8bb5c, ftLastWriteTime.dwLowDateTime=0xfd81d7c0, ftLastWriteTime.dwHighDateTime=0x1d8bb5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x689190 [0128.711] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52b215c0, ftCreationTime.dwHighDateTime=0x1d8b112, ftLastAccessTime.dwLowDateTime=0xfd81d7c0, ftLastAccessTime.dwHighDateTime=0x1d8bb5c, ftLastWriteTime.dwLowDateTime=0xfd81d7c0, ftLastWriteTime.dwHighDateTime=0x1d8bb5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.712] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaaf06900, ftCreationTime.dwHighDateTime=0x1d8b56b, ftLastAccessTime.dwLowDateTime=0xc68fa8a0, ftLastAccessTime.dwHighDateTime=0x1d8b977, ftLastWriteTime.dwLowDateTime=0xc68fa8a0, ftLastWriteTime.dwHighDateTime=0x1d8b977, nFileSizeHigh=0x0, nFileSizeLow=0x7c34, dwReserved0=0x0, dwReserved1=0x0, cFileName="0Pp_pAx5qCK3UNauCkSF.m4a", cAlternateFileName="0PP_PA~1.M4A")) returned 1 [0128.712] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6744dd0, ftCreationTime.dwHighDateTime=0x1d8bd20, ftLastAccessTime.dwLowDateTime=0x2a4b0850, ftLastAccessTime.dwHighDateTime=0x1d8bf57, ftLastWriteTime.dwLowDateTime=0x2a4b0850, ftLastWriteTime.dwHighDateTime=0x1d8bf57, nFileSizeHigh=0x0, nFileSizeLow=0x78f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="1ROq9hne6mLb99aMi0h4.m4a", cAlternateFileName="1ROQ9H~1.M4A")) returned 1 [0128.712] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0a781c0, ftCreationTime.dwHighDateTime=0x1d8ba72, ftLastAccessTime.dwLowDateTime=0xda803a90, ftLastAccessTime.dwHighDateTime=0x1d8bebe, ftLastWriteTime.dwLowDateTime=0xda803a90, ftLastWriteTime.dwHighDateTime=0x1d8bebe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bhpdCMF2_qxg", cAlternateFileName="BHPDCM~1")) returned 1 [0128.712] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5cc9760, ftCreationTime.dwHighDateTime=0x1d8b73a, ftLastAccessTime.dwLowDateTime=0x52b667e0, ftLastAccessTime.dwHighDateTime=0x1d8b82b, ftLastWriteTime.dwLowDateTime=0x52b667e0, ftLastWriteTime.dwHighDateTime=0x1d8b82b, nFileSizeHigh=0x0, nFileSizeLow=0x16704, dwReserved0=0x0, dwReserved1=0x0, cFileName="cHZujdWB.mp3", cAlternateFileName="")) returned 1 [0128.712] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x659e5770, ftCreationTime.dwHighDateTime=0x1d8b6a3, ftLastAccessTime.dwLowDateTime=0xd9a4ded0, ftLastAccessTime.dwHighDateTime=0x1d8bc86, ftLastWriteTime.dwLowDateTime=0xd9a4ded0, ftLastWriteTime.dwHighDateTime=0x1d8bc86, nFileSizeHigh=0x0, nFileSizeLow=0x104a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="L7 AC.m4a", cAlternateFileName="L7AC~1.M4A")) returned 1 [0128.712] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37bc8260, ftCreationTime.dwHighDateTime=0x1d8b503, ftLastAccessTime.dwLowDateTime=0x5ddffb60, ftLastAccessTime.dwHighDateTime=0x1d8b6b7, ftLastWriteTime.dwLowDateTime=0x5ddffb60, ftLastWriteTime.dwHighDateTime=0x1d8b6b7, nFileSizeHigh=0x0, nFileSizeLow=0xeb95, dwReserved0=0x0, dwReserved1=0x0, cFileName="reZ9jFlAXiPY.mp3", cAlternateFileName="REZ9JF~1.MP3")) returned 1 [0128.712] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacb04bd0, ftCreationTime.dwHighDateTime=0x1d8b2d6, ftLastAccessTime.dwLowDateTime=0x283690, ftLastAccessTime.dwHighDateTime=0x1d8ba13, ftLastWriteTime.dwLowDateTime=0x283690, ftLastWriteTime.dwHighDateTime=0x1d8ba13, nFileSizeHigh=0x0, nFileSizeLow=0x65c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="vGQxR.wav", cAlternateFileName="")) returned 1 [0128.712] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebd827f0, ftCreationTime.dwHighDateTime=0x1d8b188, ftLastAccessTime.dwLowDateTime=0x57d42030, ftLastAccessTime.dwHighDateTime=0x1d8bb7f, ftLastWriteTime.dwLowDateTime=0x57d42030, ftLastWriteTime.dwHighDateTime=0x1d8bb7f, nFileSizeHigh=0x0, nFileSizeLow=0x2214, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vxx1vR6KrqxFVGqkI.mp3", cAlternateFileName="VXX1VR~1.MP3")) returned 1 [0128.713] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52c86b90, ftCreationTime.dwHighDateTime=0x1d8be05, ftLastAccessTime.dwLowDateTime=0x2fb6e4d0, ftLastAccessTime.dwHighDateTime=0x1d8c033, ftLastWriteTime.dwLowDateTime=0x2fb6e4d0, ftLastWriteTime.dwHighDateTime=0x1d8c033, nFileSizeHigh=0x0, nFileSizeLow=0x62bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="zd8OWmAflBR1Psse.m4a", cAlternateFileName="ZD8OWM~1.M4A")) returned 1 [0128.713] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52c86b90, ftCreationTime.dwHighDateTime=0x1d8be05, ftLastAccessTime.dwLowDateTime=0x2fb6e4d0, ftLastAccessTime.dwHighDateTime=0x1d8c033, ftLastWriteTime.dwLowDateTime=0x2fb6e4d0, ftLastWriteTime.dwHighDateTime=0x1d8c033, nFileSizeHigh=0x0, nFileSizeLow=0x62bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="zd8OWmAflBR1Psse.m4a", cAlternateFileName="ZD8OWM~1.M4A")) returned 0 [0128.713] FindClose (in: hFindFile=0x689190 | out: hFindFile=0x689190) returned 1 [0128.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed34) returned 1 [0128.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed40) returned 1 [0128.713] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\cHZujdWB.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0128.713] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\cHZujdWB.mp3", nBufferLength=0x3d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\cHZujdWB.mp3", lpFilePart=0x0) returned 0x3c [0128.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0128.713] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\cHZujdWB.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\loccio2khp5kfwx 2op\\chzujdwb.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0128.713] GetFileType (hFile=0x37c) returned 0x1 [0128.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0128.713] GetFileType (hFile=0x37c) returned 0x1 [0128.713] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed20 | out: lpFileSizeHigh=0x19ed20*=0x0) returned 0x16704 [0128.714] ReadFile (in: hFile=0x37c, lpBuffer=0x34f3178, nNumberOfBytesToRead=0x16704, lpNumberOfBytesRead=0x19eccc, lpOverlapped=0x0 | out: lpBuffer=0x34f3178*, lpNumberOfBytesRead=0x19eccc*=0x16704, lpOverlapped=0x0) returned 1 [0128.716] CloseHandle (hObject=0x37c) returned 1 [0128.743] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0128.743] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0128.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0128.743] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed14 | out: lpFileInformation=0x19ed14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0128.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0128.744] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\cHZujdWB.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0128.744] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\cHZujdWB.mp3", nBufferLength=0x3d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\cHZujdWB.mp3", lpFilePart=0x0) returned 0x3c [0128.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec10) returned 1 [0128.744] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\cHZujdWB.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\loccio2khp5kfwx 2op\\chzujdwb.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0128.746] GetFileType (hFile=0x37c) returned 0x1 [0128.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec0c) returned 1 [0128.746] GetFileType (hFile=0x37c) returned 0x1 [0128.746] WriteFile (in: hFile=0x37c, lpBuffer=0x35634f8*, nNumberOfBytesToWrite=0x16710, lpNumberOfBytesWritten=0x19ecc0, lpOverlapped=0x0 | out: lpBuffer=0x35634f8*, lpNumberOfBytesWritten=0x19ecc0*=0x16710, lpOverlapped=0x0) returned 1 [0128.748] CloseHandle (hObject=0x37c) returned 1 [0128.751] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\cHZujdWB.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0128.751] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\cHZujdWB.mp3", nBufferLength=0x3d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\cHZujdWB.mp3", lpFilePart=0x0) returned 0x3c [0128.751] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\cHZujdWB.mp3.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x45 [0128.751] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\cHZujdWB.mp3.paradox", nBufferLength=0x45, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\cHZujdWB.mp3.paradox", lpFilePart=0x0) returned 0x44 [0128.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eca4) returned 1 [0128.751] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\cHZujdWB.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\loccio2khp5kfwx 2op\\chzujdwb.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19ed20 | out: lpFileInformation=0x19ed20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5cc9760, ftCreationTime.dwHighDateTime=0x1d8b73a, ftLastAccessTime.dwLowDateTime=0x52b667e0, ftLastAccessTime.dwHighDateTime=0x1d8b82b, ftLastWriteTime.dwLowDateTime=0xc4e8a5a9, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x16710)) returned 1 [0128.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eca0) returned 1 [0128.751] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\cHZujdWB.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\loccio2khp5kfwx 2op\\chzujdwb.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\cHZujdWB.mp3.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\loccio2khp5kfwx 2op\\chzujdwb.mp3.paradox")) returned 1 [0128.752] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\reZ9jFlAXiPY.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0128.752] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\reZ9jFlAXiPY.mp3", nBufferLength=0x41, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\reZ9jFlAXiPY.mp3", lpFilePart=0x0) returned 0x40 [0128.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0128.752] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\reZ9jFlAXiPY.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\loccio2khp5kfwx 2op\\rez9jflaxipy.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0128.753] GetFileType (hFile=0x37c) returned 0x1 [0128.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0128.753] GetFileType (hFile=0x37c) returned 0x1 [0128.753] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed20 | out: lpFileSizeHigh=0x19ed20*=0x0) returned 0xeb95 [0128.753] ReadFile (in: hFile=0x37c, lpBuffer=0x242fa38, nNumberOfBytesToRead=0xeb95, lpNumberOfBytesRead=0x19eccc, lpOverlapped=0x0 | out: lpBuffer=0x242fa38*, lpNumberOfBytesRead=0x19eccc*=0xeb95, lpOverlapped=0x0) returned 1 [0128.753] CloseHandle (hObject=0x37c) returned 1 [0128.928] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0128.928] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0128.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0128.928] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed14 | out: lpFileInformation=0x19ed14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0128.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0128.928] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\reZ9jFlAXiPY.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0128.928] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\reZ9jFlAXiPY.mp3", nBufferLength=0x41, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\reZ9jFlAXiPY.mp3", lpFilePart=0x0) returned 0x40 [0128.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec10) returned 1 [0128.929] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\reZ9jFlAXiPY.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\loccio2khp5kfwx 2op\\rez9jflaxipy.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0128.930] GetFileType (hFile=0x37c) returned 0x1 [0128.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec0c) returned 1 [0128.931] GetFileType (hFile=0x37c) returned 0x1 [0128.931] WriteFile (in: hFile=0x37c, lpBuffer=0x24a8b18*, nNumberOfBytesToWrite=0xeba0, lpNumberOfBytesWritten=0x19ecc0, lpOverlapped=0x0 | out: lpBuffer=0x24a8b18*, lpNumberOfBytesWritten=0x19ecc0*=0xeba0, lpOverlapped=0x0) returned 1 [0128.933] CloseHandle (hObject=0x37c) returned 1 [0128.936] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\reZ9jFlAXiPY.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0128.936] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\reZ9jFlAXiPY.mp3", nBufferLength=0x41, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\reZ9jFlAXiPY.mp3", lpFilePart=0x0) returned 0x40 [0128.936] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\reZ9jFlAXiPY.mp3.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0128.936] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\reZ9jFlAXiPY.mp3.paradox", nBufferLength=0x49, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\reZ9jFlAXiPY.mp3.paradox", lpFilePart=0x0) returned 0x48 [0128.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eca4) returned 1 [0128.937] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\reZ9jFlAXiPY.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\loccio2khp5kfwx 2op\\rez9jflaxipy.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19ed20 | out: lpFileInformation=0x19ed20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37bc8260, ftCreationTime.dwHighDateTime=0x1d8b503, ftLastAccessTime.dwLowDateTime=0x5ddffb60, ftLastAccessTime.dwHighDateTime=0x1d8b6b7, ftLastWriteTime.dwLowDateTime=0xc505426d, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xeba0)) returned 1 [0128.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eca0) returned 1 [0128.937] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\reZ9jFlAXiPY.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\loccio2khp5kfwx 2op\\rez9jflaxipy.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\reZ9jFlAXiPY.mp3.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\loccio2khp5kfwx 2op\\rez9jflaxipy.mp3.paradox")) returned 1 [0128.938] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\Vxx1vR6KrqxFVGqkI.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0128.938] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\Vxx1vR6KrqxFVGqkI.mp3", nBufferLength=0x46, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\Vxx1vR6KrqxFVGqkI.mp3", lpFilePart=0x0) returned 0x45 [0128.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0128.938] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\Vxx1vR6KrqxFVGqkI.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\loccio2khp5kfwx 2op\\vxx1vr6krqxfvgqki.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0128.938] GetFileType (hFile=0x37c) returned 0x1 [0128.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0128.938] GetFileType (hFile=0x37c) returned 0x1 [0128.938] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed20 | out: lpFileSizeHigh=0x19ed20*=0x0) returned 0x2214 [0128.939] ReadFile (in: hFile=0x37c, lpBuffer=0x24b798c, nNumberOfBytesToRead=0x2214, lpNumberOfBytesRead=0x19eccc, lpOverlapped=0x0 | out: lpBuffer=0x24b798c*, lpNumberOfBytesRead=0x19eccc*=0x2214, lpOverlapped=0x0) returned 1 [0128.939] CloseHandle (hObject=0x37c) returned 1 [0128.968] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0128.968] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0128.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0128.968] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed14 | out: lpFileInformation=0x19ed14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0128.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0128.969] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\Vxx1vR6KrqxFVGqkI.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0128.969] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\Vxx1vR6KrqxFVGqkI.mp3", nBufferLength=0x46, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\Vxx1vR6KrqxFVGqkI.mp3", lpFilePart=0x0) returned 0x45 [0128.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec10) returned 1 [0128.969] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\Vxx1vR6KrqxFVGqkI.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\loccio2khp5kfwx 2op\\vxx1vr6krqxfvgqki.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0128.970] GetFileType (hFile=0x37c) returned 0x1 [0128.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec0c) returned 1 [0128.971] GetFileType (hFile=0x37c) returned 0x1 [0128.971] WriteFile (in: hFile=0x37c, lpBuffer=0x250f214*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x19ecc0, lpOverlapped=0x0 | out: lpBuffer=0x250f214*, lpNumberOfBytesWritten=0x19ecc0*=0x2220, lpOverlapped=0x0) returned 1 [0128.972] CloseHandle (hObject=0x37c) returned 1 [0128.974] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\Vxx1vR6KrqxFVGqkI.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0128.974] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\Vxx1vR6KrqxFVGqkI.mp3", nBufferLength=0x46, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\Vxx1vR6KrqxFVGqkI.mp3", lpFilePart=0x0) returned 0x45 [0128.974] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\Vxx1vR6KrqxFVGqkI.mp3.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0128.974] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\Vxx1vR6KrqxFVGqkI.mp3.paradox", nBufferLength=0x4e, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\Vxx1vR6KrqxFVGqkI.mp3.paradox", lpFilePart=0x0) returned 0x4d [0128.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eca4) returned 1 [0128.974] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\Vxx1vR6KrqxFVGqkI.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\loccio2khp5kfwx 2op\\vxx1vr6krqxfvgqki.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19ed20 | out: lpFileInformation=0x19ed20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebd827f0, ftCreationTime.dwHighDateTime=0x1d8b188, ftLastAccessTime.dwLowDateTime=0x57d42030, ftLastAccessTime.dwHighDateTime=0x1d8bb7f, ftLastWriteTime.dwLowDateTime=0xc50c7109, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x2220)) returned 1 [0128.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eca0) returned 1 [0128.975] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\Vxx1vR6KrqxFVGqkI.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\loccio2khp5kfwx 2op\\vxx1vr6krqxfvgqki.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\Vxx1vR6KrqxFVGqkI.mp3.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\loccio2khp5kfwx 2op\\vxx1vr6krqxfvgqki.mp3.paradox")) returned 1 [0128.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed04) returned 1 [0128.975] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\bhpdCMF2_qxg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0128.976] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\bhpdCMF2_qxg", nBufferLength=0x3d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\bhpdCMF2_qxg", lpFilePart=0x0) returned 0x3c [0128.976] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\bhpdCMF2_qxg\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\loccio2khp5kfwx 2op\\bhpdcmf2_qxg\\*"), lpFindFileData=0x19ea2c | out: lpFindFileData=0x19ea2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0a781c0, ftCreationTime.dwHighDateTime=0x1d8ba72, ftLastAccessTime.dwLowDateTime=0xda803a90, ftLastAccessTime.dwHighDateTime=0x1d8bebe, ftLastWriteTime.dwLowDateTime=0xda803a90, ftLastWriteTime.dwHighDateTime=0x1d8bebe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688d10 [0128.976] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0a781c0, ftCreationTime.dwHighDateTime=0x1d8ba72, ftLastAccessTime.dwLowDateTime=0xda803a90, ftLastAccessTime.dwHighDateTime=0x1d8bebe, ftLastWriteTime.dwLowDateTime=0xda803a90, ftLastWriteTime.dwHighDateTime=0x1d8bebe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.976] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7df2a0, ftCreationTime.dwHighDateTime=0x1d8c082, ftLastAccessTime.dwLowDateTime=0x975ee30, ftLastAccessTime.dwHighDateTime=0x1d8c0ef, ftLastWriteTime.dwLowDateTime=0x975ee30, ftLastWriteTime.dwHighDateTime=0x1d8c0ef, nFileSizeHigh=0x0, nFileSizeLow=0xdedf, dwReserved0=0x0, dwReserved1=0x0, cFileName="3f0PF.wav", cAlternateFileName="")) returned 1 [0128.976] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37b08ee0, ftCreationTime.dwHighDateTime=0x1d8b5dc, ftLastAccessTime.dwLowDateTime=0x654c100, ftLastAccessTime.dwHighDateTime=0x1d8c03f, ftLastWriteTime.dwLowDateTime=0x654c100, ftLastWriteTime.dwHighDateTime=0x1d8c03f, nFileSizeHigh=0x0, nFileSizeLow=0x5567, dwReserved0=0x0, dwReserved1=0x0, cFileName="YUU6tBaYq0t.mp3", cAlternateFileName="YUU6TB~1.MP3")) returned 1 [0128.976] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x451115b0, ftCreationTime.dwHighDateTime=0x1d8b941, ftLastAccessTime.dwLowDateTime=0xe5e194a0, ftLastAccessTime.dwHighDateTime=0x1d8bf73, ftLastWriteTime.dwLowDateTime=0xe5e194a0, ftLastWriteTime.dwHighDateTime=0x1d8bf73, nFileSizeHigh=0x0, nFileSizeLow=0x38bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZaAPEytJn_8J2f6nmD.m4a", cAlternateFileName="ZAAPEY~1.M4A")) returned 1 [0128.976] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0128.977] FindClose (in: hFindFile=0x688d10 | out: hFindFile=0x688d10) returned 1 [0128.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0128.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eccc) returned 1 [0128.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed04) returned 1 [0128.977] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\bhpdCMF2_qxg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0128.977] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\bhpdCMF2_qxg", nBufferLength=0x3d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\bhpdCMF2_qxg", lpFilePart=0x0) returned 0x3c [0128.977] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\bhpdCMF2_qxg\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\loccio2khp5kfwx 2op\\bhpdcmf2_qxg\\*"), lpFindFileData=0x19ea2c | out: lpFindFileData=0x19ea2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0a781c0, ftCreationTime.dwHighDateTime=0x1d8ba72, ftLastAccessTime.dwLowDateTime=0xda803a90, ftLastAccessTime.dwHighDateTime=0x1d8bebe, ftLastWriteTime.dwLowDateTime=0xda803a90, ftLastWriteTime.dwHighDateTime=0x1d8bebe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688e50 [0128.977] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0a781c0, ftCreationTime.dwHighDateTime=0x1d8ba72, ftLastAccessTime.dwLowDateTime=0xda803a90, ftLastAccessTime.dwHighDateTime=0x1d8bebe, ftLastWriteTime.dwLowDateTime=0xda803a90, ftLastWriteTime.dwHighDateTime=0x1d8bebe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.977] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7df2a0, ftCreationTime.dwHighDateTime=0x1d8c082, ftLastAccessTime.dwLowDateTime=0x975ee30, ftLastAccessTime.dwHighDateTime=0x1d8c0ef, ftLastWriteTime.dwLowDateTime=0x975ee30, ftLastWriteTime.dwHighDateTime=0x1d8c0ef, nFileSizeHigh=0x0, nFileSizeLow=0xdedf, dwReserved0=0x0, dwReserved1=0x0, cFileName="3f0PF.wav", cAlternateFileName="")) returned 1 [0128.978] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37b08ee0, ftCreationTime.dwHighDateTime=0x1d8b5dc, ftLastAccessTime.dwLowDateTime=0x654c100, ftLastAccessTime.dwHighDateTime=0x1d8c03f, ftLastWriteTime.dwLowDateTime=0x654c100, ftLastWriteTime.dwHighDateTime=0x1d8c03f, nFileSizeHigh=0x0, nFileSizeLow=0x5567, dwReserved0=0x0, dwReserved1=0x0, cFileName="YUU6tBaYq0t.mp3", cAlternateFileName="YUU6TB~1.MP3")) returned 1 [0128.978] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x451115b0, ftCreationTime.dwHighDateTime=0x1d8b941, ftLastAccessTime.dwLowDateTime=0xe5e194a0, ftLastAccessTime.dwHighDateTime=0x1d8bf73, ftLastWriteTime.dwLowDateTime=0xe5e194a0, ftLastWriteTime.dwHighDateTime=0x1d8bf73, nFileSizeHigh=0x0, nFileSizeLow=0x38bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZaAPEytJn_8J2f6nmD.m4a", cAlternateFileName="ZAAPEY~1.M4A")) returned 1 [0128.978] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19ea38 | out: lpFindFileData=0x19ea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x451115b0, ftCreationTime.dwHighDateTime=0x1d8b941, ftLastAccessTime.dwLowDateTime=0xe5e194a0, ftLastAccessTime.dwHighDateTime=0x1d8bf73, ftLastWriteTime.dwLowDateTime=0xe5e194a0, ftLastWriteTime.dwHighDateTime=0x1d8bf73, nFileSizeHigh=0x0, nFileSizeLow=0x38bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZaAPEytJn_8J2f6nmD.m4a", cAlternateFileName="ZAAPEY~1.M4A")) returned 0 [0128.978] FindClose (in: hFindFile=0x688e50 | out: hFindFile=0x688e50) returned 1 [0128.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ecc0) returned 1 [0128.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eccc) returned 1 [0128.978] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\bhpdCMF2_qxg\\YUU6tBaYq0t.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0128.978] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\bhpdCMF2_qxg\\YUU6tBaYq0t.mp3", nBufferLength=0x4d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\bhpdCMF2_qxg\\YUU6tBaYq0t.mp3", lpFilePart=0x0) returned 0x4c [0128.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ebb0) returned 1 [0128.978] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\bhpdCMF2_qxg\\YUU6tBaYq0t.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\loccio2khp5kfwx 2op\\bhpdcmf2_qxg\\yuu6tbayq0t.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0128.978] GetFileType (hFile=0x37c) returned 0x1 [0128.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ebac) returned 1 [0128.979] GetFileType (hFile=0x37c) returned 0x1 [0128.979] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ecac | out: lpFileSizeHigh=0x19ecac*=0x0) returned 0x5567 [0128.979] ReadFile (in: hFile=0x37c, lpBuffer=0x2513098, nNumberOfBytesToRead=0x5567, lpNumberOfBytesRead=0x19ec58, lpOverlapped=0x0 | out: lpBuffer=0x2513098*, lpNumberOfBytesRead=0x19ec58*=0x5567, lpOverlapped=0x0) returned 1 [0128.979] CloseHandle (hObject=0x37c) returned 1 [0129.085] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0129.085] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0129.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec24) returned 1 [0129.085] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19eca0 | out: lpFileInformation=0x19eca0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0129.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec20) returned 1 [0129.085] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\bhpdCMF2_qxg\\YUU6tBaYq0t.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0129.085] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\bhpdCMF2_qxg\\YUU6tBaYq0t.mp3", nBufferLength=0x4d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\bhpdCMF2_qxg\\YUU6tBaYq0t.mp3", lpFilePart=0x0) returned 0x4c [0129.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb9c) returned 1 [0129.086] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\bhpdCMF2_qxg\\YUU6tBaYq0t.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\loccio2khp5kfwx 2op\\bhpdcmf2_qxg\\yuu6tbayq0t.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.087] GetFileType (hFile=0x37c) returned 0x1 [0129.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb98) returned 1 [0129.087] GetFileType (hFile=0x37c) returned 0x1 [0129.087] WriteFile (in: hFile=0x37c, lpBuffer=0x233f66c*, nNumberOfBytesToWrite=0x5570, lpNumberOfBytesWritten=0x19ec4c, lpOverlapped=0x0 | out: lpBuffer=0x233f66c*, lpNumberOfBytesWritten=0x19ec4c*=0x5570, lpOverlapped=0x0) returned 1 [0129.088] CloseHandle (hObject=0x37c) returned 1 [0129.090] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\bhpdCMF2_qxg\\YUU6tBaYq0t.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0129.090] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\bhpdCMF2_qxg\\YUU6tBaYq0t.mp3", nBufferLength=0x4d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\bhpdCMF2_qxg\\YUU6tBaYq0t.mp3", lpFilePart=0x0) returned 0x4c [0129.090] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\bhpdCMF2_qxg\\YUU6tBaYq0t.mp3.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0129.090] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\bhpdCMF2_qxg\\YUU6tBaYq0t.mp3.paradox", nBufferLength=0x55, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\bhpdCMF2_qxg\\YUU6tBaYq0t.mp3.paradox", lpFilePart=0x0) returned 0x54 [0129.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec30) returned 1 [0129.090] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\bhpdCMF2_qxg\\YUU6tBaYq0t.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\loccio2khp5kfwx 2op\\bhpdcmf2_qxg\\yuu6tbayq0t.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19ecac | out: lpFileInformation=0x19ecac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37b08ee0, ftCreationTime.dwHighDateTime=0x1d8b5dc, ftLastAccessTime.dwLowDateTime=0x654c100, ftLastAccessTime.dwHighDateTime=0x1d8c03f, ftLastWriteTime.dwLowDateTime=0xc51d19f8, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x5570)) returned 1 [0129.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec2c) returned 1 [0129.091] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\bhpdCMF2_qxg\\YUU6tBaYq0t.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\loccio2khp5kfwx 2op\\bhpdcmf2_qxg\\yuu6tbayq0t.mp3"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\LOcciO2KhP5kfwX 2op\\bhpdCMF2_qxg\\YUU6tBaYq0t.mp3.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\loccio2khp5kfwx 2op\\bhpdcmf2_qxg\\yuu6tbayq0t.mp3.paradox")) returned 1 [0129.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edec) returned 1 [0129.092] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\OneDrive", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1f [0129.092] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\OneDrive", nBufferLength=0x1f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\OneDrive", lpFilePart=0x0) returned 0x1e [0129.092] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\OneDrive\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\onedrive\\*"), lpFindFileData=0x19eb14 | out: lpFindFileData=0x19eb14*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x84ac775d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x84aeda3c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84aeda3c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688bd0 [0129.092] FindNextFileW (in: hFindFile=0x688bd0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x84ac775d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x84aeda3c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84aeda3c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0129.092] FindNextFileW (in: hFindFile=0x688bd0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x84aeda3c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x84aeda3c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84aeda3c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0129.093] FindNextFileW (in: hFindFile=0x688bd0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0129.093] FindClose (in: hFindFile=0x688bd0 | out: hFindFile=0x688bd0) returned 1 [0129.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda8) returned 1 [0129.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb4) returned 1 [0129.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edec) returned 1 [0129.093] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\OneDrive", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1f [0129.093] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\OneDrive", nBufferLength=0x1f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\OneDrive", lpFilePart=0x0) returned 0x1e [0129.093] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\OneDrive\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\onedrive\\*"), lpFindFileData=0x19eb14 | out: lpFindFileData=0x19eb14*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x84ac775d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x84aeda3c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84aeda3c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688bd0 [0129.093] FindNextFileW (in: hFindFile=0x688bd0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x84ac775d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x84aeda3c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84aeda3c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0129.094] FindNextFileW (in: hFindFile=0x688bd0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x84aeda3c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x84aeda3c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84aeda3c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0129.094] FindNextFileW (in: hFindFile=0x688bd0, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x84aeda3c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x84aeda3c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84aeda3c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0129.094] FindClose (in: hFindFile=0x688bd0 | out: hFindFile=0x688bd0) returned 1 [0129.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda8) returned 1 [0129.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb4) returned 1 [0129.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edec) returned 1 [0129.094] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Saved Games", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x22 [0129.094] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Saved Games", nBufferLength=0x22, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Saved Games", lpFilePart=0x0) returned 0x21 [0129.094] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Saved Games\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\saved games\\*"), lpFindFileData=0x19eb14 | out: lpFindFileData=0x19eb14*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43754b80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43754b80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688d10 [0129.095] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43754b80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43754b80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0129.095] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43754b80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43754b80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43754b80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0129.095] FindNextFileW (in: hFindFile=0x688d10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0129.095] FindClose (in: hFindFile=0x688d10 | out: hFindFile=0x688d10) returned 1 [0129.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda8) returned 1 [0129.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb4) returned 1 [0129.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edec) returned 1 [0129.095] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Saved Games", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x22 [0129.095] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Saved Games", nBufferLength=0x22, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Saved Games", lpFilePart=0x0) returned 0x21 [0129.095] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Saved Games\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\saved games\\*"), lpFindFileData=0x19eb14 | out: lpFindFileData=0x19eb14*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43754b80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43754b80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688e90 [0129.096] FindNextFileW (in: hFindFile=0x688e90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43754b80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43754b80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0129.096] FindNextFileW (in: hFindFile=0x688e90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43754b80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43754b80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43754b80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0129.096] FindNextFileW (in: hFindFile=0x688e90, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43754b80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43754b80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43754b80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0129.096] FindClose (in: hFindFile=0x688e90 | out: hFindFile=0x688e90) returned 1 [0129.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda8) returned 1 [0129.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb4) returned 1 [0129.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edec) returned 1 [0129.097] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Favorites", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x20 [0129.097] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Favorites", nBufferLength=0x20, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Favorites", lpFilePart=0x0) returned 0x1f [0129.097] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Favorites\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\favorites\\*"), lpFindFileData=0x19eb14 | out: lpFindFileData=0x19eb14*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688f10 [0129.097] FindNextFileW (in: hFindFile=0x688f10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0129.097] FindNextFileW (in: hFindFile=0x688f10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43053b43, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43053b43, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43079e90, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bing.url", cAlternateFileName="")) returned 1 [0129.097] FindNextFileW (in: hFindFile=0x688f10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x436238c4, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0129.097] FindNextFileW (in: hFindFile=0x688f10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43079e90, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43079e90, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0129.098] FindNextFileW (in: hFindFile=0x688f10, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43079e90, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43079e90, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 0 [0129.098] FindClose (in: hFindFile=0x688f10 | out: hFindFile=0x688f10) returned 1 [0129.098] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda8) returned 1 [0129.098] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb4) returned 1 [0129.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edec) returned 1 [0129.098] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Favorites", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x20 [0129.098] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Favorites", nBufferLength=0x20, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Favorites", lpFilePart=0x0) returned 0x1f [0129.100] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Favorites\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\favorites\\*"), lpFindFileData=0x19eb14 | out: lpFindFileData=0x19eb14*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x689290 [0129.101] FindNextFileW (in: hFindFile=0x689290, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0129.101] FindNextFileW (in: hFindFile=0x689290, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43053b43, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43053b43, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43079e90, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bing.url", cAlternateFileName="")) returned 1 [0129.101] FindNextFileW (in: hFindFile=0x689290, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x436238c4, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0129.101] FindNextFileW (in: hFindFile=0x689290, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43079e90, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43079e90, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0129.102] FindNextFileW (in: hFindFile=0x689290, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0129.102] FindClose (in: hFindFile=0x689290 | out: hFindFile=0x689290) returned 1 [0129.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda8) returned 1 [0129.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb4) returned 1 [0129.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed78) returned 1 [0129.102] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Favorites\\Links", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0129.102] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Favorites\\Links", nBufferLength=0x26, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Favorites\\Links", lpFilePart=0x0) returned 0x25 [0129.102] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Favorites\\Links\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\favorites\\links\\*"), lpFindFileData=0x19eaa0 | out: lpFindFileData=0x19eaa0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43079e90, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43079e90, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688e50 [0129.103] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43079e90, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43079e90, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0129.103] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x43079e90, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43079e90, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43079e90, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0129.103] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0129.103] FindClose (in: hFindFile=0x688e50 | out: hFindFile=0x688e50) returned 1 [0129.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed34) returned 1 [0129.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed40) returned 1 [0129.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed78) returned 1 [0129.103] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Favorites\\Links", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0129.103] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Favorites\\Links", nBufferLength=0x26, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Favorites\\Links", lpFilePart=0x0) returned 0x25 [0129.103] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Favorites\\Links\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\favorites\\links\\*"), lpFindFileData=0x19eaa0 | out: lpFindFileData=0x19eaa0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43079e90, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43079e90, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688f10 [0129.104] FindNextFileW (in: hFindFile=0x688f10, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43079e90, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43079e90, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0129.104] FindNextFileW (in: hFindFile=0x688f10, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x43079e90, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43079e90, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43079e90, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0129.104] FindNextFileW (in: hFindFile=0x688f10, lpFindFileData=0x19eaac | out: lpFindFileData=0x19eaac*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x43079e90, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43079e90, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43079e90, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0129.104] FindClose (in: hFindFile=0x688f10 | out: hFindFile=0x688f10) returned 1 [0129.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed34) returned 1 [0129.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed40) returned 1 [0129.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edec) returned 1 [0129.105] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Searches", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1f [0129.105] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Searches", nBufferLength=0x1f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Searches", lpFilePart=0x0) returned 0x1e [0129.105] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Searches\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\searches\\*"), lpFindFileData=0x19eb14 | out: lpFindFileData=0x19eb14*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43695fb2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437a1142, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437a1142, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688e50 [0129.105] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43695fb2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437a1142, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437a1142, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0129.105] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x436bc315, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437a1142, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0129.105] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x437a1142, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437a1142, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437a1142, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0129.106] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x4377acca, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4377acca, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x4377acca, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0129.106] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0129.106] FindClose (in: hFindFile=0x688e50 | out: hFindFile=0x688e50) returned 1 [0129.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda8) returned 1 [0129.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb4) returned 1 [0129.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edec) returned 1 [0129.106] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Searches", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1f [0129.106] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Searches", nBufferLength=0x1f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Searches", lpFilePart=0x0) returned 0x1e [0129.106] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Searches\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\searches\\*"), lpFindFileData=0x19eb14 | out: lpFindFileData=0x19eb14*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43695fb2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437a1142, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437a1142, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x689290 [0129.106] FindNextFileW (in: hFindFile=0x689290, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43695fb2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437a1142, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437a1142, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0129.107] FindNextFileW (in: hFindFile=0x689290, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x436bc315, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437a1142, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0129.107] FindNextFileW (in: hFindFile=0x689290, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x437a1142, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437a1142, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437a1142, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0129.107] FindNextFileW (in: hFindFile=0x689290, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x4377acca, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4377acca, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x4377acca, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0129.107] FindNextFileW (in: hFindFile=0x689290, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x4377acca, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4377acca, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x4377acca, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0 [0129.107] FindClose (in: hFindFile=0x689290 | out: hFindFile=0x689290) returned 1 [0129.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda8) returned 1 [0129.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb4) returned 1 [0129.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edec) returned 1 [0129.108] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0129.108] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos", nBufferLength=0x1d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos", lpFilePart=0x0) returned 0x1c [0129.108] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\*"), lpFindFileData=0x19eb14 | out: lpFindFileData=0x19eb14*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x72956115, ftLastAccessTime.dwHighDateTime=0x1d8c12e, ftLastWriteTime.dwLowDateTime=0x72956115, ftLastWriteTime.dwHighDateTime=0x1d8c12e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x689190 [0129.108] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x72956115, ftLastAccessTime.dwHighDateTime=0x1d8c12e, ftLastWriteTime.dwLowDateTime=0x72956115, ftLastWriteTime.dwHighDateTime=0x1d8c12e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0129.108] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacdec5b0, ftCreationTime.dwHighDateTime=0x1d8bd25, ftLastAccessTime.dwLowDateTime=0xc7bc9d80, ftLastAccessTime.dwHighDateTime=0x1d8bd75, ftLastWriteTime.dwLowDateTime=0xc7bc9d80, ftLastWriteTime.dwHighDateTime=0x1d8bd75, nFileSizeHigh=0x0, nFileSizeLow=0x157eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="-cAxil.mp4", cAlternateFileName="")) returned 1 [0129.108] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfcf59d0, ftCreationTime.dwHighDateTime=0x1d8bea8, ftLastAccessTime.dwLowDateTime=0x41612dd0, ftLastAccessTime.dwHighDateTime=0x1d8c128, ftLastWriteTime.dwLowDateTime=0x41612dd0, ftLastWriteTime.dwHighDateTime=0x1d8c128, nFileSizeHigh=0x0, nFileSizeLow=0xf173, dwReserved0=0x0, dwReserved1=0x0, cFileName="23WDO ZYI.avi", cAlternateFileName="23WDOZ~1.AVI")) returned 1 [0129.109] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ebe1bf0, ftCreationTime.dwHighDateTime=0x1d8baac, ftLastAccessTime.dwLowDateTime=0xab8a2980, ftLastAccessTime.dwHighDateTime=0x1d8be96, ftLastWriteTime.dwLowDateTime=0xab8a2980, ftLastWriteTime.dwHighDateTime=0x1d8be96, nFileSizeHigh=0x0, nFileSizeLow=0x116b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="2ivAWd92Lo3SA8a.avi", cAlternateFileName="2IVAWD~1.AVI")) returned 1 [0129.109] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4d17e0, ftCreationTime.dwHighDateTime=0x1d8c0a8, ftLastAccessTime.dwLowDateTime=0x81b9a230, ftLastAccessTime.dwHighDateTime=0x1d8c0c0, ftLastWriteTime.dwLowDateTime=0x81b9a230, ftLastWriteTime.dwHighDateTime=0x1d8c0c0, nFileSizeHigh=0x0, nFileSizeLow=0x309a, dwReserved0=0x0, dwReserved1=0x0, cFileName="2wWr9euR5Vz.swf", cAlternateFileName="2WWR9E~1.SWF")) returned 1 [0129.109] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x341be1b0, ftCreationTime.dwHighDateTime=0x1d8bfe8, ftLastAccessTime.dwLowDateTime=0x5074f160, ftLastAccessTime.dwHighDateTime=0x1d8c044, ftLastWriteTime.dwLowDateTime=0x5074f160, ftLastWriteTime.dwHighDateTime=0x1d8c044, nFileSizeHigh=0x0, nFileSizeLow=0xb311, dwReserved0=0x0, dwReserved1=0x0, cFileName="4DG-or0-b.avi", cAlternateFileName="4DG-OR~1.AVI")) returned 1 [0129.109] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77d12810, ftCreationTime.dwHighDateTime=0x1d8be40, ftLastAccessTime.dwLowDateTime=0xd5706680, ftLastAccessTime.dwHighDateTime=0x1d8c0b0, ftLastWriteTime.dwLowDateTime=0xd5706680, ftLastWriteTime.dwHighDateTime=0x1d8c0b0, nFileSizeHigh=0x0, nFileSizeLow=0xe626, dwReserved0=0x0, dwReserved1=0x0, cFileName="51mUVK4.mkv", cAlternateFileName="")) returned 1 [0129.109] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fb48a40, ftCreationTime.dwHighDateTime=0x1d8b4dc, ftLastAccessTime.dwLowDateTime=0xa6223760, ftLastAccessTime.dwHighDateTime=0x1d8bee8, ftLastWriteTime.dwLowDateTime=0xa6223760, ftLastWriteTime.dwHighDateTime=0x1d8bee8, nFileSizeHigh=0x0, nFileSizeLow=0xcea1, dwReserved0=0x0, dwReserved1=0x0, cFileName="85VAmns.avi", cAlternateFileName="")) returned 1 [0129.109] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3583bf80, ftCreationTime.dwHighDateTime=0x1d8b76b, ftLastAccessTime.dwLowDateTime=0x5f9166e0, ftLastAccessTime.dwHighDateTime=0x1d8bfb5, ftLastWriteTime.dwLowDateTime=0x5f9166e0, ftLastWriteTime.dwHighDateTime=0x1d8bfb5, nFileSizeHigh=0x0, nFileSizeLow=0xf239, dwReserved0=0x0, dwReserved1=0x0, cFileName="A-MC1ceN9T2G9.mkv", cAlternateFileName="A-MC1C~1.MKV")) returned 1 [0129.109] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca99ffc0, ftCreationTime.dwHighDateTime=0x1d8bc08, ftLastAccessTime.dwLowDateTime=0x46fc2220, ftLastAccessTime.dwHighDateTime=0x1d8befa, ftLastWriteTime.dwLowDateTime=0x46fc2220, ftLastWriteTime.dwHighDateTime=0x1d8befa, nFileSizeHigh=0x0, nFileSizeLow=0x56e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="a7_2ItM9Fk.mkv", cAlternateFileName="A7_2IT~1.MKV")) returned 1 [0129.110] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbafb9ea0, ftCreationTime.dwHighDateTime=0x1d8b197, ftLastAccessTime.dwLowDateTime=0x756c91b0, ftLastAccessTime.dwHighDateTime=0x1d8c091, ftLastWriteTime.dwLowDateTime=0x756c91b0, ftLastWriteTime.dwHighDateTime=0x1d8c091, nFileSizeHigh=0x0, nFileSizeLow=0x11a03, dwReserved0=0x0, dwReserved1=0x0, cFileName="B7N7KqDrR.mkv", cAlternateFileName="B7N7KQ~1.MKV")) returned 1 [0129.110] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffe65b80, ftCreationTime.dwHighDateTime=0x1d8bc97, ftLastAccessTime.dwLowDateTime=0x90c09c0, ftLastAccessTime.dwHighDateTime=0x1d8bcc6, ftLastWriteTime.dwLowDateTime=0x90c09c0, ftLastWriteTime.dwHighDateTime=0x1d8bcc6, nFileSizeHigh=0x0, nFileSizeLow=0x3ea1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BjUmhphWyEAYYO.mp4", cAlternateFileName="BJUMHP~1.MP4")) returned 1 [0129.110] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcedb4da0, ftCreationTime.dwHighDateTime=0x1d8c013, ftLastAccessTime.dwLowDateTime=0xb18221d0, ftLastAccessTime.dwHighDateTime=0x1d8c111, ftLastWriteTime.dwLowDateTime=0xb18221d0, ftLastWriteTime.dwHighDateTime=0x1d8c111, nFileSizeHigh=0x0, nFileSizeLow=0xb68d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BoiFgH0vw1T6k.mp4", cAlternateFileName="BOIFGH~1.MP4")) returned 1 [0129.110] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ef42120, ftCreationTime.dwHighDateTime=0x1d8b179, ftLastAccessTime.dwLowDateTime=0x60b2bcc0, ftLastAccessTime.dwHighDateTime=0x1d8bfb2, ftLastWriteTime.dwLowDateTime=0x60b2bcc0, ftLastWriteTime.dwHighDateTime=0x1d8bfb2, nFileSizeHigh=0x0, nFileSizeLow=0x3c5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CPp1byDqsSfWme.mp4", cAlternateFileName="CPP1BY~1.MP4")) returned 1 [0129.110] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f1243a0, ftCreationTime.dwHighDateTime=0x1d8c084, ftLastAccessTime.dwLowDateTime=0x6fdb92c0, ftLastAccessTime.dwHighDateTime=0x1d8c0ee, ftLastWriteTime.dwLowDateTime=0x6fdb92c0, ftLastWriteTime.dwHighDateTime=0x1d8c0ee, nFileSizeHigh=0x0, nFileSizeLow=0x3741, dwReserved0=0x0, dwReserved1=0x0, cFileName="c_1zZ88519M.mkv", cAlternateFileName="C_1ZZ8~1.MKV")) returned 1 [0129.110] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4347fe61, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4347fe61, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0129.111] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47937d70, ftCreationTime.dwHighDateTime=0x1d8bdb8, ftLastAccessTime.dwLowDateTime=0xe7bc1f20, ftLastAccessTime.dwHighDateTime=0x1d8be01, ftLastWriteTime.dwLowDateTime=0xe7bc1f20, ftLastWriteTime.dwHighDateTime=0x1d8be01, nFileSizeHigh=0x0, nFileSizeLow=0x449b, dwReserved0=0x0, dwReserved1=0x0, cFileName="DJ9dTzhHBcmwI.mp4", cAlternateFileName="DJ9DTZ~1.MP4")) returned 1 [0129.111] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c3514a0, ftCreationTime.dwHighDateTime=0x1d8b425, ftLastAccessTime.dwLowDateTime=0x807c8a30, ftLastAccessTime.dwHighDateTime=0x1d8b8b0, ftLastWriteTime.dwLowDateTime=0x807c8a30, ftLastWriteTime.dwHighDateTime=0x1d8b8b0, nFileSizeHigh=0x0, nFileSizeLow=0x175c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="dVIDp8o-i_Wgis5.swf", cAlternateFileName="DVIDP8~1.SWF")) returned 1 [0129.111] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1798b260, ftCreationTime.dwHighDateTime=0x1d8ba76, ftLastAccessTime.dwLowDateTime=0xfdf1a0d0, ftLastAccessTime.dwHighDateTime=0x1d8c04f, ftLastWriteTime.dwLowDateTime=0xfdf1a0d0, ftLastWriteTime.dwHighDateTime=0x1d8c04f, nFileSizeHigh=0x0, nFileSizeLow=0x39f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="EMzDrTHg.swf", cAlternateFileName="")) returned 1 [0129.111] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c420e60, ftCreationTime.dwHighDateTime=0x1d8be00, ftLastAccessTime.dwLowDateTime=0xf6b0d00, ftLastAccessTime.dwHighDateTime=0x1d8bf5c, ftLastWriteTime.dwLowDateTime=0xf6b0d00, ftLastWriteTime.dwHighDateTime=0x1d8bf5c, nFileSizeHigh=0x0, nFileSizeLow=0xa03d, dwReserved0=0x0, dwReserved1=0x0, cFileName="gD53lPKuO9VZtBOhkY.flv", cAlternateFileName="GD53LP~1.FLV")) returned 1 [0129.111] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x221e6420, ftCreationTime.dwHighDateTime=0x1d8b6e6, ftLastAccessTime.dwLowDateTime=0xa52ce0b0, ftLastAccessTime.dwHighDateTime=0x1d8b72e, ftLastWriteTime.dwLowDateTime=0xa52ce0b0, ftLastWriteTime.dwHighDateTime=0x1d8b72e, nFileSizeHigh=0x0, nFileSizeLow=0x17b7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ivSRCgqP 6nWap.flv", cAlternateFileName="IVSRCG~1.FLV")) returned 1 [0129.111] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca67b580, ftCreationTime.dwHighDateTime=0x1d8bba2, ftLastAccessTime.dwLowDateTime=0x9ee04f90, ftLastAccessTime.dwHighDateTime=0x1d8bc91, ftLastWriteTime.dwLowDateTime=0x9ee04f90, ftLastWriteTime.dwHighDateTime=0x1d8bc91, nFileSizeHigh=0x0, nFileSizeLow=0xcc55, dwReserved0=0x0, dwReserved1=0x0, cFileName="jTMNBZorE3Sk2mH.mp4", cAlternateFileName="JTMNBZ~1.MP4")) returned 1 [0129.111] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d6e0b0, ftCreationTime.dwHighDateTime=0x1d8bf80, ftLastAccessTime.dwLowDateTime=0xae86d20, ftLastAccessTime.dwHighDateTime=0x1d8c0f3, ftLastWriteTime.dwLowDateTime=0xae86d20, ftLastWriteTime.dwHighDateTime=0x1d8c0f3, nFileSizeHigh=0x0, nFileSizeLow=0x10faf, dwReserved0=0x0, dwReserved1=0x0, cFileName="KbDpI-xXRv_7VEG.mkv", cAlternateFileName="KBDPI-~1.MKV")) returned 1 [0129.112] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67abbe10, ftCreationTime.dwHighDateTime=0x1d8bf7f, ftLastAccessTime.dwLowDateTime=0x7b4b6ab0, ftLastAccessTime.dwHighDateTime=0x1d8c001, ftLastWriteTime.dwLowDateTime=0x7b4b6ab0, ftLastWriteTime.dwHighDateTime=0x1d8c001, nFileSizeHigh=0x0, nFileSizeLow=0xc573, dwReserved0=0x0, dwReserved1=0x0, cFileName="kJaRlROETbuz_IQQ.mkv", cAlternateFileName="KJARLR~1.MKV")) returned 1 [0129.112] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded23aa0, ftCreationTime.dwHighDateTime=0x1d8bff2, ftLastAccessTime.dwLowDateTime=0xcc8cae90, ftLastAccessTime.dwHighDateTime=0x1d8c117, ftLastWriteTime.dwLowDateTime=0xcc8cae90, ftLastWriteTime.dwHighDateTime=0x1d8c117, nFileSizeHigh=0x0, nFileSizeLow=0x1014d, dwReserved0=0x0, dwReserved1=0x0, cFileName="kPWM3d8k.flv", cAlternateFileName="")) returned 1 [0129.112] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcad415f0, ftCreationTime.dwHighDateTime=0x1d8b31d, ftLastAccessTime.dwLowDateTime=0x46812970, ftLastAccessTime.dwHighDateTime=0x1d8bdc0, ftLastWriteTime.dwLowDateTime=0x46812970, ftLastWriteTime.dwHighDateTime=0x1d8bdc0, nFileSizeHigh=0x0, nFileSizeLow=0xd200, dwReserved0=0x0, dwReserved1=0x0, cFileName="KzvmjeS9u5blrKG8z6.flv", cAlternateFileName="KZVMJE~1.FLV")) returned 1 [0129.112] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ec3cc90, ftCreationTime.dwHighDateTime=0x1d8b352, ftLastAccessTime.dwLowDateTime=0xa45eef20, ftLastAccessTime.dwHighDateTime=0x1d8bb5c, ftLastWriteTime.dwLowDateTime=0xa45eef20, ftLastWriteTime.dwHighDateTime=0x1d8bb5c, nFileSizeHigh=0x0, nFileSizeLow=0x8a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="oBaQE.swf", cAlternateFileName="")) returned 1 [0129.112] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f8f96d0, ftCreationTime.dwHighDateTime=0x1d8b45e, ftLastAccessTime.dwLowDateTime=0x79935ee0, ftLastAccessTime.dwHighDateTime=0x1d8ba79, ftLastWriteTime.dwLowDateTime=0x79935ee0, ftLastWriteTime.dwHighDateTime=0x1d8ba79, nFileSizeHigh=0x0, nFileSizeLow=0xe006, dwReserved0=0x0, dwReserved1=0x0, cFileName="phff.swf", cAlternateFileName="")) returned 1 [0129.112] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e4752b0, ftCreationTime.dwHighDateTime=0x1d8bdea, ftLastAccessTime.dwLowDateTime=0x37ca4f90, ftLastAccessTime.dwHighDateTime=0x1d8c0ec, ftLastWriteTime.dwLowDateTime=0x37ca4f90, ftLastWriteTime.dwHighDateTime=0x1d8c0ec, nFileSizeHigh=0x0, nFileSizeLow=0x71db, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTALwjeAzijTw40Ply.swf", cAlternateFileName="TTALWJ~1.SWF")) returned 1 [0129.112] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49fc7770, ftCreationTime.dwHighDateTime=0x1d8b1e1, ftLastAccessTime.dwLowDateTime=0x846620a0, ftLastAccessTime.dwHighDateTime=0x1d8bdb7, ftLastWriteTime.dwLowDateTime=0x846620a0, ftLastWriteTime.dwHighDateTime=0x1d8bdb7, nFileSizeHigh=0x0, nFileSizeLow=0x16db5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tynr_.swf", cAlternateFileName="")) returned 1 [0129.113] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc9f0900, ftCreationTime.dwHighDateTime=0x1d8b813, ftLastAccessTime.dwLowDateTime=0x4f4f20, ftLastAccessTime.dwHighDateTime=0x1d8bf0c, ftLastWriteTime.dwLowDateTime=0x4f4f20, ftLastWriteTime.dwHighDateTime=0x1d8bf0c, nFileSizeHigh=0x0, nFileSizeLow=0x371d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ue6Gzt3ITeB7E.mp4", cAlternateFileName="UE6GZT~1.MP4")) returned 1 [0129.113] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff44830, ftCreationTime.dwHighDateTime=0x1d8b80b, ftLastAccessTime.dwLowDateTime=0x58586940, ftLastAccessTime.dwHighDateTime=0x1d8baac, ftLastWriteTime.dwLowDateTime=0x58586940, ftLastWriteTime.dwHighDateTime=0x1d8baac, nFileSizeHigh=0x0, nFileSizeLow=0xe8cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="UlOhL.flv", cAlternateFileName="")) returned 1 [0129.113] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4b6ccd0, ftCreationTime.dwHighDateTime=0x1d8b364, ftLastAccessTime.dwLowDateTime=0x25fd24a0, ftLastAccessTime.dwHighDateTime=0x1d8b849, ftLastWriteTime.dwLowDateTime=0x25fd24a0, ftLastWriteTime.dwHighDateTime=0x1d8b849, nFileSizeHigh=0x0, nFileSizeLow=0xbe7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VLZH24-yjIUtKgUNNUg.avi", cAlternateFileName="VLZH24~1.AVI")) returned 1 [0129.113] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f38d3d0, ftCreationTime.dwHighDateTime=0x1d8b4eb, ftLastAccessTime.dwLowDateTime=0x42435710, ftLastAccessTime.dwHighDateTime=0x1d8b6cd, ftLastWriteTime.dwLowDateTime=0x42435710, ftLastWriteTime.dwHighDateTime=0x1d8b6cd, nFileSizeHigh=0x0, nFileSizeLow=0x1282d, dwReserved0=0x0, dwReserved1=0x0, cFileName="voHnl GNKaLfJq0z.mkv", cAlternateFileName="VOHNLG~1.MKV")) returned 1 [0129.113] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa390c830, ftCreationTime.dwHighDateTime=0x1d8b2e1, ftLastAccessTime.dwLowDateTime=0xb3ba3d60, ftLastAccessTime.dwHighDateTime=0x1d8b622, ftLastWriteTime.dwLowDateTime=0xb3ba3d60, ftLastWriteTime.dwHighDateTime=0x1d8b622, nFileSizeHigh=0x0, nFileSizeLow=0x13d43, dwReserved0=0x0, dwReserved1=0x0, cFileName="w XRd.flv", cAlternateFileName="WXRD~1.FLV")) returned 1 [0129.114] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6792a150, ftCreationTime.dwHighDateTime=0x1d8b57a, ftLastAccessTime.dwLowDateTime=0x7e29b730, ftLastAccessTime.dwHighDateTime=0x1d8c01c, ftLastWriteTime.dwLowDateTime=0x7e29b730, ftLastWriteTime.dwHighDateTime=0x1d8c01c, nFileSizeHigh=0x0, nFileSizeLow=0x8c4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="W1H9qw8y.mkv", cAlternateFileName="")) returned 1 [0129.114] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9faa4810, ftCreationTime.dwHighDateTime=0x1d8b406, ftLastAccessTime.dwLowDateTime=0x97b45be0, ftLastAccessTime.dwHighDateTime=0x1d8b678, ftLastWriteTime.dwLowDateTime=0x97b45be0, ftLastWriteTime.dwHighDateTime=0x1d8b678, nFileSizeHigh=0x0, nFileSizeLow=0x135c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="y60hRw2hk0le.flv", cAlternateFileName="Y60HRW~1.FLV")) returned 1 [0129.114] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f5fafe0, ftCreationTime.dwHighDateTime=0x1d8b579, ftLastAccessTime.dwLowDateTime=0x8d91d880, ftLastAccessTime.dwHighDateTime=0x1d8b836, ftLastWriteTime.dwLowDateTime=0x8d91d880, ftLastWriteTime.dwHighDateTime=0x1d8b836, nFileSizeHigh=0x0, nFileSizeLow=0xf461, dwReserved0=0x0, dwReserved1=0x0, cFileName="zGMZOxL0WD.avi", cAlternateFileName="ZGMZOX~1.AVI")) returned 1 [0129.114] FindNextFileW (in: hFindFile=0x689190, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0129.114] FindClose (in: hFindFile=0x689190 | out: hFindFile=0x689190) returned 1 [0129.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda8) returned 1 [0129.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb4) returned 1 [0129.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edec) returned 1 [0129.115] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0129.115] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos", nBufferLength=0x1d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos", lpFilePart=0x0) returned 0x1c [0129.115] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\*"), lpFindFileData=0x19eb14 | out: lpFindFileData=0x19eb14*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x72956115, ftLastAccessTime.dwHighDateTime=0x1d8c12e, ftLastWriteTime.dwLowDateTime=0x72956115, ftLastWriteTime.dwHighDateTime=0x1d8c12e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x688e50 [0129.115] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x72956115, ftLastAccessTime.dwHighDateTime=0x1d8c12e, ftLastWriteTime.dwLowDateTime=0x72956115, ftLastWriteTime.dwHighDateTime=0x1d8c12e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0129.115] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacdec5b0, ftCreationTime.dwHighDateTime=0x1d8bd25, ftLastAccessTime.dwLowDateTime=0xc7bc9d80, ftLastAccessTime.dwHighDateTime=0x1d8bd75, ftLastWriteTime.dwLowDateTime=0xc7bc9d80, ftLastWriteTime.dwHighDateTime=0x1d8bd75, nFileSizeHigh=0x0, nFileSizeLow=0x157eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="-cAxil.mp4", cAlternateFileName="")) returned 1 [0129.116] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfcf59d0, ftCreationTime.dwHighDateTime=0x1d8bea8, ftLastAccessTime.dwLowDateTime=0x41612dd0, ftLastAccessTime.dwHighDateTime=0x1d8c128, ftLastWriteTime.dwLowDateTime=0x41612dd0, ftLastWriteTime.dwHighDateTime=0x1d8c128, nFileSizeHigh=0x0, nFileSizeLow=0xf173, dwReserved0=0x0, dwReserved1=0x0, cFileName="23WDO ZYI.avi", cAlternateFileName="23WDOZ~1.AVI")) returned 1 [0129.116] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ebe1bf0, ftCreationTime.dwHighDateTime=0x1d8baac, ftLastAccessTime.dwLowDateTime=0xab8a2980, ftLastAccessTime.dwHighDateTime=0x1d8be96, ftLastWriteTime.dwLowDateTime=0xab8a2980, ftLastWriteTime.dwHighDateTime=0x1d8be96, nFileSizeHigh=0x0, nFileSizeLow=0x116b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="2ivAWd92Lo3SA8a.avi", cAlternateFileName="2IVAWD~1.AVI")) returned 1 [0129.116] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4d17e0, ftCreationTime.dwHighDateTime=0x1d8c0a8, ftLastAccessTime.dwLowDateTime=0x81b9a230, ftLastAccessTime.dwHighDateTime=0x1d8c0c0, ftLastWriteTime.dwLowDateTime=0x81b9a230, ftLastWriteTime.dwHighDateTime=0x1d8c0c0, nFileSizeHigh=0x0, nFileSizeLow=0x309a, dwReserved0=0x0, dwReserved1=0x0, cFileName="2wWr9euR5Vz.swf", cAlternateFileName="2WWR9E~1.SWF")) returned 1 [0129.116] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x341be1b0, ftCreationTime.dwHighDateTime=0x1d8bfe8, ftLastAccessTime.dwLowDateTime=0x5074f160, ftLastAccessTime.dwHighDateTime=0x1d8c044, ftLastWriteTime.dwLowDateTime=0x5074f160, ftLastWriteTime.dwHighDateTime=0x1d8c044, nFileSizeHigh=0x0, nFileSizeLow=0xb311, dwReserved0=0x0, dwReserved1=0x0, cFileName="4DG-or0-b.avi", cAlternateFileName="4DG-OR~1.AVI")) returned 1 [0129.116] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77d12810, ftCreationTime.dwHighDateTime=0x1d8be40, ftLastAccessTime.dwLowDateTime=0xd5706680, ftLastAccessTime.dwHighDateTime=0x1d8c0b0, ftLastWriteTime.dwLowDateTime=0xd5706680, ftLastWriteTime.dwHighDateTime=0x1d8c0b0, nFileSizeHigh=0x0, nFileSizeLow=0xe626, dwReserved0=0x0, dwReserved1=0x0, cFileName="51mUVK4.mkv", cAlternateFileName="")) returned 1 [0129.117] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fb48a40, ftCreationTime.dwHighDateTime=0x1d8b4dc, ftLastAccessTime.dwLowDateTime=0xa6223760, ftLastAccessTime.dwHighDateTime=0x1d8bee8, ftLastWriteTime.dwLowDateTime=0xa6223760, ftLastWriteTime.dwHighDateTime=0x1d8bee8, nFileSizeHigh=0x0, nFileSizeLow=0xcea1, dwReserved0=0x0, dwReserved1=0x0, cFileName="85VAmns.avi", cAlternateFileName="")) returned 1 [0129.117] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3583bf80, ftCreationTime.dwHighDateTime=0x1d8b76b, ftLastAccessTime.dwLowDateTime=0x5f9166e0, ftLastAccessTime.dwHighDateTime=0x1d8bfb5, ftLastWriteTime.dwLowDateTime=0x5f9166e0, ftLastWriteTime.dwHighDateTime=0x1d8bfb5, nFileSizeHigh=0x0, nFileSizeLow=0xf239, dwReserved0=0x0, dwReserved1=0x0, cFileName="A-MC1ceN9T2G9.mkv", cAlternateFileName="A-MC1C~1.MKV")) returned 1 [0129.117] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca99ffc0, ftCreationTime.dwHighDateTime=0x1d8bc08, ftLastAccessTime.dwLowDateTime=0x46fc2220, ftLastAccessTime.dwHighDateTime=0x1d8befa, ftLastWriteTime.dwLowDateTime=0x46fc2220, ftLastWriteTime.dwHighDateTime=0x1d8befa, nFileSizeHigh=0x0, nFileSizeLow=0x56e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="a7_2ItM9Fk.mkv", cAlternateFileName="A7_2IT~1.MKV")) returned 1 [0129.117] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbafb9ea0, ftCreationTime.dwHighDateTime=0x1d8b197, ftLastAccessTime.dwLowDateTime=0x756c91b0, ftLastAccessTime.dwHighDateTime=0x1d8c091, ftLastWriteTime.dwLowDateTime=0x756c91b0, ftLastWriteTime.dwHighDateTime=0x1d8c091, nFileSizeHigh=0x0, nFileSizeLow=0x11a03, dwReserved0=0x0, dwReserved1=0x0, cFileName="B7N7KqDrR.mkv", cAlternateFileName="B7N7KQ~1.MKV")) returned 1 [0129.117] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffe65b80, ftCreationTime.dwHighDateTime=0x1d8bc97, ftLastAccessTime.dwLowDateTime=0x90c09c0, ftLastAccessTime.dwHighDateTime=0x1d8bcc6, ftLastWriteTime.dwLowDateTime=0x90c09c0, ftLastWriteTime.dwHighDateTime=0x1d8bcc6, nFileSizeHigh=0x0, nFileSizeLow=0x3ea1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BjUmhphWyEAYYO.mp4", cAlternateFileName="BJUMHP~1.MP4")) returned 1 [0129.117] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcedb4da0, ftCreationTime.dwHighDateTime=0x1d8c013, ftLastAccessTime.dwLowDateTime=0xb18221d0, ftLastAccessTime.dwHighDateTime=0x1d8c111, ftLastWriteTime.dwLowDateTime=0xb18221d0, ftLastWriteTime.dwHighDateTime=0x1d8c111, nFileSizeHigh=0x0, nFileSizeLow=0xb68d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BoiFgH0vw1T6k.mp4", cAlternateFileName="BOIFGH~1.MP4")) returned 1 [0129.118] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ef42120, ftCreationTime.dwHighDateTime=0x1d8b179, ftLastAccessTime.dwLowDateTime=0x60b2bcc0, ftLastAccessTime.dwHighDateTime=0x1d8bfb2, ftLastWriteTime.dwLowDateTime=0x60b2bcc0, ftLastWriteTime.dwHighDateTime=0x1d8bfb2, nFileSizeHigh=0x0, nFileSizeLow=0x3c5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CPp1byDqsSfWme.mp4", cAlternateFileName="CPP1BY~1.MP4")) returned 1 [0129.118] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f1243a0, ftCreationTime.dwHighDateTime=0x1d8c084, ftLastAccessTime.dwLowDateTime=0x6fdb92c0, ftLastAccessTime.dwHighDateTime=0x1d8c0ee, ftLastWriteTime.dwLowDateTime=0x6fdb92c0, ftLastWriteTime.dwHighDateTime=0x1d8c0ee, nFileSizeHigh=0x0, nFileSizeLow=0x3741, dwReserved0=0x0, dwReserved1=0x0, cFileName="c_1zZ88519M.mkv", cAlternateFileName="C_1ZZ8~1.MKV")) returned 1 [0129.118] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4347fe61, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4347fe61, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0129.118] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47937d70, ftCreationTime.dwHighDateTime=0x1d8bdb8, ftLastAccessTime.dwLowDateTime=0xe7bc1f20, ftLastAccessTime.dwHighDateTime=0x1d8be01, ftLastWriteTime.dwLowDateTime=0xe7bc1f20, ftLastWriteTime.dwHighDateTime=0x1d8be01, nFileSizeHigh=0x0, nFileSizeLow=0x449b, dwReserved0=0x0, dwReserved1=0x0, cFileName="DJ9dTzhHBcmwI.mp4", cAlternateFileName="DJ9DTZ~1.MP4")) returned 1 [0129.118] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c3514a0, ftCreationTime.dwHighDateTime=0x1d8b425, ftLastAccessTime.dwLowDateTime=0x807c8a30, ftLastAccessTime.dwHighDateTime=0x1d8b8b0, ftLastWriteTime.dwLowDateTime=0x807c8a30, ftLastWriteTime.dwHighDateTime=0x1d8b8b0, nFileSizeHigh=0x0, nFileSizeLow=0x175c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="dVIDp8o-i_Wgis5.swf", cAlternateFileName="DVIDP8~1.SWF")) returned 1 [0129.119] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1798b260, ftCreationTime.dwHighDateTime=0x1d8ba76, ftLastAccessTime.dwLowDateTime=0xfdf1a0d0, ftLastAccessTime.dwHighDateTime=0x1d8c04f, ftLastWriteTime.dwLowDateTime=0xfdf1a0d0, ftLastWriteTime.dwHighDateTime=0x1d8c04f, nFileSizeHigh=0x0, nFileSizeLow=0x39f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="EMzDrTHg.swf", cAlternateFileName="")) returned 1 [0129.119] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c420e60, ftCreationTime.dwHighDateTime=0x1d8be00, ftLastAccessTime.dwLowDateTime=0xf6b0d00, ftLastAccessTime.dwHighDateTime=0x1d8bf5c, ftLastWriteTime.dwLowDateTime=0xf6b0d00, ftLastWriteTime.dwHighDateTime=0x1d8bf5c, nFileSizeHigh=0x0, nFileSizeLow=0xa03d, dwReserved0=0x0, dwReserved1=0x0, cFileName="gD53lPKuO9VZtBOhkY.flv", cAlternateFileName="GD53LP~1.FLV")) returned 1 [0129.119] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x221e6420, ftCreationTime.dwHighDateTime=0x1d8b6e6, ftLastAccessTime.dwLowDateTime=0xa52ce0b0, ftLastAccessTime.dwHighDateTime=0x1d8b72e, ftLastWriteTime.dwLowDateTime=0xa52ce0b0, ftLastWriteTime.dwHighDateTime=0x1d8b72e, nFileSizeHigh=0x0, nFileSizeLow=0x17b7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ivSRCgqP 6nWap.flv", cAlternateFileName="IVSRCG~1.FLV")) returned 1 [0129.119] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca67b580, ftCreationTime.dwHighDateTime=0x1d8bba2, ftLastAccessTime.dwLowDateTime=0x9ee04f90, ftLastAccessTime.dwHighDateTime=0x1d8bc91, ftLastWriteTime.dwLowDateTime=0x9ee04f90, ftLastWriteTime.dwHighDateTime=0x1d8bc91, nFileSizeHigh=0x0, nFileSizeLow=0xcc55, dwReserved0=0x0, dwReserved1=0x0, cFileName="jTMNBZorE3Sk2mH.mp4", cAlternateFileName="JTMNBZ~1.MP4")) returned 1 [0129.119] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d6e0b0, ftCreationTime.dwHighDateTime=0x1d8bf80, ftLastAccessTime.dwLowDateTime=0xae86d20, ftLastAccessTime.dwHighDateTime=0x1d8c0f3, ftLastWriteTime.dwLowDateTime=0xae86d20, ftLastWriteTime.dwHighDateTime=0x1d8c0f3, nFileSizeHigh=0x0, nFileSizeLow=0x10faf, dwReserved0=0x0, dwReserved1=0x0, cFileName="KbDpI-xXRv_7VEG.mkv", cAlternateFileName="KBDPI-~1.MKV")) returned 1 [0129.119] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67abbe10, ftCreationTime.dwHighDateTime=0x1d8bf7f, ftLastAccessTime.dwLowDateTime=0x7b4b6ab0, ftLastAccessTime.dwHighDateTime=0x1d8c001, ftLastWriteTime.dwLowDateTime=0x7b4b6ab0, ftLastWriteTime.dwHighDateTime=0x1d8c001, nFileSizeHigh=0x0, nFileSizeLow=0xc573, dwReserved0=0x0, dwReserved1=0x0, cFileName="kJaRlROETbuz_IQQ.mkv", cAlternateFileName="KJARLR~1.MKV")) returned 1 [0129.120] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded23aa0, ftCreationTime.dwHighDateTime=0x1d8bff2, ftLastAccessTime.dwLowDateTime=0xcc8cae90, ftLastAccessTime.dwHighDateTime=0x1d8c117, ftLastWriteTime.dwLowDateTime=0xcc8cae90, ftLastWriteTime.dwHighDateTime=0x1d8c117, nFileSizeHigh=0x0, nFileSizeLow=0x1014d, dwReserved0=0x0, dwReserved1=0x0, cFileName="kPWM3d8k.flv", cAlternateFileName="")) returned 1 [0129.120] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcad415f0, ftCreationTime.dwHighDateTime=0x1d8b31d, ftLastAccessTime.dwLowDateTime=0x46812970, ftLastAccessTime.dwHighDateTime=0x1d8bdc0, ftLastWriteTime.dwLowDateTime=0x46812970, ftLastWriteTime.dwHighDateTime=0x1d8bdc0, nFileSizeHigh=0x0, nFileSizeLow=0xd200, dwReserved0=0x0, dwReserved1=0x0, cFileName="KzvmjeS9u5blrKG8z6.flv", cAlternateFileName="KZVMJE~1.FLV")) returned 1 [0129.120] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ec3cc90, ftCreationTime.dwHighDateTime=0x1d8b352, ftLastAccessTime.dwLowDateTime=0xa45eef20, ftLastAccessTime.dwHighDateTime=0x1d8bb5c, ftLastWriteTime.dwLowDateTime=0xa45eef20, ftLastWriteTime.dwHighDateTime=0x1d8bb5c, nFileSizeHigh=0x0, nFileSizeLow=0x8a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="oBaQE.swf", cAlternateFileName="")) returned 1 [0129.120] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f8f96d0, ftCreationTime.dwHighDateTime=0x1d8b45e, ftLastAccessTime.dwLowDateTime=0x79935ee0, ftLastAccessTime.dwHighDateTime=0x1d8ba79, ftLastWriteTime.dwLowDateTime=0x79935ee0, ftLastWriteTime.dwHighDateTime=0x1d8ba79, nFileSizeHigh=0x0, nFileSizeLow=0xe006, dwReserved0=0x0, dwReserved1=0x0, cFileName="phff.swf", cAlternateFileName="")) returned 1 [0129.121] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e4752b0, ftCreationTime.dwHighDateTime=0x1d8bdea, ftLastAccessTime.dwLowDateTime=0x37ca4f90, ftLastAccessTime.dwHighDateTime=0x1d8c0ec, ftLastWriteTime.dwLowDateTime=0x37ca4f90, ftLastWriteTime.dwHighDateTime=0x1d8c0ec, nFileSizeHigh=0x0, nFileSizeLow=0x71db, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTALwjeAzijTw40Ply.swf", cAlternateFileName="TTALWJ~1.SWF")) returned 1 [0129.121] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49fc7770, ftCreationTime.dwHighDateTime=0x1d8b1e1, ftLastAccessTime.dwLowDateTime=0x846620a0, ftLastAccessTime.dwHighDateTime=0x1d8bdb7, ftLastWriteTime.dwLowDateTime=0x846620a0, ftLastWriteTime.dwHighDateTime=0x1d8bdb7, nFileSizeHigh=0x0, nFileSizeLow=0x16db5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tynr_.swf", cAlternateFileName="")) returned 1 [0129.121] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc9f0900, ftCreationTime.dwHighDateTime=0x1d8b813, ftLastAccessTime.dwLowDateTime=0x4f4f20, ftLastAccessTime.dwHighDateTime=0x1d8bf0c, ftLastWriteTime.dwLowDateTime=0x4f4f20, ftLastWriteTime.dwHighDateTime=0x1d8bf0c, nFileSizeHigh=0x0, nFileSizeLow=0x371d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ue6Gzt3ITeB7E.mp4", cAlternateFileName="UE6GZT~1.MP4")) returned 1 [0129.121] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff44830, ftCreationTime.dwHighDateTime=0x1d8b80b, ftLastAccessTime.dwLowDateTime=0x58586940, ftLastAccessTime.dwHighDateTime=0x1d8baac, ftLastWriteTime.dwLowDateTime=0x58586940, ftLastWriteTime.dwHighDateTime=0x1d8baac, nFileSizeHigh=0x0, nFileSizeLow=0xe8cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="UlOhL.flv", cAlternateFileName="")) returned 1 [0129.121] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4b6ccd0, ftCreationTime.dwHighDateTime=0x1d8b364, ftLastAccessTime.dwLowDateTime=0x25fd24a0, ftLastAccessTime.dwHighDateTime=0x1d8b849, ftLastWriteTime.dwLowDateTime=0x25fd24a0, ftLastWriteTime.dwHighDateTime=0x1d8b849, nFileSizeHigh=0x0, nFileSizeLow=0xbe7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VLZH24-yjIUtKgUNNUg.avi", cAlternateFileName="VLZH24~1.AVI")) returned 1 [0129.121] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f38d3d0, ftCreationTime.dwHighDateTime=0x1d8b4eb, ftLastAccessTime.dwLowDateTime=0x42435710, ftLastAccessTime.dwHighDateTime=0x1d8b6cd, ftLastWriteTime.dwLowDateTime=0x42435710, ftLastWriteTime.dwHighDateTime=0x1d8b6cd, nFileSizeHigh=0x0, nFileSizeLow=0x1282d, dwReserved0=0x0, dwReserved1=0x0, cFileName="voHnl GNKaLfJq0z.mkv", cAlternateFileName="VOHNLG~1.MKV")) returned 1 [0129.122] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa390c830, ftCreationTime.dwHighDateTime=0x1d8b2e1, ftLastAccessTime.dwLowDateTime=0xb3ba3d60, ftLastAccessTime.dwHighDateTime=0x1d8b622, ftLastWriteTime.dwLowDateTime=0xb3ba3d60, ftLastWriteTime.dwHighDateTime=0x1d8b622, nFileSizeHigh=0x0, nFileSizeLow=0x13d43, dwReserved0=0x0, dwReserved1=0x0, cFileName="w XRd.flv", cAlternateFileName="WXRD~1.FLV")) returned 1 [0129.122] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6792a150, ftCreationTime.dwHighDateTime=0x1d8b57a, ftLastAccessTime.dwLowDateTime=0x7e29b730, ftLastAccessTime.dwHighDateTime=0x1d8c01c, ftLastWriteTime.dwLowDateTime=0x7e29b730, ftLastWriteTime.dwHighDateTime=0x1d8c01c, nFileSizeHigh=0x0, nFileSizeLow=0x8c4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="W1H9qw8y.mkv", cAlternateFileName="")) returned 1 [0129.122] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9faa4810, ftCreationTime.dwHighDateTime=0x1d8b406, ftLastAccessTime.dwLowDateTime=0x97b45be0, ftLastAccessTime.dwHighDateTime=0x1d8b678, ftLastWriteTime.dwLowDateTime=0x97b45be0, ftLastWriteTime.dwHighDateTime=0x1d8b678, nFileSizeHigh=0x0, nFileSizeLow=0x135c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="y60hRw2hk0le.flv", cAlternateFileName="Y60HRW~1.FLV")) returned 1 [0129.122] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f5fafe0, ftCreationTime.dwHighDateTime=0x1d8b579, ftLastAccessTime.dwLowDateTime=0x8d91d880, ftLastAccessTime.dwHighDateTime=0x1d8b836, ftLastWriteTime.dwLowDateTime=0x8d91d880, ftLastWriteTime.dwHighDateTime=0x1d8b836, nFileSizeHigh=0x0, nFileSizeLow=0xf461, dwReserved0=0x0, dwReserved1=0x0, cFileName="zGMZOxL0WD.avi", cAlternateFileName="ZGMZOX~1.AVI")) returned 1 [0129.122] FindNextFileW (in: hFindFile=0x688e50, lpFindFileData=0x19eb20 | out: lpFindFileData=0x19eb20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f5fafe0, ftCreationTime.dwHighDateTime=0x1d8b579, ftLastAccessTime.dwLowDateTime=0x8d91d880, ftLastAccessTime.dwHighDateTime=0x1d8b836, ftLastWriteTime.dwLowDateTime=0x8d91d880, ftLastWriteTime.dwHighDateTime=0x1d8b836, nFileSizeHigh=0x0, nFileSizeLow=0xf461, dwReserved0=0x0, dwReserved1=0x0, cFileName="zGMZOxL0WD.avi", cAlternateFileName="ZGMZOX~1.AVI")) returned 0 [0129.122] FindClose (in: hFindFile=0x688e50 | out: hFindFile=0x688e50) returned 1 [0129.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda8) returned 1 [0129.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb4) returned 1 [0129.123] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\-cAxil.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0129.123] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\-cAxil.mp4", nBufferLength=0x28, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\-cAxil.mp4", lpFilePart=0x0) returned 0x27 [0129.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0129.123] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\-cAxil.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\-caxil.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.123] GetFileType (hFile=0x37c) returned 0x1 [0129.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0129.123] GetFileType (hFile=0x37c) returned 0x1 [0129.123] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x157eb [0129.124] ReadFile (in: hFile=0x37c, lpBuffer=0x3597368, nNumberOfBytesToRead=0x157eb, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x3597368*, lpNumberOfBytesRead=0x19ed40*=0x157eb, lpOverlapped=0x0) returned 1 [0129.125] CloseHandle (hObject=0x37c) returned 1 [0129.194] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0129.194] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0129.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0129.194] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0129.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0129.194] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\-cAxil.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0129.194] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\-cAxil.mp4", nBufferLength=0x28, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\-cAxil.mp4", lpFilePart=0x0) returned 0x27 [0129.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0129.195] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\-cAxil.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\-caxil.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.196] GetFileType (hFile=0x37c) returned 0x1 [0129.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0129.196] GetFileType (hFile=0x37c) returned 0x1 [0129.196] WriteFile (in: hFile=0x37c, lpBuffer=0x35acb70*, nNumberOfBytesToWrite=0x157f0, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x35acb70*, lpNumberOfBytesWritten=0x19ed34*=0x157f0, lpOverlapped=0x0) returned 1 [0129.199] CloseHandle (hObject=0x37c) returned 1 [0129.202] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\-cAxil.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0129.202] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\-cAxil.mp4", nBufferLength=0x28, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\-cAxil.mp4", lpFilePart=0x0) returned 0x27 [0129.202] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\-cAxil.mp4.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0129.202] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\-cAxil.mp4.paradox", nBufferLength=0x30, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\-cAxil.mp4.paradox", lpFilePart=0x0) returned 0x2f [0129.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0129.202] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\-cAxil.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\-caxil.mp4"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacdec5b0, ftCreationTime.dwHighDateTime=0x1d8bd25, ftLastAccessTime.dwLowDateTime=0xc7bc9d80, ftLastAccessTime.dwHighDateTime=0x1d8bd75, ftLastWriteTime.dwLowDateTime=0xc52dcad2, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x157f0)) returned 1 [0129.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0129.202] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\-cAxil.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\-caxil.mp4"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\-cAxil.mp4.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\-caxil.mp4.paradox")) returned 1 [0129.203] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\23WDO ZYI.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0129.203] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\23WDO ZYI.avi", nBufferLength=0x2b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\23WDO ZYI.avi", lpFilePart=0x0) returned 0x2a [0129.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0129.203] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\23WDO ZYI.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\23wdo zyi.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.203] GetFileType (hFile=0x37c) returned 0x1 [0129.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0129.203] GetFileType (hFile=0x37c) returned 0x1 [0129.203] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0xf173 [0129.204] ReadFile (in: hFile=0x37c, lpBuffer=0x22eb674, nNumberOfBytesToRead=0xf173, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x22eb674*, lpNumberOfBytesRead=0x19ed40*=0xf173, lpOverlapped=0x0) returned 1 [0129.204] CloseHandle (hObject=0x37c) returned 1 [0129.266] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0129.266] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0129.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0129.266] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0129.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0129.266] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\23WDO ZYI.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0129.266] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\23WDO ZYI.avi", nBufferLength=0x2b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\23WDO ZYI.avi", lpFilePart=0x0) returned 0x2a [0129.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0129.266] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\23WDO ZYI.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\23wdo zyi.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.268] GetFileType (hFile=0x37c) returned 0x1 [0129.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0129.268] GetFileType (hFile=0x37c) returned 0x1 [0129.268] WriteFile (in: hFile=0x37c, lpBuffer=0x2365a50*, nNumberOfBytesToWrite=0xf180, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x2365a50*, lpNumberOfBytesWritten=0x19ed34*=0xf180, lpOverlapped=0x0) returned 1 [0129.271] CloseHandle (hObject=0x37c) returned 1 [0129.273] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\23WDO ZYI.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0129.273] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\23WDO ZYI.avi", nBufferLength=0x2b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\23WDO ZYI.avi", lpFilePart=0x0) returned 0x2a [0129.273] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\23WDO ZYI.avi.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0129.273] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\23WDO ZYI.avi.paradox", nBufferLength=0x33, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\23WDO ZYI.avi.paradox", lpFilePart=0x0) returned 0x32 [0129.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0129.274] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\23WDO ZYI.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\23wdo zyi.avi"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfcf59d0, ftCreationTime.dwHighDateTime=0x1d8bea8, ftLastAccessTime.dwLowDateTime=0x41612dd0, ftLastAccessTime.dwHighDateTime=0x1d8c128, ftLastWriteTime.dwLowDateTime=0xc539b58d, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xf180)) returned 1 [0129.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0129.274] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\23WDO ZYI.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\23wdo zyi.avi"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\23WDO ZYI.avi.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\23wdo zyi.avi.paradox")) returned 1 [0129.274] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\2ivAWd92Lo3SA8a.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0129.275] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\2ivAWd92Lo3SA8a.avi", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\2ivAWd92Lo3SA8a.avi", lpFilePart=0x0) returned 0x30 [0129.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0129.275] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\2ivAWd92Lo3SA8a.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\2ivawd92lo3sa8a.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.275] GetFileType (hFile=0x37c) returned 0x1 [0129.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0129.275] GetFileType (hFile=0x37c) returned 0x1 [0129.275] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x116b7 [0129.275] ReadFile (in: hFile=0x37c, lpBuffer=0x2374e54, nNumberOfBytesToRead=0x116b7, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x2374e54*, lpNumberOfBytesRead=0x19ed40*=0x116b7, lpOverlapped=0x0) returned 1 [0129.276] CloseHandle (hObject=0x37c) returned 1 [0129.295] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0129.295] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0129.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0129.295] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0129.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0129.295] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\2ivAWd92Lo3SA8a.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0129.295] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\2ivAWd92Lo3SA8a.avi", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\2ivAWd92Lo3SA8a.avi", lpFilePart=0x0) returned 0x30 [0129.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0129.295] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\2ivAWd92Lo3SA8a.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\2ivawd92lo3sa8a.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.297] GetFileType (hFile=0x37c) returned 0x1 [0129.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0129.297] GetFileType (hFile=0x37c) returned 0x1 [0129.297] WriteFile (in: hFile=0x37c, lpBuffer=0x23f6094*, nNumberOfBytesToWrite=0x116c0, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x23f6094*, lpNumberOfBytesWritten=0x19ed34*=0x116c0, lpOverlapped=0x0) returned 1 [0129.299] CloseHandle (hObject=0x37c) returned 1 [0129.302] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\2ivAWd92Lo3SA8a.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0129.302] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\2ivAWd92Lo3SA8a.avi", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\2ivAWd92Lo3SA8a.avi", lpFilePart=0x0) returned 0x30 [0129.302] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\2ivAWd92Lo3SA8a.avi.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0129.302] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\2ivAWd92Lo3SA8a.avi.paradox", nBufferLength=0x39, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\2ivAWd92Lo3SA8a.avi.paradox", lpFilePart=0x0) returned 0x38 [0129.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0129.302] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\2ivAWd92Lo3SA8a.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\2ivawd92lo3sa8a.avi"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ebe1bf0, ftCreationTime.dwHighDateTime=0x1d8baac, ftLastAccessTime.dwLowDateTime=0xab8a2980, ftLastAccessTime.dwHighDateTime=0x1d8be96, ftLastWriteTime.dwLowDateTime=0xc53e835c, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x116c0)) returned 1 [0129.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0129.302] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\2ivAWd92Lo3SA8a.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\2ivawd92lo3sa8a.avi"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\2ivAWd92Lo3SA8a.avi.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\2ivawd92lo3sa8a.avi.paradox")) returned 1 [0129.303] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\4DG-or0-b.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0129.303] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\4DG-or0-b.avi", nBufferLength=0x2b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\4DG-or0-b.avi", lpFilePart=0x0) returned 0x2a [0129.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0129.303] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\4DG-or0-b.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\4dg-or0-b.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.303] GetFileType (hFile=0x37c) returned 0x1 [0129.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0129.303] GetFileType (hFile=0x37c) returned 0x1 [0129.303] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0xb311 [0129.304] ReadFile (in: hFile=0x37c, lpBuffer=0x24079fc, nNumberOfBytesToRead=0xb311, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x24079fc*, lpNumberOfBytesRead=0x19ed40*=0xb311, lpOverlapped=0x0) returned 1 [0129.304] CloseHandle (hObject=0x37c) returned 1 [0129.323] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0129.323] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0129.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0129.323] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0129.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0129.323] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\4DG-or0-b.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0129.323] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\4DG-or0-b.avi", nBufferLength=0x2b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\4DG-or0-b.avi", lpFilePart=0x0) returned 0x2a [0129.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0129.323] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\4DG-or0-b.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\4dg-or0-b.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.325] GetFileType (hFile=0x37c) returned 0x1 [0129.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0129.325] GetFileType (hFile=0x37c) returned 0x1 [0129.325] WriteFile (in: hFile=0x37c, lpBuffer=0x247615c*, nNumberOfBytesToWrite=0xb320, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x247615c*, lpNumberOfBytesWritten=0x19ed34*=0xb320, lpOverlapped=0x0) returned 1 [0129.326] CloseHandle (hObject=0x37c) returned 1 [0129.329] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\4DG-or0-b.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0129.329] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\4DG-or0-b.avi", nBufferLength=0x2b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\4DG-or0-b.avi", lpFilePart=0x0) returned 0x2a [0129.329] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\4DG-or0-b.avi.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0129.329] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\4DG-or0-b.avi.paradox", nBufferLength=0x33, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\4DG-or0-b.avi.paradox", lpFilePart=0x0) returned 0x32 [0129.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0129.329] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\4DG-or0-b.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\4dg-or0-b.avi"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x341be1b0, ftCreationTime.dwHighDateTime=0x1d8bfe8, ftLastAccessTime.dwLowDateTime=0x5074f160, ftLastAccessTime.dwHighDateTime=0x1d8c044, ftLastWriteTime.dwLowDateTime=0xc540dd0b, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xb320)) returned 1 [0129.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0129.330] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\4DG-or0-b.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\4dg-or0-b.avi"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\4DG-or0-b.avi.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\4dg-or0-b.avi.paradox")) returned 1 [0129.331] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\51mUVK4.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0129.331] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\51mUVK4.mkv", nBufferLength=0x29, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\51mUVK4.mkv", lpFilePart=0x0) returned 0x28 [0129.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0129.331] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\51mUVK4.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\51muvk4.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.331] GetFileType (hFile=0x37c) returned 0x1 [0129.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0129.331] GetFileType (hFile=0x37c) returned 0x1 [0129.331] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0xe626 [0129.332] ReadFile (in: hFile=0x37c, lpBuffer=0x24816f0, nNumberOfBytesToRead=0xe626, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x24816f0*, lpNumberOfBytesRead=0x19ed40*=0xe626, lpOverlapped=0x0) returned 1 [0129.332] CloseHandle (hObject=0x37c) returned 1 [0129.359] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0129.359] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0129.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0129.359] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0129.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0129.359] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\51mUVK4.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0129.359] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\51mUVK4.mkv", nBufferLength=0x29, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\51mUVK4.mkv", lpFilePart=0x0) returned 0x28 [0129.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0129.360] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\51mUVK4.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\51muvk4.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.361] GetFileType (hFile=0x37c) returned 0x1 [0129.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0129.361] GetFileType (hFile=0x37c) returned 0x1 [0129.361] WriteFile (in: hFile=0x37c, lpBuffer=0x2317070*, nNumberOfBytesToWrite=0xe630, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x2317070*, lpNumberOfBytesWritten=0x19ed34*=0xe630, lpOverlapped=0x0) returned 1 [0129.363] CloseHandle (hObject=0x37c) returned 1 [0129.366] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\51mUVK4.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0129.366] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\51mUVK4.mkv", nBufferLength=0x29, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\51mUVK4.mkv", lpFilePart=0x0) returned 0x28 [0129.366] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\51mUVK4.mkv.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0129.366] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\51mUVK4.mkv.paradox", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\51mUVK4.mkv.paradox", lpFilePart=0x0) returned 0x30 [0129.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0129.366] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\51mUVK4.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\51muvk4.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77d12810, ftCreationTime.dwHighDateTime=0x1d8be40, ftLastAccessTime.dwLowDateTime=0xd5706680, ftLastAccessTime.dwHighDateTime=0x1d8c0b0, ftLastWriteTime.dwLowDateTime=0xc5480529, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xe630)) returned 1 [0129.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0129.366] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\51mUVK4.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\51muvk4.mkv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\51mUVK4.mkv.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\51muvk4.mkv.paradox")) returned 1 [0129.367] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\85VAmns.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0129.367] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\85VAmns.avi", nBufferLength=0x29, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\85VAmns.avi", lpFilePart=0x0) returned 0x28 [0129.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0129.367] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\85VAmns.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\85vamns.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.367] GetFileType (hFile=0x37c) returned 0x1 [0129.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0129.367] GetFileType (hFile=0x37c) returned 0x1 [0129.367] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0xcea1 [0129.367] ReadFile (in: hFile=0x37c, lpBuffer=0x232590c, nNumberOfBytesToRead=0xcea1, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x232590c*, lpNumberOfBytesRead=0x19ed40*=0xcea1, lpOverlapped=0x0) returned 1 [0129.368] CloseHandle (hObject=0x37c) returned 1 [0129.454] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0129.454] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0129.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0129.454] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0129.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0129.454] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\85VAmns.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0129.454] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\85VAmns.avi", nBufferLength=0x29, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\85VAmns.avi", lpFilePart=0x0) returned 0x28 [0129.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0129.454] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\85VAmns.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\85vamns.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.456] GetFileType (hFile=0x37c) returned 0x1 [0129.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0129.456] GetFileType (hFile=0x37c) returned 0x1 [0129.456] WriteFile (in: hFile=0x37c, lpBuffer=0x2399478*, nNumberOfBytesToWrite=0xceb0, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x2399478*, lpNumberOfBytesWritten=0x19ed34*=0xceb0, lpOverlapped=0x0) returned 1 [0129.463] CloseHandle (hObject=0x37c) returned 1 [0129.467] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\85VAmns.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0129.467] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\85VAmns.avi", nBufferLength=0x29, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\85VAmns.avi", lpFilePart=0x0) returned 0x28 [0129.467] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\85VAmns.avi.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0129.467] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\85VAmns.avi.paradox", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\85VAmns.avi.paradox", lpFilePart=0x0) returned 0x30 [0129.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0129.467] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\85VAmns.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\85vamns.avi"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fb48a40, ftCreationTime.dwHighDateTime=0x1d8b4dc, ftLastAccessTime.dwLowDateTime=0xa6223760, ftLastAccessTime.dwHighDateTime=0x1d8bee8, ftLastWriteTime.dwLowDateTime=0xc556523a, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xceb0)) returned 1 [0129.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0129.467] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\85VAmns.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\85vamns.avi"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\85VAmns.avi.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\85vamns.avi.paradox")) returned 1 [0129.469] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\A-MC1ceN9T2G9.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0129.470] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\A-MC1ceN9T2G9.mkv", nBufferLength=0x2f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\A-MC1ceN9T2G9.mkv", lpFilePart=0x0) returned 0x2e [0129.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0129.470] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\A-MC1ceN9T2G9.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\a-mc1cen9t2g9.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.470] GetFileType (hFile=0x37c) returned 0x1 [0129.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0129.470] GetFileType (hFile=0x37c) returned 0x1 [0129.470] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0xf239 [0129.470] ReadFile (in: hFile=0x37c, lpBuffer=0x23a65a0, nNumberOfBytesToRead=0xf239, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x23a65a0*, lpNumberOfBytesRead=0x19ed40*=0xf239, lpOverlapped=0x0) returned 1 [0129.471] CloseHandle (hObject=0x37c) returned 1 [0129.493] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0129.493] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0129.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0129.493] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0129.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0129.494] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\A-MC1ceN9T2G9.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0129.494] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\A-MC1ceN9T2G9.mkv", nBufferLength=0x2f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\A-MC1ceN9T2G9.mkv", lpFilePart=0x0) returned 0x2e [0129.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0129.494] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\A-MC1ceN9T2G9.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\a-mc1cen9t2g9.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.495] GetFileType (hFile=0x37c) returned 0x1 [0129.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0129.495] GetFileType (hFile=0x37c) returned 0x1 [0129.496] WriteFile (in: hFile=0x37c, lpBuffer=0x2420a60*, nNumberOfBytesToWrite=0xf240, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x2420a60*, lpNumberOfBytesWritten=0x19ed34*=0xf240, lpOverlapped=0x0) returned 1 [0129.497] CloseHandle (hObject=0x37c) returned 1 [0129.500] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\A-MC1ceN9T2G9.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0129.500] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\A-MC1ceN9T2G9.mkv", nBufferLength=0x2f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\A-MC1ceN9T2G9.mkv", lpFilePart=0x0) returned 0x2e [0129.500] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\A-MC1ceN9T2G9.mkv.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0129.500] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\A-MC1ceN9T2G9.mkv.paradox", nBufferLength=0x37, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\A-MC1ceN9T2G9.mkv.paradox", lpFilePart=0x0) returned 0x36 [0129.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0129.500] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\A-MC1ceN9T2G9.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\a-mc1cen9t2g9.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3583bf80, ftCreationTime.dwHighDateTime=0x1d8b76b, ftLastAccessTime.dwLowDateTime=0x5f9166e0, ftLastAccessTime.dwHighDateTime=0x1d8bfb5, ftLastWriteTime.dwLowDateTime=0xc55b16ef, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xf240)) returned 1 [0129.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0129.500] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\A-MC1ceN9T2G9.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\a-mc1cen9t2g9.mkv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\A-MC1ceN9T2G9.mkv.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\a-mc1cen9t2g9.mkv.paradox")) returned 1 [0129.501] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\a7_2ItM9Fk.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0129.501] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\a7_2ItM9Fk.mkv", nBufferLength=0x2c, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\a7_2ItM9Fk.mkv", lpFilePart=0x0) returned 0x2b [0129.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0129.501] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\a7_2ItM9Fk.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\a7_2itm9fk.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.501] GetFileType (hFile=0x37c) returned 0x1 [0129.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0129.501] GetFileType (hFile=0x37c) returned 0x1 [0129.501] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x56e1 [0129.502] ReadFile (in: hFile=0x37c, lpBuffer=0x242ff2c, nNumberOfBytesToRead=0x56e1, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x242ff2c*, lpNumberOfBytesRead=0x19ed40*=0x56e1, lpOverlapped=0x0) returned 1 [0129.502] CloseHandle (hObject=0x37c) returned 1 [0129.522] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0129.522] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0129.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0129.522] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0129.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0129.523] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\a7_2ItM9Fk.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0129.523] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\a7_2ItM9Fk.mkv", nBufferLength=0x2c, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\a7_2ItM9Fk.mkv", lpFilePart=0x0) returned 0x2b [0129.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0129.523] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\a7_2ItM9Fk.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\a7_2itm9fk.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.524] GetFileType (hFile=0x37c) returned 0x1 [0129.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0129.524] GetFileType (hFile=0x37c) returned 0x1 [0129.524] WriteFile (in: hFile=0x37c, lpBuffer=0x2497fc8*, nNumberOfBytesToWrite=0x56f0, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x2497fc8*, lpNumberOfBytesWritten=0x19ed34*=0x56f0, lpOverlapped=0x0) returned 1 [0129.526] CloseHandle (hObject=0x37c) returned 1 [0129.527] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\a7_2ItM9Fk.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0129.527] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\a7_2ItM9Fk.mkv", nBufferLength=0x2c, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\a7_2ItM9Fk.mkv", lpFilePart=0x0) returned 0x2b [0129.527] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\a7_2ItM9Fk.mkv.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0129.527] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\a7_2ItM9Fk.mkv.paradox", nBufferLength=0x34, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\a7_2ItM9Fk.mkv.paradox", lpFilePart=0x0) returned 0x33 [0129.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0129.527] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\a7_2ItM9Fk.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\a7_2itm9fk.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca99ffc0, ftCreationTime.dwHighDateTime=0x1d8bc08, ftLastAccessTime.dwLowDateTime=0x46fc2220, ftLastAccessTime.dwHighDateTime=0x1d8befa, ftLastWriteTime.dwLowDateTime=0xc55fdbbd, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x56f0)) returned 1 [0129.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0129.528] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\a7_2ItM9Fk.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\a7_2itm9fk.mkv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\a7_2ItM9Fk.mkv.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\a7_2itm9fk.mkv.paradox")) returned 1 [0129.532] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\B7N7KqDrR.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0129.532] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\B7N7KqDrR.mkv", nBufferLength=0x2b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\B7N7KqDrR.mkv", lpFilePart=0x0) returned 0x2a [0129.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0129.533] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\B7N7KqDrR.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\b7n7kqdrr.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.533] GetFileType (hFile=0x37c) returned 0x1 [0129.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0129.533] GetFileType (hFile=0x37c) returned 0x1 [0129.533] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x11a03 [0129.533] ReadFile (in: hFile=0x37c, lpBuffer=0x249d934, nNumberOfBytesToRead=0x11a03, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x249d934*, lpNumberOfBytesRead=0x19ed40*=0x11a03, lpOverlapped=0x0) returned 1 [0129.534] CloseHandle (hObject=0x37c) returned 1 [0129.581] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0129.581] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0129.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0129.581] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0129.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0129.582] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\B7N7KqDrR.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0129.582] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\B7N7KqDrR.mkv", nBufferLength=0x2b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\B7N7KqDrR.mkv", lpFilePart=0x0) returned 0x2a [0129.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0129.582] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\B7N7KqDrR.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\b7n7kqdrr.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.585] GetFileType (hFile=0x37c) returned 0x1 [0129.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0129.585] GetFileType (hFile=0x37c) returned 0x1 [0129.585] WriteFile (in: hFile=0x37c, lpBuffer=0x233e20c*, nNumberOfBytesToWrite=0x11a10, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x233e20c*, lpNumberOfBytesWritten=0x19ed34*=0x11a10, lpOverlapped=0x0) returned 1 [0129.588] CloseHandle (hObject=0x37c) returned 1 [0129.591] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\B7N7KqDrR.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0129.591] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\B7N7KqDrR.mkv", nBufferLength=0x2b, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\B7N7KqDrR.mkv", lpFilePart=0x0) returned 0x2a [0129.591] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\B7N7KqDrR.mkv.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0129.591] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\B7N7KqDrR.mkv.paradox", nBufferLength=0x33, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\B7N7KqDrR.mkv.paradox", lpFilePart=0x0) returned 0x32 [0129.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0129.591] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\B7N7KqDrR.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\b7n7kqdrr.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbafb9ea0, ftCreationTime.dwHighDateTime=0x1d8b197, ftLastAccessTime.dwLowDateTime=0x756c91b0, ftLastAccessTime.dwHighDateTime=0x1d8c091, ftLastWriteTime.dwLowDateTime=0xc56964d8, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x11a10)) returned 1 [0129.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0129.591] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\B7N7KqDrR.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\b7n7kqdrr.mkv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\B7N7KqDrR.mkv.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\b7n7kqdrr.mkv.paradox")) returned 1 [0129.592] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\BjUmhphWyEAYYO.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0129.592] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\BjUmhphWyEAYYO.mp4", nBufferLength=0x30, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\BjUmhphWyEAYYO.mp4", lpFilePart=0x0) returned 0x2f [0129.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0129.592] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\BjUmhphWyEAYYO.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\bjumhphwyeayyo.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.592] GetFileType (hFile=0x37c) returned 0x1 [0129.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0129.593] GetFileType (hFile=0x37c) returned 0x1 [0129.593] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x3ea1 [0129.593] ReadFile (in: hFile=0x37c, lpBuffer=0x234fea0, nNumberOfBytesToRead=0x3ea1, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x234fea0*, lpNumberOfBytesRead=0x19ed40*=0x3ea1, lpOverlapped=0x0) returned 1 [0129.593] CloseHandle (hObject=0x37c) returned 1 [0129.620] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0129.620] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0129.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0129.620] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0129.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0129.620] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\BjUmhphWyEAYYO.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0129.620] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\BjUmhphWyEAYYO.mp4", nBufferLength=0x30, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\BjUmhphWyEAYYO.mp4", lpFilePart=0x0) returned 0x2f [0129.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0129.620] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\BjUmhphWyEAYYO.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\bjumhphwyeayyo.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.622] GetFileType (hFile=0x37c) returned 0x1 [0129.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0129.622] GetFileType (hFile=0x37c) returned 0x1 [0129.622] WriteFile (in: hFile=0x37c, lpBuffer=0x23b0758*, nNumberOfBytesToWrite=0x3eb0, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x23b0758*, lpNumberOfBytesWritten=0x19ed34*=0x3eb0, lpOverlapped=0x0) returned 1 [0129.624] CloseHandle (hObject=0x37c) returned 1 [0129.625] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\BjUmhphWyEAYYO.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0129.625] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\BjUmhphWyEAYYO.mp4", nBufferLength=0x30, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\BjUmhphWyEAYYO.mp4", lpFilePart=0x0) returned 0x2f [0129.625] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\BjUmhphWyEAYYO.mp4.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0129.625] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\BjUmhphWyEAYYO.mp4.paradox", nBufferLength=0x38, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\BjUmhphWyEAYYO.mp4.paradox", lpFilePart=0x0) returned 0x37 [0129.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0129.625] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\BjUmhphWyEAYYO.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\bjumhphwyeayyo.mp4"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffe65b80, ftCreationTime.dwHighDateTime=0x1d8bc97, ftLastAccessTime.dwLowDateTime=0x90c09c0, ftLastAccessTime.dwHighDateTime=0x1d8bcc6, ftLastWriteTime.dwLowDateTime=0xc56e29b5, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x3eb0)) returned 1 [0129.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0129.626] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\BjUmhphWyEAYYO.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\bjumhphwyeayyo.mp4"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\BjUmhphWyEAYYO.mp4.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\bjumhphwyeayyo.mp4.paradox")) returned 1 [0129.626] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\BoiFgH0vw1T6k.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0129.626] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\BoiFgH0vw1T6k.mp4", nBufferLength=0x2f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\BoiFgH0vw1T6k.mp4", lpFilePart=0x0) returned 0x2e [0129.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0129.627] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\BoiFgH0vw1T6k.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\boifgh0vw1t6k.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.627] GetFileType (hFile=0x37c) returned 0x1 [0129.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0129.627] GetFileType (hFile=0x37c) returned 0x1 [0129.627] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0xb68d [0129.627] ReadFile (in: hFile=0x37c, lpBuffer=0x23b489c, nNumberOfBytesToRead=0xb68d, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x23b489c*, lpNumberOfBytesRead=0x19ed40*=0xb68d, lpOverlapped=0x0) returned 1 [0129.627] CloseHandle (hObject=0x37c) returned 1 [0129.654] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0129.654] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0129.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0129.654] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0129.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0129.654] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\BoiFgH0vw1T6k.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0129.654] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\BoiFgH0vw1T6k.mp4", nBufferLength=0x2f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\BoiFgH0vw1T6k.mp4", lpFilePart=0x0) returned 0x2e [0129.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0129.654] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\BoiFgH0vw1T6k.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\boifgh0vw1t6k.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.656] GetFileType (hFile=0x37c) returned 0x1 [0129.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0129.656] GetFileType (hFile=0x37c) returned 0x1 [0129.656] WriteFile (in: hFile=0x37c, lpBuffer=0x2423a4c*, nNumberOfBytesToWrite=0xb690, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x2423a4c*, lpNumberOfBytesWritten=0x19ed34*=0xb690, lpOverlapped=0x0) returned 1 [0129.658] CloseHandle (hObject=0x37c) returned 1 [0129.668] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\BoiFgH0vw1T6k.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0129.668] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\BoiFgH0vw1T6k.mp4", nBufferLength=0x2f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\BoiFgH0vw1T6k.mp4", lpFilePart=0x0) returned 0x2e [0129.668] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\BoiFgH0vw1T6k.mp4.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0129.669] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\BoiFgH0vw1T6k.mp4.paradox", nBufferLength=0x37, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\BoiFgH0vw1T6k.mp4.paradox", lpFilePart=0x0) returned 0x36 [0129.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0129.669] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\BoiFgH0vw1T6k.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\boifgh0vw1t6k.mp4"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcedb4da0, ftCreationTime.dwHighDateTime=0x1d8c013, ftLastAccessTime.dwLowDateTime=0xb18221d0, ftLastAccessTime.dwHighDateTime=0x1d8c111, ftLastWriteTime.dwLowDateTime=0xc5755e79, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xb690)) returned 1 [0129.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0129.669] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\BoiFgH0vw1T6k.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\boifgh0vw1t6k.mp4"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\BoiFgH0vw1T6k.mp4.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\boifgh0vw1t6k.mp4.paradox")) returned 1 [0129.670] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\CPp1byDqsSfWme.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0129.670] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\CPp1byDqsSfWme.mp4", nBufferLength=0x30, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\CPp1byDqsSfWme.mp4", lpFilePart=0x0) returned 0x2f [0129.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0129.670] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\CPp1byDqsSfWme.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\cpp1bydqssfwme.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.670] GetFileType (hFile=0x37c) returned 0x1 [0129.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0129.670] GetFileType (hFile=0x37c) returned 0x1 [0129.670] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x3c5b [0129.670] ReadFile (in: hFile=0x37c, lpBuffer=0x242f370, nNumberOfBytesToRead=0x3c5b, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x242f370*, lpNumberOfBytesRead=0x19ed40*=0x3c5b, lpOverlapped=0x0) returned 1 [0129.671] CloseHandle (hObject=0x37c) returned 1 [0129.694] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0129.694] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0129.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0129.694] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0129.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0129.694] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\CPp1byDqsSfWme.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0129.694] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\CPp1byDqsSfWme.mp4", nBufferLength=0x30, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\CPp1byDqsSfWme.mp4", lpFilePart=0x0) returned 0x2f [0129.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0129.695] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\CPp1byDqsSfWme.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\cpp1bydqssfwme.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.696] GetFileType (hFile=0x37c) returned 0x1 [0129.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0129.696] GetFileType (hFile=0x37c) returned 0x1 [0129.696] WriteFile (in: hFile=0x37c, lpBuffer=0x248ef3c*, nNumberOfBytesToWrite=0x3c60, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x248ef3c*, lpNumberOfBytesWritten=0x19ed34*=0x3c60, lpOverlapped=0x0) returned 1 [0129.698] CloseHandle (hObject=0x37c) returned 1 [0129.699] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\CPp1byDqsSfWme.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0129.699] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\CPp1byDqsSfWme.mp4", nBufferLength=0x30, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\CPp1byDqsSfWme.mp4", lpFilePart=0x0) returned 0x2f [0129.699] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\CPp1byDqsSfWme.mp4.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0129.699] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\CPp1byDqsSfWme.mp4.paradox", nBufferLength=0x38, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\CPp1byDqsSfWme.mp4.paradox", lpFilePart=0x0) returned 0x37 [0129.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0129.699] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\CPp1byDqsSfWme.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\cpp1bydqssfwme.mp4"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ef42120, ftCreationTime.dwHighDateTime=0x1d8b179, ftLastAccessTime.dwLowDateTime=0x60b2bcc0, ftLastAccessTime.dwHighDateTime=0x1d8bfb2, ftLastWriteTime.dwLowDateTime=0xc57a15c6, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x3c60)) returned 1 [0129.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0129.700] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\CPp1byDqsSfWme.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\cpp1bydqssfwme.mp4"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\CPp1byDqsSfWme.mp4.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\cpp1bydqssfwme.mp4.paradox")) returned 1 [0129.700] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\c_1zZ88519M.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0129.700] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\c_1zZ88519M.mkv", nBufferLength=0x2d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\c_1zZ88519M.mkv", lpFilePart=0x0) returned 0x2c [0129.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0129.700] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\c_1zZ88519M.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\c_1zz88519m.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.701] GetFileType (hFile=0x37c) returned 0x1 [0129.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0129.701] GetFileType (hFile=0x37c) returned 0x1 [0129.701] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x3741 [0129.701] ReadFile (in: hFile=0x37c, lpBuffer=0x2492e2c, nNumberOfBytesToRead=0x3741, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x2492e2c*, lpNumberOfBytesRead=0x19ed40*=0x3741, lpOverlapped=0x0) returned 1 [0129.701] CloseHandle (hObject=0x37c) returned 1 [0129.722] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0129.722] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0129.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0129.722] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0129.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0129.723] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\c_1zZ88519M.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0129.723] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\c_1zZ88519M.mkv", nBufferLength=0x2d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\c_1zZ88519M.mkv", lpFilePart=0x0) returned 0x2c [0129.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0129.723] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\c_1zZ88519M.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\c_1zz88519m.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.724] GetFileType (hFile=0x37c) returned 0x1 [0129.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0129.724] GetFileType (hFile=0x37c) returned 0x1 [0129.724] WriteFile (in: hFile=0x37c, lpBuffer=0x24f10a8*, nNumberOfBytesToWrite=0x3750, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x24f10a8*, lpNumberOfBytesWritten=0x19ed34*=0x3750, lpOverlapped=0x0) returned 1 [0129.726] CloseHandle (hObject=0x37c) returned 1 [0129.728] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\c_1zZ88519M.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0129.728] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\c_1zZ88519M.mkv", nBufferLength=0x2d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\c_1zZ88519M.mkv", lpFilePart=0x0) returned 0x2c [0129.728] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\c_1zZ88519M.mkv.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0129.728] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\c_1zZ88519M.mkv.paradox", nBufferLength=0x35, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\c_1zZ88519M.mkv.paradox", lpFilePart=0x0) returned 0x34 [0129.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0129.728] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\c_1zZ88519M.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\c_1zz88519m.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f1243a0, ftCreationTime.dwHighDateTime=0x1d8c084, ftLastAccessTime.dwLowDateTime=0x6fdb92c0, ftLastAccessTime.dwHighDateTime=0x1d8c0ee, ftLastWriteTime.dwLowDateTime=0xc57edabe, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x3750)) returned 1 [0129.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0129.728] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\c_1zZ88519M.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\c_1zz88519m.mkv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\c_1zZ88519M.mkv.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\c_1zz88519m.mkv.paradox")) returned 1 [0129.729] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\DJ9dTzhHBcmwI.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0129.729] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\DJ9dTzhHBcmwI.mp4", nBufferLength=0x2f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\DJ9dTzhHBcmwI.mp4", lpFilePart=0x0) returned 0x2e [0129.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0129.729] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\DJ9dTzhHBcmwI.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\dj9dtzhhbcmwi.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.730] GetFileType (hFile=0x37c) returned 0x1 [0129.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0129.730] GetFileType (hFile=0x37c) returned 0x1 [0129.730] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x449b [0129.730] ReadFile (in: hFile=0x37c, lpBuffer=0x24f4a98, nNumberOfBytesToRead=0x449b, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x24f4a98*, lpNumberOfBytesRead=0x19ed40*=0x449b, lpOverlapped=0x0) returned 1 [0129.730] CloseHandle (hObject=0x37c) returned 1 [0129.788] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0129.789] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0129.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0129.789] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0129.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0129.789] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\DJ9dTzhHBcmwI.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0129.789] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\DJ9dTzhHBcmwI.mp4", nBufferLength=0x2f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\DJ9dTzhHBcmwI.mp4", lpFilePart=0x0) returned 0x2e [0129.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0129.789] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\DJ9dTzhHBcmwI.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\dj9dtzhhbcmwi.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.790] GetFileType (hFile=0x37c) returned 0x1 [0129.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0129.791] GetFileType (hFile=0x37c) returned 0x1 [0129.791] WriteFile (in: hFile=0x37c, lpBuffer=0x2556fa4*, nNumberOfBytesToWrite=0x44a0, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x2556fa4*, lpNumberOfBytesWritten=0x19ed34*=0x44a0, lpOverlapped=0x0) returned 1 [0129.792] CloseHandle (hObject=0x37c) returned 1 [0129.793] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\DJ9dTzhHBcmwI.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0129.793] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\DJ9dTzhHBcmwI.mp4", nBufferLength=0x2f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\DJ9dTzhHBcmwI.mp4", lpFilePart=0x0) returned 0x2e [0129.793] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\DJ9dTzhHBcmwI.mp4.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0129.793] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\DJ9dTzhHBcmwI.mp4.paradox", nBufferLength=0x37, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\DJ9dTzhHBcmwI.mp4.paradox", lpFilePart=0x0) returned 0x36 [0129.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0129.794] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\DJ9dTzhHBcmwI.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\dj9dtzhhbcmwi.mp4"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47937d70, ftCreationTime.dwHighDateTime=0x1d8bdb8, ftLastAccessTime.dwLowDateTime=0xe7bc1f20, ftLastAccessTime.dwHighDateTime=0x1d8be01, ftLastWriteTime.dwLowDateTime=0xc5886823, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x44a0)) returned 1 [0129.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0129.794] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\DJ9dTzhHBcmwI.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\dj9dtzhhbcmwi.mp4"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\DJ9dTzhHBcmwI.mp4.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\dj9dtzhhbcmwi.mp4.paradox")) returned 1 [0129.795] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\jTMNBZorE3Sk2mH.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0129.795] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\jTMNBZorE3Sk2mH.mp4", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\jTMNBZorE3Sk2mH.mp4", lpFilePart=0x0) returned 0x30 [0129.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0129.795] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\jTMNBZorE3Sk2mH.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\jtmnbzore3sk2mh.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.795] GetFileType (hFile=0x37c) returned 0x1 [0129.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0129.795] GetFileType (hFile=0x37c) returned 0x1 [0129.795] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0xcc55 [0129.795] ReadFile (in: hFile=0x37c, lpBuffer=0x255b738, nNumberOfBytesToRead=0xcc55, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x255b738*, lpNumberOfBytesRead=0x19ed40*=0xcc55, lpOverlapped=0x0) returned 1 [0129.796] CloseHandle (hObject=0x37c) returned 1 [0129.838] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0129.838] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0129.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0129.838] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0129.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0129.838] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\jTMNBZorE3Sk2mH.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0129.838] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\jTMNBZorE3Sk2mH.mp4", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\jTMNBZorE3Sk2mH.mp4", lpFilePart=0x0) returned 0x30 [0129.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0129.838] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\jTMNBZorE3Sk2mH.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\jtmnbzore3sk2mh.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.840] GetFileType (hFile=0x37c) returned 0x1 [0129.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0129.840] GetFileType (hFile=0x37c) returned 0x1 [0129.840] WriteFile (in: hFile=0x37c, lpBuffer=0x25cea58*, nNumberOfBytesToWrite=0xcc60, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x25cea58*, lpNumberOfBytesWritten=0x19ed34*=0xcc60, lpOverlapped=0x0) returned 1 [0129.842] CloseHandle (hObject=0x37c) returned 1 [0129.845] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\jTMNBZorE3Sk2mH.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0129.845] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\jTMNBZorE3Sk2mH.mp4", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\jTMNBZorE3Sk2mH.mp4", lpFilePart=0x0) returned 0x30 [0129.845] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\jTMNBZorE3Sk2mH.mp4.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0129.846] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\jTMNBZorE3Sk2mH.mp4.paradox", nBufferLength=0x39, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\jTMNBZorE3Sk2mH.mp4.paradox", lpFilePart=0x0) returned 0x38 [0129.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0129.846] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\jTMNBZorE3Sk2mH.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\jtmnbzore3sk2mh.mp4"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca67b580, ftCreationTime.dwHighDateTime=0x1d8bba2, ftLastAccessTime.dwLowDateTime=0x9ee04f90, ftLastAccessTime.dwHighDateTime=0x1d8bc91, ftLastWriteTime.dwLowDateTime=0xc58f8ae1, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xcc60)) returned 1 [0129.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0129.846] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\jTMNBZorE3Sk2mH.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\jtmnbzore3sk2mh.mp4"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\jTMNBZorE3Sk2mH.mp4.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\jtmnbzore3sk2mh.mp4.paradox")) returned 1 [0129.847] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\KbDpI-xXRv_7VEG.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0129.847] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\KbDpI-xXRv_7VEG.mkv", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\KbDpI-xXRv_7VEG.mkv", lpFilePart=0x0) returned 0x30 [0129.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0129.847] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\KbDpI-xXRv_7VEG.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\kbdpi-xxrv_7veg.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.847] GetFileType (hFile=0x37c) returned 0x1 [0129.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0129.847] GetFileType (hFile=0x37c) returned 0x1 [0129.847] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x10faf [0129.852] ReadFile (in: hFile=0x37c, lpBuffer=0x25db954, nNumberOfBytesToRead=0x10faf, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x25db954*, lpNumberOfBytesRead=0x19ed40*=0x10faf, lpOverlapped=0x0) returned 1 [0129.853] CloseHandle (hObject=0x37c) returned 1 [0129.916] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0129.917] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0129.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0129.917] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0129.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0129.917] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\KbDpI-xXRv_7VEG.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0129.917] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\KbDpI-xXRv_7VEG.mkv", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\KbDpI-xXRv_7VEG.mkv", lpFilePart=0x0) returned 0x30 [0129.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0129.917] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\KbDpI-xXRv_7VEG.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\kbdpi-xxrv_7veg.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.919] GetFileType (hFile=0x37c) returned 0x1 [0129.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0129.919] GetFileType (hFile=0x37c) returned 0x1 [0129.919] WriteFile (in: hFile=0x37c, lpBuffer=0x23a0634*, nNumberOfBytesToWrite=0x10fb0, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x23a0634*, lpNumberOfBytesWritten=0x19ed34*=0x10fb0, lpOverlapped=0x0) returned 1 [0129.922] CloseHandle (hObject=0x37c) returned 1 [0129.924] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\KbDpI-xXRv_7VEG.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0129.925] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\KbDpI-xXRv_7VEG.mkv", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\KbDpI-xXRv_7VEG.mkv", lpFilePart=0x0) returned 0x30 [0129.925] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\KbDpI-xXRv_7VEG.mkv.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0129.925] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\KbDpI-xXRv_7VEG.mkv.paradox", nBufferLength=0x39, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\KbDpI-xXRv_7VEG.mkv.paradox", lpFilePart=0x0) returned 0x38 [0129.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0129.925] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\KbDpI-xXRv_7VEG.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\kbdpi-xxrv_7veg.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d6e0b0, ftCreationTime.dwHighDateTime=0x1d8bf80, ftLastAccessTime.dwLowDateTime=0xae86d20, ftLastAccessTime.dwHighDateTime=0x1d8c0f3, ftLastWriteTime.dwLowDateTime=0xc59b766c, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x10fb0)) returned 1 [0129.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0129.925] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\KbDpI-xXRv_7VEG.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\kbdpi-xxrv_7veg.mkv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\KbDpI-xXRv_7VEG.mkv.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\kbdpi-xxrv_7veg.mkv.paradox")) returned 1 [0129.926] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\kJaRlROETbuz_IQQ.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0129.926] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\kJaRlROETbuz_IQQ.mkv", nBufferLength=0x32, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\kJaRlROETbuz_IQQ.mkv", lpFilePart=0x0) returned 0x31 [0129.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0129.926] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\kJaRlROETbuz_IQQ.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\kjarlroetbuz_iqq.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.933] GetFileType (hFile=0x37c) returned 0x1 [0129.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0129.933] GetFileType (hFile=0x37c) returned 0x1 [0129.933] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0xc573 [0129.933] ReadFile (in: hFile=0x37c, lpBuffer=0x23b1884, nNumberOfBytesToRead=0xc573, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x23b1884*, lpNumberOfBytesRead=0x19ed40*=0xc573, lpOverlapped=0x0) returned 1 [0129.934] CloseHandle (hObject=0x37c) returned 1 [0129.961] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0129.961] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0129.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0129.961] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0129.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0129.961] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\kJaRlROETbuz_IQQ.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0129.961] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\kJaRlROETbuz_IQQ.mkv", nBufferLength=0x32, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\kJaRlROETbuz_IQQ.mkv", lpFilePart=0x0) returned 0x31 [0129.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0129.962] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\kJaRlROETbuz_IQQ.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\kjarlroetbuz_iqq.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.963] GetFileType (hFile=0x37c) returned 0x1 [0129.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0129.963] GetFileType (hFile=0x37c) returned 0x1 [0129.963] WriteFile (in: hFile=0x37c, lpBuffer=0x2423860*, nNumberOfBytesToWrite=0xc580, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x2423860*, lpNumberOfBytesWritten=0x19ed34*=0xc580, lpOverlapped=0x0) returned 1 [0129.966] CloseHandle (hObject=0x37c) returned 1 [0129.969] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\kJaRlROETbuz_IQQ.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0129.969] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\kJaRlROETbuz_IQQ.mkv", nBufferLength=0x32, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\kJaRlROETbuz_IQQ.mkv", lpFilePart=0x0) returned 0x31 [0129.969] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\kJaRlROETbuz_IQQ.mkv.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0129.969] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\kJaRlROETbuz_IQQ.mkv.paradox", nBufferLength=0x3a, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\kJaRlROETbuz_IQQ.mkv.paradox", lpFilePart=0x0) returned 0x39 [0129.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0129.969] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\kJaRlROETbuz_IQQ.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\kjarlroetbuz_iqq.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67abbe10, ftCreationTime.dwHighDateTime=0x1d8bf7f, ftLastAccessTime.dwLowDateTime=0x7b4b6ab0, ftLastAccessTime.dwHighDateTime=0x1d8c001, ftLastWriteTime.dwLowDateTime=0xc5a29dbc, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xc580)) returned 1 [0129.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0129.970] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\kJaRlROETbuz_IQQ.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\kjarlroetbuz_iqq.mkv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\kJaRlROETbuz_IQQ.mkv.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\kjarlroetbuz_iqq.mkv.paradox")) returned 1 [0129.971] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\Ue6Gzt3ITeB7E.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0129.971] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\Ue6Gzt3ITeB7E.mp4", nBufferLength=0x2f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\Ue6Gzt3ITeB7E.mp4", lpFilePart=0x0) returned 0x2e [0129.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0129.971] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\Ue6Gzt3ITeB7E.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\ue6gzt3iteb7e.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0129.971] GetFileType (hFile=0x37c) returned 0x1 [0129.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0129.971] GetFileType (hFile=0x37c) returned 0x1 [0129.971] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x371d [0129.971] ReadFile (in: hFile=0x37c, lpBuffer=0x243010c, nNumberOfBytesToRead=0x371d, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x243010c*, lpNumberOfBytesRead=0x19ed40*=0x371d, lpOverlapped=0x0) returned 1 [0129.972] CloseHandle (hObject=0x37c) returned 1 [0130.002] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0130.002] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0130.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0130.002] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0130.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0130.002] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\Ue6Gzt3ITeB7E.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0130.003] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\Ue6Gzt3ITeB7E.mp4", nBufferLength=0x2f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\Ue6Gzt3ITeB7E.mp4", lpFilePart=0x0) returned 0x2e [0130.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0130.003] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\Ue6Gzt3ITeB7E.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\ue6gzt3iteb7e.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0130.005] GetFileType (hFile=0x37c) returned 0x1 [0130.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0130.005] GetFileType (hFile=0x37c) returned 0x1 [0130.005] WriteFile (in: hFile=0x37c, lpBuffer=0x248e298*, nNumberOfBytesToWrite=0x3720, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x248e298*, lpNumberOfBytesWritten=0x19ed34*=0x3720, lpOverlapped=0x0) returned 1 [0130.007] CloseHandle (hObject=0x37c) returned 1 [0130.009] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\Ue6Gzt3ITeB7E.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0130.009] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\Ue6Gzt3ITeB7E.mp4", nBufferLength=0x2f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\Ue6Gzt3ITeB7E.mp4", lpFilePart=0x0) returned 0x2e [0130.009] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\Ue6Gzt3ITeB7E.mp4.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0130.009] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\Ue6Gzt3ITeB7E.mp4.paradox", nBufferLength=0x37, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\Ue6Gzt3ITeB7E.mp4.paradox", lpFilePart=0x0) returned 0x36 [0130.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0130.009] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\Ue6Gzt3ITeB7E.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\ue6gzt3iteb7e.mp4"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc9f0900, ftCreationTime.dwHighDateTime=0x1d8b813, ftLastAccessTime.dwLowDateTime=0x4f4f20, ftLastAccessTime.dwHighDateTime=0x1d8bf0c, ftLastWriteTime.dwLowDateTime=0xc5a9c6b6, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x3720)) returned 1 [0130.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0130.009] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\Ue6Gzt3ITeB7E.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\ue6gzt3iteb7e.mp4"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\Ue6Gzt3ITeB7E.mp4.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\ue6gzt3iteb7e.mp4.paradox")) returned 1 [0130.010] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\VLZH24-yjIUtKgUNNUg.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0130.010] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\VLZH24-yjIUtKgUNNUg.avi", nBufferLength=0x35, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\VLZH24-yjIUtKgUNNUg.avi", lpFilePart=0x0) returned 0x34 [0130.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0130.011] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\VLZH24-yjIUtKgUNNUg.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\vlzh24-yjiutkgunnug.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0130.011] GetFileType (hFile=0x37c) returned 0x1 [0130.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0130.011] GetFileType (hFile=0x37c) returned 0x1 [0130.011] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0xbe7f [0130.011] ReadFile (in: hFile=0x37c, lpBuffer=0x2491c6c, nNumberOfBytesToRead=0xbe7f, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x2491c6c*, lpNumberOfBytesRead=0x19ed40*=0xbe7f, lpOverlapped=0x0) returned 1 [0130.011] CloseHandle (hObject=0x37c) returned 1 [0130.061] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0130.061] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0130.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0130.061] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0130.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0130.061] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\VLZH24-yjIUtKgUNNUg.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0130.061] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\VLZH24-yjIUtKgUNNUg.avi", nBufferLength=0x35, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\VLZH24-yjIUtKgUNNUg.avi", lpFilePart=0x0) returned 0x34 [0130.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0130.062] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\VLZH24-yjIUtKgUNNUg.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\vlzh24-yjiutkgunnug.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0130.064] GetFileType (hFile=0x37c) returned 0x1 [0130.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0130.064] GetFileType (hFile=0x37c) returned 0x1 [0130.064] WriteFile (in: hFile=0x37c, lpBuffer=0x25025ec*, nNumberOfBytesToWrite=0xbe80, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x25025ec*, lpNumberOfBytesWritten=0x19ed34*=0xbe80, lpOverlapped=0x0) returned 1 [0130.066] CloseHandle (hObject=0x37c) returned 1 [0130.069] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\VLZH24-yjIUtKgUNNUg.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0130.069] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\VLZH24-yjIUtKgUNNUg.avi", nBufferLength=0x35, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\VLZH24-yjIUtKgUNNUg.avi", lpFilePart=0x0) returned 0x34 [0130.069] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\VLZH24-yjIUtKgUNNUg.avi.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0130.069] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\VLZH24-yjIUtKgUNNUg.avi.paradox", nBufferLength=0x3d, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\VLZH24-yjIUtKgUNNUg.avi.paradox", lpFilePart=0x0) returned 0x3c [0130.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0130.069] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\VLZH24-yjIUtKgUNNUg.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\vlzh24-yjiutkgunnug.avi"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4b6ccd0, ftCreationTime.dwHighDateTime=0x1d8b364, ftLastAccessTime.dwLowDateTime=0x25fd24a0, ftLastAccessTime.dwHighDateTime=0x1d8b849, ftLastWriteTime.dwLowDateTime=0xc5b34e6d, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xbe80)) returned 1 [0130.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0130.070] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\VLZH24-yjIUtKgUNNUg.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\vlzh24-yjiutkgunnug.avi"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\VLZH24-yjIUtKgUNNUg.avi.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\vlzh24-yjiutkgunnug.avi.paradox")) returned 1 [0130.071] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\voHnl GNKaLfJq0z.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0130.071] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\voHnl GNKaLfJq0z.mkv", nBufferLength=0x32, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\voHnl GNKaLfJq0z.mkv", lpFilePart=0x0) returned 0x31 [0130.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0130.071] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\voHnl GNKaLfJq0z.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\vohnl gnkalfjq0z.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0130.071] GetFileType (hFile=0x37c) returned 0x1 [0130.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0130.071] GetFileType (hFile=0x37c) returned 0x1 [0130.071] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x1282d [0130.071] ReadFile (in: hFile=0x37c, lpBuffer=0x250e71c, nNumberOfBytesToRead=0x1282d, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x250e71c*, lpNumberOfBytesRead=0x19ed40*=0x1282d, lpOverlapped=0x0) returned 1 [0130.072] CloseHandle (hObject=0x37c) returned 1 [0130.105] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0130.105] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0130.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0130.105] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0130.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0130.105] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\voHnl GNKaLfJq0z.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0130.105] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\voHnl GNKaLfJq0z.mkv", nBufferLength=0x32, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\voHnl GNKaLfJq0z.mkv", lpFilePart=0x0) returned 0x31 [0130.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0130.106] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\voHnl GNKaLfJq0z.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\vohnl gnkalfjq0z.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0130.107] GetFileType (hFile=0x37c) returned 0x1 [0130.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0130.107] GetFileType (hFile=0x37c) returned 0x1 [0130.107] WriteFile (in: hFile=0x37c, lpBuffer=0x23945d8*, nNumberOfBytesToWrite=0x12830, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x23945d8*, lpNumberOfBytesWritten=0x19ed34*=0x12830, lpOverlapped=0x0) returned 1 [0130.110] CloseHandle (hObject=0x37c) returned 1 [0130.115] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\voHnl GNKaLfJq0z.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0130.115] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\voHnl GNKaLfJq0z.mkv", nBufferLength=0x32, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\voHnl GNKaLfJq0z.mkv", lpFilePart=0x0) returned 0x31 [0130.115] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\voHnl GNKaLfJq0z.mkv.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0130.115] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\voHnl GNKaLfJq0z.mkv.paradox", nBufferLength=0x3a, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\voHnl GNKaLfJq0z.mkv.paradox", lpFilePart=0x0) returned 0x39 [0130.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0130.115] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\voHnl GNKaLfJq0z.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\vohnl gnkalfjq0z.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f38d3d0, ftCreationTime.dwHighDateTime=0x1d8b4eb, ftLastAccessTime.dwLowDateTime=0x42435710, ftLastAccessTime.dwHighDateTime=0x1d8b6cd, ftLastWriteTime.dwLowDateTime=0xc5ba92f0, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x12830)) returned 1 [0130.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0130.116] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\voHnl GNKaLfJq0z.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\vohnl gnkalfjq0z.mkv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\voHnl GNKaLfJq0z.mkv.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\vohnl gnkalfjq0z.mkv.paradox")) returned 1 [0130.116] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\W1H9qw8y.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0130.116] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\W1H9qw8y.mkv", nBufferLength=0x2a, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\W1H9qw8y.mkv", lpFilePart=0x0) returned 0x29 [0130.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0130.116] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\W1H9qw8y.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\w1h9qw8y.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0130.117] GetFileType (hFile=0x37c) returned 0x1 [0130.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0130.117] GetFileType (hFile=0x37c) returned 0x1 [0130.117] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0x8c4b [0130.117] ReadFile (in: hFile=0x37c, lpBuffer=0x23a70b4, nNumberOfBytesToRead=0x8c4b, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x23a70b4*, lpNumberOfBytesRead=0x19ed40*=0x8c4b, lpOverlapped=0x0) returned 1 [0130.117] CloseHandle (hObject=0x37c) returned 1 [0130.138] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0130.138] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0130.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0130.138] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0130.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0130.139] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\W1H9qw8y.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0130.139] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\W1H9qw8y.mkv", nBufferLength=0x2a, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\W1H9qw8y.mkv", lpFilePart=0x0) returned 0x29 [0130.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0130.139] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\W1H9qw8y.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\w1h9qw8y.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0130.140] GetFileType (hFile=0x37c) returned 0x1 [0130.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0130.140] GetFileType (hFile=0x37c) returned 0x1 [0130.140] WriteFile (in: hFile=0x37c, lpBuffer=0x241fd8c*, nNumberOfBytesToWrite=0x8c50, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x241fd8c*, lpNumberOfBytesWritten=0x19ed34*=0x8c50, lpOverlapped=0x0) returned 1 [0130.142] CloseHandle (hObject=0x37c) returned 1 [0130.143] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\W1H9qw8y.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0130.144] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\W1H9qw8y.mkv", nBufferLength=0x2a, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\W1H9qw8y.mkv", lpFilePart=0x0) returned 0x29 [0130.144] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\W1H9qw8y.mkv.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0130.144] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\W1H9qw8y.mkv.paradox", nBufferLength=0x32, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\W1H9qw8y.mkv.paradox", lpFilePart=0x0) returned 0x31 [0130.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0130.144] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\W1H9qw8y.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\w1h9qw8y.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6792a150, ftCreationTime.dwHighDateTime=0x1d8b57a, ftLastAccessTime.dwLowDateTime=0x7e29b730, ftLastAccessTime.dwHighDateTime=0x1d8c01c, ftLastWriteTime.dwLowDateTime=0xc5bcd7a5, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x8c50)) returned 1 [0130.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0130.144] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\W1H9qw8y.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\w1h9qw8y.mkv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\W1H9qw8y.mkv.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\w1h9qw8y.mkv.paradox")) returned 1 [0130.145] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\zGMZOxL0WD.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0130.145] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\zGMZOxL0WD.avi", nBufferLength=0x2c, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\zGMZOxL0WD.avi", lpFilePart=0x0) returned 0x2b [0130.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec98) returned 1 [0130.145] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\zGMZOxL0WD.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\zgmzoxl0wd.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0130.145] GetFileType (hFile=0x37c) returned 0x1 [0130.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec94) returned 1 [0130.145] GetFileType (hFile=0x37c) returned 0x1 [0130.145] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19ed94 | out: lpFileSizeHigh=0x19ed94*=0x0) returned 0xf461 [0130.146] ReadFile (in: hFile=0x37c, lpBuffer=0x2428c6c, nNumberOfBytesToRead=0xf461, lpNumberOfBytesRead=0x19ed40, lpOverlapped=0x0 | out: lpBuffer=0x2428c6c*, lpNumberOfBytesRead=0x19ed40*=0xf461, lpOverlapped=0x0) returned 1 [0130.146] CloseHandle (hObject=0x37c) returned 1 [0130.168] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0130.168] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", nBufferLength=0x31, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x30 [0130.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed0c) returned 1 [0130.168] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x19ed88 | out: lpFileInformation=0x19ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0130.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed08) returned 1 [0130.168] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\zGMZOxL0WD.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0130.168] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\zGMZOxL0WD.avi", nBufferLength=0x2c, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\zGMZOxL0WD.avi", lpFilePart=0x0) returned 0x2b [0130.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ec84) returned 1 [0130.169] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\zGMZOxL0WD.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\zgmzoxl0wd.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0130.170] GetFileType (hFile=0x37c) returned 0x1 [0130.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ec80) returned 1 [0130.170] GetFileType (hFile=0x37c) returned 0x1 [0130.170] WriteFile (in: hFile=0x37c, lpBuffer=0x24a37bc*, nNumberOfBytesToWrite=0xf470, lpNumberOfBytesWritten=0x19ed34, lpOverlapped=0x0 | out: lpBuffer=0x24a37bc*, lpNumberOfBytesWritten=0x19ed34*=0xf470, lpOverlapped=0x0) returned 1 [0130.173] CloseHandle (hObject=0x37c) returned 1 [0130.176] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\zGMZOxL0WD.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0130.176] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\zGMZOxL0WD.avi", nBufferLength=0x2c, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\zGMZOxL0WD.avi", lpFilePart=0x0) returned 0x2b [0130.176] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\zGMZOxL0WD.avi.paradox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0130.176] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\zGMZOxL0WD.avi.paradox", nBufferLength=0x34, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos\\zGMZOxL0WD.avi.paradox", lpFilePart=0x0) returned 0x33 [0130.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed18) returned 1 [0130.178] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\zGMZOxL0WD.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\zgmzoxl0wd.avi"), fInfoLevelId=0x0, lpFileInformation=0x19ed94 | out: lpFileInformation=0x19ed94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f5fafe0, ftCreationTime.dwHighDateTime=0x1d8b579, ftLastAccessTime.dwLowDateTime=0x8d91d880, ftLastAccessTime.dwHighDateTime=0x1d8b836, ftLastWriteTime.dwLowDateTime=0xc5c19c2b, ftLastWriteTime.dwHighDateTime=0x1d8cd7a, nFileSizeHigh=0x0, nFileSizeLow=0xf470)) returned 1 [0130.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed14) returned 1 [0130.178] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\zGMZOxL0WD.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\zgmzoxl0wd.avi"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\zGMZOxL0WD.avi.paradox" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\zgmzoxl0wd.avi.paradox")) returned 1 [0130.218] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_ME.txt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0130.218] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_ME.txt", nBufferLength=0x2a, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x29 [0130.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edc8) returned 1 [0130.218] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x37c [0130.219] GetFileType (hFile=0x37c) returned 0x1 [0130.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edc4) returned 1 [0130.219] GetFileType (hFile=0x37c) returned 0x1 [0130.221] WriteFile (in: hFile=0x37c, lpBuffer=0x24b4a60*, nNumberOfBytesToWrite=0x8a, lpNumberOfBytesWritten=0x19ee38, lpOverlapped=0x0 | out: lpBuffer=0x24b4a60*, lpNumberOfBytesWritten=0x19ee38*=0x8a, lpOverlapped=0x0) returned 1 [0130.223] CloseHandle (hObject=0x37c) returned 1 [0130.449] GetACP () returned 0x4e4 [0131.438] GetCurrentProcess () returned 0xffffffff [0131.438] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eb40 | out: TokenHandle=0x19eb40*=0x380) returned 1 [0131.445] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0131.445] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x2f, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0131.452] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19eb38 | out: lpFileInformation=0x19eb38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0131.455] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0131.455] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x44, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0131.455] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19eb40 | out: lpFileInformation=0x19eb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0131.456] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0131.457] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x44, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0131.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ea78) returned 1 [0131.457] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x384 [0131.457] GetFileType (hFile=0x384) returned 0x1 [0131.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ea74) returned 1 [0131.457] GetFileType (hFile=0x384) returned 0x1 [0131.558] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\XML", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eac4 | out: phkResult=0x19eac4*=0x0) returned 0x2 [0131.558] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\XML", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eac4 | out: phkResult=0x19eac4*=0x0) returned 0x2 [0131.560] GetFileSize (in: hFile=0x384, lpFileSizeHigh=0x19eb34 | out: lpFileSizeHigh=0x19eb34*=0x0) returned 0x8c8f [0131.560] ReadFile (in: hFile=0x384, lpBuffer=0x24b97c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19eaf0, lpOverlapped=0x0 | out: lpBuffer=0x24b97c8*, lpNumberOfBytesRead=0x19eaf0*=0x1000, lpOverlapped=0x0) returned 1 [0131.590] ReadFile (in: hFile=0x384, lpBuffer=0x24b97c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e9a0, lpOverlapped=0x0 | out: lpBuffer=0x24b97c8*, lpNumberOfBytesRead=0x19e9a0*=0x1000, lpOverlapped=0x0) returned 1 [0131.592] ReadFile (in: hFile=0x384, lpBuffer=0x24b97c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e854, lpOverlapped=0x0 | out: lpBuffer=0x24b97c8*, lpNumberOfBytesRead=0x19e854*=0x1000, lpOverlapped=0x0) returned 1 [0131.593] ReadFile (in: hFile=0x384, lpBuffer=0x24b97c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e854, lpOverlapped=0x0 | out: lpBuffer=0x24b97c8*, lpNumberOfBytesRead=0x19e854*=0x1000, lpOverlapped=0x0) returned 1 [0131.593] ReadFile (in: hFile=0x384, lpBuffer=0x24b97c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e854, lpOverlapped=0x0 | out: lpBuffer=0x24b97c8*, lpNumberOfBytesRead=0x19e854*=0x1000, lpOverlapped=0x0) returned 1 [0131.593] ReadFile (in: hFile=0x384, lpBuffer=0x24b97c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e78c, lpOverlapped=0x0 | out: lpBuffer=0x24b97c8*, lpNumberOfBytesRead=0x19e78c*=0x1000, lpOverlapped=0x0) returned 1 [0131.602] ReadFile (in: hFile=0x384, lpBuffer=0x24b97c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e90c, lpOverlapped=0x0 | out: lpBuffer=0x24b97c8*, lpNumberOfBytesRead=0x19e90c*=0x1000, lpOverlapped=0x0) returned 1 [0131.604] ReadFile (in: hFile=0x384, lpBuffer=0x24b97c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e81c, lpOverlapped=0x0 | out: lpBuffer=0x24b97c8*, lpNumberOfBytesRead=0x19e81c*=0x1000, lpOverlapped=0x0) returned 1 [0131.604] ReadFile (in: hFile=0x384, lpBuffer=0x24b97c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e81c, lpOverlapped=0x0 | out: lpBuffer=0x24b97c8*, lpNumberOfBytesRead=0x19e81c*=0xc8f, lpOverlapped=0x0) returned 1 [0131.604] ReadFile (in: hFile=0x384, lpBuffer=0x24b97c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e8dc, lpOverlapped=0x0 | out: lpBuffer=0x24b97c8*, lpNumberOfBytesRead=0x19e8dc*=0x0, lpOverlapped=0x0) returned 1 [0131.604] CloseHandle (hObject=0x384) returned 1 [0131.605] GetCurrentProcess () returned 0xffffffff [0131.605] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ec84 | out: TokenHandle=0x19ec84*=0x384) returned 1 [0131.606] GetCurrentProcess () returned 0xffffffff [0131.606] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ec84 | out: TokenHandle=0x19ec84*=0x388) returned 1 [0131.606] GetCurrentProcess () returned 0xffffffff [0131.607] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eb40 | out: TokenHandle=0x19eb40*=0x38c) returned 1 [0131.607] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe.config" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19eb38 | out: lpFileInformation=0x19eb38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0131.607] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6a [0131.607] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe.config", nBufferLength=0x6a, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe.config", lpFilePart=0x0) returned 0x69 [0131.607] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe.config" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19eb40 | out: lpFileInformation=0x19eb40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0131.608] GetCurrentProcess () returned 0xffffffff [0131.608] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ec84 | out: TokenHandle=0x19ec84*=0x390) returned 1 [0131.608] GetCurrentProcess () returned 0xffffffff [0131.608] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ec84 | out: TokenHandle=0x19ec84*=0x394) returned 1 [0131.635] GetCurrentProcess () returned 0xffffffff [0131.635] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eae4 | out: TokenHandle=0x19eae4*=0x398) returned 1 [0131.667] GetCurrentProcess () returned 0xffffffff [0131.667] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eaf4 | out: TokenHandle=0x19eaf4*=0x39c) returned 1 [0131.698] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3a0 [0131.698] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3a4 [0131.707] GetCurrentProcess () returned 0xffffffff [0131.707] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eb00 | out: TokenHandle=0x19eb00*=0x3a8) returned 1 [0131.709] GetCurrentProcess () returned 0xffffffff [0131.709] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eb10 | out: TokenHandle=0x19eb10*=0x3ac) returned 1 [0131.712] QueryPerformanceFrequency (in: lpFrequency=0x535a70 | out: lpFrequency=0x535a70*=100000000) returned 1 [0131.712] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee84 | out: lpPerformanceCount=0x19ee84*=3574982853247) returned 1 [0131.718] GetCurrentProcess () returned 0xffffffff [0131.719] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eacc | out: TokenHandle=0x19eacc*=0x3b0) returned 1 [0131.752] GetCurrentProcess () returned 0xffffffff [0131.752] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eadc | out: TokenHandle=0x19eadc*=0x3b4) returned 1 [0131.789] GetCurrentProcess () returned 0xffffffff [0131.789] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eae0 | out: TokenHandle=0x19eae0*=0x3b8) returned 1 [0131.792] GetCurrentProcess () returned 0xffffffff [0131.792] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eaf0 | out: TokenHandle=0x19eaf0*=0x3bc) returned 1 [0131.798] GetCurrentProcess () returned 0xffffffff [0131.798] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ed68 | out: TokenHandle=0x19ed68*=0x3c0) returned 1 [0131.810] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x19dea4 | out: phkResult=0x19dea4*=0x3c4) returned 0x0 [0131.810] RegQueryValueExW (in: hKey=0x3c4, lpValueName="InstallationType", lpReserved=0x0, lpType=0x19dec4, lpData=0x0, lpcbData=0x19dec0*=0x0 | out: lpType=0x19dec4*=0x1, lpData=0x0, lpcbData=0x19dec0*=0xe) returned 0x0 [0131.811] RegQueryValueExW (in: hKey=0x3c4, lpValueName="InstallationType", lpReserved=0x0, lpType=0x19dec4, lpData=0x24db5b8, lpcbData=0x19dec0*=0xe | out: lpType=0x19dec4*=0x1, lpData="Client", lpcbData=0x19dec0*=0xe) returned 0x0 [0131.811] RegCloseKey (hKey=0x3c4) returned 0x0 [0133.315] CoTaskMemAlloc (cb=0xcc0) returned 0x6ed560 [0133.316] RasEnumConnectionsW (in: param_1=0x6ed560, param_2=0x19ed78, param_3=0x19ed7c | out: param_1=0x6ed560, param_2=0x19ed78, param_3=0x19ed7c) returned 0x0 [0133.634] CoTaskMemFree (pv=0x6ed560) [0134.388] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19eb60 | out: lpWSAData=0x19eb60) returned 0 [0134.396] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x420 [0134.802] setsockopt (s=0x420, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0134.802] closesocket (s=0x420) returned 0 [0134.803] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x420 [0134.804] setsockopt (s=0x420, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0134.804] closesocket (s=0x420) returned 0 [0134.804] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x420 [0134.805] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x424 [0134.805] ioctlsocket (in: s=0x420, cmd=-2147195266, argp=0x19ed80 | out: argp=0x19ed80) returned 0 [0134.806] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x428 [0134.806] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x42c [0134.806] ioctlsocket (in: s=0x428, cmd=-2147195266, argp=0x19ed80 | out: argp=0x19ed80) returned 0 [0134.807] WSAIoctl (in: s=0x420, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x19ed68, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x19ed68, lpOverlapped=0x0) returned -1 [0135.135] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x19ea98, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0135.220] WSAEventSelect (s=0x420, hEventObject=0x424, lNetworkEvents=512) returned 0 [0135.220] WSAIoctl (in: s=0x428, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x19ed68, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x19ed68, lpOverlapped=0x0) returned -1 [0135.220] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x19ea98, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0135.220] WSAEventSelect (s=0x428, hEventObject=0x42c, lNetworkEvents=512) returned 0 [0135.220] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x434 [0135.221] RasConnectionNotificationW (param_1=0xffffffff, param_2=0x434, param_3=0x3) returned 0x0 [0135.230] RegOpenCurrentUser (in: samDesired=0x20019, phkResult=0x19ed94 | out: phkResult=0x19ed94*=0x44c) returned 0x0 [0135.231] RegOpenKeyExW (in: hKey=0x44c, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ed48 | out: phkResult=0x19ed48*=0x450) returned 0x0 [0135.231] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x454 [0135.231] RegNotifyChangeKeyValue (hKey=0x450, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x454, fAsynchronous=1) returned 0x0 [0135.232] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ed4c | out: phkResult=0x19ed4c*=0x458) returned 0x0 [0135.232] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x45c [0135.232] RegNotifyChangeKeyValue (hKey=0x458, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x45c, fAsynchronous=1) returned 0x0 [0135.232] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ed4c | out: phkResult=0x19ed4c*=0x460) returned 0x0 [0135.233] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x464 [0135.233] RegNotifyChangeKeyValue (hKey=0x460, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x464, fAsynchronous=1) returned 0x0 [0135.233] GetCurrentProcess () returned 0xffffffff [0135.233] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ed3c | out: TokenHandle=0x19ed3c*=0x468) returned 1 [0135.242] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e640 | out: phkResult=0x19e640*=0x480) returned 0x0 [0135.242] RegQueryValueExW (in: hKey=0x480, lpValueName="LegacyWPADSupport", lpReserved=0x0, lpType=0x19e65c, lpData=0x0, lpcbData=0x19e658*=0x0 | out: lpType=0x19e65c*=0x0, lpData=0x0, lpcbData=0x19e658*=0x0) returned 0x2 [0135.242] RegCloseKey (hKey=0x480) returned 0x0 [0135.835] WinHttpOpen (pszAgentW=0x0, dwAccessType=0x1, pszProxyW=0x0, pszProxyBypassW=0x0, dwFlags=0x0) returned 0x6f4f18 [0136.268] WinHttpSetTimeouts (hInternet=0x6f4f18, nResolveTimeout=60000, nConnectTimeout=60000, nSendTimeout=60000, nReceiveTimeout=60000) returned 1 [0136.269] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x19ed48 | out: pProxyConfig=0x19ed48) returned 1 [0136.729] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_Disabled", lpBuffer=0x19e5b8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0136.729] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_MinCount", lpBuffer=0x19e5b8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0136.734] EtwEventRegister (in: ProviderId=0x24de294, EnableCallback=0x960686, CallbackContext=0x0, RegHandle=0x24de270 | out: RegHandle=0x24de270) returned 0x0 [0136.734] EtwEventSetInformation (RegHandle=0x6ac528, InformationClass=0x56, EventInformation=0x2, InformationLength=0x24de230) returned 0x0 [0136.737] GetCurrentProcess () returned 0xffffffff [0136.737] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eaa8 | out: TokenHandle=0x19eaa8*=0x4c4) returned 1 [0136.739] GetCurrentProcess () returned 0xffffffff [0136.739] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eab8 | out: TokenHandle=0x19eab8*=0x4c8) returned 1 [0136.745] SetEvent (hEvent=0x3a0) returned 1 [0136.766] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ecb4*=0x434, lpdwindex=0x19ead4 | out: lpdwindex=0x19ead4) returned 0x80010115 [0136.809] BeginPaint (in: hWnd=0x60208, lpPaint=0x19e464 | out: lpPaint=0x19e464) returned 0x1b0107ae [0136.809] GetWindowPlacement (in: hWnd=0x60208, lpwndpl=0x19e188 | out: lpwndpl=0x19e188) returned 1 [0136.810] GetClientRect (in: hWnd=0x60208, lpRect=0x19e134 | out: lpRect=0x19e134) returned 1 [0136.810] GetWindowTextLengthW (hWnd=0x60208) returned 5 [0136.810] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0136.810] GetSystemMetrics (nIndex=42) returned 0 [0136.810] GetWindowTextW (in: hWnd=0x60208, lpString=0x19e000, nMaxCount=6 | out: lpString="Form1") returned 5 [0136.810] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0xd, wParam=0x6, lParam=0x19e000) returned 0x5 [0136.810] GetClientRect (in: hWnd=0x60208, lpRect=0x19e03c | out: lpRect=0x19e03c) returned 1 [0136.810] GetCurrentObject (hdc=0x1b0107ae, type=0x1) returned 0x1b00017 [0136.810] GetCurrentObject (hdc=0x1b0107ae, type=0x2) returned 0x1900010 [0136.810] GetCurrentObject (hdc=0x1b0107ae, type=0x7) returned 0x1d050693 [0136.810] GetCurrentObject (hdc=0x1b0107ae, type=0x6) returned 0x18a0048 [0136.810] SaveDC (hdc=0x1b0107ae) returned 1 [0136.811] GetNearestColor (hdc=0x1b0107ae, color=0xf0f0f0) returned 0xf0f0f0 [0136.811] CreateSolidBrush (color=0xf0f0f0) returned 0x37100988 [0136.811] FillRect (hDC=0x1b0107ae, lprc=0x19dedc, hbr=0x37100988) returned 1 [0136.817] DeleteObject (ho=0x37100988) returned 1 [0136.817] RestoreDC (hdc=0x1b0107ae, nSavedDC=-1) returned 1 [0136.818] GdipCreateHalftonePalette () returned 0xffffffffd1080783 [0136.820] SelectPalette (hdc=0x1b0107ae, hPal=0xd1080783, bForceBkgd=1) returned 0x188000b [0136.821] GetWindowTextLengthW (hWnd=0x60208) returned 5 [0136.821] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0136.821] GetSystemMetrics (nIndex=42) returned 0 [0136.821] GetWindowTextW (in: hWnd=0x60208, lpString=0x19e400, nMaxCount=6 | out: lpString="Form1") returned 5 [0136.821] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0xd, wParam=0x6, lParam=0x19e400) returned 0x5 [0136.821] SelectPalette (hdc=0x1b0107ae, hPal=0x188000b, bForceBkgd=0) returned 0xd1080783 [0136.821] EndPaint (hWnd=0x60208, lpPaint=0x19e460) returned 1 [0136.822] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ec94*=0x424, lpdwindex=0x19eab4 | out: lpdwindex=0x19eab4) returned 0x80010115 [0136.823] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ec94*=0x42c, lpdwindex=0x19eab4 | out: lpdwindex=0x19eab4) returned 0x80010115 [0136.823] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ece8*=0x454, lpdwindex=0x19eb04 | out: lpdwindex=0x19eb04) returned 0x80010115 [0136.823] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ece8*=0x45c, lpdwindex=0x19eb04 | out: lpdwindex=0x19eb04) returned 0x80010115 [0136.824] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ece8*=0x464, lpdwindex=0x19eb04 | out: lpdwindex=0x19eb04) returned 0x80010115 [0136.829] GetCurrentProcess () returned 0xffffffff [0136.829] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ea24 | out: TokenHandle=0x19ea24*=0x508) returned 1 [0136.829] GetCurrentProcess () returned 0xffffffff [0136.830] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ea34 | out: TokenHandle=0x19ea34*=0x50c) returned 1 [0136.831] GetTimeZoneInformation (in: lpTimeZoneInformation=0x19eba4 | out: lpTimeZoneInformation=0x19eba4) returned 0x2 [0136.833] GetDynamicTimeZoneInformation (in: pTimeZoneInformation=0x19ea00 | out: pTimeZoneInformation=0x19ea00) returned 0x2 [0136.836] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eae4 | out: phkResult=0x19eae4*=0x510) returned 0x0 [0136.837] RegQueryValueExW (in: hKey=0x510, lpValueName="TZI", lpReserved=0x0, lpType=0x19eb00, lpData=0x0, lpcbData=0x19eafc*=0x0 | out: lpType=0x19eb00*=0x3, lpData=0x0, lpcbData=0x19eafc*=0x2c) returned 0x0 [0136.837] RegQueryValueExW (in: hKey=0x510, lpValueName="TZI", lpReserved=0x0, lpType=0x19eb00, lpData=0x24e1648, lpcbData=0x19eafc*=0x2c | out: lpType=0x19eb00*=0x3, lpData=0x24e1648*, lpcbData=0x19eafc*=0x2c) returned 0x0 [0136.838] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time\\Dynamic DST", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e938 | out: phkResult=0x19e938*=0x0) returned 0x2 [0136.838] RegQueryValueExW (in: hKey=0x510, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x19ead8, lpData=0x0, lpcbData=0x19ead4*=0x0 | out: lpType=0x19ead8*=0x1, lpData=0x0, lpcbData=0x19ead4*=0x20) returned 0x0 [0136.838] RegQueryValueExW (in: hKey=0x510, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x19ead8, lpData=0x24e1a6c, lpcbData=0x19ead4*=0x20 | out: lpType=0x19ead8*=0x1, lpData="@tzres.dll,-320", lpcbData=0x19ead4*=0x20) returned 0x0 [0136.839] RegQueryValueExW (in: hKey=0x510, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x19ead8, lpData=0x0, lpcbData=0x19ead4*=0x0 | out: lpType=0x19ead8*=0x1, lpData=0x0, lpcbData=0x19ead4*=0x20) returned 0x0 [0136.839] RegQueryValueExW (in: hKey=0x510, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x19ead8, lpData=0x24e1ac4, lpcbData=0x19ead4*=0x20 | out: lpType=0x19ead8*=0x1, lpData="@tzres.dll,-322", lpcbData=0x19ead4*=0x20) returned 0x0 [0136.839] RegQueryValueExW (in: hKey=0x510, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x19ead8, lpData=0x0, lpcbData=0x19ead4*=0x0 | out: lpType=0x19ead8*=0x1, lpData=0x0, lpcbData=0x19ead4*=0x20) returned 0x0 [0136.839] RegQueryValueExW (in: hKey=0x510, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x19ead8, lpData=0x24e1b1c, lpcbData=0x19ead4*=0x20 | out: lpType=0x19ead8*=0x1, lpData="@tzres.dll,-321", lpcbData=0x19ead4*=0x20) returned 0x0 [0136.847] CoTaskMemAlloc (cb=0x20c) returned 0x6fe038 [0136.847] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x6fe038 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0136.848] CoTaskMemFree (pv=0x6fe038) [0136.848] CoTaskMemAlloc (cb=0x20c) returned 0x6fe038 [0136.849] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x19eaf4, pwszFileMUIPath=0x6fe038, pcchFileMUIPath=0x19eaf8, pululEnumerator=0x19eaec | out: pwszLanguage=0x0, pcchLanguage=0x19eaf4, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x19eaf8, pululEnumerator=0x19eaec) returned 1 [0136.882] CoTaskMemFree (pv=0x0) [0136.882] CoTaskMemFree (pv=0x6fe038) [0136.883] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x4980001 [0136.923] CoTaskMemAlloc (cb=0x3ec) returned 0x6fe038 [0136.923] LoadStringW (in: hInstance=0x4980001, uID=0x140, lpBuffer=0x6fe038, cchBufferMax=500 | out: lpBuffer="(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna") returned 0x3c [0136.923] CoTaskMemFree (pv=0x6fe038) [0136.923] FreeLibrary (hLibModule=0x4980001) returned 1 [0136.924] CoTaskMemAlloc (cb=0x20c) returned 0x6fe038 [0136.924] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x6fe038 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0136.924] CoTaskMemFree (pv=0x6fe038) [0136.924] CoTaskMemAlloc (cb=0x20c) returned 0x6fe038 [0136.925] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x19eaf4, pwszFileMUIPath=0x6fe038, pcchFileMUIPath=0x19eaf8, pululEnumerator=0x19eaec | out: pwszLanguage=0x0, pcchLanguage=0x19eaf4, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x19eaf8, pululEnumerator=0x19eaec) returned 1 [0136.927] CoTaskMemFree (pv=0x0) [0136.927] CoTaskMemFree (pv=0x6fe038) [0136.928] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x4980001 [0136.931] CoTaskMemAlloc (cb=0x3ec) returned 0x6fe038 [0136.931] LoadStringW (in: hInstance=0x4980001, uID=0x142, lpBuffer=0x6fe038, cchBufferMax=500 | out: lpBuffer="W. Europe Standard Time") returned 0x17 [0136.933] CoTaskMemFree (pv=0x6fe038) [0136.933] FreeLibrary (hLibModule=0x4980001) returned 1 [0136.934] CoTaskMemAlloc (cb=0x20c) returned 0x6fe038 [0136.934] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x6fe038 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0136.934] CoTaskMemFree (pv=0x6fe038) [0136.935] CoTaskMemAlloc (cb=0x20c) returned 0x6fe038 [0136.935] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x19eaf4, pwszFileMUIPath=0x6fe038, pcchFileMUIPath=0x19eaf8, pululEnumerator=0x19eaec | out: pwszLanguage=0x0, pcchLanguage=0x19eaf4, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x19eaf8, pululEnumerator=0x19eaec) returned 1 [0136.939] CoTaskMemFree (pv=0x0) [0136.939] CoTaskMemFree (pv=0x6fe038) [0136.940] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x4980001 [0136.943] CoTaskMemAlloc (cb=0x3ec) returned 0x6fe038 [0136.943] LoadStringW (in: hInstance=0x4980001, uID=0x141, lpBuffer=0x6fe038, cchBufferMax=500 | out: lpBuffer="W. Europe Daylight Time") returned 0x17 [0136.943] CoTaskMemFree (pv=0x6fe038) [0136.943] FreeLibrary (hLibModule=0x4980001) returned 1 [0136.944] RegCloseKey (hKey=0x510) returned 0x0 [0136.944] SetEvent (hEvent=0x3a0) returned 1 [0136.964] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x19ed00 | out: pFixedInfo=0x0, pOutBufLen=0x19ed00) returned 0x6f [0137.822] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6fe038 [0137.822] GetNetworkParams (in: pFixedInfo=0x6fe038, pOutBufLen=0x19ed00 | out: pFixedInfo=0x6fe038, pOutBufLen=0x19ed00) returned 0x0 [0137.836] LocalFree (hMem=0x6fe038) returned 0x0 [0137.838] CoTaskMemAlloc (cb=0x20c) returned 0x6fe038 [0137.838] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_Disabled", lpBuffer=0x6fe038, nSize=0x104 | out: lpBuffer="") returned 0x0 [0137.838] CoTaskMemFree (pv=0x6fe038) [0137.838] CoTaskMemAlloc (cb=0x20c) returned 0x6fe038 [0137.838] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_MinCount", lpBuffer=0x6fe038, nSize=0x104 | out: lpBuffer="") returned 0x0 [0137.838] CoTaskMemFree (pv=0x6fe038) [0137.843] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x550 [0137.926] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x528 [0137.927] GetAddrInfoW (in: pNodeName="www.google.com", pServiceName=0x0, pHints=0x19ebe8*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x19eb90 | out: ppResult=0x19eb90*=0x6eb128*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="www.google.com", ai_addr=0x70a700*(sa_family=2, sin_port=0x0, sin_addr="216.58.212.164"), ai_next=0x0)) returned 0 [0138.827] FreeAddrInfoW (pAddrInfo=0x6eb128*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="www.google.com", ai_addr=0x70a700*(sa_family=2, sin_port=0x0, sin_addr="216.58.212.164"), ai_next=0x0)) [0138.884] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x558 [0138.885] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x560 [0138.885] ioctlsocket (in: s=0x558, cmd=-2147195266, argp=0x19ebc0 | out: argp=0x19ebc0) returned 0 [0138.885] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x564 [0138.885] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x568 [0138.885] ioctlsocket (in: s=0x564, cmd=-2147195266, argp=0x19ebc0 | out: argp=0x19ebc0) returned 0 [0138.886] WSAIoctl (in: s=0x558, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x19eba8, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x19eba8, lpOverlapped=0x0) returned -1 [0138.886] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x19e8d8, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0138.886] WSAEventSelect (s=0x558, hEventObject=0x560, lNetworkEvents=512) returned 0 [0138.886] WSAIoctl (in: s=0x564, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x19eba8, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x19eba8, lpOverlapped=0x0) returned -1 [0138.886] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x19e8d8, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0138.886] WSAEventSelect (s=0x564, hEventObject=0x568, lNetworkEvents=512) returned 0 [0138.887] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x19eba4*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x19eba4*=0xa80) returned 0x6f [0138.893] LocalAlloc (uFlags=0x0, uBytes=0xa80) returned 0x714950 [0138.893] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x714950, SizePointer=0x19eba4*=0xa80 | out: AdapterAddresses=0x714950*(Alignment=0x600000178, Length=0x178, IfIndex=0x6, Next=0x714c00, AdapterName="{E96D977E-F067-4CE9-924D-F6E0A04729E4}", FirstUnicastAddress=0x714b74, FirstAnycastAddress=0x0, FirstMulticastAddress=0x0, FirstDnsServerAddress=0x0, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection #2", FriendlyName="Ethernet 2", PhysicalAddress=([0]=0x0, [1]=0x0, [2]=0xcb, [3]=0xc0, [4]=0xfa, [5]=0xfc, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x1c5, DdnsEnabled=0x1c5, RegisterAdapterSuffix=0x1c5, Dhcpv4Enabled=0x1c5, ReceiveOnly=0x1c5, NoMulticast=0x1c5, Ipv6OtherStatefulConfig=0x1c5, NetbiosOverTcpipEnabled=0x1c5, Ipv4Enabled=0x1c5, Ipv6Enabled=0x1c5, Ipv6ManagedAddressConfigurationSupported=0x1c5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x6, ZoneIndices=([0]=0x6, [1]=0x6, [2]=0x6, [3]=0x6, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x6008002000000, Dhcpv4Server.lpSockaddr=0x714ac8*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11eb6c9dc20d55b0, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x28, [5]=0xb6, [6]=0x28, [7]=0x5e, [8]=0x0, [9]=0xf, [10]=0xf3, [11]=0xe1, [12]=0x61, [13]=0x38, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x6000ff3, FirstDnsSuffix=0x0), SizePointer=0x19eba4*=0xa80) returned 0x0 [0138.903] LocalFree (hMem=0x714950) returned 0x0 [0138.916] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ebc0 | out: phkResult=0x19ebc0*=0x56c) returned 0x0 [0138.916] RegQueryValueExW (in: hKey=0x56c, lpValueName="HWRPortReuseOnSocketBind", lpReserved=0x0, lpType=0x19ebdc, lpData=0x0, lpcbData=0x19ebd8*=0x0 | out: lpType=0x19ebdc*=0x0, lpData=0x0, lpcbData=0x19ebd8*=0x0) returned 0x2 [0138.916] RegCloseKey (hKey=0x56c) returned 0x0 [0138.917] WSAConnect (in: s=0x550, name=0x24ede8c*(sa_family=2, sin_port=0x1bb, sin_addr="216.58.212.164"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0138.936] closesocket (s=0x528) returned 0 [0139.170] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb0c | out: phkResult=0x19eb0c*=0x528) returned 0x0 [0139.170] RegQueryValueExW (in: hKey=0x528, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x19eb28, lpData=0x0, lpcbData=0x19eb24*=0x0 | out: lpType=0x19eb28*=0x4, lpData=0x0, lpcbData=0x19eb24*=0x4) returned 0x0 [0139.170] RegQueryValueExW (in: hKey=0x528, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x19eb28, lpData=0x19eb14, lpcbData=0x19eb24*=0x4 | out: lpType=0x19eb28*=0x4, lpData=0x19eb14*=0x1, lpcbData=0x19eb24*=0x4) returned 0x0 [0139.225] RegQueryValueExW (in: hKey=0x528, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x19eb60, lpData=0x0, lpcbData=0x19eb5c*=0x0 | out: lpType=0x19eb60*=0x4, lpData=0x0, lpcbData=0x19eb5c*=0x4) returned 0x0 [0139.227] RegCloseKey (hKey=0x528) returned 0x0 [0139.261] GetCurrentProcessId () returned 0x1388 [0139.263] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1388) returned 0x528 [0139.491] EnumProcessModules (in: hProcess=0x528, lphModule=0x24f0134, cb=0x100, lpcbNeeded=0x19eb14 | out: lphModule=0x24f0134, lpcbNeeded=0x19eb14) returned 1 [0139.492] EnumProcessModules (in: hProcess=0x528, lphModule=0x24f0240, cb=0x200, lpcbNeeded=0x19eb14 | out: lphModule=0x24f0240, lpcbNeeded=0x19eb14) returned 1 [0139.495] GetModuleInformation (in: hProcess=0x528, hModule=0x400000, lpmodinfo=0x24f0480, cb=0xc | out: lpmodinfo=0x24f0480*(lpBaseOfDll=0x400000, SizeOfImage=0xa000, EntryPoint=0x0)) returned 1 [0139.495] CoTaskMemAlloc (cb=0x804) returned 0x714d58 [0139.495] GetModuleBaseNameW (in: hProcess=0x528, hModule=0x400000, lpBaseName=0x714d58, nSize=0x800 | out: lpBaseName="66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe") returned 0x44 [0139.496] CoTaskMemFree (pv=0x714d58) [0139.496] CoTaskMemAlloc (cb=0x804) returned 0x714d58 [0139.496] GetModuleFileNameExW (in: hProcess=0x528, hModule=0x400000, lpFilename=0x714d58, nSize=0x800 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe")) returned 0x62 [0139.497] CoTaskMemFree (pv=0x714d58) [0139.497] CloseHandle (hObject=0x528) returned 1 [0139.497] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x63 [0139.497] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe", nBufferLength=0x63, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe", lpFilePart=0x0) returned 0x62 [0139.498] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.SecurityProtocol", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb0c | out: phkResult=0x19eb0c*=0x0) returned 0x2 [0139.555] GetCurrentProcessId () returned 0x1388 [0139.555] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1388) returned 0x528 [0139.555] EnumProcessModules (in: hProcess=0x528, lphModule=0x24f2dfc, cb=0x100, lpcbNeeded=0x19eb1c | out: lphModule=0x24f2dfc, lpcbNeeded=0x19eb1c) returned 1 [0139.556] EnumProcessModules (in: hProcess=0x528, lphModule=0x24f2f08, cb=0x200, lpcbNeeded=0x19eb1c | out: lphModule=0x24f2f08, lpcbNeeded=0x19eb1c) returned 1 [0139.557] GetModuleInformation (in: hProcess=0x528, hModule=0x400000, lpmodinfo=0x24f3148, cb=0xc | out: lpmodinfo=0x24f3148*(lpBaseOfDll=0x400000, SizeOfImage=0xa000, EntryPoint=0x0)) returned 1 [0139.558] CoTaskMemAlloc (cb=0x804) returned 0x714d58 [0139.558] GetModuleBaseNameW (in: hProcess=0x528, hModule=0x400000, lpBaseName=0x714d58, nSize=0x800 | out: lpBaseName="66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe") returned 0x44 [0139.558] CoTaskMemFree (pv=0x714d58) [0139.558] CoTaskMemAlloc (cb=0x804) returned 0x714d58 [0139.558] GetModuleFileNameExW (in: hProcess=0x528, hModule=0x400000, lpFilename=0x714d58, nSize=0x800 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe")) returned 0x62 [0139.558] CoTaskMemFree (pv=0x714d58) [0139.558] CloseHandle (hObject=0x528) returned 1 [0139.558] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x63 [0139.558] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe", nBufferLength=0x63, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe", lpFilePart=0x0) returned 0x62 [0139.559] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.SchSendAuxRecord", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb14 | out: phkResult=0x19eb14*=0x0) returned 0x2 [0139.559] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb14 | out: phkResult=0x19eb14*=0x528) returned 0x0 [0139.559] RegQueryValueExW (in: hKey=0x528, lpValueName="SchSendAuxRecord", lpReserved=0x0, lpType=0x19eb30, lpData=0x0, lpcbData=0x19eb2c*=0x0 | out: lpType=0x19eb30*=0x0, lpData=0x0, lpcbData=0x19eb2c*=0x0) returned 0x2 [0139.559] RegCloseKey (hKey=0x528) returned 0x0 [0140.193] EnumerateSecurityPackagesW (in: pcPackages=0x19eb38, ppPackageInfo=0x19eacc | out: pcPackages=0x19eb38, ppPackageInfo=0x19eacc) returned 0x0 [0140.277] FreeContextBuffer (in: pvContextBuffer=0x7143e8 | out: pvContextBuffer=0x7143e8) returned 0x0 [0140.334] GetCurrentProcess () returned 0xffffffff [0140.334] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e918 | out: TokenHandle=0x19e918*=0x56c) returned 1 [0140.335] AcquireCredentialsHandleW (in: pPrincipal=0x0, pPackage=0x24f57e4, fCredentialUse=0x2, pvLogonId=0x0, pAuthData=0x19e96c, pGetKeyFn=0x0, pvGetKeyArgument=0x0, phCredential=0x24f6d70, ptsExpiry=0x19e8f0 | out: phCredential=0x24f6d70, ptsExpiry=0x19e8f0) returned 0x0 [0141.886] InitializeSecurityContextW (in: phCredential=0x19e930, phContext=0x0, pTargetName=0x24edf80, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x0, Reserved2=0x0, phNewContext=0x24f6f74, pOutput=0x24f6f0c, pfContextAttr=0x24f57b8, ptsExpiry=0x19e928 | out: phNewContext=0x24f6f74, pOutput=0x24f6f0c, pfContextAttr=0x24f57b8, ptsExpiry=0x19e928) returned 0x90312 [0141.935] FreeContextBuffer (in: pvContextBuffer=0x7033e0 | out: pvContextBuffer=0x7033e0) returned 0x0 [0141.941] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77340000 [0141.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="AppPolicyGetClrCompat", cchWideChar=21, lpMultiByteStr=0x19e96c, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AppPolicyGetClrCompatÃ8oîú¶\r(úHn\x8cð\x19", lpUsedDefaultChar=0x0) returned 21 [0141.941] GetProcAddress (hModule=0x77340000, lpProcName="AppPolicyGetClrCompat") returned 0x0 [0141.942] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77340000 [0141.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="GetCurrentPackageId", cchWideChar=19, lpMultiByteStr=0x19e96c, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentPackageId", lpUsedDefaultChar=0x0) returned 19 [0141.942] GetProcAddress (hModule=0x77340000, lpProcName="GetCurrentPackageId") returned 0x7563ded0 [0141.942] GetCurrentPackageId () returned 0x3d54 [0141.944] send (s=0x550, buf=0x24f6f88*, len=178, flags=0) returned 178 [0142.049] recv (in: s=0x550, buf=0x24f6f88, len=5, flags=0 | out: buf=0x24f6f88*) returned 5 [0142.049] recv (in: s=0x550, buf=0x24f6f8d, len=63, flags=0 | out: buf=0x24f6f8d*) returned 63 [0142.050] InitializeSecurityContextW (in: phCredential=0x19e894, phContext=0x19e920, pTargetName=0x24edf80, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x24f7398, Reserved2=0x0, phNewContext=0x24f6f74, pOutput=0x24f73ac, pfContextAttr=0x24f57b8, ptsExpiry=0x19e88c | out: phNewContext=0x24f6f74, pOutput=0x24f73ac, pfContextAttr=0x24f57b8, ptsExpiry=0x19e88c) returned 0x90312 [0142.052] recv (in: s=0x550, buf=0x24f743c, len=5, flags=0 | out: buf=0x24f743c*) returned 5 [0142.052] recv (in: s=0x550, buf=0x24f7455, len=3994, flags=0 | out: buf=0x24f7455*) returned 3994 [0142.052] InitializeSecurityContextW (in: phCredential=0x19e7fc, phContext=0x19e888, pTargetName=0x24edf80, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x24f8460, Reserved2=0x0, phNewContext=0x24f6f74, pOutput=0x24f8474, pfContextAttr=0x24f57b8, ptsExpiry=0x19e7f4 | out: phNewContext=0x24f6f74, pOutput=0x24f8474, pfContextAttr=0x24f57b8, ptsExpiry=0x19e7f4) returned 0x90312 [0142.057] recv (in: s=0x550, buf=0x24f8504, len=5, flags=0 | out: buf=0x24f8504*) returned 5 [0142.057] recv (in: s=0x550, buf=0x24f851d, len=148, flags=0 | out: buf=0x24f851d*) returned 148 [0142.057] InitializeSecurityContextW (in: phCredential=0x19e764, phContext=0x19e7f0, pTargetName=0x24edf80, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x24f8624, Reserved2=0x0, phNewContext=0x24f6f74, pOutput=0x24f8638, pfContextAttr=0x24f57b8, ptsExpiry=0x19e75c | out: phNewContext=0x24f6f74, pOutput=0x24f8638, pfContextAttr=0x24f57b8, ptsExpiry=0x19e75c) returned 0x90312 [0142.058] recv (in: s=0x550, buf=0x24f86c8, len=5, flags=0 | out: buf=0x24f86c8*) returned 5 [0142.058] recv (in: s=0x550, buf=0x24f86e1, len=4, flags=0 | out: buf=0x24f86e1*) returned 4 [0142.058] InitializeSecurityContextW (in: phCredential=0x19e6cc, phContext=0x19e758, pTargetName=0x24edf80, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x24f8758, Reserved2=0x0, phNewContext=0x24f6f74, pOutput=0x24f876c, pfContextAttr=0x24f57b8, ptsExpiry=0x19e6c4 | out: phNewContext=0x24f6f74, pOutput=0x24f876c, pfContextAttr=0x24f57b8, ptsExpiry=0x19e6c4) returned 0x90312 [0142.316] FreeContextBuffer (in: pvContextBuffer=0x7185a8 | out: pvContextBuffer=0x7185a8) returned 0x0 [0142.316] send (s=0x550, buf=0x24f87e8*, len=126, flags=0) returned 126 [0142.317] recv (in: s=0x550, buf=0x24f87e8, len=5, flags=0 | out: buf=0x24f87e8*) returned 5 [0142.331] recv (in: s=0x550, buf=0x24f888d, len=239, flags=0 | out: buf=0x24f888d*) returned 239 [0142.331] InitializeSecurityContextW (in: phCredential=0x19e634, phContext=0x19e6c0, pTargetName=0x24edf80, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x24f89ec, Reserved2=0x0, phNewContext=0x24f6f74, pOutput=0x24f8a00, pfContextAttr=0x24f57b8, ptsExpiry=0x19e62c | out: phNewContext=0x24f6f74, pOutput=0x24f8a00, pfContextAttr=0x24f57b8, ptsExpiry=0x19e62c) returned 0x90312 [0142.332] recv (in: s=0x550, buf=0x24f8a90, len=5, flags=0 | out: buf=0x24f8a90*) returned 5 [0142.332] recv (in: s=0x550, buf=0x24f8aa9, len=1, flags=0 | out: buf=0x24f8aa9*) returned 1 [0142.332] InitializeSecurityContextW (in: phCredential=0x19e59c, phContext=0x19e628, pTargetName=0x24edf80, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x24f8b1c, Reserved2=0x0, phNewContext=0x24f6f74, pOutput=0x24f8b30, pfContextAttr=0x24f57b8, ptsExpiry=0x19e594 | out: phNewContext=0x24f6f74, pOutput=0x24f8b30, pfContextAttr=0x24f57b8, ptsExpiry=0x19e594) returned 0x90312 [0142.333] recv (in: s=0x550, buf=0x24f8bc0, len=5, flags=0 | out: buf=0x24f8bc0*) returned 5 [0142.333] recv (in: s=0x550, buf=0x24f8bd9, len=40, flags=0 | out: buf=0x24f8bd9*) returned 40 [0142.333] InitializeSecurityContextW (in: phCredential=0x19e504, phContext=0x19e590, pTargetName=0x24edf80, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x24f8c74, Reserved2=0x0, phNewContext=0x24f6f74, pOutput=0x24f8c88, pfContextAttr=0x24f57b8, ptsExpiry=0x19e4fc | out: phNewContext=0x24f6f74, pOutput=0x24f8c88, pfContextAttr=0x24f57b8, ptsExpiry=0x19e4fc) returned 0x0 [0142.985] QueryContextAttributesW (in: phContext=0x24f6f74, ulAttribute=0x4, pBuffer=0x24f8d34 | out: pBuffer=0x24f8d34) returned 0x0 [0142.986] QueryContextAttributesW (in: phContext=0x24f6f74, ulAttribute=0x5a, pBuffer=0x24f8d8c | out: pBuffer=0x24f8d8c) returned 0x0 [0142.994] QueryContextAttributesW (in: phContext=0x24f6f74, ulAttribute=0x53, pBuffer=0x24f9040 | out: pBuffer=0x24f9040) returned 0x0 [0143.003] CertDuplicateCertificateContext (pCertContext=0x6896e0) returned 0x6896e0 [0143.004] CertDuplicateStore (hCertStore=0x6fe408) returned 0x6fe408 [0143.004] CertEnumCertificatesInStore (hCertStore=0x6fe408, pPrevCertContext=0x0) returned 0x6897d0 [0143.004] CertDuplicateCertificateContext (pCertContext=0x6897d0) returned 0x6897d0 [0143.005] CertEnumCertificatesInStore (hCertStore=0x6fe408, pPrevCertContext=0x6897d0) returned 0x689730 [0143.005] CertDuplicateCertificateContext (pCertContext=0x689730) returned 0x689730 [0143.005] CertEnumCertificatesInStore (hCertStore=0x6fe408, pPrevCertContext=0x689730) returned 0x6896e0 [0143.005] CertDuplicateCertificateContext (pCertContext=0x6896e0) returned 0x6896e0 [0143.005] CertEnumCertificatesInStore (hCertStore=0x6fe408, pPrevCertContext=0x6896e0) returned 0x0 [0143.005] CertCloseStore (hCertStore=0x6fe408, dwFlags=0x0) returned 1 [0143.005] CertFreeCertificateContext (pCertContext=0x6896e0) returned 1 [0143.020] CertOpenStore (lpszStoreProvider=0x2, dwEncodingType=0x10001, hCryptProv=0x0, dwFlags=0x2204, pvPara=0x0) returned 0x706ba0 [0143.026] CertAddCRLLinkToStore (in: hCertStore=0x706ba0, pCrlContext=0x6897d0, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0143.031] CertAddCRLLinkToStore (in: hCertStore=0x706ba0, pCrlContext=0x689730, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0143.031] CertAddCRLLinkToStore (in: hCertStore=0x706ba0, pCrlContext=0x6896e0, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0143.036] CertGetCertificateChain (in: hChainEngine=0x0, pCertContext=0x6896e0, pTime=0x19e510, hAdditionalStore=0x706ba0, pChainPara=0x19e450, dwFlags=0x0, pvReserved=0x0, ppChainContext=0x19e444 | out: ppChainContext=0x19e444) returned 1 [0143.055] CertDuplicateCertificateChain (pChainContext=0x718998) returned 0x718998 [0143.055] CertDuplicateCertificateContext (pCertContext=0x6896e0) returned 0x6896e0 [0143.056] CertDuplicateCertificateContext (pCertContext=0x66b458) returned 0x66b458 [0143.056] CertDuplicateCertificateContext (pCertContext=0x66b598) returned 0x66b598 [0143.056] CertDuplicateCertificateContext (pCertContext=0x712640) returned 0x712640 [0143.056] CertFreeCertificateChain (pChainContext=0x718998) [0143.057] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x1, pChainContext=0x718998, pPolicyPara=0x19e5f0, pPolicyStatus=0x19e5dc | out: pPolicyStatus=0x19e5dc) returned 1 [0143.058] SetLastError (dwErrCode=0x0) [0143.060] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x4, pChainContext=0x718998, pPolicyPara=0x19e65c, pPolicyStatus=0x19e604 | out: pPolicyStatus=0x19e604) returned 1 [0143.066] CertFreeCertificateChain (pChainContext=0x718998) [0143.066] CertFreeCertificateContext (pCertContext=0x6896e0) returned 1 [0143.100] CoTaskMemAlloc (cb=0x20c) returned 0x71f810 [0143.100] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_Disabled", lpBuffer=0x71f810, nSize=0x104 | out: lpBuffer="") returned 0x0 [0143.100] CoTaskMemFree (pv=0x71f810) [0143.100] CoTaskMemAlloc (cb=0x210) returned 0x71f810 [0143.100] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_MinCount", lpBuffer=0x71f810, nSize=0x106 | out: lpBuffer="") returned 0x0 [0143.100] CoTaskMemFree (pv=0x71f810) [0143.100] CoTaskMemAlloc (cb=0x210) returned 0x71f810 [0143.100] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_Disabled", lpBuffer=0x71f810, nSize=0x106 | out: lpBuffer="") returned 0x0 [0143.100] CoTaskMemFree (pv=0x71f810) [0143.101] CoTaskMemAlloc (cb=0x210) returned 0x71f810 [0143.101] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_MinCount", lpBuffer=0x71f810, nSize=0x106 | out: lpBuffer="") returned 0x0 [0143.101] CoTaskMemFree (pv=0x71f810) [0143.102] EncryptMessage (in: phContext=0x24f6f74, fQOP=0x0, pMessage=0x2501220, MessageSeqNo=0x0 | out: pMessage=0x2501220) returned 0x0 [0143.102] send (s=0x550, buf=0x24ffcf8*, len=93, flags=0) returned 93 [0143.103] setsockopt (s=0x550, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0143.104] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.171] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.172] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x25115f0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x25115f0, pfQOP=0x0) returned 0x0 [0143.205] GetCurrentProcess () returned 0xffffffff [0143.205] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eb18 | out: TokenHandle=0x19eb18*=0x64c) returned 1 [0143.206] GetCurrentProcess () returned 0xffffffff [0143.206] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eb28 | out: TokenHandle=0x19eb28*=0x654) returned 1 [0143.209] setsockopt (s=0x550, level=65535, optname=4102, optval="ô\x01", optlen=4) returned 0 [0143.209] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee74 | out: lpPerformanceCount=0x19ee74*=3576132539477) returned 1 [0143.209] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576132550537) returned 1 [0143.217] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.217] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.218] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x2515d30, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2515d30, pfQOP=0x0) returned 0x0 [0143.218] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576133415373) returned 1 [0143.218] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.218] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.218] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x2515e50, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2515e50, pfQOP=0x0) returned 0x0 [0143.218] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576133444442) returned 1 [0143.218] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.218] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.218] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x2515f70, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2515f70, pfQOP=0x0) returned 0x0 [0143.218] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576133470968) returned 1 [0143.218] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.218] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.218] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x2516090, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2516090, pfQOP=0x0) returned 0x0 [0143.219] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576133499341) returned 1 [0143.219] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.219] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.219] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x25161b0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x25161b0, pfQOP=0x0) returned 0x0 [0143.219] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576133529485) returned 1 [0143.219] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.219] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.219] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x25162d0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x25162d0, pfQOP=0x0) returned 0x0 [0143.219] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576133558788) returned 1 [0143.219] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.219] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.219] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x25163f0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x25163f0, pfQOP=0x0) returned 0x0 [0143.219] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576133592117) returned 1 [0143.220] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.220] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.220] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x2516510, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2516510, pfQOP=0x0) returned 0x0 [0143.220] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576133623743) returned 1 [0143.220] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.220] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.220] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x2516630, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2516630, pfQOP=0x0) returned 0x0 [0143.220] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576133654915) returned 1 [0143.220] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.220] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.220] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x2516750, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2516750, pfQOP=0x0) returned 0x0 [0143.220] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576133683675) returned 1 [0143.220] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.221] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.221] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x2516870, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2516870, pfQOP=0x0) returned 0x0 [0143.221] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576133710427) returned 1 [0143.221] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.221] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.221] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x2516990, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2516990, pfQOP=0x0) returned 0x0 [0143.221] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576133740978) returned 1 [0143.221] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.221] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.221] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x2516ab0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2516ab0, pfQOP=0x0) returned 0x0 [0143.223] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576133966073) returned 1 [0143.223] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.223] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.223] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x2516bd0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2516bd0, pfQOP=0x0) returned 0x0 [0143.224] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576134000486) returned 1 [0143.224] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.224] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.224] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x2516cf0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2516cf0, pfQOP=0x0) returned 0x0 [0143.224] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576134030424) returned 1 [0143.224] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.224] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.224] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x2516e10, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2516e10, pfQOP=0x0) returned 0x0 [0143.224] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576134059642) returned 1 [0143.224] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.224] recv (in: s=0x550, buf=0x250d535, len=485, flags=0 | out: buf=0x250d535*) returned 485 [0143.224] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x2516f30, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2516f30, pfQOP=0x0) returned 0x0 [0143.224] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576134086410) returned 1 [0143.225] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.225] recv (in: s=0x550, buf=0x250d535, len=365, flags=0 | out: buf=0x250d535*) returned 365 [0143.225] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x2517050, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2517050, pfQOP=0x0) returned 0x0 [0143.225] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576134146142) returned 1 [0143.225] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.225] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.225] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x2517170, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2517170, pfQOP=0x0) returned 0x0 [0143.225] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576134187711) returned 1 [0143.226] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.226] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.226] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x2517290, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2517290, pfQOP=0x0) returned 0x0 [0143.226] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576134220545) returned 1 [0143.226] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.226] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.226] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x25173b0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x25173b0, pfQOP=0x0) returned 0x0 [0143.226] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576134260351) returned 1 [0143.226] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.226] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.226] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x25174d0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x25174d0, pfQOP=0x0) returned 0x0 [0143.226] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576134288342) returned 1 [0143.227] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.227] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.227] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x25175f0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x25175f0, pfQOP=0x0) returned 0x0 [0143.227] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576134318946) returned 1 [0143.227] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.227] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.227] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x2517710, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2517710, pfQOP=0x0) returned 0x0 [0143.227] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576134349591) returned 1 [0143.227] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.227] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.227] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x2517830, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2517830, pfQOP=0x0) returned 0x0 [0143.227] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576134376491) returned 1 [0143.227] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.227] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.228] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x2517950, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2517950, pfQOP=0x0) returned 0x0 [0143.228] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576134402997) returned 1 [0143.228] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.228] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.228] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x2517a70, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2517a70, pfQOP=0x0) returned 0x0 [0143.228] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576134429614) returned 1 [0143.228] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.228] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.228] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x2517b90, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2517b90, pfQOP=0x0) returned 0x0 [0143.228] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576134457662) returned 1 [0143.228] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.228] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.228] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x2517cb0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2517cb0, pfQOP=0x0) returned 0x0 [0143.228] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576134483182) returned 1 [0143.228] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.229] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.229] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x2517dd0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2517dd0, pfQOP=0x0) returned 0x0 [0143.229] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576134508869) returned 1 [0143.229] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.229] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.229] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x2517ef0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2517ef0, pfQOP=0x0) returned 0x0 [0143.229] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576134539331) returned 1 [0143.229] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.229] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.229] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x2518010, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2518010, pfQOP=0x0) returned 0x0 [0143.229] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576134567726) returned 1 [0143.229] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.229] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.229] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x2518130, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2518130, pfQOP=0x0) returned 0x0 [0143.229] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576134593223) returned 1 [0143.230] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.230] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.230] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x2518250, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2518250, pfQOP=0x0) returned 0x0 [0143.230] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576134623145) returned 1 [0143.230] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.230] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.230] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x2518370, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2518370, pfQOP=0x0) returned 0x0 [0143.230] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576134653534) returned 1 [0143.230] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.230] recv (in: s=0x550, buf=0x250d535, len=1407, flags=0 | out: buf=0x250d535*) returned 1407 [0143.230] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x2518490, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2518490, pfQOP=0x0) returned 0x0 [0143.230] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576134682908) returned 1 [0143.230] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.231] recv (in: s=0x550, buf=0x250d535, len=1183, flags=0 | out: buf=0x250d535*) returned 1183 [0143.231] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x25185b0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x25185b0, pfQOP=0x0) returned 0x0 [0143.231] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee3c | out: lpPerformanceCount=0x19ee3c*=3576134711835) returned 1 [0143.231] recv (in: s=0x550, buf=0x250d530, len=5, flags=0 | out: buf=0x250d530*) returned 5 [0143.231] recv (in: s=0x550, buf=0x250d535, len=29, flags=0 | out: buf=0x250d535*) returned 29 [0143.231] DecryptMessage (in: phContext=0x24f6f74, pMessage=0x25186d0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x25186d0, pfQOP=0x0) returned 0x0 [0143.231] SetEvent (hEvent=0x3a0) returned 1 [0143.234] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee60 | out: lpPerformanceCount=0x19ee60*=3576135032357) returned 1 [0143.243] GetFullPathNameW (in: lpFileName="C:\\RDhJ0CNFevzX\\wallpaper.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1e [0143.243] GetFullPathNameW (in: lpFileName="C:\\RDhJ0CNFevzX\\wallpaper.jpg", nBufferLength=0x1e, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\RDhJ0CNFevzX\\wallpaper.jpg", lpFilePart=0x0) returned 0x1d [0143.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee04) returned 1 [0143.243] CreateFileW (lpFileName="C:\\RDhJ0CNFevzX\\wallpaper.jpg" (normalized: "c:\\rdhj0cnfevzx\\wallpaper.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x658 [0143.245] GetFileType (hFile=0x658) returned 0x1 [0143.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee00) returned 1 [0143.245] GetFileType (hFile=0x658) returned 0x1 [0143.245] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee88 | out: lpPerformanceCount=0x19ee88*=3576136149339) returned 1 [0143.245] SetEvent (hEvent=0x3a0) returned 1 [0143.248] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ec94*=0x434, lpdwindex=0x19eab4 | out: lpdwindex=0x19eab4) returned 0x80010115 [0143.248] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ec74*=0x424, lpdwindex=0x19ea94 | out: lpdwindex=0x19ea94) returned 0x80010115 [0143.249] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ec74*=0x42c, lpdwindex=0x19ea94 | out: lpdwindex=0x19ea94) returned 0x80010115 [0143.249] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ecc8*=0x454, lpdwindex=0x19eae4 | out: lpdwindex=0x19eae4) returned 0x80010115 [0143.249] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ecc8*=0x45c, lpdwindex=0x19eae4 | out: lpdwindex=0x19eae4) returned 0x80010115 [0143.250] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ecc8*=0x464, lpdwindex=0x19eae4 | out: lpdwindex=0x19eae4) returned 0x80010115 [0143.251] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x65c [0143.251] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x660 [0143.252] GetAddrInfoW (in: pNodeName="media.threatpost.com", pServiceName=0x0, pHints=0x19ebc8*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x19eb70 | out: ppResult=0x19eb70*=0x715498*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="d2x8sklh0hjsql.cloudfront.net", ai_addr=0x70a328*(sa_family=2, sin_port=0x0, sin_addr="13.226.153.98"), ai_next=0x715308*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x70a340*(sa_family=2, sin_port=0x0, sin_addr="13.226.153.2"), ai_next=0x715538*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x70a4c0*(sa_family=2, sin_port=0x0, sin_addr="13.226.153.79"), ai_next=0x715290*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x70a460*(sa_family=2, sin_port=0x0, sin_addr="13.226.153.42"), ai_next=0x0))))) returned 0 [0143.273] FreeAddrInfoW (pAddrInfo=0x715498*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="d2x8sklh0hjsql.cloudfront.net", ai_addr=0x70a328*(sa_family=2, sin_port=0x0, sin_addr="13.226.153.98"), ai_next=0x715308*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x70a340*(sa_family=2, sin_port=0x0, sin_addr="13.226.153.2"), ai_next=0x715538*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x70a4c0*(sa_family=2, sin_port=0x0, sin_addr="13.226.153.79"), ai_next=0x715290*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x70a460*(sa_family=2, sin_port=0x0, sin_addr="13.226.153.42"), ai_next=0x0))))) [0143.274] GetAddrInfoW (in: pNodeName="media.threatpost.com", pServiceName=0x0, pHints=0x19ebc8*(ai_flags=131072, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x19eb70 | out: ppResult=0x19eb70*=0x715538*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="media.threatpost.com", ai_addr=0x70a418*(sa_family=2, sin_port=0x0, sin_addr="13.226.153.98"), ai_next=0x7153d0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x70a400*(sa_family=2, sin_port=0x0, sin_addr="13.226.153.2"), ai_next=0x7154c0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x70a448*(sa_family=2, sin_port=0x0, sin_addr="13.226.153.79"), ai_next=0x715628*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x70a460*(sa_family=2, sin_port=0x0, sin_addr="13.226.153.42"), ai_next=0x0))))) returned 0 [0143.276] FreeAddrInfoW (pAddrInfo=0x715538*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="media.threatpost.com", ai_addr=0x70a418*(sa_family=2, sin_port=0x0, sin_addr="13.226.153.98"), ai_next=0x7153d0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x70a400*(sa_family=2, sin_port=0x0, sin_addr="13.226.153.2"), ai_next=0x7154c0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x70a448*(sa_family=2, sin_port=0x0, sin_addr="13.226.153.79"), ai_next=0x715628*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x70a460*(sa_family=2, sin_port=0x0, sin_addr="13.226.153.42"), ai_next=0x0))))) [0143.276] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19eb10*=0x560, lpdwindex=0x19e92c | out: lpdwindex=0x19e92c) returned 0x80010115 [0143.276] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19eb10*=0x568, lpdwindex=0x19e92c | out: lpdwindex=0x19e92c) returned 0x80010115 [0143.277] WSAConnect (in: s=0x65c, name=0x252b334*(sa_family=2, sin_port=0x1bb, sin_addr="13.226.153.98"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0143.296] closesocket (s=0x660) returned 0 [0143.296] InitializeSecurityContextW (in: phCredential=0x19e910, phContext=0x0, pTargetName=0x252b390, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x0, Reserved2=0x0, phNewContext=0x252b9a0, pOutput=0x252b938, pfContextAttr=0x252b858, ptsExpiry=0x19e908 | out: phNewContext=0x252b9a0, pOutput=0x252b938, pfContextAttr=0x252b858, ptsExpiry=0x19e908) returned 0x90312 [0143.297] FreeContextBuffer (in: pvContextBuffer=0x702a20 | out: pvContextBuffer=0x702a20) returned 0x0 [0143.297] send (s=0x65c, buf=0x252b9b4*, len=184, flags=0) returned 184 [0143.298] recv (in: s=0x65c, buf=0x252b9b4, len=5, flags=0 | out: buf=0x252b9b4*) returned 5 [0143.316] recv (in: s=0x65c, buf=0x252b9b9, len=99, flags=0 | out: buf=0x252b9b9*) returned 99 [0143.316] InitializeSecurityContextW (in: phCredential=0x19e874, phContext=0x19e900, pTargetName=0x252b390, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x252baf0, Reserved2=0x0, phNewContext=0x252b9a0, pOutput=0x252bb04, pfContextAttr=0x252b858, ptsExpiry=0x19e86c | out: phNewContext=0x252b9a0, pOutput=0x252bb04, pfContextAttr=0x252b858, ptsExpiry=0x19e86c) returned 0x90312 [0143.319] recv (in: s=0x65c, buf=0x252bb94, len=5, flags=0 | out: buf=0x252bb94*) returned 5 [0143.319] recv (in: s=0x65c, buf=0x252bbad, len=4945, flags=0 | out: buf=0x252bbad*) returned 4945 [0143.320] InitializeSecurityContextW (in: phCredential=0x19e7dc, phContext=0x19e868, pTargetName=0x252b390, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x252cf70, Reserved2=0x0, phNewContext=0x252b9a0, pOutput=0x252cf84, pfContextAttr=0x252b858, ptsExpiry=0x19e7d4 | out: phNewContext=0x252b9a0, pOutput=0x252cf84, pfContextAttr=0x252b858, ptsExpiry=0x19e7d4) returned 0x90312 [0143.323] recv (in: s=0x65c, buf=0x252d014, len=5, flags=0 | out: buf=0x252d014*) returned 5 [0143.324] recv (in: s=0x65c, buf=0x252d02d, len=333, flags=0 | out: buf=0x252d02d*) returned 333 [0143.324] InitializeSecurityContextW (in: phCredential=0x19e744, phContext=0x19e7d0, pTargetName=0x252b390, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x252d1ec, Reserved2=0x0, phNewContext=0x252b9a0, pOutput=0x252d200, pfContextAttr=0x252b858, ptsExpiry=0x19e73c | out: phNewContext=0x252b9a0, pOutput=0x252d200, pfContextAttr=0x252b858, ptsExpiry=0x19e73c) returned 0x90312 [0143.324] recv (in: s=0x65c, buf=0x252d290, len=5, flags=0 | out: buf=0x252d290*) returned 5 [0143.324] recv (in: s=0x65c, buf=0x252d2a9, len=4, flags=0 | out: buf=0x252d2a9*) returned 4 [0143.324] InitializeSecurityContextW (in: phCredential=0x19e6ac, phContext=0x19e738, pTargetName=0x252b390, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x252d320, Reserved2=0x0, phNewContext=0x252b9a0, pOutput=0x252d334, pfContextAttr=0x252b858, ptsExpiry=0x19e6a4 | out: phNewContext=0x252b9a0, pOutput=0x252d334, pfContextAttr=0x252b858, ptsExpiry=0x19e6a4) returned 0x90312 [0143.640] FreeContextBuffer (in: pvContextBuffer=0x718510 | out: pvContextBuffer=0x718510) returned 0x0 [0143.640] send (s=0x65c, buf=0x252d3b0*, len=126, flags=0) returned 126 [0143.640] recv (in: s=0x65c, buf=0x252d3b0, len=5, flags=0 | out: buf=0x252d3b0*) returned 5 [0143.654] recv (in: s=0x65c, buf=0x252d3b5, len=115, flags=0 | out: buf=0x252d3b5*) returned 115 [0143.654] InitializeSecurityContextW (in: phCredential=0x19e614, phContext=0x19e6a0, pTargetName=0x252b390, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x252d4b4, Reserved2=0x0, phNewContext=0x252b9a0, pOutput=0x252d4c8, pfContextAttr=0x252b858, ptsExpiry=0x19e60c | out: phNewContext=0x252b9a0, pOutput=0x252d4c8, pfContextAttr=0x252b858, ptsExpiry=0x19e60c) returned 0x90312 [0143.654] recv (in: s=0x65c, buf=0x252d558, len=5, flags=0 | out: buf=0x252d558*) returned 5 [0143.655] recv (in: s=0x65c, buf=0x252d571, len=1, flags=0 | out: buf=0x252d571*) returned 1 [0143.655] InitializeSecurityContextW (in: phCredential=0x19e57c, phContext=0x19e608, pTargetName=0x252b390, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x252d5e4, Reserved2=0x0, phNewContext=0x252b9a0, pOutput=0x252d5f8, pfContextAttr=0x252b858, ptsExpiry=0x19e574 | out: phNewContext=0x252b9a0, pOutput=0x252d5f8, pfContextAttr=0x252b858, ptsExpiry=0x19e574) returned 0x90312 [0143.655] recv (in: s=0x65c, buf=0x252d688, len=5, flags=0 | out: buf=0x252d688*) returned 5 [0143.655] recv (in: s=0x65c, buf=0x252d6a1, len=40, flags=0 | out: buf=0x252d6a1*) returned 40 [0143.655] InitializeSecurityContextW (in: phCredential=0x19e4e4, phContext=0x19e570, pTargetName=0x252b390, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x252d73c, Reserved2=0x0, phNewContext=0x252b9a0, pOutput=0x252d750, pfContextAttr=0x252b858, ptsExpiry=0x19e4dc | out: phNewContext=0x252b9a0, pOutput=0x252d750, pfContextAttr=0x252b858, ptsExpiry=0x19e4dc) returned 0x0 [0143.659] QueryContextAttributesW (in: phContext=0x252b9a0, ulAttribute=0x4, pBuffer=0x252d7e0 | out: pBuffer=0x252d7e0) returned 0x0 [0143.659] QueryContextAttributesW (in: phContext=0x252b9a0, ulAttribute=0x5a, pBuffer=0x252d81c | out: pBuffer=0x252d81c) returned 0x0 [0143.659] QueryContextAttributesW (in: phContext=0x252b9a0, ulAttribute=0x53, pBuffer=0x252d868 | out: pBuffer=0x252d868) returned 0x0 [0143.660] CertDuplicateCertificateContext (pCertContext=0x712780) returned 0x712780 [0143.660] CertDuplicateStore (hCertStore=0x711d38) returned 0x711d38 [0143.660] CertEnumCertificatesInStore (hCertStore=0x711d38, pPrevCertContext=0x0) returned 0x7124b0 [0143.660] CertDuplicateCertificateContext (pCertContext=0x7124b0) returned 0x7124b0 [0143.660] CertEnumCertificatesInStore (hCertStore=0x711d38, pPrevCertContext=0x7124b0) returned 0x712550 [0143.660] CertDuplicateCertificateContext (pCertContext=0x712550) returned 0x712550 [0143.660] CertEnumCertificatesInStore (hCertStore=0x711d38, pPrevCertContext=0x712550) returned 0x7127d0 [0143.660] CertDuplicateCertificateContext (pCertContext=0x7127d0) returned 0x7127d0 [0143.660] CertEnumCertificatesInStore (hCertStore=0x711d38, pPrevCertContext=0x7127d0) returned 0x712780 [0143.661] CertDuplicateCertificateContext (pCertContext=0x712780) returned 0x712780 [0143.661] CertEnumCertificatesInStore (hCertStore=0x711d38, pPrevCertContext=0x712780) returned 0x0 [0143.661] CertCloseStore (hCertStore=0x711d38, dwFlags=0x0) returned 1 [0143.661] CertFreeCertificateContext (pCertContext=0x712780) returned 1 [0143.661] CertOpenStore (lpszStoreProvider=0x2, dwEncodingType=0x10001, hCryptProv=0x0, dwFlags=0x2204, pvPara=0x0) returned 0x711630 [0143.661] CertAddCRLLinkToStore (in: hCertStore=0x711630, pCrlContext=0x7124b0, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0143.661] CertAddCRLLinkToStore (in: hCertStore=0x711630, pCrlContext=0x712550, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0143.662] CertAddCRLLinkToStore (in: hCertStore=0x711630, pCrlContext=0x7127d0, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0143.662] CertAddCRLLinkToStore (in: hCertStore=0x711630, pCrlContext=0x712780, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0143.662] CertGetCertificateChain (in: hChainEngine=0x0, pCertContext=0x712780, pTime=0x19e4f0, hAdditionalStore=0x711630, pChainPara=0x19e430, dwFlags=0x0, pvReserved=0x0, ppChainContext=0x19e424 | out: ppChainContext=0x19e424) returned 1 [0143.664] CertDuplicateCertificateChain (pChainContext=0x725900) returned 0x725900 [0143.664] CertDuplicateCertificateContext (pCertContext=0x712780) returned 0x712780 [0143.664] CertDuplicateCertificateContext (pCertContext=0x711f10) returned 0x711f10 [0143.664] CertDuplicateCertificateContext (pCertContext=0x712690) returned 0x712690 [0143.664] CertFreeCertificateChain (pChainContext=0x725900) [0143.664] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x1, pChainContext=0x725900, pPolicyPara=0x19e5d0, pPolicyStatus=0x19e5bc | out: pPolicyStatus=0x19e5bc) returned 1 [0143.664] SetLastError (dwErrCode=0x0) [0143.664] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x4, pChainContext=0x725900, pPolicyPara=0x19e63c, pPolicyStatus=0x19e5e4 | out: pPolicyStatus=0x19e5e4) returned 1 [0143.664] CertFreeCertificateChain (pChainContext=0x725900) [0143.665] CertFreeCertificateContext (pCertContext=0x712780) returned 1 [0144.004] EncryptMessage (in: phContext=0x237e154, fQOP=0x0, pMessage=0x2392d08, MessageSeqNo=0x0 | out: pMessage=0x2392d08) returned 0x0 [0144.004] send (s=0x65c, buf=0x23561fc*, len=160, flags=0) returned 160 [0144.005] setsockopt (s=0x65c, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0144.005] recv (in: s=0x65c, buf=0x2360d00, len=5, flags=0 | out: buf=0x2360d00*) returned 5 [0144.028] recv (in: s=0x65c, buf=0x2360d05, len=652, flags=0 | out: buf=0x2360d05*) returned 652 [0144.029] DecryptMessage (in: phContext=0x237e154, pMessage=0x23d3228, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x23d3228, pfQOP=0x0) returned 0x0 [0144.290] setsockopt (s=0x65c, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0144.290] recv (in: s=0x65c, buf=0x2360d00, len=5, flags=0 | out: buf=0x2360d00*) returned 5 [0144.290] recv (in: s=0x65c, buf=0x2360d05, len=2920, flags=0 | out: buf=0x2360d05*) returned 2920 [0144.291] DecryptMessage (in: phContext=0x237e154, pMessage=0x23e3e7c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x23e3e7c, pfQOP=0x0) returned 0x0 [0144.291] recv (in: s=0x65c, buf=0x2360d00, len=5, flags=0 | out: buf=0x2360d00*) returned 5 [0144.291] recv (in: s=0x65c, buf=0x2360d05, len=8712, flags=0 | out: buf=0x2360d05*) returned 8712 [0144.292] DecryptMessage (in: phContext=0x237e154, pMessage=0x23e4f9c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x23e4f9c, pfQOP=0x0) returned 0x0 [0144.292] WriteFile (in: hFile=0x658, lpBuffer=0x23e3f08*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19ee48, lpOverlapped=0x0 | out: lpBuffer=0x23e3f08*, lpNumberOfBytesWritten=0x19ee48*=0x1000, lpOverlapped=0x0) returned 1 [0144.294] WriteFile (in: hFile=0x658, lpBuffer=0x23d4274*, nNumberOfBytesToWrite=0x1d40, lpNumberOfBytesWritten=0x19ee48, lpOverlapped=0x0 | out: lpBuffer=0x23d4274*, lpNumberOfBytesWritten=0x19ee48*=0x1d40, lpOverlapped=0x0) returned 1 [0144.294] recv (in: s=0x65c, buf=0x2360d00, len=5, flags=0 | out: buf=0x2360d00*) returned 5 [0144.294] recv (in: s=0x65c, buf=0x2360d05, len=16408, flags=0 | out: buf=0x2360d05*) returned 16408 [0144.295] DecryptMessage (in: phContext=0x237e154, pMessage=0x23e50b0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x23e50b0, pfQOP=0x0) returned 0x0 [0144.295] WriteFile (in: hFile=0x658, lpBuffer=0x23d3dc4*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19ee48, lpOverlapped=0x0 | out: lpBuffer=0x23d3dc4*, lpNumberOfBytesWritten=0x19ee48*=0x4000, lpOverlapped=0x0) returned 1 [0144.295] recv (in: s=0x65c, buf=0x2360d00, len=5, flags=0 | out: buf=0x2360d00*) returned 5 [0144.295] recv (in: s=0x65c, buf=0x2360d05, len=16408, flags=0 | out: buf=0x2360d05*) returned 16408 [0144.295] DecryptMessage (in: phContext=0x237e154, pMessage=0x23e51c4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x23e51c4, pfQOP=0x0) returned 0x0 [0144.296] WriteFile (in: hFile=0x658, lpBuffer=0x23d3dc4*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19ee48, lpOverlapped=0x0 | out: lpBuffer=0x23d3dc4*, lpNumberOfBytesWritten=0x19ee48*=0x4000, lpOverlapped=0x0) returned 1 [0144.296] recv (in: s=0x65c, buf=0x2360d00, len=5, flags=0 | out: buf=0x2360d00*) returned 5 [0144.296] recv (in: s=0x65c, buf=0x2360d05, len=9248, flags=0 | out: buf=0x2360d05*) returned 9248 [0144.296] DecryptMessage (in: phContext=0x237e154, pMessage=0x23e52d8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x23e52d8, pfQOP=0x0) returned 0x0 [0144.296] WriteFile (in: hFile=0x658, lpBuffer=0x23d3dc4*, nNumberOfBytesToWrite=0x2408, lpNumberOfBytesWritten=0x19ee48, lpOverlapped=0x0 | out: lpBuffer=0x23d3dc4*, lpNumberOfBytesWritten=0x19ee48*=0x2408, lpOverlapped=0x0) returned 1 [0144.297] recv (in: s=0x65c, buf=0x2360d00, len=5, flags=0 | out: buf=0x2360d00*) returned 5 [0144.297] recv (in: s=0x65c, buf=0x2360d05, len=16408, flags=0 | out: buf=0x2360d05*) returned 16408 [0144.297] DecryptMessage (in: phContext=0x237e154, pMessage=0x23e53ec, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x23e53ec, pfQOP=0x0) returned 0x0 [0144.297] WriteFile (in: hFile=0x658, lpBuffer=0x23d3dc4*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19ee48, lpOverlapped=0x0 | out: lpBuffer=0x23d3dc4*, lpNumberOfBytesWritten=0x19ee48*=0x4000, lpOverlapped=0x0) returned 1 [0144.298] recv (in: s=0x65c, buf=0x2360d00, len=5, flags=0 | out: buf=0x2360d00*) returned 5 [0144.298] recv (in: s=0x65c, buf=0x2360d05, len=16408, flags=0 | out: buf=0x2360d05*) returned 16408 [0144.298] DecryptMessage (in: phContext=0x237e154, pMessage=0x23e5500, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x23e5500, pfQOP=0x0) returned 0x0 [0144.298] WriteFile (in: hFile=0x658, lpBuffer=0x23d3dc4*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19ee48, lpOverlapped=0x0 | out: lpBuffer=0x23d3dc4*, lpNumberOfBytesWritten=0x19ee48*=0x4000, lpOverlapped=0x0) returned 1 [0144.299] recv (in: s=0x65c, buf=0x2360d00, len=5, flags=0 | out: buf=0x2360d00*) returned 5 [0144.299] recv (in: s=0x65c, buf=0x2360d05, len=6352, flags=0 | out: buf=0x2360d05*) returned 6352 [0144.299] DecryptMessage (in: phContext=0x237e154, pMessage=0x23e5614, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x23e5614, pfQOP=0x0) returned 0x0 [0144.299] WriteFile (in: hFile=0x658, lpBuffer=0x23d3dc4*, nNumberOfBytesToWrite=0x18b8, lpNumberOfBytesWritten=0x19ee48, lpOverlapped=0x0 | out: lpBuffer=0x23d3dc4*, lpNumberOfBytesWritten=0x19ee48*=0x18b8, lpOverlapped=0x0) returned 1 [0144.299] recv (in: s=0x65c, buf=0x2360d00, len=5, flags=0 | out: buf=0x2360d00*) returned 5 [0144.299] recv (in: s=0x65c, buf=0x2360d05, len=16408, flags=0 | out: buf=0x2360d05*) returned 16408 [0144.299] DecryptMessage (in: phContext=0x237e154, pMessage=0x23e5728, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x23e5728, pfQOP=0x0) returned 0x0 [0144.300] WriteFile (in: hFile=0x658, lpBuffer=0x23d3dc4*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19ee48, lpOverlapped=0x0 | out: lpBuffer=0x23d3dc4*, lpNumberOfBytesWritten=0x19ee48*=0x4000, lpOverlapped=0x0) returned 1 [0144.300] recv (in: s=0x65c, buf=0x2360d00, len=5, flags=0 | out: buf=0x2360d00*) returned 5 [0144.300] recv (in: s=0x65c, buf=0x2360d05, len=16408, flags=0 | out: buf=0x2360d05*) returned 16408 [0144.300] DecryptMessage (in: phContext=0x237e154, pMessage=0x23e583c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x23e583c, pfQOP=0x0) returned 0x0 [0144.300] WriteFile (in: hFile=0x658, lpBuffer=0x23d3dc4*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19ee48, lpOverlapped=0x0 | out: lpBuffer=0x23d3dc4*, lpNumberOfBytesWritten=0x19ee48*=0x4000, lpOverlapped=0x0) returned 1 [0144.301] recv (in: s=0x65c, buf=0x2360d00, len=5, flags=0 | out: buf=0x2360d00*) returned 5 [0144.301] recv (in: s=0x65c, buf=0x2360d05, len=13592, flags=0 | out: buf=0x2360d05*) returned 6643 [0144.302] recv (in: s=0x65c, buf=0x23626f8, len=6949, flags=0 | out: buf=0x23626f8*) returned 6949 [0144.314] DecryptMessage (in: phContext=0x237e154, pMessage=0x23e5950, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x23e5950, pfQOP=0x0) returned 0x0 [0144.314] WriteFile (in: hFile=0x658, lpBuffer=0x23d3dc4*, nNumberOfBytesToWrite=0x3500, lpNumberOfBytesWritten=0x19ee48, lpOverlapped=0x0 | out: lpBuffer=0x23d3dc4*, lpNumberOfBytesWritten=0x19ee48*=0x3500, lpOverlapped=0x0) returned 1 [0144.315] recv (in: s=0x65c, buf=0x2360d00, len=5, flags=0 | out: buf=0x2360d00*) returned 5 [0144.315] recv (in: s=0x65c, buf=0x2360d05, len=16408, flags=0 | out: buf=0x2360d05*) returned 16408 [0144.316] DecryptMessage (in: phContext=0x237e154, pMessage=0x23e5a64, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x23e5a64, pfQOP=0x0) returned 0x0 [0144.316] WriteFile (in: hFile=0x658, lpBuffer=0x23d3dc4*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19ee48, lpOverlapped=0x0 | out: lpBuffer=0x23d3dc4*, lpNumberOfBytesWritten=0x19ee48*=0x4000, lpOverlapped=0x0) returned 1 [0144.317] recv (in: s=0x65c, buf=0x2360d00, len=5, flags=0 | out: buf=0x2360d00*) returned 5 [0144.317] recv (in: s=0x65c, buf=0x2360d05, len=16408, flags=0 | out: buf=0x2360d05*) returned 16408 [0144.317] DecryptMessage (in: phContext=0x237e154, pMessage=0x23e5b78, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x23e5b78, pfQOP=0x0) returned 0x0 [0144.317] WriteFile (in: hFile=0x658, lpBuffer=0x23d3dc4*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19ee48, lpOverlapped=0x0 | out: lpBuffer=0x23d3dc4*, lpNumberOfBytesWritten=0x19ee48*=0x4000, lpOverlapped=0x0) returned 1 [0144.318] recv (in: s=0x65c, buf=0x2360d00, len=5, flags=0 | out: buf=0x2360d00*) returned 5 [0144.318] recv (in: s=0x65c, buf=0x2360d05, len=16408, flags=0 | out: buf=0x2360d05*) returned 16408 [0144.318] DecryptMessage (in: phContext=0x237e154, pMessage=0x23e5c8c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x23e5c8c, pfQOP=0x0) returned 0x0 [0144.318] WriteFile (in: hFile=0x658, lpBuffer=0x23d3dc4*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19ee48, lpOverlapped=0x0 | out: lpBuffer=0x23d3dc4*, lpNumberOfBytesWritten=0x19ee48*=0x4000, lpOverlapped=0x0) returned 1 [0144.319] recv (in: s=0x65c, buf=0x2360d00, len=5, flags=0 | out: buf=0x2360d00*) returned 5 [0144.319] recv (in: s=0x65c, buf=0x2360d05, len=104, flags=0 | out: buf=0x2360d05*) returned 104 [0144.319] DecryptMessage (in: phContext=0x237e154, pMessage=0x23e5da0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x23e5da0, pfQOP=0x0) returned 0x0 [0144.319] recv (in: s=0x65c, buf=0x2360d00, len=5, flags=0 | out: buf=0x2360d00*) returned 5 [0144.319] recv (in: s=0x65c, buf=0x2360d05, len=16408, flags=0 | out: buf=0x2360d05*) returned 16408 [0144.319] DecryptMessage (in: phContext=0x237e154, pMessage=0x23e5eb4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x23e5eb4, pfQOP=0x0) returned 0x0 [0144.319] WriteFile (in: hFile=0x658, lpBuffer=0x23e3f08*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19ee48, lpOverlapped=0x0 | out: lpBuffer=0x23e3f08*, lpNumberOfBytesWritten=0x19ee48*=0x1000, lpOverlapped=0x0) returned 1 [0144.319] WriteFile (in: hFile=0x658, lpBuffer=0x23d4d74*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x19ee48, lpOverlapped=0x0 | out: lpBuffer=0x23d4d74*, lpNumberOfBytesWritten=0x19ee48*=0x3050, lpOverlapped=0x0) returned 1 [0144.320] recv (in: s=0x65c, buf=0x2360d00, len=5, flags=0 | out: buf=0x2360d00*) returned 5 [0144.320] recv (in: s=0x65c, buf=0x2360d05, len=16408, flags=0 | out: buf=0x2360d05*) returned 16408 [0144.320] DecryptMessage (in: phContext=0x237e154, pMessage=0x23e5fc8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x23e5fc8, pfQOP=0x0) returned 0x0 [0144.320] WriteFile (in: hFile=0x658, lpBuffer=0x23d3dc4*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19ee48, lpOverlapped=0x0 | out: lpBuffer=0x23d3dc4*, lpNumberOfBytesWritten=0x19ee48*=0x4000, lpOverlapped=0x0) returned 1 [0144.320] recv (in: s=0x65c, buf=0x2360d00, len=5, flags=0 | out: buf=0x2360d00*) returned 5 [0144.320] recv (in: s=0x65c, buf=0x2360d05, len=16408, flags=0 | out: buf=0x2360d05*) returned 16408 [0144.320] DecryptMessage (in: phContext=0x237e154, pMessage=0x23e60dc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x23e60dc, pfQOP=0x0) returned 0x0 [0144.321] WriteFile (in: hFile=0x658, lpBuffer=0x23d3dc4*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19ee48, lpOverlapped=0x0 | out: lpBuffer=0x23d3dc4*, lpNumberOfBytesWritten=0x19ee48*=0x4000, lpOverlapped=0x0) returned 1 [0144.321] recv (in: s=0x65c, buf=0x2360d00, len=5, flags=0 | out: buf=0x2360d00*) returned 5 [0144.321] recv (in: s=0x65c, buf=0x2360d05, len=4448, flags=0 | out: buf=0x2360d05*) returned 4448 [0144.321] DecryptMessage (in: phContext=0x237e154, pMessage=0x23e61f0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x23e61f0, pfQOP=0x0) returned 0x0 [0144.321] WriteFile (in: hFile=0x658, lpBuffer=0x23d3dc4*, nNumberOfBytesToWrite=0x1148, lpNumberOfBytesWritten=0x19ee48, lpOverlapped=0x0 | out: lpBuffer=0x23d3dc4*, lpNumberOfBytesWritten=0x19ee48*=0x1148, lpOverlapped=0x0) returned 1 [0144.321] recv (in: s=0x65c, buf=0x2360d00, len=5, flags=0 | out: buf=0x2360d00*) returned 5 [0144.321] recv (in: s=0x65c, buf=0x2360d05, len=16408, flags=0 | out: buf=0x2360d05*) returned 16408 [0144.322] DecryptMessage (in: phContext=0x237e154, pMessage=0x23e6304, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x23e6304, pfQOP=0x0) returned 0x0 [0144.322] WriteFile (in: hFile=0x658, lpBuffer=0x23d3dc4*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19ee48, lpOverlapped=0x0 | out: lpBuffer=0x23d3dc4*, lpNumberOfBytesWritten=0x19ee48*=0x4000, lpOverlapped=0x0) returned 1 [0144.322] recv (in: s=0x65c, buf=0x2360d00, len=5, flags=0 | out: buf=0x2360d00*) returned 5 [0144.322] recv (in: s=0x65c, buf=0x2360d05, len=3968, flags=0 | out: buf=0x2360d05*) returned 3968 [0144.322] DecryptMessage (in: phContext=0x237e154, pMessage=0x23e6418, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x23e6418, pfQOP=0x0) returned 0x0 [0144.322] recv (in: s=0x65c, buf=0x2360d00, len=5, flags=0 | out: buf=0x2360d00*) returned 5 [0144.322] recv (in: s=0x65c, buf=0x2360d05, len=15255, flags=0 | out: buf=0x2360d05*) returned 15255 [0144.323] DecryptMessage (in: phContext=0x237e154, pMessage=0x23e652c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x23e652c, pfQOP=0x0) returned 0x0 [0144.323] WriteFile (in: hFile=0x658, lpBuffer=0x23e3f08*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19ee48, lpOverlapped=0x0 | out: lpBuffer=0x23e3f08*, lpNumberOfBytesWritten=0x19ee48*=0x1000, lpOverlapped=0x0) returned 1 [0144.324] WriteFile (in: hFile=0x658, lpBuffer=0x23d3e5c*, nNumberOfBytesToWrite=0x3ae7, lpNumberOfBytesWritten=0x19ee48, lpOverlapped=0x0 | out: lpBuffer=0x23d3e5c*, lpNumberOfBytesWritten=0x19ee48*=0x3ae7, lpOverlapped=0x0) returned 1 [0144.324] CloseHandle (hObject=0x658) returned 1 [0144.350] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam="C:\\RDhJ0CNFevzX\\wallpaper.jpg" (normalized: "c:\\rdhj0cnfevzx\\wallpaper.jpg"), fWinIni=0x3 | out: pvParam=0x232cd70) returned 1 [0145.762] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x4020a, Msg=0x1a, wParam=0x14, lParam=0x9d728) returned 0x0 [0145.763] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0x1a, wParam=0x14, lParam=0x9d728) returned 0x0 [0145.765] SystemParametersInfoW (in: uiAction=0x26, uiParam=0x0, pvParam=0x19eab4, fWinIni=0x0 | out: pvParam=0x19eab4) returned 1 [0145.767] LocalAlloc (uFlags=0x0, uBytes=0x2) returned 0x7166f8 [0145.768] PostMessageW (hWnd=0x502c2, Msg=0x201a, wParam=0x14, lParam=0x7166f8) returned 1 [0145.768] NtdllDefWindowProc_W (hWnd=0x502c2, Msg=0x1a, wParam=0x14, lParam=0x9d728) returned 0x0 [0146.033] QueryPerformanceCounter (in: lpPerformanceCount=0x19ee4c | out: lpPerformanceCount=0x19ee4c*=3576414941675) returned 1 [0146.033] SetEvent (hEvent=0x3a0) returned 1 [0146.033] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ec58*=0x434, lpdwindex=0x19ea74 | out: lpdwindex=0x19ea74) returned 0x80010115 [0146.034] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ec38*=0x424, lpdwindex=0x19ea54 | out: lpdwindex=0x19ea54) returned 0x80010115 [0146.034] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ec38*=0x42c, lpdwindex=0x19ea54 | out: lpdwindex=0x19ea54) returned 0x80010115 [0146.034] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ec8c*=0x454, lpdwindex=0x19eaac | out: lpdwindex=0x19eaac) returned 0x80010115 [0146.035] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ec8c*=0x45c, lpdwindex=0x19eaac | out: lpdwindex=0x19eaac) returned 0x80010115 [0146.035] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ec8c*=0x464, lpdwindex=0x19eaac | out: lpdwindex=0x19eaac) returned 0x80010115 [0146.036] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x658 [0146.036] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x380 [0146.036] GetAddrInfoW (in: pNodeName="en3ez7v505kx8.x.pipedream.net", pServiceName=0x0, pHints=0x19eb8c*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x19eb34 | out: ppResult=0x19eb34*=0x715588*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="en3ez7v505kx8.x.pipedream.net", ai_addr=0x70a4d8*(sa_family=2, sin_port=0x0, sin_addr="3.228.107.54"), ai_next=0x715538*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x70a400*(sa_family=2, sin_port=0x0, sin_addr="107.22.74.15"), ai_next=0x7155b0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x70a340*(sa_family=2, sin_port=0x0, sin_addr="50.19.131.153"), ai_next=0x715740*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x70a4f0*(sa_family=2, sin_port=0x0, sin_addr="54.174.214.98"), ai_next=0x7152e0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x70a298*(sa_family=2, sin_port=0x0, sin_addr="23.21.95.90"), ai_next=0x0)))))) returned 0 [0146.041] FreeAddrInfoW (pAddrInfo=0x715588*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="en3ez7v505kx8.x.pipedream.net", ai_addr=0x70a4d8*(sa_family=2, sin_port=0x0, sin_addr="3.228.107.54"), ai_next=0x715538*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x70a400*(sa_family=2, sin_port=0x0, sin_addr="107.22.74.15"), ai_next=0x7155b0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x70a340*(sa_family=2, sin_port=0x0, sin_addr="50.19.131.153"), ai_next=0x715740*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x70a4f0*(sa_family=2, sin_port=0x0, sin_addr="54.174.214.98"), ai_next=0x7152e0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x70a298*(sa_family=2, sin_port=0x0, sin_addr="23.21.95.90"), ai_next=0x0)))))) [0146.043] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ead4*=0x560, lpdwindex=0x19e8f4 | out: lpdwindex=0x19e8f4) returned 0x80010115 [0146.043] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ead4*=0x568, lpdwindex=0x19e8f4 | out: lpdwindex=0x19e8f4) returned 0x80010115 [0146.043] WSAConnect (in: s=0x658, name=0x23e95f0*(sa_family=2, sin_port=0x1bb, sin_addr="3.228.107.54"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0146.151] closesocket (s=0x380) returned 0 [0146.152] InitializeSecurityContextW (in: phCredential=0x19e8d4, phContext=0x0, pTargetName=0x23e965c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x0, Reserved2=0x0, phNewContext=0x23ea7c4, pOutput=0x23ea75c, pfContextAttr=0x23ea67c, ptsExpiry=0x19e8cc | out: phNewContext=0x23ea7c4, pOutput=0x23ea75c, pfContextAttr=0x23ea67c, ptsExpiry=0x19e8cc) returned 0x90312 [0146.153] FreeContextBuffer (in: pvContextBuffer=0x6f5c28 | out: pvContextBuffer=0x6f5c28) returned 0x0 [0146.153] send (s=0x658, buf=0x23ea7d8*, len=193, flags=0) returned 193 [0146.154] recv (in: s=0x658, buf=0x23ea7d8, len=5, flags=0 | out: buf=0x23ea7d8*) returned 5 [0146.256] recv (in: s=0x658, buf=0x23ea7dd, len=61, flags=0 | out: buf=0x23ea7dd*) returned 61 [0146.257] InitializeSecurityContextW (in: phCredential=0x19e838, phContext=0x19e8c4, pTargetName=0x23e965c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x23ea920, Reserved2=0x0, phNewContext=0x23ea7c4, pOutput=0x23ea934, pfContextAttr=0x23ea67c, ptsExpiry=0x19e830 | out: phNewContext=0x23ea7c4, pOutput=0x23ea934, pfContextAttr=0x23ea67c, ptsExpiry=0x19e830) returned 0x90312 [0146.258] recv (in: s=0x658, buf=0x23ea9c4, len=5, flags=0 | out: buf=0x23ea9c4*) returned 5 [0146.258] recv (in: s=0x658, buf=0x23ea9dd, len=4962, flags=0 | out: buf=0x23ea9dd*) returned 4962 [0146.258] InitializeSecurityContextW (in: phCredential=0x19e7a0, phContext=0x19e82c, pTargetName=0x23e965c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x23ebdb0, Reserved2=0x0, phNewContext=0x23ea7c4, pOutput=0x23ebdc4, pfContextAttr=0x23ea67c, ptsExpiry=0x19e798 | out: phNewContext=0x23ea7c4, pOutput=0x23ebdc4, pfContextAttr=0x23ea67c, ptsExpiry=0x19e798) returned 0x90312 [0146.261] recv (in: s=0x658, buf=0x23ebe54, len=5, flags=0 | out: buf=0x23ebe54*) returned 5 [0146.261] recv (in: s=0x658, buf=0x23ebe6d, len=333, flags=0 | out: buf=0x23ebe6d*) returned 333 [0146.261] InitializeSecurityContextW (in: phCredential=0x19e708, phContext=0x19e794, pTargetName=0x23e965c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x23ec02c, Reserved2=0x0, phNewContext=0x23ea7c4, pOutput=0x23ec040, pfContextAttr=0x23ea67c, ptsExpiry=0x19e700 | out: phNewContext=0x23ea7c4, pOutput=0x23ec040, pfContextAttr=0x23ea67c, ptsExpiry=0x19e700) returned 0x90312 [0146.262] recv (in: s=0x658, buf=0x23ec0d0, len=5, flags=0 | out: buf=0x23ec0d0*) returned 5 [0146.262] recv (in: s=0x658, buf=0x23ec0e9, len=4, flags=0 | out: buf=0x23ec0e9*) returned 4 [0146.262] InitializeSecurityContextW (in: phCredential=0x19e670, phContext=0x19e6fc, pTargetName=0x23e965c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x23ec160, Reserved2=0x0, phNewContext=0x23ea7c4, pOutput=0x23ec174, pfContextAttr=0x23ea67c, ptsExpiry=0x19e668 | out: phNewContext=0x23ea7c4, pOutput=0x23ec174, pfContextAttr=0x23ea67c, ptsExpiry=0x19e668) returned 0x90312 [0146.471] FreeContextBuffer (in: pvContextBuffer=0x717f20 | out: pvContextBuffer=0x717f20) returned 0x0 [0146.471] send (s=0x658, buf=0x23ec1f0*, len=126, flags=0) returned 126 [0146.472] recv (in: s=0x658, buf=0x23ec1f0, len=5, flags=0 | out: buf=0x23ec1f0*) returned 5 [0146.583] recv (in: s=0x658, buf=0x23ec1f5, len=1, flags=0 | out: buf=0x23ec1f5*) returned 1 [0146.583] InitializeSecurityContextW (in: phCredential=0x19e5d8, phContext=0x19e664, pTargetName=0x23e965c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x23ec2f4, Reserved2=0x0, phNewContext=0x23ea7c4, pOutput=0x23ec308, pfContextAttr=0x23ea67c, ptsExpiry=0x19e5d0 | out: phNewContext=0x23ea7c4, pOutput=0x23ec308, pfContextAttr=0x23ea67c, ptsExpiry=0x19e5d0) returned 0x90312 [0146.584] recv (in: s=0x658, buf=0x23ec398, len=5, flags=0 | out: buf=0x23ec398*) returned 5 [0146.584] recv (in: s=0x658, buf=0x23ec3b1, len=40, flags=0 | out: buf=0x23ec3b1*) returned 40 [0146.584] InitializeSecurityContextW (in: phCredential=0x19e540, phContext=0x19e5cc, pTargetName=0x23e965c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x23ec44c, Reserved2=0x0, phNewContext=0x23ea7c4, pOutput=0x23ec460, pfContextAttr=0x23ea67c, ptsExpiry=0x19e538 | out: phNewContext=0x23ea7c4, pOutput=0x23ec460, pfContextAttr=0x23ea67c, ptsExpiry=0x19e538) returned 0x0 [0146.586] QueryContextAttributesW (in: phContext=0x23ea7c4, ulAttribute=0x4, pBuffer=0x23ec4f0 | out: pBuffer=0x23ec4f0) returned 0x0 [0146.586] QueryContextAttributesW (in: phContext=0x23ea7c4, ulAttribute=0x5a, pBuffer=0x23ec52c | out: pBuffer=0x23ec52c) returned 0x0 [0146.586] QueryContextAttributesW (in: phContext=0x23ea7c4, ulAttribute=0x53, pBuffer=0x23ec578 | out: pBuffer=0x23ec578) returned 0x0 [0146.586] CertDuplicateCertificateContext (pCertContext=0x712370) returned 0x712370 [0146.586] CertDuplicateStore (hCertStore=0x711810) returned 0x711810 [0146.587] CertEnumCertificatesInStore (hCertStore=0x711810, pPrevCertContext=0x0) returned 0x712050 [0146.587] CertDuplicateCertificateContext (pCertContext=0x712050) returned 0x712050 [0146.587] CertEnumCertificatesInStore (hCertStore=0x711810, pPrevCertContext=0x712050) returned 0x7126e0 [0146.587] CertDuplicateCertificateContext (pCertContext=0x7126e0) returned 0x7126e0 [0146.587] CertEnumCertificatesInStore (hCertStore=0x711810, pPrevCertContext=0x7126e0) returned 0x712000 [0146.587] CertDuplicateCertificateContext (pCertContext=0x712000) returned 0x712000 [0146.587] CertEnumCertificatesInStore (hCertStore=0x711810, pPrevCertContext=0x712000) returned 0x712370 [0146.587] CertDuplicateCertificateContext (pCertContext=0x712370) returned 0x712370 [0146.587] CertEnumCertificatesInStore (hCertStore=0x711810, pPrevCertContext=0x712370) returned 0x0 [0146.587] CertCloseStore (hCertStore=0x711810, dwFlags=0x0) returned 1 [0146.587] CertFreeCertificateContext (pCertContext=0x712370) returned 1 [0146.588] CertOpenStore (lpszStoreProvider=0x2, dwEncodingType=0x10001, hCryptProv=0x0, dwFlags=0x2204, pvPara=0x0) returned 0x72a9f8 [0146.588] CertAddCRLLinkToStore (in: hCertStore=0x72a9f8, pCrlContext=0x712050, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0146.588] CertAddCRLLinkToStore (in: hCertStore=0x72a9f8, pCrlContext=0x7126e0, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0146.588] CertAddCRLLinkToStore (in: hCertStore=0x72a9f8, pCrlContext=0x712000, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0146.588] CertAddCRLLinkToStore (in: hCertStore=0x72a9f8, pCrlContext=0x712370, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0146.588] CertGetCertificateChain (in: hChainEngine=0x0, pCertContext=0x712370, pTime=0x19e54c, hAdditionalStore=0x72a9f8, pChainPara=0x19e48c, dwFlags=0x0, pvReserved=0x0, ppChainContext=0x19e480 | out: ppChainContext=0x19e480) returned 1 [0146.590] CertDuplicateCertificateChain (pChainContext=0x726ec8) returned 0x726ec8 [0146.590] CertDuplicateCertificateContext (pCertContext=0x712370) returned 0x712370 [0146.590] CertDuplicateCertificateContext (pCertContext=0x711e70) returned 0x711e70 [0146.591] CertDuplicateCertificateContext (pCertContext=0x711f60) returned 0x711f60 [0146.591] CertFreeCertificateChain (pChainContext=0x726ec8) [0146.591] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x1, pChainContext=0x726ec8, pPolicyPara=0x19e62c, pPolicyStatus=0x19e618 | out: pPolicyStatus=0x19e618) returned 1 [0146.591] SetLastError (dwErrCode=0x0) [0146.591] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x4, pChainContext=0x726ec8, pPolicyPara=0x19e698, pPolicyStatus=0x19e640 | out: pPolicyStatus=0x19e640) returned 1 [0146.591] CertFreeCertificateChain (pChainContext=0x726ec8) [0146.591] CertFreeCertificateContext (pCertContext=0x712370) returned 1 [0146.591] EncryptMessage (in: phContext=0x23ea7c4, fQOP=0x0, pMessage=0x23edea4, MessageSeqNo=0x0 | out: pMessage=0x23edea4) returned 0x0 [0146.591] send (s=0x658, buf=0x2391868*, len=189, flags=0) returned 189 [0146.599] setsockopt (s=0x658, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0146.599] recv (in: s=0x658, buf=0x23cf168, len=5, flags=0 | out: buf=0x23cf168*) returned 5 [0146.709] recv (in: s=0x658, buf=0x23cf16d, len=272, flags=0 | out: buf=0x23cf16d*) returned 272 [0146.709] DecryptMessage (in: phContext=0x23ea7c4, pMessage=0x23edfb8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x23edfb8, pfQOP=0x0) returned 0x0 [0146.710] setsockopt (s=0x658, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0146.731] PostThreadMessageW (idThread=0x138c, Msg=0x12, wParam=0x0, lParam=0x0) returned 1 [0146.732] GetWindowThreadProcessId (in: hWnd=0x60208, lpdwProcessId=0x19ef54 | out: lpdwProcessId=0x19ef54) returned 0x138c [0146.732] GetCurrentThreadId () returned 0x138c [0146.732] RegisterClipboardFormatW (lpszFormat="WindowsForms12_ThreadCallbackMessage") returned 0xc20e [0146.733] PostMessageW (hWnd=0x60208, Msg=0xc20e, wParam=0x0, lParam=0x0) returned 1 [0146.733] GetWindowTextLengthW (hWnd=0x60208) returned 5 [0146.733] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0146.733] GetSystemMetrics (nIndex=42) returned 0 [0146.733] GetWindowTextW (in: hWnd=0x60208, lpString=0x19eed4, nMaxCount=6 | out: lpString="Form1") returned 5 [0146.733] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0xd, wParam=0x6, lParam=0x19eed4) returned 0x5 [0146.737] OleInitialize (pvReserved=0x0) returned 0x0 [0146.738] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x19f43c | out: lplpMessageFilter=0x19f43c*=0x0) returned 0x0 [0146.739] PeekMessageW (in: lpMsg=0x19f410, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19f410) returned 1 [0146.740] IsWindowUnicode (hWnd=0x60208) returned 1 [0146.740] GetMessageW (in: lpMsg=0x19f410, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19f410) returned 1 [0146.741] TranslateMessage (lpMsg=0x19f410) returned 0 [0146.741] DispatchMessageW (lpMsg=0x19f410) returned 0x0 [0146.742] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0x46, wParam=0x0, lParam=0x19f1ac) returned 0x0 [0146.742] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0x83, wParam=0x1, lParam=0x19f184) returned 0x0 [0146.743] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0x85, wParam=0xa30409a2, lParam=0x0) returned 0x0 [0146.744] GetWindowPlacement (in: hWnd=0x60208, lpwndpl=0x19ef38 | out: lpwndpl=0x19ef38) returned 1 [0146.745] GetClientRect (in: hWnd=0x60208, lpRect=0x19eee4 | out: lpRect=0x19eee4) returned 1 [0146.745] GetWindowTextLengthW (hWnd=0x60208) returned 5 [0146.745] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0146.745] GetSystemMetrics (nIndex=42) returned 0 [0146.745] GetWindowTextW (in: hWnd=0x60208, lpString=0x19edb0, nMaxCount=6 | out: lpString="Form1") returned 5 [0146.745] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0xd, wParam=0x6, lParam=0x19edb0) returned 0x5 [0146.745] GetClientRect (in: hWnd=0x60208, lpRect=0x19edec | out: lpRect=0x19edec) returned 1 [0146.745] GetCurrentObject (hdc=0x220106d6, type=0x1) returned 0x1b00017 [0146.745] GetCurrentObject (hdc=0x220106d6, type=0x2) returned 0x1900010 [0146.745] GetCurrentObject (hdc=0x220106d6, type=0x7) returned 0x1d050693 [0146.745] GetCurrentObject (hdc=0x220106d6, type=0x6) returned 0x18a0048 [0146.745] SaveDC (hdc=0x220106d6) returned 1 [0146.745] GetNearestColor (hdc=0x220106d6, color=0xf0f0f0) returned 0xf0f0f0 [0146.745] CreateSolidBrush (color=0xf0f0f0) returned 0x38100988 [0146.746] FillRect (hDC=0x220106d6, lprc=0x19ec8c, hbr=0x38100988) returned 1 [0146.746] DeleteObject (ho=0x38100988) returned 1 [0146.746] RestoreDC (hdc=0x220106d6, nSavedDC=-1) returned 1 [0146.746] GetWindowPlacement (in: hWnd=0x60208, lpwndpl=0x19ef1c | out: lpwndpl=0x19ef1c) returned 1 [0146.746] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0x47, wParam=0x0, lParam=0x19f1ac) returned 0x0 [0146.746] GetClientRect (in: hWnd=0x60208, lpRect=0x19eecc | out: lpRect=0x19eecc) returned 1 [0146.746] GetWindowRect (in: hWnd=0x60208, lpRect=0x19eecc | out: lpRect=0x19eecc) returned 1 [0146.750] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0x83, wParam=0x1, lParam=0x19ecfc) returned 0x0 [0146.751] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0x85, wParam=0xa60409a2, lParam=0x0) returned 0x0 [0146.752] GetWindowPlacement (in: hWnd=0x60208, lpwndpl=0x19eab0 | out: lpwndpl=0x19eab0) returned 1 [0146.752] GetClientRect (in: hWnd=0x60208, lpRect=0x19ea5c | out: lpRect=0x19ea5c) returned 1 [0146.752] GetWindowTextLengthW (hWnd=0x60208) returned 5 [0146.752] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0146.752] GetSystemMetrics (nIndex=42) returned 0 [0146.752] GetWindowTextW (in: hWnd=0x60208, lpString=0x19e928, nMaxCount=6 | out: lpString="Form1") returned 5 [0146.752] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0xd, wParam=0x6, lParam=0x19e928) returned 0x5 [0146.752] GetClientRect (in: hWnd=0x60208, lpRect=0x19e964 | out: lpRect=0x19e964) returned 1 [0146.752] GetCurrentObject (hdc=0x1b0107ae, type=0x1) returned 0x1b00017 [0146.753] GetCurrentObject (hdc=0x1b0107ae, type=0x2) returned 0x1900010 [0146.753] GetCurrentObject (hdc=0x1b0107ae, type=0x7) returned 0x1d050693 [0146.753] GetCurrentObject (hdc=0x1b0107ae, type=0x6) returned 0x18a0048 [0146.753] SaveDC (hdc=0x1b0107ae) returned 1 [0146.753] GetNearestColor (hdc=0x1b0107ae, color=0xf0f0f0) returned 0xf0f0f0 [0146.753] CreateSolidBrush (color=0xf0f0f0) returned 0x39100988 [0146.753] FillRect (hDC=0x1b0107ae, lprc=0x19e804, hbr=0x39100988) returned 1 [0146.753] DeleteObject (ho=0x39100988) returned 1 [0146.753] RestoreDC (hdc=0x1b0107ae, nSavedDC=-1) returned 1 [0146.754] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0146.754] PeekMessageW (in: lpMsg=0x19f410, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19f410) returned 1 [0146.754] IsWindowUnicode (hWnd=0x4020a) returned 1 [0146.754] GetMessageW (in: lpMsg=0x19f410, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19f410) returned 1 [0146.754] TranslateMessage (lpMsg=0x19f410) returned 0 [0146.754] DispatchMessageW (lpMsg=0x19f410) returned 0x0 [0146.754] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x4020a, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0146.754] PeekMessageW (in: lpMsg=0x19f410, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19f410) returned 1 [0146.754] IsWindowUnicode (hWnd=0x502c2) returned 1 [0146.754] GetMessageW (in: lpMsg=0x19f410, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19f410) returned 1 [0146.754] TranslateMessage (lpMsg=0x19f410) returned 0 [0146.754] DispatchMessageW (lpMsg=0x19f410) returned 0x0 [0146.766] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x63 [0146.766] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe", nBufferLength=0x63, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe", lpFilePart=0x0) returned 0x62 [0146.766] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x63 [0146.766] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe", nBufferLength=0x63, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe", lpFilePart=0x0) returned 0x62 [0146.767] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x63 [0146.767] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe", nBufferLength=0x63, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe", lpFilePart=0x0) returned 0x62 [0146.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef8c) returned 1 [0146.767] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe"), fInfoLevelId=0x0, lpFileInformation=0x19f008 | out: lpFileInformation=0x19f008*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0146.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef88) returned 1 [0146.772] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x63 [0146.773] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe", nBufferLength=0x63, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe", lpFilePart=0x0) returned 0x62 [0146.773] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x63 [0146.773] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe", nBufferLength=0x63, lpBuffer=0x684c40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\66ec6a7bb5cec8d1205685833524b4f577af75570896e0b368f16e5ee0d2a955.exe", lpFilePart=0x0) returned 0x62 [0146.803] GetWindowThreadProcessId (in: hWnd=0x80298, lpdwProcessId=0x19f084 | out: lpdwProcessId=0x19f084) returned 0x138c [0146.803] GetCurrentThreadId () returned 0x138c [0146.821] GetWindowThreadProcessId (in: hWnd=0x80298, lpdwProcessId=0x19f084 | out: lpdwProcessId=0x19f084) returned 0x138c [0146.821] GetCurrentThreadId () returned 0x138c [0146.824] LocalFree (hMem=0x7166f8) returned 0x0 [0146.824] NtdllDefWindowProc_W (hWnd=0x502c2, Msg=0x201a, wParam=0x14, lParam=0x7166f8) returned 0x0 [0146.824] PeekMessageW (in: lpMsg=0x19f410, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19f410) returned 1 [0146.826] GetMessageA (in: lpMsg=0x19f410, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19f410) returned 0 [0146.836] DestroyCursor (hCursor=0x7020d) returned 1 [0146.839] GetWindowLongW (hWnd=0x60208, nIndex=-20) returned 590208 [0146.839] DestroyWindow (hWnd=0x60208) returned 1 [0146.840] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0146.840] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0x46, wParam=0x0, lParam=0x19f1c4) returned 0x0 [0146.843] GetWindowPlacement (in: hWnd=0x60208, lpwndpl=0x19ef34 | out: lpwndpl=0x19ef34) returned 1 [0146.843] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0x47, wParam=0x0, lParam=0x19f1c4) returned 0x0 [0146.843] GetClientRect (in: hWnd=0x60208, lpRect=0x19eee4 | out: lpRect=0x19eee4) returned 1 [0146.843] GetWindowRect (in: hWnd=0x60208, lpRect=0x19eee4 | out: lpRect=0x19eee4) returned 1 [0146.843] PostThreadMessageW (idThread=0x138c, Msg=0x12, wParam=0x0, lParam=0x0) returned 1 [0146.844] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0146.845] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x60208, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0146.845] DestroyWindow (hWnd=0x4020a) returned 1 [0146.845] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x4020a, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0146.845] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x4020a, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0146.845] CallWindowProcW (lpPrevWndFunc=0x744107e0, hWnd=0x4020a, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0146.857] GetCurrentThreadId () returned 0x138c [0146.860] EnumThreadWindows (dwThreadId=0x138c, lpfn=0x9606ae, lParam=0x0) returned 1 [0146.861] IsWindowVisible (hWnd=0x502c2) returned 0 [0146.861] IsWindowVisible (hWnd=0x40206) returned 0 [0146.861] GetCurrentThreadId () returned 0x138c [0146.862] GetCurrentThreadId () returned 0x138c [0146.862] EnumThreadWindows (dwThreadId=0x138c, lpfn=0x96078e, lParam=0x0) returned 1 [0146.862] IsWindowVisible (hWnd=0x502c2) returned 0 [0146.862] IsWindowVisible (hWnd=0x40206) returned 0 [0146.864] OleUninitialize () [0146.864] CloseHandle (hObject=0x280) returned 1 [0146.864] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10e70002) returned 1 [0146.865] CoGetContextToken (in: pToken=0x19fdc0 | out: pToken=0x19fdc0) returned 0x0 [0146.865] CObjectContext::QueryInterface () returned 0x0 [0146.865] CObjectContext::GetCurrentThreadType () returned 0x0 [0146.866] Release () returned 0x0 [0146.867] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x13880, cHandles=0x1, pHandles=0x64c618*=0x14c, lpdwindex=0x19fc64 | out: lpdwindex=0x19fc64) returned 0x0 Thread: id = 2 os_tid = 0x13a4 Thread: id = 3 os_tid = 0x13e4 Thread: id = 4 os_tid = 0x13e8 [0099.610] CoGetContextToken (in: pToken=0x226fc74 | out: pToken=0x226fc74) returned 0x800401f0 [0099.610] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0099.610] RoInitialize () returned 0x1 [0099.610] RoUninitialize () returned 0x0 [0143.993] CertFreeCertificateContext (pCertContext=0x7124b0) returned 1 [0143.994] CertFreeCertificateContext (pCertContext=0x711f10) returned 1 [0143.994] CloseHandle (hObject=0x56c) returned 1 [0143.995] CertFreeCertificateContext (pCertContext=0x712780) returned 1 [0143.995] CertFreeCertificateContext (pCertContext=0x712690) returned 1 [0143.996] CertCloseStore (hCertStore=0x711630, dwFlags=0x0) returned 1 [0143.997] CloseHandle (hObject=0x654) returned 1 [0143.997] CloseHandle (hObject=0x64c) returned 1 [0143.998] CloseHandle (hObject=0x50c) returned 1 [0143.998] CloseHandle (hObject=0x508) returned 1 [0143.998] CertFreeCertificateContext (pCertContext=0x712780) returned 1 [0143.998] CertFreeCertificateContext (pCertContext=0x712640) returned 1 [0143.998] CertFreeCertificateContext (pCertContext=0x66b598) returned 1 [0143.999] CertFreeCertificateContext (pCertContext=0x66b458) returned 1 [0143.999] CloseHandle (hObject=0x4c8) returned 1 [0143.999] CloseHandle (hObject=0x4c4) returned 1 [0143.999] CertFreeCertificateContext (pCertContext=0x6896e0) returned 1 [0144.000] CertFreeCertificateContext (pCertContext=0x7127d0) returned 1 [0144.000] CloseHandle (hObject=0x3c0) returned 1 [0144.000] CloseHandle (hObject=0x3bc) returned 1 [0144.000] CloseHandle (hObject=0x3b8) returned 1 [0144.000] CloseHandle (hObject=0x3b4) returned 1 [0144.001] CloseHandle (hObject=0x3b0) returned 1 [0144.001] CertCloseStore (hCertStore=0x706ba0, dwFlags=0x0) returned 1 [0144.001] CloseHandle (hObject=0x3ac) returned 1 [0144.001] CloseHandle (hObject=0x3a8) returned 1 [0144.001] CloseHandle (hObject=0x39c) returned 1 [0144.001] CloseHandle (hObject=0x398) returned 1 [0144.001] CertFreeCertificateContext (pCertContext=0x6896e0) returned 1 [0144.002] CloseHandle (hObject=0x394) returned 1 [0144.002] CloseHandle (hObject=0x390) returned 1 [0144.002] CloseHandle (hObject=0x38c) returned 1 [0144.002] CertFreeCertificateContext (pCertContext=0x689730) returned 1 [0144.002] CloseHandle (hObject=0x388) returned 1 [0144.002] CloseHandle (hObject=0x384) returned 1 [0144.003] CertFreeCertificateContext (pCertContext=0x6897d0) returned 1 [0144.003] CloseHandle (hObject=0x380) returned 1 [0144.003] CertFreeCertificateContext (pCertContext=0x712550) returned 1 [0146.871] SetWindowLongW (hWnd=0x80298, nIndex=-4, dwNewLong=1950418912) returned 9831910 [0146.872] SetClassLongW (hWnd=0x80298, nIndex=-24, dwNewLong=1950418912) returned 0x9605be [0146.873] PostMessageW (hWnd=0x80298, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0146.873] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0146.874] UnregisterClassW (lpClassName="WindowsForms10.Window.0.app.0.141b42a_r10_ad1", hInstance=0x400000) returned 1 [0146.874] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0146.874] UnregisterClassW (lpClassName="WindowsForms10.Window.8.app.0.141b42a_r10_ad1", hInstance=0x400000) returned 0 [0146.877] IsWindow (hWnd=0x502c2) returned 1 [0146.878] GetModuleHandleW (lpModuleName="user32.dll") returned 0x74f40000 [0146.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x226fa14, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcW8oîú¶\r(úHn\x98ü&\x02\x01", lpUsedDefaultChar=0x0) returned 14 [0146.879] GetProcAddress (hModule=0x74f40000, lpProcName="DefWindowProcW") returned 0x744107e0 [0146.879] SetWindowLongW (hWnd=0x502c2, nIndex=-4, dwNewLong=1950418912) returned 9832030 [0146.880] SetClassLongW (hWnd=0x502c2, nIndex=-24, dwNewLong=1950418912) returned 0x96065e [0146.880] IsWindow (hWnd=0x502c2) returned 1 [0146.880] DestroyWindow (hWnd=0x502c2) returned 0 [0146.880] PostMessageW (hWnd=0x502c2, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0146.880] SetConsoleCtrlHandler (HandlerRoutine=0x960636, Add=0) returned 1 [0146.881] EtwEventUnregister (RegHandle=0x6ace18) returned 0x0 [0146.881] EtwEventUnregister (RegHandle=0x6ac528) returned 0x0 [0146.881] DeleteObject (ho=0xd1080783) returned 1 [0146.902] DestroyCursor (hCursor=0x1e0067) returned 1 [0146.903] GdipDeleteFont (font=0x49aefc0) returned 0x0 [0146.904] DeleteObject (ho=0xf0a066f) returned 1 [0146.906] CertFreeCertificateContext (pCertContext=0x712370) returned 1 [0146.907] CloseHandle (hObject=0x37c) returned 1 [0146.907] UnmapViewOfFile (lpBaseAddress=0x6570000) returned 1 [0146.908] WinHttpCloseHandle (hInternet=0x6f4f18) returned 1 [0146.908] CloseHandle (hObject=0x468) returned 1 [0146.909] CloseHandle (hObject=0x464) returned 1 [0146.909] RegCloseKey (hKey=0x460) returned 0x0 [0146.909] CloseHandle (hObject=0x45c) returned 1 [0146.910] RegCloseKey (hKey=0x458) returned 0x0 [0146.910] CloseHandle (hObject=0x454) returned 1 [0146.910] RegCloseKey (hKey=0x450) returned 0x0 [0146.911] RegCloseKey (hKey=0x44c) returned 0x0 [0146.911] CloseHandle (hObject=0x434) returned 1 [0146.911] setsockopt (s=0x428, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0146.912] closesocket (s=0x428) returned 0 [0146.912] CloseHandle (hObject=0x42c) returned 1 [0146.913] setsockopt (s=0x420, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0146.913] closesocket (s=0x420) returned 0 [0146.913] CloseHandle (hObject=0x424) returned 1 [0146.914] CertCloseStore (hCertStore=0x72a9f8, dwFlags=0x0) returned 1 [0146.914] setsockopt (s=0x550, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0146.914] closesocket (s=0x550) returned 0 [0146.915] DeleteSecurityContext (phContext=0x237e154) returned 0x0 [0146.918] CertFreeCertificateContext (pCertContext=0x712370) returned 1 [0146.918] CertFreeCertificateContext (pCertContext=0x712000) returned 1 [0146.919] setsockopt (s=0x65c, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0146.919] closesocket (s=0x65c) returned 0 [0146.920] CertFreeCertificateContext (pCertContext=0x7126e0) returned 1 [0146.921] CertFreeCertificateContext (pCertContext=0x712050) returned 1 [0146.922] DeleteSecurityContext (phContext=0x235201c) returned 0x0 [0146.923] setsockopt (s=0x564, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0146.923] closesocket (s=0x564) returned 0 [0146.923] CloseHandle (hObject=0x568) returned 1 [0146.924] setsockopt (s=0x558, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0146.924] closesocket (s=0x558) returned 0 [0146.924] CloseHandle (hObject=0x560) returned 1 [0146.926] FreeCredentialsHandle (phCredential=0x2351e64) returned 0x0 [0146.928] DeleteSecurityContext (phContext=0x23ea7c4) returned 0x0 [0146.930] setsockopt (s=0x658, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0146.930] closesocket (s=0x658) returned 0 [0146.931] CertFreeCertificateContext (pCertContext=0x711f60) returned 1 [0146.932] CertFreeCertificateContext (pCertContext=0x711e70) returned 1 [0146.933] LocalFree (hMem=0x684c40) returned 0x0 [0146.935] RegCloseKey (hKey=0x80000004) returned 0x0 Thread: id = 5 os_tid = 0x284 Thread: id = 6 os_tid = 0xd80 Thread: id = 7 os_tid = 0xd7c Thread: id = 8 os_tid = 0xd70 Thread: id = 9 os_tid = 0xd6c Thread: id = 10 os_tid = 0xd68 [0136.759] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0136.759] RoInitialize () returned 0x1 [0136.759] RoUninitialize () returned 0x0 [0136.762] ResetEvent (hEvent=0x3a0) returned 1 Thread: id = 11 os_tid = 0xd60 Thread: id = 12 os_tid = 0xd64 Thread: id = 13 os_tid = 0xca0